From 649b3744f0061aaa05eea148c20a133d86f2649c Mon Sep 17 00:00:00 2001
From: Khue Doan <mail@khuedoan.com>
Date: Mon, 16 Mar 2026 22:47:53 +0700
Subject: [PATCH] feat: setup HTTPS for Gateway

---
 platform/staging/cert-manager.yaml | 30 ++++++++++++++++++++++++++++++
 platform/staging/istio.yaml        | 13 +++++++++----
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/platform/staging/cert-manager.yaml b/platform/staging/cert-manager.yaml
index 26adbb5..e4ba8eb 100644
--- a/platform/staging/cert-manager.yaml
+++ b/platform/staging/cert-manager.yaml
@@ -27,7 +27,37 @@ spec:
     createNamespace: true
   values:
     config:
+      enableGatewayAPI: true
       featureGates:
         ACMEHTTP01IngressPathTypeExact: false
     crds:
       enabled: true
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+  annotations:
+    # TODO dedicated SA for cert-manager
+    vault.security.banzaicloud.io/vault-addr: http://vault.vault.svc.cluster.local:8200
+    vault.security.banzaicloud.io/vault-role: default
+    vault.security.banzaicloud.io/vault-path: kubernetes
+stringData:
+  api-token: vault:secret/data/platform/cloudflare#API_TOKEN
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
diff --git a/platform/staging/istio.yaml b/platform/staging/istio.yaml
index d995cce..c9fc7c3 100644
--- a/platform/staging/istio.yaml
+++ b/platform/staging/istio.yaml
@@ -95,13 +95,18 @@ kind: Gateway
 metadata:
   name: gateway
   namespace: istio-system # TODO dedicated namespace?
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
 spec:
   gatewayClassName: istio
   listeners:
-  - name: default
-    hostname: "*.staging.khuedoan.com" # TODO make this var/configurable
-    port: 80 # TODO HTTPS by default, only use HTTP for ACME HTTP-01
-    protocol: HTTP
+  - name: https
+    hostname: "*.staging.khuedoan.com"
+    port: 443
+    protocol: HTTPS
+    tls:
+      certificateRefs:
+        - name: wildcard-tls
     allowedRoutes:
       namespaces:
         from: All
-- 
2.51.2