# JWT Validator Plugin Example for Kubernetes
#
# This example demonstrates JWT token validation for API protection in Kubernetes
#
# Prerequisites:
# 1. EasyHAProxy installed in your cluster
# 2. Generate RSA key pair:
#    openssl genrsa -out jwt_private.pem 2048
#    openssl rsa -in jwt_private.pem -pubout -out jwt_pubkey.pem
#
# 3. Create ConfigMap with public key:
#    kubectl create configmap jwt-keys --from-file=api_pubkey.pem=jwt_pubkey.pem
#
# 4. Mount the ConfigMap in EasyHAProxy deployment (add to volumeMounts and volumes):
#    volumeMounts:
#      - name: jwt-keys
#        mountPath: /etc/haproxy/jwt_keys
#    volumes:
#      - name: jwt-keys
#        configMap:
#          name: jwt-keys
#
# 5. Apply this manifest:
#    kubectl apply -f jwt-validator.yml
#
# 6. Test without token (should fail):
#    curl http://api.example.local/
#    # Response: Missing Authorization HTTP header
#
# 7. Generate test JWT at https://jwt.io with:
#    - Algorithm: RS256
#    - Payload: {"iss":"https://auth.example.com/","aud":"https://api.example.com","exp":9999999999}
#    - Use your jwt_private.pem for signing
#
# 8. Test with token:
#    TOKEN="eyJhbGc..."
#    curl -H "Authorization: Bearer $TOKEN" http://api.example.local/
#    # Response: Success

---
apiVersion: v1
kind: Service
metadata:
  name: api-service
  namespace: default
spec:
  ports:
  - port: 8080
    targetPort: 8080
  selector:
    app: api
  type: ClusterIP

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
      - name: api
        image: byjg/static-httpserver
        ports:
        - containerPort: 8080
        env:
        - name: TITLE
          value: "Protected API - JWT Required"
        resources:
          limits:
            cpu: '0.1'
            memory: '64Mi'
          requests:
            cpu: '0.05'
            memory: '32Mi'

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: easyhaproxy-ingress

    # Enable JWT validator plugin
    easyhaproxy.plugins: "jwt_validator"

    # JWT validator configuration
    easyhaproxy.plugin.jwt_validator.algorithm: "RS256"
    easyhaproxy.plugin.jwt_validator.issuer: "https://auth.example.com/"
    easyhaproxy.plugin.jwt_validator.audience: "https://api.example.com"
    easyhaproxy.plugin.jwt_validator.pubkey_path: "/etc/haproxy/jwt_keys/api_pubkey.pem"
  name: api-ingress-jwt
  namespace: default
spec:
  rules:
  - host: api.example.local
    http:
      paths:
      - backend:
          service:
            name: api-service
            port:
              number: 8080
        pathType: ImplementationSpecific