# Example demonstrating JWT validator with Kubernetes secret
# This shows the recommended way to provide JWT public keys in Kubernetes
#
# IMPORTANT: Before applying this manifest, generate JWT keys by running:
#   cd /path/to/examples && bash generate-keys.sh
#
# Then create the secrets with your generated keys:
#   kubectl create secret generic jwt-pubkey-secret \
#     --from-file=pubkey=docker/jwt_pubkey.pem -n default
#   kubectl create secret generic jwt-custom-secret \
#     --from-file=rsa-public-key=docker/jwt_pubkey.pem -n default
#
# TWO ANNOTATION FORMATS:
# 1. Auto-detect key (tries common variations):
#    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
#    Tries keys: pubkey, public-key, jwt.pub, tls.crt
#
# 2. Explicit key (no variations):
#    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret/rsa-public-key"
#    Only tries key: rsa-public-key

---
# NOTE: Secrets should be created separately using your generated JWT keys
# See instructions at the top of this file
# The test fixture creates these secrets automatically

---
# Deployment for API service
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: byjg/static-httpserver
        ports:
        - containerPort: 8080
        env:
        - name: TITLE
          value: "Protected API - JWT Required"

---
# Service to be protected with JWT
apiVersion: v1
kind: Service
metadata:
  name: api-service
  namespace: default
spec:
  selector:
    app: api
  ports:
  - port: 8080
    targetPort: 8080

---
# Ingress Example 1: Auto-detect key (uses standard key name "pubkey")
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress-jwt-auto
  namespace: default
  annotations:
    # Enable JWT validator plugin
    easyhaproxy.plugins: "jwt_validator"

    # JWT validator configuration
    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"

    # Auto-detect: tries pubkey, public-key, jwt.pub, tls.crt
    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-pubkey-secret"
spec:
  ingressClassName: easyhaproxy
  rules:
  - host: api.example.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

---
# Ingress Example 2: Explicit key (uses custom key name "rsa-public-key")
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress-jwt-explicit
  namespace: default
  annotations:
    # Enable JWT validator plugin
    easyhaproxy.plugins: "jwt_validator"

    # JWT validator configuration
    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"

    # Explicit key: only tries "rsa-public-key" from the secret
    easyhaproxy.plugin.jwt_validator.k8s_secret.pubkey: "jwt-custom-secret/rsa-public-key"

    # Optional: Protect only specific paths
    # easyhaproxy.plugin.jwt_validator.paths: "/api,/admin"

    # Optional: Allow anonymous access (JWT validated only if present)
    # easyhaproxy.plugin.jwt_validator.allow_anonymous: "true"
spec:
  ingressClassName: easyhaproxy
  rules:
  - host: api-custom.example.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080