aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

HOMELAB-510: fix(gateway): Harbor backend TLS re-encryption via appProtocol #110

Merged
aaron merged 1 commit from plane/HOMELAB-510-harbor-gateway-tls into live 2026-03-31 05:23:53 +00:00
Conversation 1 Commits 1 Files changed 1 +42
aaron commented 2026-03-31 05:23:52 +00:00
Owner
Copy link

INCIDENT FIX

Harbor needs TLS on its backend. Instead of mixing Gateway + LB IPs, use Cilium's appProtocol: https to re-encrypt traffic from the Gateway to Harbor.

  • Creates harbor-gateway Service with appProtocol: https (port 443 → nginx 8443)
  • HTTPRoute targets harbor-gateway:443
  • Envoy re-encrypts after TLS termination

All services stay behind the Gateway IP — no more LB IP mixing.

## INCIDENT FIX Harbor needs TLS on its backend. Instead of mixing Gateway + LB IPs, use Cilium's `appProtocol: https` to re-encrypt traffic from the Gateway to Harbor. - Creates `harbor-gateway` Service with `appProtocol: https` (port 443 → nginx 8443) - HTTPRoute targets `harbor-gateway:443` - Envoy re-encrypts after TLS termination All services stay behind the Gateway IP — no more LB IP mixing.
HOMELAB-510: fix(gateway): Harbor backend TLS via appProtocol + dedicated Service
Some checks failed
Plan failed.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
dfc08cb05e 
Harbor requires TLS on its backend (nginx 8443). The Gateway terminates
external TLS then re-encrypts to Harbor using Cilium's appProtocol support
(enable-gateway-api-app-protocol is already enabled).

Creates harbor-gateway Service with appProtocol: https targeting Harbor's
nginx SSL port (8443). HTTPRoute points to this service on port 443.

Traffic flow: Client → Gateway (TLS terminated) → Envoy (re-encrypts) →
harbor-gateway:443 → nginx:8443 → Harbor core

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
aaron merged commit a394bf59a5 into live 2026-03-31 05:23:53 +00:00
atlantis commented 2026-03-31 05:23:54 +00:00
Collaborator
Copy link

Plan Error

running git clone --depth=1 --branch plane/HOMELAB-510-harbor-gateway-tls --single-branch https://atlantis:<redacted>@forgejo.aaron.reynoza.org/aaron/infra-core.git /atlantis-data/repos/aaron/infra-core/110/default: Cloning into '/atlantis-data/repos/aaron/infra-core/110/default'...
fatal: unable to write new index file
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry with 'git restore --source=HEAD :/'

: exit status 128
**Plan Error** ``` running git clone --depth=1 --branch plane/HOMELAB-510-harbor-gateway-tls --single-branch https://atlantis:<redacted>@forgejo.aaron.reynoza.org/aaron/infra-core.git /atlantis-data/repos/aaron/infra-core/110/default: Cloning into '/atlantis-data/repos/aaron/infra-core/110/default'... fatal: unable to write new index file warning: Clone succeeded, but checkout failed. You can inspect what was checked out with 'git status' and retry with 'git restore --source=HEAD :/' : exit status 128 ```
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!110
No description provided.