{{- if .Values.ingress.private.enabled }}
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: kubezero-istio-private-ingress
  namespace: istio-system
  labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
spec:
  profile: empty
  components:
    ingressGateways:
    - name: istio-private-ingressgateway
      enabled: true
      namespace: istio-system
      k8s:
        replicaCount: {{ .Values.ingress.replicaCount }}
        {{- if .Values.ingress.autoscaleEnabled }}
        hpaSpec:
          maxReplicas: 5
          metrics:
          - resource:
              name: cpu
              targetAverageUtilization: 80
            type: Resource
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-private-ingressgateway
        {{- end }}
        env:
        {{- if .Values.ingress.private.http10 }}
        - name: ISTIO_META_HTTP10
          value: '"1"'
        {{- end }}
        # https://github.com/istio/istio/issues/26524, not in 1.7 either
        #- name: TERMINATION_DRAIN_DURATION_SECONDS
        #  value: "60"
        #- name: ISTIO_META_IDLE_TIMEOUT
        #  value: "3600s"
        {{- if eq .Values.ingress.type "NodePort" }}
        nodeSelector:
          node.kubernetes.io/ingress.private: "{{ .Values.ingress.private.nodeSelector }}"
        {{- end }}
        resources:
          limits:
            # cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 64Mi
        strategy:
          rollingUpdate:
            maxSurge: 100%
            maxUnavailable: 25%
        overlays:
        - apiVersion: apps/v1
          kind: Deployment
          name: istio-private-ingressgateway
          patches:
            - path: spec.template.spec.containers.[name:istio-proxy].lifecycle
              value: {"preStop": {"exec": {"command": ["sh", "-c", "curl -X POST http://localhost:15000/healthcheck/fail && sleep 30"]}}}
            - path: spec.template.spec.terminationGracePeriodSeconds
              value: 90

  meshConfig:
    accessLogFile: /dev/stdout
    accessLogEncoding: 'JSON'
    h2UpgradePolicy: 'DO_NOT_UPGRADE'
    tcpKeepalive:
      interval: 30s
      time: 60s

  values:
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: {{ .Values.ingress.autoscaleEnabled }}
        externalTrafficPolicy: Local
        labels:
          app: istio-private-ingressgateway
          istio: private-ingressgateway
        meshExpansionPorts: []
        podAntiAffinityLabelSelector:
        - key: app
          operator: In
          topologyKey: kubernetes.io/hostname
          values: istio-private-ingressgateway
        type: {{ default "NodePort" .Values.ingress.type }}
        ports:
        - name: http-status
          port: 15021
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31021
          {{- end }}
        - name: http2
          port: 80
          targetPort: 8080
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31080
          {{- end }}
        - name: https
          port: 443
          targetPort: 8443
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31443
          {{- end }}
        - name: fluentd-forward
          port: 24224
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31224
          {{- end }}
        - name: amqps
          port: 5671
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31671
          {{- end }}
        - name: amqp
          port: 5672
          {{- if eq .Values.ingress.type "NodePort" }}
          nodePort: 31672
          {{- end }}

    global:
      jwtPolicy: first-party-jwt
      logAsJson: true
      defaultPodDisruptionBudget:
        enabled: false

{{- end }}