Gateway api support (#890)

* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2026-07-30 19:38:43 +00:00
parent 2d92b81ba4
commit 3cfefb72ba
39 changed files with 1015 additions and 5 deletions
@@ -0,0 +1,15 @@
+# Expose the OIDC discovery provider via Gateway API with HTTPS termination at
+# the edge. The provider's SPIRE TLS is disabled so it serves plaintext behind
+# the Gateway; the Gateway terminates TLS with tls-cert (set gatewayAPI.tlsSecret)
+# => HTTPRoute + a terminating SNI listener. The helm test curls the discovery
+# document over HTTPS and validates the gateway cert against the tls-cert CA.
+spiffe-oidc-discovery-provider:
+  tls:
+    spire:
+      enabled: false
+  tests:
+    tls:
+      enabled: true
+  gatewayAPI:
+    enabled: true
+    tlsSecret: tls-cert