Troubleshooting common application developer use case

[root-io]

I'm trying EG to serve my frontend (web) service on foo.com, www.foo.com (redirect to foo.com) and my api service on api.foo.com with auto-renew of letsencrypt certificates.

api.foo.com must be only accessible on HTTPS and NOT be accessible on HTTP except to get the challenge for the certificate.

My certificate has :
Common foo.com
Subject Alt Names api.foo.com foo.com www.foo.com

I get random 404, I find very few issues regarding this, I'm a bit confused because it's really common to have that kind of setup for a web app.

Similar issues:

#2675
istio/istio#52853

kubernetes v1.30
eg v1.1.0
cert-manager v1.15.3

In my api repo:

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: foo

resources:
  - resources/deployment.yaml
  - resources/gateway-class.yaml
  - resources/gateway.yaml
  - resources/http-route.yaml
  - resources/namespace.yaml
  - resources/service-account.yaml
  - resources/service.yaml

secretGenerator:
  - name: env
    env: .env

resources/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
name: api
spec:
replicas: 1
selector:
  matchLabels:
    app: api
template:
  metadata:
    labels:
      app: api
  spec:
    serviceAccountName: api
    containers:
      - name: api
        image: foo/api
        imagePullPolicy: Always
        ports:
          - name: http
            containerPort: 3000
        envFrom:
          - secretRef:
              name: env
    securityContext:
      runAsNonRoot: true

resources/gateway-class.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: eg
spec:
controllerName: gateway.envoyproxy.io/gatewayclass-controller

resources/gateway.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: eg
spec:
gatewayClassName: eg
listeners:
  - name: http-root
    protocol: HTTP
    hostname: foo.com
    port: 80
  - name: http-wildcard
    protocol: HTTP
    hostname: "*.foo.com"
    port: 80
  - name: https-root
    protocol: HTTPS
    port: 443
    hostname: foo.com
    tls:
      certificateRefs:
        - kind: Secret
          name: eg-https
  - name: https-wildcard
    protocol: HTTPS
    port: 443
    hostname: "*.foo.com"
    tls:
      certificateRefs:
        - kind: Secret
          name: eg-https

resources/http-route.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: api
spec:
parentRefs:
  - kind: Gateway
    name: eg
    sectionName: https-wildcard
rules:
  - backendRefs:
      - kind: Service
        name: api
        port: 3000
    matches:
      - path:
          type: PathPrefix
          value: /
hostnames:
  - api.foo.com

resources/namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
name: foo

resources/service-account.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
name: api
imagePullSecrets:
- name: regcred

resources/service.yaml

apiVersion: v1
kind: Service
metadata:
name: api
spec:
ports:
  - name: http
    port: 3000
    targetPort: 3000
selector:
  app: api

In my frontend (web) repo:

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: foo

resources:
- resources/deployment.yaml
- resources/http-route.yaml
- resources/namespace.yaml
- resources/service-account.yaml
- resources/service.yaml

secretGenerator:
- name: env
  env: .env

resources/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
name: web
spec:
replicas: 1
selector:
  matchLabels:
    app: web
template:
  metadata:
    labels:
      app: web
  spec:
    serviceAccountName: web
    containers:
      - name: web
        image: foo/web
        imagePullPolicy: Always
        ports:
          - name: http
            containerPort: 8080
        envFrom:
          - secretRef:
              name: env
    securityContext:
      runAsNonRoot: true

resources/http-route.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: root-to-https-redirect
spec:
parentRefs:
  - kind: Gateway
    name: eg
    sectionName: http-root
rules:
  - filters:
      - type: RequestRedirect
        requestRedirect:
          scheme: https
hostnames:
  - foo.com
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web
spec:
parentRefs:
  - kind: Gateway
    name: eg
    sectionName: https-root
rules:
  - backendRefs:
      - kind: Service
        name: web
        port: 8080
    matches:
      - path:
          type: PathPrefix
          value: /
hostnames:
  - foo.com

resources/namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
name: foo

resources/service-account.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
name: web
imagePullSecrets:
- name: regcred

resources/service.yaml

apiVersion: v1
kind: Service
metadata:
name: web
spec:
ports:
  - name: http
    port: 8080
    targetPort: 8080
selector:
  app: web