apiVersion: v1
kind: Namespace
metadata:
  name: incus
---
apiVersion: v1
kind: Service
metadata:
  name: incus
  namespace: incus
spec:
  ports:
    - name: https
      port: 8443
      targetPort: 8443
---
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: incus-laptop
  namespace: incus
  labels:
    kubernetes.io/service-name: incus
    endpointslice.kubernetes.io/managed-by: homelab-ansible
addressType: IPv4
ports:
  - name: https
    protocol: TCP
    port: 8443
endpoints:
  - addresses: [192.168.10.127]
    conditions:
      ready: true
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: incus-backend-ca
  namespace: incus
data:
  ca.crt: |
{{ incus_backend_certificate.content | b64decode | indent(4, true) }}
---
apiVersion: gateway.networking.k8s.io/v1alpha3
kind: BackendTLSPolicy
metadata:
  name: incus
  namespace: incus
spec:
  targetRefs:
    - group: ''
      kind: Service
      name: incus
  validation:
    hostname: laptop
    caCertificateRefs:
      - group: ''
        kind: ConfigMap
        name: incus-backend-ca
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: incus
  namespace: incus
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: eg
      namespace: envoy-gateway-system
      sectionName: https
  hostnames: [incus.ad.ddupan.top]
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ''
          kind: Service
          name: incus
          port: 8443
          weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: incus-http
  namespace: incus
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: eg
      namespace: envoy-gateway-system
      sectionName: http
  hostnames: [incus.ad.ddupan.top]
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            port: 443
            statusCode: 301