Gateway API

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: molesignal-internal
  namespace: molesignal
spec:
  gatewayClassName: <GatewayClass>
  infrastructure:
    annotations:
      # 按云厂商填写，例如阿里云 ACK：
      service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: intranet
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: molesignal.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - name: molesignal-tls
      allowedRoutes:
        namespaces:
          from: Same
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: molesignal-public
  namespace: molesignal
spec:
  gatewayClassName: <GatewayClass>
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: molesignal.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - name: molesignal-tls
      allowedRoutes:
        namespaces:
          from: Same

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: molesignal-internal
  namespace: molesignal
spec:
  parentRefs:
    - name: molesignal-internal
  hostnames: [molesignal.example.com]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /api/v1/query/stream }
      timeouts:
        request: 600s
      backendRefs:
        - { name: molesignal, port: 5080 }
    - matches:
        - path: { type: PathPrefix, value: / }
      backendRefs:
        - { name: molesignal, port: 5080 }

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: molesignal-public
  namespace: molesignal
spec:
  parentRefs:
    - name: molesignal-public
  hostnames: [molesignal.example.com]
  rules:
    # 外部回调：外部告警、心跳打卡、Jira 的工单 Webhook、值班日历订阅、Teams 里的 Mole Agent、回复短信与电话按键、自动化的 API 触发、推送来源
    - matches:
        - { path: { type: Exact, value: /api/v1/intake/alerts }, method: POST }
        - { path: { type: PathPrefix, value: /api/v1/intake/heartbeats }, method: GET }
        - { path: { type: PathPrefix, value: /api/v1/intake/heartbeats }, method: POST }
        - { path: { type: PathPrefix, value: /api/v1/public/tickets/jira }, method: POST }
        - { path: { type: PathPrefix, value: /api/v1/public/calendar }, method: GET }
        - { path: { type: PathPrefix, value: /api/v1/public/im/teams }, method: POST }
        - { path: { type: PathPrefix, value: /api/v1/public/notify }, method: POST }
        - { path: { type: PathPrefix, value: /api/v1/public/automations }, method: POST }
        - { path: { type: Exact, value: /api/v1/_kinesis_firehose }, method: POST }
        - { path: { type: Exact, value: /api/v1/_cloudflare }, method: POST }
        - { path: { type: Exact, value: /api/v1/_heroku }, method: POST }
      backendRefs:
        - { name: molesignal, port: 5080 }
    # 用户体验：POST 和浏览器的 CORS 预检
    - matches:
        - { path: { type: Exact, value: /api/v1/rum/events }, method: POST }
        - { path: { type: Exact, value: /api/v1/rum/events }, method: OPTIONS }
        - { path: { type: Exact, value: /api/v1/rum/replay }, method: POST }
        - { path: { type: Exact, value: /api/v1/rum/replay }, method: OPTIONS }
      backendRefs:
        - { name: molesignal, port: 5080 }
    # 拨测 Probe Agent 上传产物
    - matches:
        - { path: { type: PathPrefix, value: /api/v1/synthetics/artifacts }, method: PUT }
      backendRefs:
        - { name: molesignal, port: 5080 }
    # 状态页、资源共享和它们的网页文件
    - matches:
        - { path: { type: PathPrefix, value: /status }, method: GET }
        - { path: { type: PathPrefix, value: /api/v1/public/status-pages } }
        - { path: { type: PathPrefix, value: /s }, method: GET }
        - { path: { type: Exact, value: /shared }, method: GET }
        - { path: { type: PathPrefix, value: /api/v1/public/share } }
        - { path: { type: PathPrefix, value: /assets }, method: GET }
        - { path: { type: Exact, value: /favicon.ico }, method: GET }
        - { path: { type: Exact, value: /favicon.svg }, method: GET }
      backendRefs:
        - { name: molesignal, port: 5080 }

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: molesignal-teams-allowlist
  namespace: molesignal
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: molesignal-public-teams
  authorization:
    defaultAction: Deny
    rules:
      - action: Allow
        principal:
          clientCIDRs:
            - 203.0.113.0/24
            - 198.51.100.0/24

# 加到 molesignal-public 的 listeners 里
- name: https-status
  protocol: HTTPS
  port: 443
  hostname: status.example.org
  tls:
    mode: Terminate
    certificateRefs:
      - name: status-example-org-tls
  allowedRoutes:
    namespaces:
      from: Same

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: molesignal-status-domain
  namespace: molesignal
spec:
  parentRefs:
    - { name: molesignal-public, sectionName: https-status }
  hostnames: [status.example.org]
  rules:
    - matches:
        - { path: { type: Exact, value: / }, method: GET }
        - { path: { type: Exact, value: /history }, method: GET }
        - { path: { type: Exact, value: /uptime }, method: GET }
        - { path: { type: PathPrefix, value: /incidents }, method: GET }
        - { path: { type: PathPrefix, value: /api/v1/public/status-pages } }
        - { path: { type: PathPrefix, value: /assets }, method: GET }
        - { path: { type: Exact, value: /favicon.ico }, method: GET }
        - { path: { type: Exact, value: /favicon.svg }, method: GET }
      backendRefs:
        - { name: molesignal, port: 5080 }

kubectl -n molesignal get gateway,httproute

curl -s -o /dev/null -w '%{http_code}\n' https://molesignal.example.com/api/v1/auth/signin

curl -s -o /dev/null -w '%{http_code}\n' -X POST https://molesignal.example.com/api/v1/intake/alerts