6914b8dbc0
Add operator-facing documentation for the Gateway API feature: packages/extra/gateway/README.md grows three sections: - Security model — explains the two layers that protect cross-tenant isolation (Gateway listener allowedRoutes namespace whitelist + ValidatingAdmissionPolicy for tenant hostname ownership). Makes it explicit which namespaces are on the default whitelist so operators who add a new system component know where to register it. - Rate limits — spells out the Let's Encrypt quotas (50 certs / registered domain / week, 5 duplicate certs / week, 300 new orders / account / 3h), lists mitigations (letsencrypt-stage, resourceQuotas with count/certificates.cert-manager.io, self-signed ClusterIssuer, internal ACME). - Known limitations — TLS passthrough services still use ingress-nginx, tenant-scoped apps (harbor, bucket) not yet wired to per-tenant Gateway, child-tenant ACME HTTP-01 needs a namespace-scoped Issuer. All three are tracked as follow-up work rather than hidden failure modes. packages/core/platform/values.yaml adds a comment block under publishing.certificates.issuerName reminding operators of the rate-limit consequences before they flip gateway.enabled=true on a production cluster. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la> |
||
|---|---|---|
| .. | ||
| flux-aio | ||
| installer | ||
| platform | ||
| talos | ||
| testing | ||