apiVersion: gateway.tsb.tetrate.io/v2
kind: IngressGateway
metadata:
  name: httpbin-gw-ingress
  group: httpbin-gw
  workspace: httpbin-ws
  tenant: tetrate
spec:
  workloadSelector:
    namespace: httpbin
    labels:
      app: tsb-gateway-httpbin
  http:
    - name: httpbin
      port: 8443
      hostname: "httpbin.tetrate.com"
      tls:
        mode: SIMPLE
        secretName: httpbin-certs
      authentication:
        jwt:
          issuer: https://keycloak.example.com/auth/realms/tetrate
          audiences:
          - tetrateapp
          jwks_uri: https://keycloak.example.com/auth/realms/tetrate/protocol/openid-connect/certs
      authorization:
        local:
          rules:
          - name: admin
            from:
            - jwt:
                iss: "https://keycloak.example.com/auth/realms/tetrate"
                sub: "*"
                other:
                  roles: admin
            to:
            - paths: ["*"]
          - name: normal
            from:
            - jwt:
                iss: "https://keycloak.example.com/auth/realms/tetrate"
                sub: "*"
                other:
                  roles: normal
            to:
            - paths: ["/status/*"]
              methods: ["GET"]
      routing:
        rules:
          - route:
              host: "httpbin/httpbin.httpbin.svc.cluster.local"
              port: 8000
