# Console UI-API routes (PRD #571 Slice 3): the dbaas-ui frontend calls these
# prefixes on its dbaasUrl origin with an Auth0 Bearer id_token. Kong stays a
# pure passthrough (staging model: auth happens in the backend handlers via
# the account service), so no digest-auth here — these are separate from the
# OpenAPI emulation routes in route.yaml.
#
# Backend truth (staging-base dump 2026-07-05): /api/v1 + /api_proxy/billing
# -> account-central (serves full paths, own credentialed CORS);
# /api/v2025/cloud + /api/v2023/clusterManagement -> the same tidb-mgmt-portal
# pods that serve the OpenAPI surface (staging *-portal-ui Services are plain
# aliases); dataflow console resources -> dataflow-ng-http.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: premium-console-central
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /api/v1
            pathType: Prefix
            backend:
              service:
                name: account-central-http
                port:
                  number: 11000
          - path: /api_proxy/billing
            pathType: Prefix
            backend:
              service:
                name: account-central-http
                port:
                  number: 11000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: premium-console-portal
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /api/v2025/cloud
            pathType: Prefix
            backend:
              service:
                name: tidb-mgmt-portal
                port:
                  number: 8080
          - path: /api/v2023/clusterManagement
            pathType: Prefix
            backend:
              service:
                name: tidb-mgmt-portal
                port:
                  number: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: premium-console-serverless-org-scope
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management,console-plugin-default-project
    konghq.com/regex-priority: "300"
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /~/api/v2023/serverless/v1beta1/regions(:listCloudProviders)?$
            pathType: ImplementationSpecific
            backend:
              service:
                name: tidb-mgmt-portal-ui
                port:
                  number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: premium-console-dataflow
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management
    # Console dataflow resources live under the same /api/v1beta2 prefix as
    # the digest-auth OpenAPI route (staging separates the two surfaces by
    # host; cp9 has one host). The explicit regex-priority guarantees this
    # regex wins over that prefix route for console tidbs/<id> resources --
    # same precedent as the starter-openapi-serverless regex routes.
    konghq.com/regex-priority: "200"
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /~/api/v1beta2/tidbs/[0-9]+/
            pathType: ImplementationSpecific
            backend:
              service:
                name: dataflow-ng-http
                port:
                  number: 11000