# Application manifests
# Before deploying, replace all instances of "broker.apps.cluster.example.com" with your desired FQDN

# Ingress via external load balancer is not working, as Istio is intercepting port 5672
# However, it's possible connect from inside the mesh with something like:
# kubectl -n maistra-1629 run debug -it --rm --image nicolaka/netshoot --overrides='{ "spec": { "template": { "metadata": {"annotations": { "sidecar.istio.io/inject":"true" } } } } }' --image-pull-policy IfNotPresent -- nc -v broker-amqp 5672

---
apiVersion: project.openshift.io/v1
kind: Project
metadata:
  name: maistra-1629

---
apiVersion: maistra.io/v1
kind: ServiceMeshMember
metadata:
  name: default
  namespace: maistra-1629
spec:
  controlPlaneRef:
    name: default-service-mesh
    namespace: istio-system

---
apiVersion: v1
kind: Service
metadata:
  annotations:
    cloud.google.com/load-balancer-type: Internal
  name: broker-amqp
  namespace: maistra-1629
spec:
  externalTrafficPolicy: Local
  ports:
    - name: tcp-amqp
      port: 5672
      targetPort: tcp-amqp
  selector:
    app: broker-instance
  type: LoadBalancer

---
apiVersion: v1
kind: Service
metadata:
  name: broker-http
  namespace: maistra-1629
spec:
  ports:
    - name: http
      port: 80
      targetPort: http
  selector:
    app: broker-instance

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: broker-gateway
  namespace: maistra-1629
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        # TODO: replace me with fqdn
        - broker.apps.cluster.example.com

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: broker-virtualservice
  namespace: maistra-1629
spec:
  hosts:
    # TODO: replace me with fqdn
    - broker.apps.cluster.example.com
  gateways:
    - broker-gateway
  http:
    - route:
        - destination:
            host: broker-http
            port:
              number: 80

---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: disable-amqp-mtls
  namespace: maistra-1629
spec:
  host: broker-amqp
  trafficPolicy:
    tls:
      mode: DISABLE

---
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: disable-amqp-mtls
  namespace: maistra-1629
spec:
  targets:
    - name: broker-amqp

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: broker-instance
  name: broker
  namespace: maistra-1629
spec:
  replicas: 1
  selector:
    matchLabels:
      app: broker-instance
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
        sidecar.istio.io/rewriteAppHTTPProbers: "true"
        # XXX: This annotation should configure istio-proxy to only intercept 8080,
        #      but inbound port 5672 seems to be intercepted also
        traffic.sidecar.istio.io/includeInboundPorts: "8080"
        # XXX: This annotation should allow network connectivity to api server,
        #      but outbound port 443 seems to be intercepted also
        traffic.sidecar.istio.io/excludeOutboundPorts: "443"
      labels:
        app: broker-instance
    spec:
      initContainers:
        - name: init
          image: bitnami/kubectl:latest
          imagePullPolicy: Always
          args:
            - version
      containers:
        - image: chrisob/qpid-broker-j-docker:8.0.0
          imagePullPolicy: IfNotPresent
          name: broker
          ports:
            - containerPort: 5672
              name: tcp-amqp
              protocol: TCP
            - containerPort: 8080
              name: http
              protocol: TCP
          resources:
            limits:
              cpu: 500m
              memory: 5Gi
            requests:
              cpu: 300m
              memory: 4Gi
          securityContext:
            readOnlyRootFilesystem: true
          volumeMounts:
            - mountPath: /var/lib/qpid
              name: message-store
      volumes:
        - name: message-store
          emptyDir: {}
