… Separate the listeners We initially had one listener for all our hosts, but they need to be separated unless you use DNS solver for a wildcard certificate . apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: shared-gateway namespace: envoy-gateway annotations: cert-manager.io/cl… …
… This is the resource that tells the operator: “Go to Bitwarden, grab the secret named ‘stripe-api-key’, and create a Kubernetes Secret named ‘payment-creds’.” cat <<EOF | kubectl apply -f - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: app-payment-creds namespace: app-back… …
… Loading the Image into Kind bash kind load docker-image envoy-wrapper:latest --name ai-gateway-lab Part 6: Deploying the Custom Envoy Image To deploy your custom image without kgateway’s controller reverting changes, use GatewayParameters: yaml apiVersion: gateway.kgateway.dev/v1alpha1 kind: Gatewa… …
… Here’s what the provider definitions look like: apiVersion: operator.cluster.x-k8s.io/v1alpha2 kind: BootstrapProvider metadata: name: k3s spec: version: v0.3.0 fetchConfig: url: https://github.com/k3s-io/cluster-api-k3s/releases/v0.3.0/bootstrap-components.yaml {{- if .Values.configSecret.name }} … …
… Create a file: apiVersion: v1 kind: Secret metadata: name: openstack-cloud-config namespace: kcm-system type: Opaque stringData: clouds.yaml: | clouds: openstack: auth: auth url: https:// username: password: project name: user domain name: Default project domain name: Default region name: RegionOne… …
… Cosign image signing and verification Stage 1: Build the container image - task: Docker@2 displayName: 'Build Container Image' inputs: command: build repository: $ ACR NAME .azurecr.io/$ IMAGE NAME tags: $ Build.BuildId Stage 2: Fetch OIDC token via Workload Identity Federation - task: AzureCLI@2 d… …
… Below is an example of running the tool, specifying Cilium as the destination output. ingress2gateway print \ --providers=cilium Notifications from CILIUM: +--------------+----------------------------------------------------------------------------------------------------------------+--------------… …
… It follows the same pattern, pointing at the kyverno-policies/ directory and running at sync-wave ”2″ so it always comes after Kyverno itself is ready: infra-services/kyverno-policies.yaml apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: kyverno-policies namespace: argocd annotati… …
… That matters in our case, because not every namespace looks the same. Some have the full picture: centralized logs, distributed traces, the works. Multi-tenant workloads often have none of that; for those namespaces, it’s kubectl and Prometheus only. …