kind: Deployment      
apiVersion: apps/v1
metadata:                  
  name: app1
  namespace: http-service
  labels:                
    app: app1
spec:
  replicas: 1
  selector:   
    matchLabels:
      app: app1
  template:            
    metadata:
      labels:
        app: app1
    spec:
      volumes:
        - name: domain-server-secret
          secret:
              secretName: domain-server-secret
      containers:
        # Sample application, listens on port 9010 for HTTPS and 9000 for HTTP
        - name: http-service
          image: appsentinels/http-server:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: getextractport
              containerPort: 9010
            - name: http
              containerPort: 9000
          env:
           - name: HTTPS_SERVICE_PORT
             value: "9010"
           - name: MTLS
             value: "true"
          volumeMounts:
             - name: domain-server-secret
               mountPath: /certs/server_public.crt
               subPath: app1.crt
               readOnly: true
             - name: domain-server-secret
               mountPath: /certs/server_private.key
               subPath: app1.key
               readOnly: true
              # Needed for validation of client certificate that front proxy will present
             - name: domain-server-secret
               mountPath: /etc/ssl/certs/ca-certificates.crt
               subPath: myCA.crt
               readOnly: true
        - name: front-proxy
          image: appsentinels/front-proxy:latest
          imagePullPolicy: IfNotPresent
          volumeMounts:
             - name: domain-server-secret
               mountPath: /etc/server_public.crt
               subPath: app1.crt
               readOnly: true
             - name: domain-server-secret
               mountPath: /etc/server_private.key
               subPath: app1.key
               readOnly: true
             # mTLS: CA cert for validating client certificate (load balancer or app cert validation)
             - name: domain-server-secret
               mountPath: /etc/ssl/certs/ca-certificates.crt
               subPath: myCA.crt
               readOnly: true
          securityContext:
             capabilities:
               # Needed for installing filters to punt traffic to the sidecar
               add:
                - NET_ADMIN
          env:
            # Reference: https://sample-config.appsentinels.ai/appsentinels-deployment/deployment-guides/FrontProxy/AppSentinels-Front-Proxy-Deployment.pdf
            # On-prem controller to send logs to, update with IP or hostname (no schema or port needed)
            - name: ENVOY_ON_PREM_CONTROLLER
              value: <controller-ip-or-hostname>

            # Keep it same as the target port of container
            - name: ENVOY_SERVICE_PORT
              value: "<target container port, in this case 9010>"

            # Downstream side TLS certs, this will same as the certs applications were presenting earlier
            # Server cert presented by sidecar to other apps or load balancers downstream
            - name: ENVOY_DOWNSTREAM_TLS_SERVER_CERT
              value: "/etc/server_public.crt"
            - name: ENVOY_DOWNSTREAM_TLS_SERVER_PRIVATE_KEY
              value: "/etc/server_private.key"

            # mTLS: Define this client location if sidecar needs to be validate client certificate
            - name: ENVOY_DOWNSTREAM_TLS_CA_CERT
              value: "/etc/ssl/certs/ca-certificates.crt"

            # Upstream side TLS certs
            # Define this if sidecar needs to be validate server (i.e. app) certificate. It is unlikely that intra-pod
            # communication will be TLS, otherwise set this to "false"
            - name: ENVOY_UPSTREAM_TLS
              value: "true"
            # For upstream mTLS, location where client cert presented by front proxy to app is present. This along with ENVOY_UPSTREAM_TLS_CLIENT_PRIVATE_KEY will enable upstream TLS
            # enable upstream TLS
            - name: ENVOY_UPSTREAM_TLS_CLIENT_CERT
              value: "/etc/server_public.crt"
            - name: ENVOY_UPSTREAM_TLS_CLIENT_PRIVATE_KEY
              value: "/etc/server_private.key"
            
            # CA cert for upstream server certificate validation
            - name: ENVOY_UPSTREAM_TLS_CA_CERT
              value: "/etc/ca-certificate.crt"

            # Leave this to "127.0.0.1" for sidecar in K8 pods
            - name: ENVOY_SERVICE_NAME
              value: "127.0.0.1"
            
            # No change needed here
            - name: PROXY_SIDECAR
              value: "yes"
            - name: ENVOY_LISTENING_PORT
              value: "8000"
---
kind: Service
apiVersion: v1
metadata:
  name: app1
  namespace: http-service
spec:
  selector:
    app: app1
  ports:
  - name: http
    protocol: TCP
    port: 6000
    targetPort: 9010
  type: LoadBalancer

