ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vision-week-ingress
  namespace: vision-week
  labels:
    app: vision-week-virtual-exploration
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type, X-Requested-With"
    nginx.ingress.kubernetes.io/cors-max-age: "86400"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header X-Frame-Options "SAMEORIGIN" always;
      add_header X-Content-Type-Options "nosniff" always;
      add_header X-XSS-Protection "1; mode=block" always;
      add_header Referrer-Policy "strict-origin-when-cross-origin" always;
      add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; child-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self';" always;
spec:
  tls:
    - hosts:
        - vision-week.example.com
        - api.vision-week.example.com
        - ws.vision-week.example.com
      secretName: vision-week-tls
  rules:
    # Main application
    - host: vision-week.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vision-week-app-service
                port:
                  number: 80
    
    # API subdomain
    - host: api.vision-week.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vision-week-app-service
                port:
                  number: 80
    
    # WebSocket subdomain
    - host: ws.vision-week.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: vision-week-websocket-service
                port:
                  number: 8080

---
# WebSocket Service
apiVersion: v1
kind: Service
metadata:
  name: vision-week-websocket-service
  namespace: vision-week
  labels:
    app: vision-week-virtual-exploration
    component: websocket
spec:
  type: ClusterIP
  ports:
    - name: websocket
      port: 8080
      targetPort: websocket
      protocol: TCP
  selector:
    app: vision-week-virtual-exploration
    component: websocket

---
# WebSocket Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vision-week-websocket
  namespace: vision-week
  labels:
    app: vision-week-virtual-exploration
    component: websocket
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: vision-week-virtual-exploration
      component: websocket
  template:
    metadata:
      labels:
        app: vision-week-virtual-exploration
        component: websocket
    spec:
      containers:
        - name: websocket
          image: vision-week/app:latest
          imagePullPolicy: Always
          command: ["php", "/var/www/html/src/WebSocket/server.php"]
          ports:
            - name: websocket
              containerPort: 8080
              protocol: TCP
          env:
            - name: APP_ENV
              valueFrom:
                configMapKeyRef:
                  name: vision-week-config
                  key: APP_ENV
            - name: WEBSOCKET_HOST
              valueFrom:
                configMapKeyRef:
                  name: vision-week-config
                  key: WEBSOCKET_HOST
            - name: WEBSOCKET_PORT
              valueFrom:
                configMapKeyRef:
                  name: vision-week-config
                  key: WEBSOCKET_PORT
            - name: REDIS_HOST
              valueFrom:
                configMapKeyRef:
                  name: vision-week-config
                  key: REDIS_HOST
            - name: REDIS_PORT
              valueFrom:
                configMapKeyRef:
                  name: vision-week-config
                  key: REDIS_PORT
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: redis-secrets
                  key: REDIS_PASSWORD
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "200m"
          livenessProbe:
            tcpSocket:
              port: websocket
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            tcpSocket:
              port: websocket
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3

---
# Network Policy for security
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: vision-week-network-policy
  namespace: vision-week
  labels:
    app: vision-week-virtual-exploration
spec:
  podSelector:
    matchLabels:
      app: vision-week-virtual-exploration
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Allow ingress from nginx-ingress
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - protocol: TCP
          port: 80
        - protocol: TCP
          port: 8080
    # Allow internal communication
    - from:
        - podSelector:
            matchLabels:
              app: vision-week-virtual-exploration
      ports:
        - protocol: TCP
          port: 80
        - protocol: TCP
          port: 5432
        - protocol: TCP
          port: 6379
        - protocol: TCP
          port: 8080
  egress:
    # Allow DNS resolution
    - to: []
      ports:
        - protocol: UDP
          port: 53
    # Allow HTTPS outbound (for external APIs)
    - to: []
      ports:
        - protocol: TCP
          port: 443
    # Allow internal communication
    - to:
        - podSelector:
            matchLabels:
              app: vision-week-virtual-exploration
      ports:
        - protocol: TCP
          port: 5432
        - protocol: TCP
          port: 6379