ServiceEntry-gateway.yaml

################
## This ServiceEntry creates a DNS entry for Pods in the mesh to access the gateway,
## even if it's not resolvable on public DNS. Additionally, even when the gateway is resolvable
## on public DNS, this ServiceEntry will cause traffic from the Pods to the gateway stay within the mesh.
## ---
## This feature uses istio DNS Proxying (introduced in istio 1.8, but disabled by default).
## Kubeflow requires that DNS Proxying is enabled mesh-wide by enabling the meshConfigs
## `defaultConfig.proxyMetadata.ISTIO_META_DNS_CAPTURE` and `defaultConfig.proxyMetadata.ISTIO_META_DNS_AUTO_ALLOCATE`
################
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: deploykf-istio-gateway
  labels:
    helm.sh/chart: {{ include "deploykf-istio-gateway.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-istio-gateway.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
  workloadSelector:
    labels:
      {{- toYaml .Values.deployKF.gateway.selectorLabels | nindent 6 }}
  hosts:
    - {{ .Values.deployKF.gateway.hostname | quote }}
    {{- if .Values.deployKF.argoWorkflows.enabled }}
    - "argo-server.{{ .Values.deployKF.gateway.hostname }}"
    {{- end }}
    {{- if .Values.deployKF.minio.enabled }}
    - "minio-api.{{ .Values.deployKF.gateway.hostname }}"
    - "minio-console.{{ .Values.deployKF.gateway.hostname }}"
    {{- end }}

    {{- /* TODO: remove this once we update Kubeflow Notebooks/TensorBoards: https://github.com/kubeflow/kubeflow/pull/6902 */ -}}
    {{- if and .Values.deployKF.gateway.tls.enabled (not .Values.deployKF.gateway.tls.matchSNI) }}
    {{- if .Values.deployKF.kubeflow.notebooks.enabled }}
    ## NOTE: the notebooks subdomain is NOT exposed on the public gateway (see `VirtualService/notebooks-redirect`)
    - "notebooks-redirect.{{ .Values.deployKF.gateway.hostname }}"
    {{- end }}
    {{- if .Values.deployKF.kubeflow.tensorboards.enabled }}
    ## NOTE: the tensorboards subdomain is NOT exposed on the public gateway (see `VirtualService/tensorboards-redirect`)
    - "tensorboards-redirect.{{ .Values.deployKF.gateway.hostname }}"
    {{- end }}
    {{- end }}
  location: MESH_INTERNAL
  ports:
    - name: http
      number: {{ .Values.deployKF.gateway.servicePorts.http | default .Values.deployKF.gateway.ports.http | int }}
      protocol: HTTP
      targetPort: {{ .Values.deployKF.gateway.ports.http | int }}
    {{- if .Values.deployKF.gateway.tls.enabled }}
    - name: https
      number: {{ .Values.deployKF.gateway.servicePorts.https | default .Values.deployKF.gateway.ports.https | int }}
      protocol: HTTPS
      targetPort: {{ .Values.deployKF.gateway.ports.https | int }}
    {{- end }}
  resolution: STATIC