emissary-ingress

apiVersion: getambassador.io/v3alpha1
kind: Host
metadata:
  name: minimal-host
spec:
  # 支持 *.example.com, host.example.*
  hostname: host.example.com
  # 选择 Mapping
  mappingSelector:
    matchLabels:
      examplehost: host
  acmeProvider:
    authority: none
    email: [email protected]
  tlsSecret:
    name: tls-cert
  requestPolicy:
    insecure:
      # Redirect, Route, Reject
      # 默认 HTTP 会跳转 HTTPS
      action: Redirect
      additionalPort: 8080
---
apiVersion: getambassador.io/v3alpha1
kind: TLSContext
metadata:
  name: upstream-context
spec:
  hosts: []
  secret: upstream-certs
  # self-signed
  # secret: self-signed-cert
  min_tls_version: v1.3
  sni: some-sni-hostname
---
apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: mapping-with-label-match
  labels:
    examplehost: host
spec:
  # 可以配置 hostname 选择 Host
  hostname: '*.example.com'
  prefix: /httpbin/
  service: http://httpbin.org
  host_rewrite: httpbin.org
  tls: upstream-context

---
apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: example-listener
spec:
  port: 8080
  protocol: HTTPS # HTTP, HTTPS, HTTPPROXY, HTTPSPROXY, TCP
  protocolStack: [HTTP, TCP]
  securityModel: XFP # XFP (for X-Forwarded-Proto), SECURE, INSECURE
  statsPrefix: example-listener # default depends on protocol
  l7Depth: 0
  hostBinding:
    namespace:
      from: SELF # SELF, ALL
    selector: ... # Kubernetes label selector

---
apiVersion: getambassador.io/v3alpha1
kind: AuthService
metadata:
  name: authentication
spec:
  ambassador_id: ['ambassador-1']
  auth_service: 'example-auth.authentication:3000'
  tls: true
  proto: http
  timeout_ms: 5000
  include_body:
    max_bytes: 4096
    allow_partial: true
  status_on_error:
    code: 403
  failure_mode_allow: false

  # proto: grpc only
  protocol_version: v2

  # proto: http only
  path_prefix: '/path'
  allowed_request_headers:
    - 'x-example-header'
  allowed_authorization_headers:
    - 'x-qotm-session'
  add_auth_headers:
    x-added-auth: auth-added
  add_linkerd_headers: false

apiVersion: getambassador.io/v3alpha1
kind: Module
metadata:
  name: ambassador
spec:
  config:
    grpc_stats:
      upstream_stats: true
      services:
        - name: <package>.<service>
          method_names: [<method>]