apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: cp9-o11y-key-auth
  namespace: observability
  annotations:
    kubernetes.io/ingress.class: kong
plugin: key-auth
config:
  key_names:
    - x-cp9-o11y-token
    - Authorization
  hide_credentials: true
---
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: cp9-o11y
  namespace: observability
  annotations:
    kubernetes.io/ingress.class: kong
username: cp9-o11y
credentials:
  - cp9-o11y-kong-key
  - cp9-o11y-kong-bearer-key
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cp9-o11y-global-metadata
  namespace: observability
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /external
            pathType: Prefix
            backend:
              service:
                name: globalserver
                port:
                  number: 8080
---
# Starter's regional EKS mirrors staging's HTTPS Global Server client. The
# control-only Service avoids the /api/v1 path owned by the browser metadata
# Service; Kong strips only the session path and Global Server validates the
# ACS bearer token.
apiVersion: v1
kind: Service
metadata:
  name: cp9-o11y-global-control
  namespace: observability
spec:
  selector:
    app.kubernetes.io/name: globalserver
  ports:
    - name: http
      port: 8080
      targetPort: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cp9-o11y-global-control
  namespace: observability
  annotations:
    konghq.com/strip-path: "true"
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /o11y/control
            pathType: Prefix
            backend:
              service:
                name: cp9-o11y-global-control
                port:
                  number: 8080
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: cp9-o11y-metrics
  namespace: observability
  annotations:
    konghq.com/plugins: cp9-o11y-key-auth
    konghq.com/strip-path: "true"
spec:
  parentRefs:
    - name: kong
      namespace: kong-system
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /o11y/insert
      backendRefs:
        - name: o11y-metrics-insert
          port: 8480
    - matches:
        - path:
            type: PathPrefix
            value: /o11y/select
      backendRefs:
        - name: o11y-metrics-select
          port: 8481
---
# Released ACS sends no public credential on this path. The route is owned only
# by Regional Kong, reached through its dedicated internal NLB and exact-source
# host security-group rule; the public Kong has no private-write route.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: cp9-o11y-private-write-rewrite
  namespace: observability
  annotations:
    kubernetes.io/ingress.class: shared-regional-kong
plugin: request-transformer
config:
  replace:
    uri: /insert/multitenant/prometheus/api/v1/write
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: cp9-o11y-private-write
  namespace: observability
  annotations:
    konghq.com/plugins: cp9-o11y-private-write-rewrite
spec:
  parentRefs:
    - name: shared-regional-kong
      namespace: shared-regional-kong-system
  hostnames:
    - o11y.__CP9_PUBLIC_HOST__
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /multitenant/api/v1/write
      backendRefs:
        - name: vminsert-cp9-metrics
          port: 8480
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: cp9-o11y-dedicated-route
  namespace: observability
  annotations:
    kubernetes.io/ingress.class: shared-regional-kong
plugin: o11y-dedicated-route
---
# Public Metrics reads reuse the UI cookie-auth chain, then resolve the O11Y ID
# through Regional Server before reaching the matching VictoriaMetrics tenant.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: cp9-o11y-public-route
  namespace: observability
  annotations:
    kubernetes.io/ingress.class: kong
plugin: o11y-dedicated-route
config:
  router_service_url: http://globalserver.observability.svc.cluster.local:8080/internal/v1/routes
  tls_ca_path: /etc/cp9/gcp-regional-ca/ca.crt
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cp9-o11y-public-read
  namespace: observability
  annotations:
    konghq.com/plugins: openapi-plugin-force-https,console-plugin-cookie-filter,console-plugin-bearer-token-fallback,console-plugin-cookie-auth,console-plugin-console-header-management,cp9-o11y-public-route
    konghq.com/regex-priority: "400"
spec:
  ingressClassName: kong
  rules:
    - http:
        paths:
          - path: /~/[0-9a-fA-F-]{36}/metrics/api/v1/
            pathType: ImplementationSpecific
            backend:
              service:
                name: o11y-metrics-select
                port:
                  number: 8481
---
# Dedicated ACS writes to /<o11y-id>/api/v1/write. Resolve that O11Y ID
# through Regional Server, then route to the VictoriaMetrics account it owns.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: cp9-o11y-private-dedicated-write
  namespace: observability
  annotations:
    konghq.com/plugins: cp9-o11y-dedicated-route
spec:
  parentRefs:
    - name: shared-regional-kong
      namespace: shared-regional-kong-system
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: vminsert-cp9-metrics
          port: 8480