# Kubernetes Gateway API example: https://app.example.com -> web-service:80 -> 3 NGINX Pods
#
# PREREQUISITES (this file does NOT install them):
#   1. Gateway API CRDs (gateway.networking.k8s.io/v1), e.g. the standard-install.yaml
#      from https://github.com/kubernetes-sigs/gateway-api/releases
#   2. A Gateway API controller (implementation) running in the cluster. The controller
#      programs the data-plane proxy; it never carries user traffic itself.
#   3. A TLS Secret named "web-tls" in namespace "demo" holding the certificate for
#      app.example.com (see the command below), or one issued by cert-manager.
#   4. A DNS record for app.example.com pointing at the address in the Gateway status
#      (kubectl get gateway web-gateway -n demo -o jsonpath='{.status.addresses}').
#
#   kubectl create namespace demo
#   kubectl create secret tls web-tls -n demo --cert=app.example.com.crt --key=app.example.com.key
#
# Placeholders marked "REPLACE" are implementation-dependent.
---
apiVersion: v1
kind: Namespace
metadata:
  name: demo
---
# GatewayClass: which controller manages Gateways of this class. Cluster-scoped.
# Many implementations install their own GatewayClass; if yours does, delete this
# object and set spec.gatewayClassName on the Gateway to that class's name instead
# (check with: kubectl get gatewayclass).
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: example-gateway-class                        # REPLACE if your implementation ships one
spec:
  controllerName: example.com/gateway-controller     # REPLACE with your controller's exact controllerName
---
# Gateway: how traffic enters. One HTTPS listener on 443; TLS terminates here.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: web-gateway
  namespace: demo
spec:
  gatewayClassName: example-gateway-class            # must match the GatewayClass name
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: app.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: web-tls                            # PREREQUISITE: TLS Secret in namespace demo
      allowedRoutes:
        namespaces:
          from: Same
---
# HTTPRoute: where matching requests go. Configuration only, not a running proxy.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: web-route
  namespace: demo
spec:
  parentRefs:
    - name: web-gateway
      sectionName: https
  hostnames:
    - app.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: web-service
          port: 80
---
# Pods: three NGINX replicas, labelled app=web.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: demo
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: nginx
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 80
          readinessProbe:
            httpGet:
              path: /
              port: http
---
# Service: stable backend reference. selector app=web picks the Pods above.
apiVersion: v1
kind: Service
metadata:
  name: web-service
  namespace: demo
spec:
  type: ClusterIP
  selector:
    app: web
  ports:
    - name: http
      port: 80
      targetPort: http
---
# VALIDATION
#   kubectl get gatewayclass                  # ACCEPTED should be True
#   kubectl get gateways -A                   # PROGRAMMED should be True, ADDRESS filled
#   kubectl get httproutes -A
#   kubectl describe gateway web-gateway -n demo
#   kubectl describe httproute web-route -n demo   # look for Accepted and ResolvedRefs = True
#   kubectl get svc,pods -n demo
#   kubectl get endpointslices -n demo -l kubernetes.io/service-name=web-service
#   curl -v https://app.example.com/