apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: istio-config namespace: default spec: interval: 5m timeout: 10m values: global: env: contour environments: contour: namespaces: - name: attachments certManager: certificates: platform-tls: dnsNames: - sarex.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer minio-tls: dnsNames: - minio.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer zitadel-tls: dnsNames: - zitadel.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer dashboard-tls: dnsNames: - dashboard.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer rabbitmq-tls: dnsNames: - rabbitmq.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer keycloak-tls: dnsNames: - keycloak.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer glitchtip-tls: dnsNames: - glitchtip.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer openobserve-tls: dnsNames: - openobserve.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer camunda-keycloak-tls: dnsNames: - camunda-keycloak.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer camunda-identity-tls: dnsNames: - camunda-identity.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer camunda-operate-tls: dnsNames: - camunda-operate.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer camunda-tasklist-tls: dnsNames: - camunda-tasklist.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer camunda-optimize-tls: dnsNames: - camunda-optimize.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer vault-tls: dnsNames: - vault.contour.infra.sarex.tech issuerRef: name: letsencrypt-issuer-istio kind: ClusterIssuer istio: requestAuthentications: api-jwt: namespace: istio-system selector: matchLabels: istio: ingressgateway jwtRules: - issuer: django jwks: | { "keys": [{ "kty": "RSA", "kid": "tiSFtZhCeHtAmHjjY3cG55ZYRgpTnIbAdmX1DsD8GOk=", "use": "sig", "alg": "RS512", "n": "iJxequyGx7cS2MKqYBlyFXsrN5mhvKKyMeYFYW2XbvCiVRXVs0OK7gwvmhMRR-spCTxJLrG2rxzvs0CBXEFIrvmVRpXSLAau_aRAoTxmfCTqsZWb9ZT7u2i3_itUgFZmQg9UsuKoSodLJ16mf29XLE6VRqlu9oIxTB61FN5WtJ8ML7-lS00UBNYbemD8iVVFTHdn_v-uJ9blhg-2l-SPaJmwFlYlr8Zll99NXhw0-SNRzYTKJ04B1SIlebkuyTpvKbeGwnA6sPainH26MQ88DJIueRpJy_zgDWYoQBO7JAxbxJnF5A5RWeWDqodZU0FPkuNyQM8RI20j83GPI-X4FvTJNXKoBVgWNpq0yvxbwcFo0GdXDkXu8FPxBjCmh0yQnz-C_3SWcQ6gM1e9ryypoi4IJzR9KIlo7c39VTK4K70lx6piEtR_Cl3LldnHVhztAPEQr58e9cIrStax3EzwMijS6eFPf21vZNIpgs96XoZGBXvbtRJJx8uqbYSjO4uofgJWkIrjleO-ygD1MpTe7Opr_5h7-DfywrgBNbstskCecSbEgCv0Hblx55JCZcb_lL6hT5cJRXOybFEmIGRpGZTR-eUELrI1cqP62Tf3qvUyNeOPi9WE2lDCJtsF1gya64xWTi1nxSXdCJEZGjKyGFHg_Majf2RzyzsYuX90P5c", "e": "AQAB" }] } forwardOriginalToken: true outputClaims: user_id: x-user-id company_ids: x-company-ids zitadel-jwks: namespace: istio-system selector: matchLabels: istio: ingressgateway jwtRules: - issuer: https://zitadel.contour.infra.sarex.tech jwksUri: https://zitadel.contour.infra.sarex.tech/oauth/v2/keys forwardOriginalToken: true fromHeaders: - name: Identity prefix: "Bearer " - name: Authorization prefix: "Bearer " outputClaims: company_ids: x-company-ids sub: x-user-id add-traceparent-filter: - attachments - bim - cde - checklists - comparisons - contracts - control-interface - cross-section - django - documentations - drawings - eav - faas - flows - gateway - inspections - issues - mapper - measurements - message-hub - notes - pm - prescriptions - processing - projects - remarks - resources - reviews - rfi - stamp-verification - subscriptions - system-log - transmittal - workspaces envoyFilters: http-header-count-size-control: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: NETWORK_FILTER match: listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: MERGE value: typed_config: '@type': >- type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager common_http_protocol_options: max_headers_count: 200 max_request_headers_kb: 96 header-size-sidecar: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: NETWORK_FILTER match: context: SIDECAR_INBOUND listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: MERGE value: typed_config: '@type': >- type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager common_http_protocol_options: max_headers_kb: 96 max_request_headers_kb: 96 - applyTo: NETWORK_FILTER match: context: SIDECAR_OUTBOUND listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: MERGE value: typed_config: '@type': >- type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager common_http_protocol_options: max_headers_kb: 96 max_request_headers_kb: 96 sarex-agents-upload-body-50mb: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: sni: sarex.contour.infra.sarex.tech filter: name: envoy.filters.network.http_connection_manager subFilter: name: envoy.filters.http.router patch: operation: INSERT_BEFORE value: name: envoy.filters.http.buffer typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer max_request_bytes: 2147483648 x-robots-tag-noindex: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: VIRTUAL_HOST match: context: GATEWAY routeConfiguration: vhost: name: sarex.contour.infra.sarex.tech:443 patch: operation: MERGE value: response_headers_to_add: - append: false header: key: X-Robots-Tag value: noindex, nofollow - applyTo: VIRTUAL_HOST match: context: GATEWAY routeConfiguration: vhost: name: dashboard.contour.infra.sarex.tech:443 patch: operation: MERGE value: response_headers_to_add: - append: false header: key: X-Robots-Tag value: noindex, nofollow - applyTo: VIRTUAL_HOST match: context: GATEWAY routeConfiguration: vhost: name: sarex.contour.infra.sarex.tech:80 patch: operation: MERGE value: response_headers_to_add: - append: false header: key: X-Robots-Tag value: noindex, nofollow - applyTo: VIRTUAL_HOST match: context: GATEWAY routeConfiguration: vhost: name: dashboard.contour.infra.sarex.tech:80 patch: operation: MERGE value: response_headers_to_add: - append: false header: key: X-Robots-Tag value: noindex, nofollow strip-jwt-on-public-hosts: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.network.http_connection_manager subFilter: name: envoy.filters.http.jwt_authn patch: operation: INSERT_BEFORE value: name: envoy.filters.http.lua typed_config: '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua inlineCode: | local public_hosts = { ["camunda-keycloak.contour.infra.sarex.tech"] = true, ["keycloak.contour.infra.sarex.tech"] = true, ["zitadel.contour.infra.sarex.tech"] = true, ["dashboard.contour.infra.sarex.tech"] = true, ["openobserve.contour.infra.sarex.tech"] = true, } local public_paths = { "^/documentations/api/v1/public/qr", "^/documentations/api/v1/public/documents/public_link", } local function is_public(host, path) if not host then return false end host = string.gsub(host, ":%d+$", "") if public_hosts[host] then return true end if path then for _,pref in ipairs(public_paths) do if string.find(path, pref) == 1 then return true end end end return false end function envoy_on_request(handle) local h = handle:headers() local host = h:get(":authority") local path = h:get(":path") if is_public(host, path) then local auth = h:get("authorization") if auth then h:replace("x-orig-authorization", auth) h:remove("authorization") end end end - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.network.http_connection_manager subFilter: name: envoy.filters.http.jwt_authn patch: operation: INSERT_AFTER value: name: envoy.filters.http.lua typed_config: '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua inlineCode: | function envoy_on_request(handle) local h = handle:headers() local xauth = h:get("x-orig-authorization") if xauth and not h:get("authorization") then h:replace("authorization", xauth) h:remove("x-orig-authorization") end end strip-jwt-on-public-paths: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.network.http_connection_manager subFilter: name: envoy.filters.http.jwt_authn patch: operation: INSERT_BEFORE value: name: envoy.filters.http.lua typed_config: '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua inlineCode: | local public_prefixes = { "^/documentations/api/v1/public/qr", "^/documentations/api/v1/public/documents/public_link" } local download_prefixes = { "^/files/api/v1/documents/folders", "^/files/api/v1/documents", "^/files/api/v1/bundles" } local function starts_with_any(path, prefixes) for _, pref in ipairs(prefixes) do if string.find(path, pref) == 1 then return true end end return false end local function has_download_type(path) if not path or path == "" then return false end return string.match(path, "[%?&]download_type=") ~= nil end local function should_strip(path) if not path then return false end if starts_with_any(path, public_prefixes) then return true end if starts_with_any(path, download_prefixes) and has_download_type(path) then return true end return false end function envoy_on_request(handle) local h = handle:headers() local p = h:get(":path") or "" if should_strip(p) then local auth = h:get("authorization") if auth then h:replace("x-orig-authorization-public-paths", auth) h:remove("authorization") end local identity = h:get("identity") if identity then h:replace("x-orig-identity-public-paths", identity) h:remove("identity") end h:replace("x-jwt-stripped-public-paths", "1") end end - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.network.http_connection_manager subFilter: name: envoy.filters.http.jwt_authn patch: operation: INSERT_AFTER value: name: envoy.filters.http.lua typed_config: '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua inlineCode: | function envoy_on_request(handle) local h = handle:headers() local stripped = h:get("x-jwt-stripped-public-paths") if stripped == "1" then local xauth = h:get("x-orig-authorization-public-paths") if xauth and not h:get("authorization") then h:replace("authorization", xauth) end h:remove("x-orig-authorization-public-paths") local xidentity = h:get("x-orig-identity-public-paths") if xidentity and not h:get("identity") then h:replace("identity", xidentity) end h:remove("x-orig-identity-public-paths") h:remove("x-jwt-stripped-public-paths") end end cors-json-401: namespace: istio-system workloadSelector: labels: istio: ingressgateway configPatches: - applyTo: HTTP_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.http.jwt_authn patch: operation: INSERT_BEFORE value: name: envoy.filters.http.cors typed_config: '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors cors: allow_credentials: true allow_headers: "Authorization,Content-Type" allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS" allow_origin_string_match: - safe_regex: regex: https://.*\.sarex\.io - safe_regex: regex: https://.*\.contour\.infra\.sarex\.tech - safe_regex: regex: https://localhost:.* max_age: "86400" - applyTo: NETWORK_FILTER match: context: GATEWAY listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: MERGE value: typed_config: '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager local_reply_config: mappers: - body: inline_string: | {"error":"unauthorized","detail":"Invalid or expired token"} filter: status_code_filter: comparison: op: EQ value: default_value: 401 runtime_key: default headers_to_add: - append_action: OVERWRITE_IF_EXISTS_OR_ADD header: key: Content-Type value: application/json - append_action: OVERWRITE_IF_EXISTS_OR_ADD header: key: Access-Control-Allow-Origin value: '%REQ(Origin)%' - append_action: OVERWRITE_IF_EXISTS_OR_ADD header: key: Access-Control-Allow-Credentials value: 'true' gateways: platform: name: platform-gateway namespace: gateway servers: - hosts: - sarex.contour.infra.sarex.tech tls: credentialName: platform-tls minio: name: minio-gateway namespace: gateway servers: - hosts: - minio.contour.infra.sarex.tech tls: credentialName: minio-tls zitadel: name: zitadel-gateway namespace: gateway servers: - hosts: - zitadel.contour.infra.sarex.tech tls: credentialName: zitadel-tls dashboard: name: dashboard-gateway namespace: gateway servers: - hosts: - dashboard.contour.infra.sarex.tech tls: credentialName: dashboard-tls rabbitmq: name: rabbitmq-gateway namespace: gateway servers: - hosts: - rabbitmq.contour.infra.sarex.tech tls: credentialName: rabbitmq-tls keycloak: name: keycloak-gateway namespace: gateway servers: - hosts: - keycloak.contour.infra.sarex.tech tls: credentialName: keycloak-tls glitchtip: name: glitchtip-gateway namespace: gateway servers: - hosts: - glitchtip.contour.infra.sarex.tech tls: credentialName: glitchtip-tls openobserve: name: openobserve-gateway namespace: gateway servers: - hosts: - openobserve.contour.infra.sarex.tech tls: credentialName: openobserve-tls vault: name: vault-gateway namespace: gateway servers: - hosts: - vault.contour.infra.sarex.tech tls: credentialName: vault-tls camunda: name: camunda-gateway namespace: gateway servers: - hosts: - camunda-keycloak.contour.infra.sarex.tech tls: credentialName: camunda-keycloak-tls - hosts: - camunda-identity.contour.infra.sarex.tech tls: credentialName: camunda-identity-tls - hosts: - camunda-operate.contour.infra.sarex.tech tls: credentialName: camunda-operate-tls - hosts: - camunda-tasklist.contour.infra.sarex.tech tls: credentialName: camunda-tasklist-tls - hosts: - camunda-optimize.contour.infra.sarex.tech tls: credentialName: camunda-optimize-tls virtualServices: platform: name: sarex-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /admin/ service: backend-svc.django.svc.cluster.local port: 80 - path: prefix: /api/ service: backend-svc.django.svc.cluster.local port: 80 - path: prefix: / service: frontend-svc.django.svc.cluster.local port: 80 gateway-platform: name: pdm-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /gateway/ rewrite: / service: pdm-svc.documentations.svc.cluster.local port: 80 resources-admin: name: resources-admin-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /resource-management rewrite: /resource-management service: backend-svc.resources.svc.cluster.local port: 80 srx-admin-frontend: name: srx-admin-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /control-interface/ rewrite: / service: frontend-svc.control-interface.svc.cluster.local port: 80 workflows-frontend: name: workflows-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /workflows/api/ rewrite: /api/ service: backend-svc.processing.svc.cluster.local port: 80 - path: prefix: /workflows/ rewrite: / service: frontend-svc.processing.svc.cluster.local port: 80 eav-api: name: eav-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /eav/api/ rewrite: /api/ service: backend-svc.eav.svc.cluster.local port: 80 issues-api: name: issues-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /issues/api/ rewrite: /api/ service: backend-svc.issues.svc.cluster.local port: 80 flows-api: name: flows-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /flows/api/ rewrite: /api/ service: backend-svc.flows.svc.cluster.local port: 80 rfi-api: name: rfi-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /rfi/api/ rewrite: /api/ service: backend-svc.rfi.svc.cluster.local port: 80 transmittals-api: name: flows-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /transmittals/api/ rewrite: /api/ service: backend-svc.transmittal.svc.cluster.local port: 80 workspaces-api: name: workspaces-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /workspaces/api/ rewrite: /api/ service: backend-svc.workspaces.svc.cluster.local port: 80 documentations-frontend: name: documentations-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /documentations/static/ rewrite: / service: frontend-svc.documentations.svc.cluster.local port: 80 transmittal-frontend: name: transmittal-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /transmittal/static/ rewrite: / service: frontend-svc.transmittal.svc.cluster.local port: 80 documentations-api: name: documentations-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /documentations/api/ rewrite: /api/ service: backend-api-svc.documentations.svc.cluster.local port: 80 mapper-api: name: mapper-api-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /mapper/api/ rewrite: /api/ service: backend-svc.mapper.svc.cluster.local port: 80 filestream-api: name: documentations-filestream-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /files/api/ rewrite: /api/ service: backend-filestream-svc.documentations.svc.cluster.local port: 80 issues-frontend: name: issues-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /issues/static/ rewrite: / service: frontend-svc.issues.svc.cluster.local port: 80 flows-frontend: name: flows-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /flows/static/ rewrite: / service: frontend-svc.flows.svc.cluster.local port: 80 reviews-frontend: name: reviews-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /reviews/static/ rewrite: / service: frontend-svc.reviews.svc.cluster.local port: 80 rfi-frontend: name: rfi-frontend-virt-service namespace: gateway hosts: - sarex.contour.infra.sarex.tech gateways: - gateway/platform-gateway routes: - path: prefix: /rfi/static/ rewrite: / service: frontend-svc.rfi.svc.cluster.local port: 80 vault: name: vault-virt-service namespace: gateway hosts: - vault.contour.infra.sarex.tech gateways: - gateway/vault-gateway routes: - path: prefix: / service: vault-vault-contour.vault.svc.cluster.local port: 8200 minio: name: minio-virt-service namespace: gateway hosts: - minio.contour.infra.sarex.tech gateways: - gateway/minio-gateway routes: - path: prefix: /console/ service: minio-console.minio.svc.cluster.local port: 9001 minio-api: name: minio-api-virt-service namespace: gateway hosts: - minio.contour.infra.sarex.tech gateways: - gateway/minio-gateway routes: - path: prefix: / service: minio.minio.svc.cluster.local port: 9000 zitadel: name: zitadel-virt-service namespace: gateway hosts: - zitadel.contour.infra.sarex.tech gateways: - gateway/zitadel-gateway routes: - path: prefix: / service: zitadel-idp-contour.zitadel.svc.cluster.local port: 8080 dashboard: name: dashboard-virt-service namespace: gateway hosts: - dashboard.contour.infra.sarex.tech gateways: - gateway/dashboard-gateway routes: - path: prefix: / service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local port: 80 rabbitmq: name: rabbitmq-virt-service namespace: gateway hosts: - rabbitmq.contour.infra.sarex.tech gateways: - gateway/rabbitmq-gateway routes: - path: prefix: / service: rabbitmq.rabbitmq.svc.cluster.local port: 15672 keycloak: name: keycloak-virt-service namespace: gateway hosts: - keycloak.contour.infra.sarex.tech gateways: - gateway/keycloak-gateway routes: - path: prefix: / service: keycloak-keycloak-contour.keycloak.svc.cluster.local port: 80 glitchtip: name: glitchtip-virt-service namespace: gateway hosts: - glitchtip.contour.infra.sarex.tech gateways: - gateway/glitchtip-gateway routes: - path: prefix: / service: glitchtip-web.glitchtip.svc.cluster.local port: 8000 openobserve: name: openobserve-virt-service namespace: gateway hosts: - openobserve.contour.infra.sarex.tech gateways: - gateway/openobserve-gateway routes: - path: prefix: / service: openobserve-web.openobserve.svc.cluster.local port: 5080 camunda-keycloak: name: camunda-keycloak-virt-service namespace: gateway hosts: - camunda-keycloak.contour.infra.sarex.tech gateways: - gateway/camunda-gateway routes: - path: prefix: / service: camunda-keycloak.camunda.svc.cluster.local port: 80 camunda-identity: name: camunda-identity-virt-service namespace: gateway hosts: - camunda-identity.contour.infra.sarex.tech gateways: - gateway/camunda-gateway routes: - path: prefix: / service: camunda-identity.camunda.svc.cluster.local port: 80 camunda-operate: name: camunda-operate-virt-service namespace: gateway hosts: - camunda-operate.contour.infra.sarex.tech gateways: - gateway/camunda-gateway routes: - path: prefix: / service: camunda-operate.camunda.svc.cluster.local port: 80 camunda-tasklist: name: camunda-tasklist-virt-service namespace: gateway hosts: - camunda-tasklist.contour.infra.sarex.tech gateways: - gateway/camunda-gateway routes: - path: prefix: / service: camunda-tasklist.camunda.svc.cluster.local port: 80 camunda-optimize: name: camunda-optimize-virt-service namespace: gateway hosts: - camunda-optimize.contour.infra.sarex.tech gateways: - gateway/camunda-gateway routes: - path: prefix: / service: camunda-optimize.camunda.svc.cluster.local port: 80