The homelab Cloudflare tunnel is network-policy-scoped to platform-envoy-proxy, but the platform Gateway HTTP listener only accepts *.samuelho.space. Cloudflare can terminate TLS for other project domains, then the origin Gateway rejects their hostnames; dev.creativetoolkits.com/webhooks/stripe hangs and Stripe disables the endpoint.
Make the platform Gateway's cleartext HTTP listener hostname-agnostic. HTTPS remains certificate/hostname scoped, and attached HTTPRoutes continue to enforce exact hostnames.
Acceptance: generated Gateway renders an HTTP listener without hostname; Kyverno chart validation passes; no TLS listener scope changes.
The homelab Cloudflare tunnel is network-policy-scoped to
platform-envoy-proxy, but the platform Gateway HTTP listener only accepts*.samuelho.space. Cloudflare can terminate TLS for other project domains, then the origin Gateway rejects their hostnames;dev.creativetoolkits.com/webhooks/stripehangs and Stripe disables the endpoint.Make the platform Gateway's cleartext HTTP listener hostname-agnostic. HTTPS remains certificate/hostname scoped, and attached HTTPRoutes continue to enforce exact hostnames.
Acceptance: generated Gateway renders an HTTP listener without
hostname; Kyverno chart validation passes; no TLS listener scope changes.