Add operator-facing documentation for the Gateway API feature:
packages/extra/gateway/README.md grows three sections:
- Security model — explains the two layers that protect cross-tenant
isolation (Gateway listener allowedRoutes namespace whitelist +
ValidatingAdmissionPolicy for tenant hostname ownership). Makes it
explicit which namespaces are on the default whitelist so operators
who add a new system component know where to register it.
- Rate limits — spells out the Let's Encrypt quotas (50 certs /
registered domain / week, 5 duplicate certs / week, 300 new orders /
account / 3h), lists mitigations (letsencrypt-stage, resourceQuotas
with count/certificates.cert-manager.io, self-signed ClusterIssuer,
internal ACME).
- Known limitations — TLS passthrough services still use ingress-nginx,
tenant-scoped apps (harbor, bucket) not yet wired to per-tenant
Gateway, child-tenant ACME HTTP-01 needs a namespace-scoped Issuer.
All three are tracked as follow-up work rather than hidden failure
modes.
packages/core/platform/values.yaml adds a comment block under
publishing.certificates.issuerName reminding operators of the
rate-limit consequences before they flip gateway.enabled=true on a
production cluster.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
6914b8dbc0