# Kibana — nginx-internal with Google OAuth via oauth2-proxy.
# Ref: https://medium.com/@hrlimaye/google-oauth2-with-kubernetes-nginx-controller-d7a0a3e62e1b
#
# nginx auth_request flow:
#   1. Request hits this ingress for path /
#   2. nginx makes internal subrequest to auth-url (cluster-internal DNS, always resolvable from nginx pod)
#   3. oauth2-proxy returns 202 (valid cookie) -> request passes to Kibana
#      oauth2-proxy returns 401 (no/bad cookie) -> nginx redirects browser to auth-signin
#   4. auth-signin uses $host (browser redirect, not internal subrequest - $host is fine here)
#      -> oauth2-proxy starts Google login flow -> /oauth2/callback -> sets cookie -> back to Kibana
#
# Why auth-url uses cluster DNS (not $host):
#   auth-url is an nginx internal subrequest - nginx tries to resolve it from inside the pod.
#   External hostnames like prd.meesho.int may not resolve from within the nginx controller pod.
#   auth-signin is a browser redirect, so $host works fine there.
#
# Requires:
#   - Secret oauth2-proxy-google applied (oauth2-proxy-secret.example.yaml)
#   - oauth2-proxy Deployment + Service (oauth2-proxy.yaml)
#   - /oauth2 Ingress on same host (ingress-oauth2-proxy.yaml)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kibana-prd-observability-nginx
  namespace: eck-observability-prd
  annotations:
    kubernetes.io/ingress.class: nginx-internal
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
    # auth-url: cluster-internal DNS so nginx can always reach oauth2-proxy for the subrequest.
    nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy-kibana.eck-observability-prd.svc.cluster.local:4180/oauth2/auth"
    # auth-signin: browser redirect — $host resolves to the request Host header in the browser.
    nginx.ingress.kubernetes.io/auth-signin: "http://$host/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/auth-response-headers: "X-Auth-Request-Email, X-Auth-Request-User"
spec:
  ingressClassName: nginx-internal
  rules:
    - host: kibana-prd-observability.prd.meesho.int
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: kibana-eck-observability-prd-kb-http
                port:
                  number: 5601