# ==============================================================================
# EXAMPLE: IP Whitelist Plugin for Kubernetes
# ==============================================================================
#
# WHAT THIS DEMONSTRATES:
# - Restricting access to specific IP addresses or CIDR ranges
# - Using annotations for IP-based access control
# - Protecting admin panels or sensitive services in Kubernetes
# - Custom HTTP status code for blocked requests
#
# REQUIREMENTS (run these first):
# ```bash
# # 1. Ensure EasyHAProxy is installed in your cluster
# kubectl create namespace easyhaproxy
# kubectl apply -f https://raw.githubusercontent.com/byjg/docker-easy-haproxy/6.1.1/deploy/kubernetes/easyhaproxy-daemonset.yml
#
# # 2. IMPORTANT: Edit this file (line 80) and update allowed_ips
# #    with your actual office/VPN IP addresses or networks
# ```
#
# HOW TO START:
# ```bash
# kubectl apply -f ip-whitelist.yml
# ```
#
# HOW TO VERIFY IT'S WORKING:
# ```bash
# # Check resources are created
# kubectl get deployment,service,ingress -l app=admin
#
# # Test from allowed IP
# kubectl port-forward -n easyhaproxy deployment/easyhaproxy 8080:80
# curl -H "Host: admin.example.local" http://localhost:8080
# # Expected: 200 OK with "Admin Panel - IP Restricted" (if your IP is in allowed_ips)
#
# # Test from non-allowed IP
# # Expected: HTTP 403 Forbidden
# ```
#
# CLEAN UP:
# ```bash
# kubectl delete -f ip-whitelist.yml
# ```
#
# ==============================================================================

---
apiVersion: v1
kind: Service
metadata:
  name: admin-service
  namespace: default
spec:
  ports:
  - port: 8080
    targetPort: 8080
  selector:
    app: admin
  type: ClusterIP

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: admin
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: admin
  template:
    metadata:
      labels:
        app: admin
    spec:
      containers:
      - name: admin
        image: byjg/static-httpserver
        ports:
        - containerPort: 8080
        env:
        - name: TITLE
          value: "Admin Panel - IP Restricted"
        resources:
          limits:
            cpu: '0.1'
            memory: '64Mi'
          requests:
            cpu: '0.05'
            memory: '32Mi'

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    # Enable IP whitelist plugin
    easyhaproxy.plugins: "ip_whitelist"

    # Allow specific IPs and networks
    # UPDATE THIS with your actual office/VPN IPs!
    # For testing: includes localhost and Docker/Kubernetes private networks
    easyhaproxy.plugin.ip_whitelist.allowed_ips: "127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,203.0.113.0/24,198.51.100.42"

    # Status code to return for blocked IPs
    easyhaproxy.plugin.ip_whitelist.status_code: "403"
  name: admin-ingress-whitelist
  namespace: default
spec:
  # Use ingressClassName instead of the deprecated annotation
  # For backward compatibility, annotation kubernetes.io/ingress.class is still supported
  ingressClassName: easyhaproxy
  rules:
  - host: admin.example.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 8080