IngressPolicy

apiVersion: gwin.yandex.cloud/v1
kind: IngressPolicy
metadata:
  name: example-ingress-policy
  namespace: example-ns
spec:
  # Target Ingress resources
  targetRefs:
    - group: networking.k8s.io
      kind: Ingress
      name: example-ingress
  # Or use label selector
  selector:
    matchLabels:
      app: my-ingress
    matchExpressions:
      - key: environment
        operator: In
        values: ["production", "staging"]
  # Ingress policy configuration
  policy:
    # Ingress group configuration
    groupName: "my-ingress-group"  # group multiple ingresses
    groupOrder: 100  # processing order within group
    
    # Load balancer configuration
    externalIPv4Address: "5.4.3.2"  # external IPv4 address
    externalIPv6Address: "2001:db8::1"  # external IPv6 address
    subnets: ["subnet-id-1", "subnet-id-2"]  # where to place balancer
    securityGroups: ["sg-id-1", "sg-id-2"]  # network access control
    allowZonalShift: true  # enable failover between zones
    
    # Cloud Logging
    logs:
      logGroupID: "log-group-id-1"  # where to send logs
      disable: false  # enable logging
      discardRule:
        rule1:  # custom rule name
          httpCodes: [404, 500]  # skip these status codes
          httpCodeIntervals: ["HTTP_4XX", "HTTP_5XX"]  # skip error ranges
          grpcCodes: ["INTERNAL", "UNIMPLEMENTED"]  # skip gRPC errors
          discardPercent: 10  # drop 10% of logs
    
    # Autoscaling
    autoScale:
      minZoneSize: 2  # min instances per zone
      maxSize: 10  # max total instances
    
    # Zone traffic control
    zone:
      ru-central1-a:
        receiveTraffic: false  # disable this zone
      ru-central1-b:
        receiveTraffic: true  # enable this zone
    
    # Listener configuration
    listeners:
      http:
        protocolSettings:
          allowHTTP10: true  # support old HTTP
          http2Options:
            maxConcurrentStreams: 100  # limit connections
      stream:
        idleTimeout: "300s"  # close idle connections
      # HTTP router configuration
      rbac:
        action: "ALLOW"  # access control policy
        principals:
          admin:  # principal group
            check-token:  # principal name
              header:
                name: "X-Api-Token"
                exact: "admin123"
    
    # Backend and route configuration
    rules:
      # Backend group configuration
      backends:
        http:
          useHTTP2: true  # enable HTTP/2 to backends
        balancing:
          mode: "ROUND_ROBIN"  # load balancing algorithm
          localityAwareRouting: 80  # prefer same zone
          strictLocality: false  # allow cross-zone routing
          panicThreshold: 50  # panic mode threshold
        
        # Health checks
        hc:
          timeout: "5s"  # health check timeout
          interval: "10s"  # check interval
          healthyThreshold: 2  # checks to mark healthy
          unhealthyThreshold: 3  # checks to mark unhealthy
          port: 8080  # health check port
          
          http:
            path: "/health"  # HTTP health check path
            host: "health.example.com"  # Host header
            useHTTP2: false  # use HTTP/1.1 for checks
            expectedStatuses: [200, 202]  # healthy status codes
          
          # Health check transport settings
          transportSettings:
            plaintext: true  # use plaintext for health checks
            tls:
              sni: "health.example.com"  # SNI for health check TLS
              trustedCA:
                id: "health-cert-123"  # health check TLS cert ID
        
        # Backend TLS configuration
        tls:
          sni: "backend.example.com"  # SNI for TLS
          trustedCA:
            id: "cert-123456"  # cloud certificate ID
        
        # Session affinity
        sessionAffinity:
          connection:
            sourceIP: true  # IP-based affinity
          cookie:
            name: "session"  # cookie name
            ttl: "3600s"  # cookie lifetime
          header:
            name: "X-Session-ID"  # header-based affinity
      
      # Route timeouts
      timeout: "60s"  # overall connection timeout
      idleTimeout: "300s"  # idle connection timeout
      
      # HTTP specific settings
      http:
        upgradeTypes: ["websocket"]  # supported upgrade protocols
      
      # HTTP method restrictions
      allowedMethods: ["GET", "POST", "PUT"]  # restrict allowed HTTP methods
      
      # URL path rewriting
      prefixRewrite: "/new-prefix"  # rewrite URL path prefix
      
      # Header modifications
      modifyRequestHeaders:
        append:
          X-Custom-Header: "custom-value"  # add request header
        rename:
          Old-Header: "New-Header"  # rename request header
        replace:
          Authorization: "Bearer token"  # replace request header
        remove: ["X-Remove-Me", "X-Also-Remove"]  # remove request headers
      modifyResponseHeaders:
        append:
          X-Response-Header: "response-value"  # add response header
        rename:
          Old-Response: "New-Response"  # rename response header
        replace:
          Cache-Control: "no-cache"  # replace response header
        remove: ["Server", "X-Powered-By"]  # remove response headers
      
      # Security
      securityProfileID: "security-profile-1"  # WAF profile for routes
      rbac:
        action: "ALLOW"  # default RBAC action
        principals:
          admin:
            check-token:
              header:
                name: "authorization"
                exact: "Bearer admin123"
    
    # Virtual host configuration
    hosts:
      securityProfileID: "host-security-profile-1"  # WAF profile for hosts
      rateLimit:
        allRequests:
          perSecond: 100  # global rate limit
          perMinute: 6000  # global rate limit
        requestsPerIP:
          perSecond: 10  # per-IP rate limit
          perMinute: 600  # per-IP rate limit
      rbac:
        action: "DENY"  # host-level RBAC action
        principals:
          blocked:
            bad-ip:
              ip:
                remoteIp: "192.168.1.0/24"
   
   # Redirect actions (referenced by Ingress backend resources)
   redirect:
     https-redirect:  # redirect action name
       replaceScheme: "https"  # change URL scheme
       replaceHost: "secure.example.com"  # change hostname
       replacePort: 443  # change port
       path:
         replacePath: "/new-path"  # replace entire path
       removeQuery: true  # remove query parameters
       responseCode: 301  # redirect status code
   
   # Direct response actions (referenced by Ingress backend resources)
   directResponse:
     maintenance-response:  # direct response action name
       responseCode: 503  # HTTP status code
       responseBody:
         text: "Service temporarily unavailable"  # response body text
status:
  conditions:
    - type: "Ready"
      status: "True"
      reason: "PolicyApplied"
  attachedIngresses: 3