# ==============================================================
# Namespace
# ==============================================================
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring

# ===============================================================
# Envoy Config (HTTP/Protobuf on 4317, x-tenant-id 기반 동적 라우팅)
# - Downstream: HTTP/1.x 수신(4317)
# - Lua: x-tenant-id 검증 + x-otlp-upstream-host 헤더 구성
# - DFP: x-otlp-upstream-host 값을 :authority 로 사용해 동적 DNS/업스트림 연결
# - Upstream: HTTP/1.x
# - Envoy 1.31.0 호환 (use_tcp_for_dns_lookups 제거)
# ===============================================================
apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-router-envoy
  namespace: monitoring
data:
  envoy.yaml: |
    static_resources:
      listeners:
      - name: otlp_http_listener_4317
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 4317
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: hcm_http_4317
              codec_type: AUTO
              route_config:
                name: local_route
                virtual_hosts:
                - name: any
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/v1/"
                    route:
                      cluster: dynamic_forward_proxy_cluster
                      timeout: 15s
                    # Per-Route: DFP가 사용할 :authority 헤더 지정
                    typed_per_filter_config:
                      envoy.filters.http.dynamic_forward_proxy:
                        "@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig
                        host_rewrite_header: "x-otlp-upstream-host"

              http_filters:
              - name: envoy.filters.http.lua
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                  inline_code: |
                    -- /v1/* 만 허용하고, x-tenant-id 검증 + x-otlp-upstream-host 설정
                    function envoy_on_request(handle)
                      local path = handle:headers():get(":path") or ""
                      if not string.match(path, "^/v1/") then
                        handle:respond({[":status"]="404"}, "not found")
                        return
                      end

                      local tenant = handle:headers():get("x-tenant-id")
                      if tenant  nil then
                        handle:respond({[":status"]="400"}, "missing x-tenant-id")
                        return
                      end
                      if not string.match(tenant, "^[a-zA-Z0-9_-]+$") then
                        handle:respond({[":status"]="400"}, "invalid tenant id")
                        return
                      end

                      -- 업스트림 FQDN(:authority로 사용). 포트 포함.
                      local upstream = string.format("otelcol-%s.%s.svc.cluster.local:4317", tenant, tenant)
                      handle:headers():add("x-otlp-upstream-host", upstream)
                    end

              - name: envoy.filters.http.dynamic_forward_proxy
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig
                  dns_cache_config:
                    name: otlp_http_dns_cache_4317
                    dns_lookup_family: V4_ONLY
                    dns_refresh_rate: 5s
                    host_ttl: 300s
                    max_hosts: 1024
                    # CoreDNS 리졸버 고정 (ClusterIP 198.19.128.3)
                    dns_resolution_config:
                      resolvers:
                      - socket_address:
                          address: 198.19.128.3
                          port_value: 53

              - name: envoy.filters.http.router
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

              access_log:
              - name: envoy.access_loggers.stdout
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                  log_format:
                    text_format: "[%START_TIME%] %REQ(:method)% %REQ(:path)% x-tenant-id=%REQ(x-tenant-id)% x-otlp-upstream-host=%REQ(x-otlp-upstream-host)% upstream=%UPSTREAM_HOST% status=%RESPONSE_CODE% flags=%RESPONSE_FLAGS%\n"

      clusters:
      - name: dynamic_forward_proxy_cluster
        connect_timeout: 5s
        lb_policy: CLUSTER_PROVIDED
        cluster_type:
          name: envoy.clusters.dynamic_forward_proxy
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.clusters.dynamic_forward_proxy.v3.ClusterConfig
            # 아래 dns_cache_config 는 위(http 필터)의 설정과 바이트 단위로 동일해야 함
            dns_cache_config:
              name: otlp_http_dns_cache_4317
              dns_lookup_family: V4_ONLY
              dns_refresh_rate: 5s
              host_ttl: 300s
              max_hosts: 1024
              dns_resolution_config:
                resolvers:
                - socket_address:
                    address: 198.19.128.3
                    port_value: 53
            allow_insecure_cluster_options: true  # 평문 HTTP 업스트림 허용
        typed_extension_protocol_options:
          envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
            "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
            explicit_http_config:
              http_protocol_options: {}

# ===============================================================
# Envoy Deployment
# ===============================================================
apiVersion: apps/v1
kind: Deployment
metadata:
  name: otel-router
  namespace: monitoring
spec:
  replicas: 2
  selector:
    matchLabels:
      app: otel-router
  template:
    metadata:
      labels:
        app: otel-router
    spec:
      containers:
      - name: envoy
        image: envoyproxy/envoy:v1.31.0
        args: ["-c", "/etc/envoy/envoy.yaml", "--log-level", "info"]
        ports:
        - containerPort: 4317
          name: http-otlp
        volumeMounts:
        - name: envoy-config
          mountPath: /etc/envoy
        readinessProbe:
          tcpSocket:
            port: 4317
          initialDelaySeconds: 3
          periodSeconds: 5
        livenessProbe:
          tcpSocket:
            port: 4317
          initialDelaySeconds: 10
          periodSeconds: 10
        startupProbe:
          tcpSocket:
            port: 4317
          failureThreshold: 30
          periodSeconds: 2
      volumes:
      - name: envoy-config
        configMap:
          name: otel-router-envoy

# ===============================================================
# Envoy Service (ClusterIP) - Ingress가 이 서비스로 전달
# ===============================================================
apiVersion: v1
kind: Service
metadata:
  name: otel-router
  namespace: monitoring
spec:
  selector:
    app: otel-router
  ports:
  - name: http-otlp
    port: 4317
    targetPort: 4317
    protocol: TCP
  type: ClusterIP

# ===============================================================
# NetworkPolicy
#  - DNS (UDP/TCP 53): CoreDNS ClusterIP ipBlock 화이트리스트(198.19.128.3/32)
#  - 업스트림(Service 포트) 4317 허용 (monitoring 네임스페이스)
#  - Ingress-NGINX 로부터 4317 수신 허용
# ===============================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-otel-router-4317
  namespace: monitoring
spec:
  podSelector:
    matchLabels:
      app: otel-router
  policyTypes: ["Ingress","Egress"]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          ingress-allow: "true"                   # 환경에 맞게 조정
      podSelector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx   # 환경 라벨에 맞게 조정
    ports:
    - protocol: TCP
      port: 4317
  egress:
  - to:
    - ipBlock:
        cidr: 198.19.128.3/32                     # CoreDNS ClusterIP 고정
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - protocol: TCP
      port: 4317

# ===============================================================
# Ingress (nginx 클래스, 80/443에서 /v1/* → otel-router:4317로 전달)
# ===============================================================
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: otlp-http-external
  namespace: monitoring
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
    nginx.ingress.kubernetes.io/proxy-body-size: "32m"
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
spec:
  ingressClassName: nginx
  rules:
  - host: otel.monitoring.mesimsaas.com
    http:
      paths:
      - path: /v1/
        pathType: Prefix
        backend:
          service:
            name: otel-router
            port:
              number: 4317

# =
# tenant01 Collector Service (selector 기반, 자동 Endpoints)
# - Collector가 HTTP=4317 리스닝이면 targetPort=4317 유지
# - Collector가 HTTP=4318이면 targetPort=4318 로 변경 필요
# =
apiVersion: v1
kind: Service
metadata:
  name: otelcol-tenant01
  namespace: monitoring
spec:
  type: ClusterIP
  selector:
    app: otelcol-master
  ports:
  - name: http-otlp
    port: 4317
    targetPort: 4317