apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/configuration-snippet: 'more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains"; more_set_headers "X-Frame-Options: DENY"; more_set_headers "X-Content-Type-Options: nosniff"; more_set_headers "X-XSS-Protection: 1; mode=block";'
    nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, Authorization
    nginx.ingress.kubernetes.io/cors-allow-methods: GET, POST, PUT, DELETE, OPTIONS
    nginx.ingress.kubernetes.io/cors-allow-origin: https://control-center:8080
    nginx.ingress.kubernetes.io/enable-cors: 'true'
    nginx.ingress.kubernetes.io/limit-connections: '100'
    nginx.ingress.kubernetes.io/limit-rps: '1000'
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-ciphers: HIGH:!aNULL:!MD5
    nginx.ingress.kubernetes.io/ssl-protocols: TLSv1.2 TLSv1.3
  labels:
    app: platform
    component: provisioning-platform
  name: platform-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator
            port:
              number: 9090
        path: /orchestrator
        pathType: Prefix
  - host: control-center.example.com
    http:
      paths:
      - backend:
          service:
            name: control-center
            port:
              number: 8080
        path: /
        pathType: Prefix
  - host: mcp.example.com
    http:
      paths:
      - backend:
          service:
            name: mcp-server
            port:
              number: 8888
        path: /
        pathType: Prefix
  - host: orchestrator.example.com
    http:
      paths:
      - backend:
          service:
            name: orchestrator
            port:
              number: 9090
        path: /api
        pathType: Prefix
      - backend:
          service:
            name: control-center
            port:
              number: 8080
        path: /policy
        pathType: Prefix
  tls:
  - hosts:
    - orchestrator.example.com
    - control-center.example.com
    - mcp.example.com
    - api.example.com
    secretName: platform-tls-cert