# ------------------------------------------------------------------------------
# hello-world — Gateway API + cert-manager + external-dns end-to-end test
#
# Tests:
#   - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool)
#   - cert-manager DNS-01 cert issuance (letsencrypt-staging)
#   - external-dns CNAME creation in Technitium via RFC2136
#   - HTTPRoute routing to backend service
#
# Cleanup when done:
#   kubectl delete -f hello-world.yaml -n default
# ------------------------------------------------------------------------------

# Gateway — one per cluster (shared by all HTTPRoutes)
# This is the only Gateway you'll ever need for internal cluster traffic.
# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: fastpass-gateway
  namespace: default
  annotations:
    io.cilium/lb-ipam-ips: "10.1.71.90"
spec:
  gatewayClassName: cilium
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: hello-world-tls
            kind: Secret
      allowedRoutes:
        namespaces:
          from: Same
---
# Certificate — staging issuer to avoid LE rate limits during testing
# Switch to letsencrypt-prod once staging validates successfully
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: hello-world-tls
  namespace: default
spec:
  secretName: hello-world-tls
  issuerRef:
    name: letsencrypt-staging
    kind: ClusterIssuer
  dnsNames:
    - hello.local.mk-labs.cloud
---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: hello-world
          image: nginxdemos/hello:plain-text
          ports:
            - containerPort: 80
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
---
# Service
apiVersion: v1
kind: Service
metadata:
  name: hello-world
  namespace: default
spec:
  selector:
    app: hello-world
  ports:
    - port: 80
      targetPort: 80
---
# HTTPRoute — handles both HTTP and HTTPS listeners
# external-dns watches this resource and creates the DNS record in Technitium
# because the hostname annotation is present.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: hello-world
  namespace: default
  annotations:
    external-dns.alpha.kubernetes.io/hostname: hello.local.mk-labs.cloud
    external-dns.alpha.kubernetes.io/target: "10.1.71.90"
spec:
  parentRefs:
    - name: fastpass-gateway
      sectionName: https
  hostnames:
    - hello.local.mk-labs.cloud
  rules:
    - backendRefs:
        - name: hello-world
          port: 80