Load Balancing Patterns

# AWS Application Load Balancer (ALB) - Layer 7 HTTP Load Balancing
#
# This example demonstrates:
# - ALB with HTTPS listener
# - Path-based routing to multiple target groups
# - Health checks with custom endpoints
# - Cookie-based sticky sessions
# - SSL/TLS termination
#
# Dependencies:
# - terraform >= 1.0
# - AWS provider configured
# - VPC and subnets created
# - ACM certificate for SSL

# Application Load Balancer
resource "aws_lb" "application" {
  name               = "app-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id

  enable_deletion_protection = true
  enable_http2              = true
  enable_cross_zone_load_balancing = true

  access_logs {
    bucket  = aws_s3_bucket.lb_logs.id
    prefix  = "alb"
    enabled = true
  }

  tags = {
    Name        = "app-alb"
    Environment = "production"
  }
}

# Target Group: Web Application
resource "aws_lb_target_group" "web" {
  name     = "web-targets"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id

  health_check {
    enabled             = true
    healthy_threshold   = 2
    unhealthy_threshold = 3
    timeout             = 5
    interval            = 30
    path                = "/health"
    matcher             = "200"
    protocol            = "HTTP"
  }

  deregistration_delay = 30

  stickiness {
    type            = "lb_cookie"
    cookie_duration = 86400  # 24 hours
    enabled         = true
  }

  tags = {
    Name = "web-targets"
  }
}

# Target Group: API
resource "aws_lb_target_group" "api" {
  name     = "api-targets"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id

  health_check {
    enabled             = true
    healthy_threshold   = 2
    unhealthy_threshold = 3
    timeout             = 5
    interval            = 15  # More frequent for API
    path                = "/api/health"
    matcher             = "200,204"
    protocol            = "HTTP"
  }

  deregistration_delay = 10  # Faster for stateless API

  # Slow start for gradual traffic ramp-up
  slow_start = 30

  tags = {
    Name = "api-targets"
  }
}

# HTTPS Listener (primary)
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.application.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn   = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web.arn
  }
}

# HTTP Listener (redirect to HTTPS)
resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.application.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

# Listener Rule: API path-based routing
resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 100

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api.arn
  }

  condition {
    path_pattern {
      values = ["/api/*"]
    }
  }
}

# Listener Rule: Admin host-based routing
resource "aws_lb_listener_rule" "admin" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 90

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.admin.arn
  }

  condition {
    host_header {
      values = ["admin.example.com"]
    }
  }
}

# Listener Rule: Header-based routing (API versioning)
resource "aws_lb_listener_rule" "api_v2" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 80

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api_v2.arn
  }

  condition {
    path_pattern {
      values = ["/api/*"]
    }
  }

  condition {
    http_header {
      http_header_name = "X-API-Version"
      values           = ["v2"]
    }
  }
}

# Security Group for ALB
resource "aws_security_group" "alb" {
  name        = "alb-sg"
  description = "Security group for Application Load Balancer"
  vpc_id      = aws_vpc.main.id

  ingress {
    description = "HTTPS from internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTP from internet (redirect to HTTPS)"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "Allow all outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "alb-sg"
  }
}

# Outputs
output "alb_dns_name" {
  description = "DNS name of the Application Load Balancer"
  value       = aws_lb.application.dns_name
}

output "alb_zone_id" {
  description = "Route 53 zone ID for ALB"
  value       = aws_lb.application.zone_id
}

output "alb_arn" {
  description = "ARN of the Application Load Balancer"
  value       = aws_lb.application.arn
}

# AWS Network Load Balancer (NLB) Configuration with Terraform
# This configuration demonstrates production-ready NLB setup with health checks and cross-zone load balancing

# Terraform and provider configuration
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Variables for configuration
variable "vpc_id" {
  description = "VPC ID where the NLB will be deployed"
  type        = string
}

variable "subnet_ids" {
  description = "List of subnet IDs for the NLB (must be in different AZs)"
  type        = list(string)
}

variable "environment" {
  description = "Environment name (e.g., production, staging)"
  type        = string
  default     = "production"
}

# Data source to get VPC information
data "aws_vpc" "main" {
  id = var.vpc_id
}

#---------------------------------------------------------------------
# Network Load Balancer
#---------------------------------------------------------------------
resource "aws_lb" "main" {
  name               = "${var.environment}-app-nlb"
  internal           = false  # Set to true for internal NLB
  load_balancer_type = "network"

  # Enable cross-zone load balancing for even distribution
  enable_cross_zone_load_balancing = true

  # Enable deletion protection for production
  enable_deletion_protection = var.environment == "production" ? true : false

  # Subnet mappings (must span multiple AZs for high availability)
  # NLB requires at least 2 subnets in different availability zones
  dynamic "subnet_mapping" {
    for_each = var.subnet_ids
    content {
      subnet_id = subnet_mapping.value
      # Optional: Assign static IP per AZ
      # allocation_id = aws_eip.nlb[subnet_mapping.key].id
    }
  }

  # Enable access logs to S3 (optional but recommended)
  # access_logs {
  #   bucket  = aws_s3_bucket.nlb_logs.id
  #   prefix  = "nlb"
  #   enabled = true
  # }

  tags = {
    Name        = "${var.environment}-app-nlb"
    Environment = var.environment
    ManagedBy   = "Terraform"
    Service     = "LoadBalancing"
  }
}

#---------------------------------------------------------------------
# Target Group: TCP (for general TCP traffic)
#---------------------------------------------------------------------
resource "aws_lb_target_group" "tcp" {
  name     = "${var.environment}-tcp-tg"
  port     = 8080
  protocol = "TCP"
  vpc_id   = var.vpc_id

  # Target type: instance | ip | alb | lambda
  target_type = "instance"

  # Deregistration delay (time to drain connections)
  deregistration_delay = 30

  # Health check configuration
  health_check {
    enabled             = true
    interval            = 30              # Check every 30 seconds
    port                = "traffic-port"  # Use same port as target
    protocol            = "TCP"           # TCP health check
    healthy_threshold   = 3               # 3 successful checks = healthy
    unhealthy_threshold = 3               # 3 failed checks = unhealthy
  }

  # Connection termination on deregistration
  connection_termination = true

  # Preserve client IP address
  preserve_client_ip = true

  tags = {
    Name        = "${var.environment}-tcp-target-group"
    Environment = var.environment
    Protocol    = "TCP"
  }
}

#---------------------------------------------------------------------
# Target Group: TLS (for encrypted TCP traffic)
#---------------------------------------------------------------------
resource "aws_lb_target_group" "tls" {
  name     = "${var.environment}-tls-tg"
  port     = 443
  protocol = "TLS"
  vpc_id   = var.vpc_id

  target_type = "instance"

  # TLS-specific settings
  # Proxy protocol v2 adds connection information to the TCP stream
  proxy_protocol_v2 = false

  health_check {
    enabled             = true
    interval            = 30
    port                = 443
    protocol            = "TCP"  # Can also use "HTTPS" for application-layer health checks
    healthy_threshold   = 3
    unhealthy_threshold = 3

    # Optional: HTTP/HTTPS health check parameters
    # protocol = "HTTPS"
    # path     = "/health"
    # matcher  = "200-299"
  }

  tags = {
    Name        = "${var.environment}-tls-target-group"
    Environment = var.environment
    Protocol    = "TLS"
  }
}

#---------------------------------------------------------------------
# Target Group: UDP (for UDP traffic like DNS, QUIC)
#---------------------------------------------------------------------
resource "aws_lb_target_group" "udp" {
  name     = "${var.environment}-udp-tg"
  port     = 53
  protocol = "UDP"
  vpc_id   = var.vpc_id

  target_type = "instance"

  health_check {
    enabled             = true
    interval            = 30
    port                = 53
    protocol            = "TCP"  # UDP health checks use TCP or HTTP(S)
    healthy_threshold   = 3
    unhealthy_threshold = 3
  }

  tags = {
    Name        = "${var.environment}-udp-target-group"
    Environment = var.environment
    Protocol    = "UDP"
  }
}

#---------------------------------------------------------------------
# Listener: TCP on port 80
#---------------------------------------------------------------------
resource "aws_lb_listener" "tcp" {
  load_balancer_arn = aws_lb.main.arn
  port              = 80
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.tcp.arn
  }

  tags = {
    Name = "${var.environment}-tcp-listener"
  }
}

#---------------------------------------------------------------------
# Listener: TLS on port 443 with certificate
#---------------------------------------------------------------------
resource "aws_lb_listener" "tls" {
  load_balancer_arn = aws_lb.main.arn
  port              = 443
  protocol          = "TLS"
  certificate_arn   = aws_acm_certificate.main.arn

  # TLS security policy
  # Options: ELBSecurityPolicy-TLS13-1-2-2021-06, ELBSecurityPolicy-TLS-1-2-2017-01, etc.
  ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"

  # ALPN policy for HTTP/2, HTTP/1.1
  alpn_policy = "HTTP2Preferred"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.tls.arn
  }

  tags = {
    Name = "${var.environment}-tls-listener"
  }
}

#---------------------------------------------------------------------
# Listener: UDP on port 53 (DNS example)
#---------------------------------------------------------------------
resource "aws_lb_listener" "udp" {
  load_balancer_arn = aws_lb.main.arn
  port              = 53
  protocol          = "UDP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.udp.arn
  }

  tags = {
    Name = "${var.environment}-udp-listener"
  }
}

#---------------------------------------------------------------------
# Target Group Attachments (register EC2 instances)
#---------------------------------------------------------------------
# Example: Attach existing EC2 instances to target groups
# You would typically use auto-scaling groups instead

resource "aws_lb_target_group_attachment" "tcp_instance_1" {
  target_group_arn = aws_lb_target_group.tcp.arn
  target_id        = aws_instance.app_server_1.id
  port             = 8080
}

resource "aws_lb_target_group_attachment" "tcp_instance_2" {
  target_group_arn = aws_lb_target_group.tcp.arn
  target_id        = aws_instance.app_server_2.id
  port             = 8080
}

resource "aws_lb_target_group_attachment" "tls_instance_1" {
  target_group_arn = aws_lb_target_group.tls.arn
  target_id        = aws_instance.app_server_1.id
  port             = 443
}

resource "aws_lb_target_group_attachment" "tls_instance_2" {
  target_group_arn = aws_lb_target_group.tls.arn
  target_id        = aws_instance.app_server_2.id
  port             = 443
}

#---------------------------------------------------------------------
# ACM Certificate (for TLS listener)
#---------------------------------------------------------------------
resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  validation_method = "DNS"

  subject_alternative_names = [
    "*.example.com",
  ]

  lifecycle {
    create_before_destroy = true
  }

  tags = {
    Name        = "${var.environment}-certificate"
    Environment = var.environment
  }
}

#---------------------------------------------------------------------
# Security Group for NLB targets (EC2 instances)
#---------------------------------------------------------------------
resource "aws_security_group" "nlb_targets" {
  name        = "${var.environment}-nlb-targets-sg"
  description = "Security group for NLB target instances"
  vpc_id      = var.vpc_id

  # Allow TCP traffic on port 8080 from anywhere
  ingress {
    description = "HTTP from NLB"
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Allow TLS traffic on port 443
  ingress {
    description = "HTTPS from NLB"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Allow UDP traffic on port 53
  ingress {
    description = "DNS from NLB"
    from_port   = 53
    to_port     = 53
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Allow all outbound traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name        = "${var.environment}-nlb-targets-sg"
    Environment = var.environment
  }
}

#---------------------------------------------------------------------
# Example EC2 Instances (target servers)
#---------------------------------------------------------------------
# These are placeholder instances - in production, use Auto Scaling Groups

data "aws_ami" "amazon_linux_2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

resource "aws_instance" "app_server_1" {
  ami           = data.aws_ami.amazon_linux_2.id
  instance_type = "t3.medium"
  subnet_id     = var.subnet_ids[0]

  vpc_security_group_ids = [aws_security_group.nlb_targets.id]

  user_data = <<-EOF
              #!/bin/bash
              yum update -y
              yum install -y httpd
              systemctl start httpd
              systemctl enable httpd
              echo "Server 1" > /var/www/html/index.html
              EOF

  tags = {
    Name        = "${var.environment}-app-server-1"
    Environment = var.environment
  }
}

resource "aws_instance" "app_server_2" {
  ami           = data.aws_ami.amazon_linux_2.id
  instance_type = "t3.medium"
  subnet_id     = var.subnet_ids[1]

  vpc_security_group_ids = [aws_security_group.nlb_targets.id]

  user_data = <<-EOF
              #!/bin/bash
              yum update -y
              yum install -y httpd
              systemctl start httpd
              systemctl enable httpd
              echo "Server 2" > /var/www/html/index.html
              EOF

  tags = {
    Name        = "${var.environment}-app-server-2"
    Environment = var.environment
  }
}

#---------------------------------------------------------------------
# Outputs
#---------------------------------------------------------------------
output "nlb_dns_name" {
  description = "DNS name of the Network Load Balancer"
  value       = aws_lb.main.dns_name
}

output "nlb_arn" {
  description = "ARN of the Network Load Balancer"
  value       = aws_lb.main.arn
}

output "nlb_zone_id" {
  description = "Zone ID of the Network Load Balancer"
  value       = aws_lb.main.zone_id
}

output "tcp_target_group_arn" {
  description = "ARN of the TCP target group"
  value       = aws_lb_target_group.tcp.arn
}

output "tls_target_group_arn" {
  description = "ARN of the TLS target group"
  value       = aws_lb_target_group.tls.arn
}

output "udp_target_group_arn" {
  description = "ARN of the UDP target group"
  value       = aws_lb_target_group.udp.arn
}

# Envoy Proxy Load Balancer Configuration
# This configuration demonstrates core load balancing patterns with health checking and circuit breaking

static_resources:
  listeners:
  # HTTP listener on port 8080
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      # HTTP Connection Manager - handles HTTP/1.1 and HTTP/2
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: backend
              domains: ["*"]
              routes:
              # Route all traffic to the service cluster
              - match:
                  prefix: "/"
                route:
                  cluster: service_cluster
                  # Timeout for the entire request (including retries)
                  timeout: 15s
                  # Retry policy for transient failures
                  retry_policy:
                    retry_on: "5xx,reset,connect-failure,refused-stream"
                    num_retries: 3
                    per_try_timeout: 5s
          http_filters:
          # Router filter - required for routing
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
  # Backend service cluster with multiple endpoints
  - name: service_cluster
    type: STRICT_DNS
    # DNS refresh rate
    dns_lookup_family: V4_ONLY

    # Load balancing policy: ROUND_ROBIN
    # Alternatives: LEAST_REQUEST, RANDOM, RING_HASH, MAGLEV
    lb_policy: ROUND_ROBIN

    # Least Request LB settings (uncomment to use)
    # lb_policy: LEAST_REQUEST
    # least_request_lb_config:
    #   choice_count: 2  # P2C (Power of Two Choices)

    # Connection pool settings
    circuit_breakers:
      thresholds:
      - priority: DEFAULT
        # Maximum connections to all hosts in the cluster
        max_connections: 1000
        # Maximum pending requests (queued when all connections are in use)
        max_pending_requests: 1000
        # Maximum concurrent requests
        max_requests: 1000
        # Maximum active retries
        max_retries: 3

    # Outlier detection (circuit breaking based on consecutive failures)
    outlier_detection:
      # Number of consecutive 5xx errors before ejection
      consecutive_5xx: 5
      # Time interval for checking ejection
      interval: 10s
      # Minimum percentage of hosts that must be ejected
      base_ejection_time: 30s
      # Maximum percentage of hosts that can be ejected
      max_ejection_percent: 50
      # Number of consecutive gateway failures before ejection
      consecutive_gateway_failure: 5
      # Success rate-based outlier detection
      enforcing_consecutive_5xx: 100
      enforcing_consecutive_gateway_failure: 100

    # Health check configuration
    health_checks:
    - timeout: 1s
      interval: 5s
      # Number of healthy checks before marking healthy
      healthy_threshold: 2
      # Number of unhealthy checks before marking unhealthy
      unhealthy_threshold: 3
      http_health_check:
        path: "/health"
        # Expected HTTP status codes for healthy response
        expected_statuses:
        - start: 200
          end: 299

    # Upstream connection settings
    connect_timeout: 5s

    # Backend endpoints (servers)
    load_assignment:
      cluster_name: service_cluster
      endpoints:
      # Locality-aware endpoint group (zone A)
      - lb_endpoints:
        # Backend server 1
        - endpoint:
            address:
              socket_address:
                address: backend-1.example.com
                port_value: 8000
            health_check_config:
              port_value: 8000
          # Optional: per-endpoint load balancing weight
          load_balancing_weight: 1

        # Backend server 2
        - endpoint:
            address:
              socket_address:
                address: backend-2.example.com
                port_value: 8000
            health_check_config:
              port_value: 8000
          load_balancing_weight: 1

        # Backend server 3
        - endpoint:
            address:
              socket_address:
                address: backend-3.example.com
                port_value: 8000
            health_check_config:
              port_value: 8000
          load_balancing_weight: 2  # This server gets 2x traffic

        # Locality information for zone-aware routing
        locality:
          zone: "us-east-1a"

# Admin interface for monitoring and management
admin:
  address:
    socket_address:
      address: 127.0.0.1
      port_value: 9901

# HAProxy HTTP Load Balancer Configuration
# Version: 2.8+
# This configuration demonstrates production-ready HTTP/HTTPS load balancing with health checks

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    # Logging configuration
    log /dev/log local0
    log /dev/log local1 notice

    # Process management
    chroot /var/lib/haproxy
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

    # Default SSL/TLS settings
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

    # Performance tuning
    tune.ssl.default-dh-param 2048
    maxconn 4096

#---------------------------------------------------------------------
# Default settings for all proxies
#---------------------------------------------------------------------
defaults
    log     global
    mode    http
    option  httplog
    option  dontlognull
    option  http-server-close
    option  forwardfor except 127.0.0.0/8
    option  redispatch

    # Timeouts
    timeout connect 5s
    timeout client  50s
    timeout server  50s

    # Error handling
    retries 3
    errorfile 400 /etc/haproxy/errors/400.http
    errorfile 403 /etc/haproxy/errors/403.http
    errorfile 408 /etc/haproxy/errors/408.http
    errorfile 500 /etc/haproxy/errors/500.http
    errorfile 502 /etc/haproxy/errors/502.http
    errorfile 503 /etc/haproxy/errors/503.http
    errorfile 504 /etc/haproxy/errors/504.http

#---------------------------------------------------------------------
# Statistics page (password: changeme)
#---------------------------------------------------------------------
listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 30s
    stats auth admin:changeme
    stats admin if TRUE

#---------------------------------------------------------------------
# Frontend: HTTP traffic (port 80)
#---------------------------------------------------------------------
frontend http_front
    bind *:80

    # ACL rules for request routing
    # Match requests with /api prefix
    acl is_api path_beg /api
    # Match requests for specific host
    acl is_admin_host hdr(host) -i admin.example.com
    # Match requests based on source IP
    acl is_internal_ip src 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

    # Routing decisions based on ACLs
    use_backend api_backend if is_api
    use_backend admin_backend if is_admin_host
    use_backend internal_backend if is_internal_ip

    # Default backend
    default_backend web_backend

    # Security headers
    http-response set-header X-Frame-Options SAMEORIGIN
    http-response set-header X-Content-Type-Options nosniff
    http-response set-header X-XSS-Protection "1; mode=block"

#---------------------------------------------------------------------
# Frontend: HTTPS traffic (port 443)
#---------------------------------------------------------------------
frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem alpn h2,http/1.1

    # Redirect HTTP to HTTPS
    http-request redirect scheme https unless { ssl_fc }

    # ACL rules (same as HTTP frontend)
    acl is_api path_beg /api
    acl is_admin_host hdr(host) -i admin.example.com
    acl is_internal_ip src 10.0.0.0/8

    # Routing
    use_backend api_backend if is_api
    use_backend admin_backend if is_admin_host
    use_backend internal_backend if is_internal_ip
    default_backend web_backend

    # HSTS header (6 months)
    http-response set-header Strict-Transport-Security "max-age=15768000; includeSubDomains"

#---------------------------------------------------------------------
# Backend: Web servers (round-robin with session persistence)
#---------------------------------------------------------------------
backend web_backend
    # Load balancing algorithm: round-robin
    # Alternatives: leastconn, source, uri, random
    balance roundrobin

    # Session persistence using cookies
    cookie SERVERID insert indirect nocache httponly secure

    # Health check: HTTP GET to /health
    option httpchk GET /health HTTP/1.1\r\nHost:\ www.example.com
    http-check expect status 200

    # Server definitions
    # server <name> <address>:<port> [options]
    server web1 10.0.1.10:8080 check cookie web1 weight 100 maxconn 500
    server web2 10.0.1.11:8080 check cookie web2 weight 100 maxconn 500
    server web3 10.0.1.12:8080 check cookie web3 weight 100 maxconn 500
    # Backup server (only used when all others are down)
    server web4 10.0.1.13:8080 check backup

#---------------------------------------------------------------------
# Backend: API servers (least connections)
#---------------------------------------------------------------------
backend api_backend
    # Use least connections algorithm for API traffic
    balance leastconn

    # Stick table for rate limiting (per source IP)
    stick-table type ip size 100k expire 30s store conn_rate(10s)
    # Track connection rate
    tcp-request connection track-sc0 src
    # Deny if more than 100 connections in 10 seconds
    tcp-request connection reject if { sc_conn_rate(0) gt 100 }

    # Health check: TCP check with HTTP validation
    option httpchk GET /api/health HTTP/1.1\r\nHost:\ api.example.com
    http-check expect string "healthy"

    # Compression for API responses
    compression algo gzip
    compression type application/json text/plain text/html

    # Server definitions with inter-check intervals
    server api1 10.0.2.10:8080 check inter 2000 rise 2 fall 3
    server api2 10.0.2.11:8080 check inter 2000 rise 2 fall 3
    server api3 10.0.2.12:8080 check inter 2000 rise 2 fall 3
    server api4 10.0.2.13:8080 check inter 2000 rise 2 fall 3

#---------------------------------------------------------------------
# Backend: Admin servers (source IP hash for session persistence)
#---------------------------------------------------------------------
backend admin_backend
    # Source IP hash - same client always goes to same server
    balance source

    # TCP health check on port 8080
    option tcp-check
    tcp-check connect port 8080

    # Longer timeout for admin operations
    timeout server 120s

    # Server definitions
    server admin1 10.0.3.10:8080 check
    server admin2 10.0.3.11:8080 check

#---------------------------------------------------------------------
# Backend: Internal services (URI hash for cache efficiency)
#---------------------------------------------------------------------
backend internal_backend
    # URI hash - same URI always goes to same server (cache locality)
    balance uri

    # Health check: HTTP with custom header
    option httpchk GET /internal/health HTTP/1.1\r\nHost:\ internal.example.com\r\nX-Health-Check:\ true
    http-check expect status 200-299

    # Server definitions with weight adjustment
    server internal1 10.0.4.10:8080 check weight 50
    server internal2 10.0.4.11:8080 check weight 100
    server internal3 10.0.4.12:8080 check weight 150

#---------------------------------------------------------------------
# Additional backend examples
#---------------------------------------------------------------------

# Backend with custom health check intervals
backend custom_health_backend
    balance roundrobin

    # Custom health check parameters:
    # inter: interval between checks (default: 2000ms)
    # rise: number of successful checks before marking server up (default: 2)
    # fall: number of failed checks before marking server down (default: 3)
    # downinter: interval when server is down (faster detection)
    server srv1 10.0.5.10:8080 check inter 5000 rise 2 fall 3 downinter 1000
    server srv2 10.0.5.11:8080 check inter 5000 rise 2 fall 3 downinter 1000

# Backend with connection limits and queuing
backend limited_backend
    balance roundrobin

    # Global backend connection limit
    fullconn 1000

    # Server with maxconn and maxqueue limits
    server lim1 10.0.6.10:8080 check maxconn 250 maxqueue 50
    server lim2 10.0.6.11:8080 check maxconn 250 maxqueue 50

# Kubernetes Gateway API Configuration
# Gateway API is the successor to Ingress, providing more expressive traffic routing
# Requires Gateway API CRDs installed: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml

---
# GatewayClass: Defines the controller implementation
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: traefik-gateway-class
spec:
  controllerName: traefik.io/gateway-controller
  description: "Traefik-based Gateway implementation"

---
# Gateway: Entry point for traffic (replaces LoadBalancer/NodePort services)
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: production-gateway
  namespace: default
  labels:
    environment: production
spec:
  gatewayClassName: traefik-gateway-class

  # Listeners define the ports and protocols
  listeners:
    # HTTP listener (port 80)
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All  # Allow routes from all namespaces

    # HTTPS listener (port 443)
    - name: https
      protocol: HTTPS
      port: 443
      allowedRoutes:
        namespaces:
          from: All
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: example-com-tls
            namespace: default

    # Additional HTTPS listener with SNI
    - name: https-api
      protocol: HTTPS
      port: 443
      hostname: api.example.com
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: api-example-com-tls

---
# HTTPRoute: Main application routing with load balancing
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-route
  namespace: default
  labels:
    app: web-application
spec:
  # Attach to the Gateway
  parentRefs:
    - name: production-gateway
      namespace: default
      sectionName: https

  # Hostname matching
  hostnames:
    - "example.com"
    - "www.example.com"

  # Routing rules
  rules:
    # Rule 1: Homepage with round-robin load balancing
    - matches:
        - path:
            type: PathPrefix
            value: /
          headers:
            - name: X-Version
              value: stable
      backendRefs:
        # Multiple backends for load balancing
        - name: web-frontend-v1
          port: 80
          weight: 100  # All traffic to v1
      filters:
        # Add response header
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            add:
              - name: X-Backend-Version
                value: v1

    # Rule 2: API path with weighted traffic splitting (canary)
    - matches:
        - path:
            type: PathPrefix
            value: /api
      backendRefs:
        # Weighted load balancing: 90% to v1, 10% to v2
        - name: api-backend-v1
          port: 8080
          weight: 90
        - name: api-backend-v2
          port: 8080
          weight: 10
      filters:
        # Strip /api prefix before forwarding
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /

    # Rule 3: Static content with header-based routing
    - matches:
        - path:
            type: PathPrefix
            value: /static
          headers:
            - name: X-Cache-Control
              type: Exact
              value: no-cache
      backendRefs:
        - name: static-backend-nocache
          port: 80
          weight: 100

    # Rule 4: Exact path match for health check
    - matches:
        - path:
            type: Exact
            value: /health
      backendRefs:
        - name: health-check-backend
          port: 8080

---
# HTTPRoute: API subdomain with advanced routing
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
  namespace: default
spec:
  parentRefs:
    - name: production-gateway
      sectionName: https-api

  hostnames:
    - "api.example.com"

  rules:
    # Rule 1: Versioned API routing (v1)
    - matches:
        - path:
            type: PathPrefix
            value: /v1
      backendRefs:
        - name: api-backend-v1
          port: 8080
      filters:
        # Add API version header
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: X-API-Version
                value: "1"
            remove:
              - Authorization  # Example: remove sensitive headers

    # Rule 2: Versioned API routing (v2)
    - matches:
        - path:
            type: PathPrefix
            value: /v2
      backendRefs:
        - name: api-backend-v2
          port: 8080
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: X-API-Version
                value: "2"

    # Rule 3: Query parameter-based routing
    - matches:
        - path:
            type: PathPrefix
            value: /search
          queryParams:
            - name: beta
              value: "true"
      backendRefs:
        - name: api-backend-v2-beta
          port: 8080

    # Rule 4: Default route (no version specified)
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: api-backend-v1
          port: 8080
          weight: 80
        - name: api-backend-v2
          port: 8080
          weight: 20

---
# HTTPRoute: Traffic mirroring for testing
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: mirrored-route
  namespace: default
spec:
  parentRefs:
    - name: production-gateway

  hostnames:
    - "test.example.com"

  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        # Primary backend
        - name: api-backend-v1
          port: 8080
          weight: 100
        # Mirror backend (responses ignored)
        - name: api-backend-v2
          port: 8080
          weight: 0  # Weight 0 means mirror only
      filters:
        - type: RequestMirror
          requestMirror:
            backendRef:
              name: api-backend-v2
              port: 8080

---
# HTTPRoute: Redirect rules
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: redirect-route
  namespace: default
spec:
  parentRefs:
    - name: production-gateway
      sectionName: http  # HTTP listener

  hostnames:
    - "example.com"

  rules:
    # Redirect HTTP to HTTPS
    - matches:
        - path:
            type: PathPrefix
            value: /
      filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301

---
# HTTPRoute: Header-based routing for A/B testing
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ab-test-route
  namespace: default
spec:
  parentRefs:
    - name: production-gateway

  hostnames:
    - "app.example.com"

  rules:
    # Rule 1: Beta users (based on cookie)
    - matches:
        - path:
            type: PathPrefix
            value: /
          headers:
            - name: Cookie
              type: RegularExpression
              value: ".*beta=true.*"
      backendRefs:
        - name: app-backend-beta
          port: 80

    # Rule 2: Premium users (based on header)
    - matches:
        - path:
            type: PathPrefix
            value: /
          headers:
            - name: X-User-Tier
              value: premium
      backendRefs:
        - name: app-backend-premium
          port: 80

    # Rule 3: Default users
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: app-backend-standard
          port: 80

---
# HTTPRoute: Method-based routing
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: method-route
  namespace: default
spec:
  parentRefs:
    - name: production-gateway

  hostnames:
    - "api.example.com"

  rules:
    # Route GET requests to read-only backend
    - matches:
        - path:
            type: PathPrefix
            value: /data
          method: GET
      backendRefs:
        - name: api-backend-readonly
          port: 8080

    # Route POST/PUT/DELETE to read-write backend
    - matches:
        - path:
            type: PathPrefix
            value: /data
          method: POST
      backendRefs:
        - name: api-backend-readwrite
          port: 8080

    - matches:
        - path:
            type: PathPrefix
            value: /data
          method: PUT
      backendRefs:
        - name: api-backend-readwrite
          port: 8080

    - matches:
        - path:
            type: PathPrefix
            value: /data
          method: DELETE
      backendRefs:
        - name: api-backend-readwrite
          port: 8080

---
# ReferenceGrant: Allow cross-namespace references
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-gateway-to-backend
  namespace: backend-namespace
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: default
  to:
    - group: ""
      kind: Service

---
# Backend Services (Kubernetes Services)
---
apiVersion: v1
kind: Service
metadata:
  name: web-frontend-v1
  namespace: default
spec:
  selector:
    app: web-frontend
    version: v1
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v1
  namespace: default
spec:
  selector:
    app: api-backend
    version: v1
  ports:
    - port: 8080
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v2
  namespace: default
spec:
  selector:
    app: api-backend
    version: v2
  ports:
    - port: 8080
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v2-beta
  namespace: default
spec:
  selector:
    app: api-backend
    version: v2-beta
  ports:
    - port: 8080
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: static-backend-nocache
  namespace: default
spec:
  selector:
    app: static-assets
    cache: disabled
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: health-check-backend
  namespace: default
spec:
  selector:
    app: health-check
  ports:
    - port: 8080
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: app-backend-beta
  namespace: default
spec:
  selector:
    app: web-app
    version: beta
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: app-backend-premium
  namespace: default
spec:
  selector:
    app: web-app
    tier: premium
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: app-backend-standard
  namespace: default
spec:
  selector:
    app: web-app
    tier: standard
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: api-backend-readonly
  namespace: default
spec:
  selector:
    app: api-backend
    mode: readonly
  ports:
    - port: 8080
      targetPort: 8080

---
apiVersion: v1
kind: Service
metadata:
  name: api-backend-readwrite
  namespace: default
spec:
  selector:
    app: api-backend
    mode: readwrite
  ports:
    - port: 8080
      targetPort: 8080

---
# TLS Secret for HTTPS
apiVersion: v1
kind: Secret
metadata:
  name: example-com-tls
  namespace: default
type: kubernetes.io/tls
data:
  tls.crt: LS0tLS1CRUdJTi...  # Base64 encoded certificate
  tls.key: LS0tLS1CRUdJTi...  # Base64 encoded private key

---
apiVersion: v1
kind: Secret
metadata:
  name: api-example-com-tls
  namespace: default
type: kubernetes.io/tls
data:
  tls.crt: LS0tLS1CRUdJTi...
  tls.key: LS0tLS1CRUdJTi...

# Kubernetes NGINX Ingress Controller Example
#
# This example demonstrates:
# - Basic Ingress resource with path-based routing
# - TLS/SSL termination
# - Sticky sessions (cookie-based affinity)
# - Custom annotations for NGINX configuration
# - Multiple services with different routing rules
#
# Prerequisites:
# - Kubernetes cluster
# - NGINX Ingress Controller installed
# - cert-manager for TLS certificate management (optional)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: default
  annotations:
    # Use NGINX Ingress Controller
    kubernetes.io/ingress.class: nginx

    # SSL redirect
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

    # Rewrite target (strip path prefix)
    # nginx.ingress.kubernetes.io/rewrite-target: /

    # CORS configuration
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://example.com"

    # Rate limiting
    nginx.ingress.kubernetes.io/limit-rps: "100"
    nginx.ingress.kubernetes.io/limit-burst-multiplier: "5"

    # Timeouts
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "5"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"

    # Body size limit
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"

    # Session affinity (sticky sessions)
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/affinity-mode: "persistent"
    nginx.ingress.kubernetes.io/session-cookie-name: "app_session"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
    nginx.ingress.kubernetes.io/session-cookie-path: "/"
    nginx.ingress.kubernetes.io/session-cookie-samesite: "Strict"

    # Load balancing algorithm
    nginx.ingress.kubernetes.io/load-balance: "least_conn"

    # cert-manager certificate
    cert-manager.io/cluster-issuer: "letsencrypt-prod"

spec:
  ingressClassName: nginx

  # TLS configuration
  tls:
  - hosts:
    - app.example.com
    - api.example.com
    secretName: app-tls-cert

  # Routing rules
  rules:
  # Main application domain
  - host: app.example.com
    http:
      paths:
      # API routes
      - path: /api/v1
        pathType: Prefix
        backend:
          service:
            name: api-service-v1
            port:
              number: 80

      - path: /api/v2
        pathType: Prefix
        backend:
          service:
            name: api-service-v2
            port:
              number: 80

      # Static assets
      - path: /static
        pathType: Prefix
        backend:
          service:
            name: static-service
            port:
              number: 80

      # WebSocket endpoint
      - path: /ws
        pathType: Prefix
        backend:
          service:
            name: websocket-service
            port:
              number: 8080

      # Default: Web application
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

  # API subdomain
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service-v1
            port:
              number: 80

---
# Service: Web Application
apiVersion: v1
kind: Service
metadata:
  name: web-service
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http

---
# Service: API v1
apiVersion: v1
kind: Service
metadata:
  name: api-service-v1
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: api
    version: v1
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http

---
# Deployment: Web Application (with health checks)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-deployment
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: web
        image: myapp/web:latest
        ports:
        - containerPort: 8080
          name: http

        # Liveness probe
        livenessProbe:
          httpGet:
            path: /health/live
            port: 8080
            httpHeaders:
            - name: X-Health-Check
              value: kubernetes
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

        # Readiness probe
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3

        # Startup probe (for slow-starting apps)
        startupProbe:
          httpGet:
            path: /health/startup
            port: 8080
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 30  # Allow up to 5 minutes for startup

        # Resource limits
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        # Environment variables
        env:
        - name: PORT
          value: "8080"
        - name: LOG_LEVEL
          value: "info"

---
# Alternative: Ingress with multiple services and weighted routing
# (Requires NGINX Ingress Controller with canary support)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress-canary
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-weight: "10"  # 10% traffic to canary
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service-canary
            port:
              number: 80

# Traefik IngressRoute Configuration for Kubernetes
# Demonstrates advanced load balancing with Traefik CRDs including middleware and traffic management

---
# IngressRoute: HTTP to HTTPS redirect
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: http-redirect
  namespace: default
  labels:
    app: web-application
    component: ingress
spec:
  entryPoints:
    - web  # HTTP entry point (port 80)
  routes:
    # Catch-all route to redirect HTTP to HTTPS
    - match: HostRegexp(`{host:.+}`)
      kind: Rule
      services:
        - name: noop@internal
          kind: TraefikService
      middlewares:
        - name: redirect-to-https

---
# IngressRoute: Main HTTPS traffic with load balancing
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: web-app-https
  namespace: default
  labels:
    app: web-application
    component: ingress
  annotations:
    # Optional: External DNS annotation
    external-dns.alpha.kubernetes.io/hostname: example.com
spec:
  entryPoints:
    - websecure  # HTTPS entry point (port 443)

  routes:
    # Route 1: Homepage and static content
    - match: Host(`example.com`) && PathPrefix(`/`)
      kind: Rule
      services:
        # Primary backend service
        - name: web-frontend
          port: 80
          weight: 10  # Traffic weight for load distribution
          # Health check configuration
          healthCheck:
            path: /health
            intervalSeconds: 10
            timeoutSeconds: 3
          # Load balancing strategy: wrr (Weighted Round Robin)
          strategy: RoundRobin
      middlewares:
        - name: security-headers
        - name: compression
        - name: rate-limit

    # Route 2: API traffic with different middleware
    - match: Host(`example.com`) && PathPrefix(`/api`)
      kind: Rule
      priority: 100  # Higher priority routes are evaluated first
      services:
        # Multiple backends for API with weighted load balancing
        - name: api-backend-v1
          port: 8080
          weight: 80  # 80% of traffic
        - name: api-backend-v2
          port: 8080
          weight: 20  # 20% of traffic (canary deployment)
      middlewares:
        - name: api-auth
        - name: api-rate-limit
        - name: cors-headers
        - name: strip-api-prefix

    # Route 3: WebSocket traffic
    - match: Host(`example.com`) && PathPrefix(`/ws`)
      kind: Rule
      services:
        - name: websocket-backend
          port: 8080
      middlewares:
        - name: websocket-headers

  # TLS configuration
  tls:
    secretName: example-com-tls
    # Optional: TLS options reference
    options:
      name: default

---
# IngressRoute: Multiple host routing
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: multi-host-routing
  namespace: default
spec:
  entryPoints:
    - websecure
  routes:
    # Admin subdomain
    - match: Host(`admin.example.com`)
      kind: Rule
      services:
        - name: admin-backend
          port: 80
      middlewares:
        - name: admin-auth
        - name: ip-whitelist

    # API subdomain
    - match: Host(`api.example.com`)
      kind: Rule
      services:
        - name: api-backend-v1
          port: 8080
      middlewares:
        - name: api-rate-limit

  tls:
    secretName: wildcard-example-com-tls

---
# Middleware: HTTPS redirect
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-to-https
  namespace: default
spec:
  redirectScheme:
    scheme: https
    permanent: true
    port: "443"

---
# Middleware: Security headers
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: default
spec:
  headers:
    # Security headers
    sslRedirect: true
    stsSeconds: 31536000  # HSTS: 1 year
    stsIncludeSubdomains: true
    stsPreload: true
    forceSTSHeader: true
    frameDeny: true
    contentTypeNosniff: true
    browserXssFilter: true
    customResponseHeaders:
      X-Content-Type-Options: "nosniff"
      X-Frame-Options: "SAMEORIGIN"
      X-XSS-Protection: "1; mode=block"
      Referrer-Policy: "strict-origin-when-cross-origin"

---
# Middleware: Compression
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: compression
  namespace: default
spec:
  compress:
    excludedContentTypes:
      - "text/event-stream"
      - "application/grpc"

---
# Middleware: Rate limiting (per IP)
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: default
spec:
  rateLimit:
    average: 100  # Average requests per second
    period: 1m
    burst: 200    # Maximum burst size

---
# Middleware: API-specific rate limiting
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-rate-limit
  namespace: default
spec:
  rateLimit:
    average: 50
    period: 1m
    burst: 100

---
# Middleware: CORS headers
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cors-headers
  namespace: default
spec:
  headers:
    accessControlAllowMethods:
      - "GET"
      - "POST"
      - "PUT"
      - "DELETE"
      - "OPTIONS"
    accessControlAllowOriginList:
      - "https://example.com"
      - "https://app.example.com"
    accessControlAllowHeaders:
      - "Content-Type"
      - "Authorization"
      - "X-Requested-With"
    accessControlExposeHeaders:
      - "Content-Length"
      - "Content-Range"
    accessControlAllowCredentials: true
    accessControlMaxAge: 3600

---
# Middleware: Strip API prefix
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-api-prefix
  namespace: default
spec:
  stripPrefix:
    prefixes:
      - "/api"
    forceSlash: false

---
# Middleware: Basic authentication
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-auth
  namespace: default
spec:
  basicAuth:
    secret: api-auth-credentials  # Reference to Kubernetes Secret

---
# Middleware: Admin authentication
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: admin-auth
  namespace: default
spec:
  basicAuth:
    secret: admin-auth-credentials

---
# Middleware: IP whitelist for admin access
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ip-whitelist
  namespace: default
spec:
  ipWhiteList:
    sourceRange:
      - "10.0.0.0/8"      # Internal network
      - "192.168.0.0/16"  # Private network
      - "172.16.0.0/12"   # Private network

---
# Middleware: WebSocket headers
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: websocket-headers
  namespace: default
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Proto: "https"
      X-Forwarded-For: ""

---
# TLS Options: Custom TLS configuration
apiVersion: traefik.io/v1alpha1
kind: TLSOption
metadata:
  name: default
  namespace: default
spec:
  minVersion: VersionTLS12
  maxVersion: VersionTLS13
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  curvePreferences:
    - CurveP521
    - CurveP384
  sniStrict: true

---
# Service: Web frontend deployment
apiVersion: v1
kind: Service
metadata:
  name: web-frontend
  namespace: default
  labels:
    app: web-frontend
spec:
  type: ClusterIP
  selector:
    app: web-frontend
  ports:
    - name: http
      port: 80
      targetPort: 8080
      protocol: TCP

---
# Service: API backend v1
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v1
  namespace: default
  labels:
    app: api-backend
    version: v1
spec:
  type: ClusterIP
  selector:
    app: api-backend
    version: v1
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      protocol: TCP

---
# Service: API backend v2 (canary)
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v2
  namespace: default
  labels:
    app: api-backend
    version: v2
spec:
  type: ClusterIP
  selector:
    app: api-backend
    version: v2
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      protocol: TCP

---
# Service: WebSocket backend
apiVersion: v1
kind: Service
metadata:
  name: websocket-backend
  namespace: default
  labels:
    app: websocket-backend
spec:
  type: ClusterIP
  selector:
    app: websocket-backend
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      protocol: TCP

---
# Service: Admin backend
apiVersion: v1
kind: Service
metadata:
  name: admin-backend
  namespace: default
  labels:
    app: admin-backend
spec:
  type: ClusterIP
  selector:
    app: admin-backend
  ports:
    - name: http
      port: 80
      targetPort: 8080
      protocol: TCP

---
# Secret: TLS certificate
apiVersion: v1
kind: Secret
metadata:
  name: example-com-tls
  namespace: default
type: kubernetes.io/tls
data:
  # Base64-encoded certificate and key
  tls.crt: LS0tLS1CRUdJTi... # Your certificate here
  tls.key: LS0tLS1CRUdJTi... # Your private key here

---
# Secret: API authentication credentials
apiVersion: v1
kind: Secret
metadata:
  name: api-auth-credentials
  namespace: default
type: Opaque
stringData:
  # Format: username:password (hashed with htpasswd)
  users: |
    api_user:$apr1$xyz...

# NGINX HTTP Load Balancing Configuration
#
# This example demonstrates:
# - Multiple upstream server pools
# - Different load balancing algorithms
# - Health checks (passive in open source, active in NGINX Plus)
# - Sticky sessions
# - Connection keepalive
# - SSL/TLS termination
#
# Place in: /etc/nginx/conf.d/load-balancer.conf

# Upstream: Web servers (round-robin)
upstream web_backend {
    # Load balancing method: round-robin (default)
    # Alternatives: least_conn, ip_hash, hash $variable [consistent]

    server web1.example.com:8080 weight=3 max_fails=3 fail_timeout=30s;
    server web2.example.com:8080 weight=2 max_fails=3 fail_timeout=30s;
    server web3.example.com:8080 weight=1 backup;  # Backup server

    # Keepalive connections to upstream
    keepalive 32;
    keepalive_requests 100;
    keepalive_timeout 60s;
}

# Upstream: API servers (least connections)
upstream api_backend {
    least_conn;  # Route to server with fewest active connections

    server api1.example.com:8080 max_fails=2 fail_timeout=10s;
    server api2.example.com:8080 max_fails=2 fail_timeout=10s;
    server api3.example.com:8080 max_fails=2 fail_timeout=10s;

    keepalive 64;
}

# Upstream: Static file servers (IP hash for cache affinity)
upstream static_backend {
    ip_hash;  # Same client IP always routed to same server

    server static1.example.com:8080;
    server static2.example.com:8080;
    server static3.example.com:8080;
}

# Server: HTTP (redirect to HTTPS)
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Redirect all HTTP to HTTPS
    return 301 https://$server_name$request_uri;
}

# Server: HTTPS
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # SSL/TLS Configuration
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    # Logging
    access_log /var/log/nginx/lb_access.log combined;
    error_log /var/log/nginx/lb_error.log warn;

    # Location: API (to API backend)
    location /api/ {
        proxy_pass http://api_backend;

        # Headers for backend
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # Timeouts
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # Keepalive to upstream
        proxy_http_version 1.1;
        proxy_set_header Connection "";

        # Buffering
        proxy_buffering on;
        proxy_buffer_size 4k;
        proxy_buffers 8 4k;
        proxy_busy_buffers_size 8k;

        # Error handling
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
        proxy_next_upstream_tries 2;
        proxy_next_upstream_timeout 10s;
    }

    # Location: Static files (to static backend)
    location /static/ {
        proxy_pass http://static_backend;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Caching at load balancer
        proxy_cache static_cache;
        proxy_cache_valid 200 1h;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        add_header X-Cache-Status $upstream_cache_status;

        # Long timeouts for large files
        proxy_read_timeout 300s;
    }

    # Location: Default (to web backend)
    location / {
        proxy_pass http://web_backend;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        proxy_http_version 1.1;
        proxy_set_header Connection "";

        # Error handling
        proxy_next_upstream error timeout http_502 http_503 http_504;
    }

    # Health check endpoint (for monitoring)
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
}

# Cache configuration (for static backend)
proxy_cache_path /var/cache/nginx/static
                 levels=1:2
                 keys_zone=static_cache:10m
                 max_size=1g
                 inactive=60m
                 use_temp_path=off;

# Rate limiting zone
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

# Alternative server with rate limiting
server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/nginx/ssl/api.example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/api.example.com.key;

    location / {
        # Rate limiting
        limit_req zone=api_limit burst=20 nodelay;
        limit_req_status 429;

        proxy_pass http://api_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

# Standard Kubernetes Ingress with Traefik-specific annotations
# This demonstrates using the standard Ingress resource with Traefik annotations
# for load balancing, rather than Traefik's CRDs

---
# Ingress: Main application with path-based routing
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: default
  labels:
    app: web-application
  annotations:
    # Ingress class to use Traefik
    kubernetes.io/ingress.class: traefik

    # TLS certificate resolver
    cert-manager.io/cluster-issuer: letsencrypt-prod

    # Traefik-specific: Entry points
    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure

    # Traefik-specific: Redirect HTTP to HTTPS
    traefik.ingress.kubernetes.io/redirect-scheme: https
    traefik.ingress.kubernetes.io/redirect-permanent: "true"

    # Traefik-specific: Middleware chain
    traefik.ingress.kubernetes.io/router.middlewares: default-security-headers@kubernetescrd,default-compression@kubernetescrd,default-rate-limit@kubernetescrd

    # Traefik-specific: TLS options
    traefik.ingress.kubernetes.io/router.tls: "true"
    traefik.ingress.kubernetes.io/router.tls.options: default@kubernetescrd

spec:
  # TLS configuration
  tls:
    - hosts:
        - example.com
        - www.example.com
      secretName: example-com-tls

  # Routing rules
  rules:
    # Rule 1: Main domain
    - host: example.com
      http:
        paths:
          # Path 1: Homepage
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-frontend
                port:
                  number: 80

          # Path 2: API endpoints
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-backend
                port:
                  number: 8080

          # Path 3: Static assets
          - path: /static
            pathType: Prefix
            backend:
              service:
                name: static-assets
                port:
                  number: 80

    # Rule 2: WWW subdomain (mirror of main)
    - host: www.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-frontend
                port:
                  number: 80

---
# Ingress: API subdomain with weighted load balancing
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-subdomain-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik

    # Weighted load balancing between v1 and v2 (canary deployment)
    # Note: This requires TraefikService CRD for proper weighted routing
    # Standard Ingress doesn't support weights, but we can use multiple backends
    traefik.ingress.kubernetes.io/service.weighted: "true"

    # Rate limiting for API
    traefik.ingress.kubernetes.io/router.middlewares: default-api-rate-limit@kubernetescrd,default-cors-headers@kubernetescrd

spec:
  tls:
    - hosts:
        - api.example.com
      secretName: api-example-com-tls

  rules:
    - host: api.example.com
      http:
        paths:
          # All API traffic
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-backend-v1
                port:
                  number: 8080

---
# Ingress: Admin interface with IP whitelisting
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: admin-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik

    # IP whitelist middleware
    traefik.ingress.kubernetes.io/router.middlewares: default-ip-whitelist@kubernetescrd,default-admin-auth@kubernetescrd

    # Priority (higher number = higher priority)
    traefik.ingress.kubernetes.io/router.priority: "100"

spec:
  tls:
    - hosts:
        - admin.example.com
      secretName: admin-example-com-tls

  rules:
    - host: admin.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: admin-backend
                port:
                  number: 8080

---
# Ingress: WebSocket support
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: websocket-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik

    # WebSocket-specific headers
    traefik.ingress.kubernetes.io/router.middlewares: default-websocket-headers@kubernetescrd

    # Sticky sessions for WebSocket connections
    traefik.ingress.kubernetes.io/affinity: "true"
    traefik.ingress.kubernetes.io/session-cookie-name: "ws-sticky"

spec:
  tls:
    - hosts:
        - ws.example.com
      secretName: ws-example-com-tls

  rules:
    - host: ws.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: websocket-backend
                port:
                  number: 8080

---
# Ingress: Regex path matching
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: regex-path-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik

    # Enable regex path matching
    traefik.ingress.kubernetes.io/router.pathmatcher: PathRegexp

spec:
  rules:
    - host: example.com
      http:
        paths:
          # Match versioned API paths: /api/v1/*, /api/v2/*, etc.
          - path: /api/v[0-9]+
            pathType: ImplementationSpecific
            backend:
              service:
                name: versioned-api-backend
                port:
                  number: 8080

---
# Ingress: Custom error pages
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: error-pages-ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: traefik

    # Custom error page middleware
    traefik.ingress.kubernetes.io/router.middlewares: default-error-pages@kubernetescrd

spec:
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-frontend
                port:
                  number: 80

---
# TraefikService: Weighted load balancing (requires Traefik CRD)
# This is used to implement proper canary deployments with weight distribution
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-weighted-service
  namespace: default
spec:
  weighted:
    services:
      - name: api-backend-v1
        port: 8080
        weight: 80  # 80% traffic to v1
      - name: api-backend-v2
        port: 8080
        weight: 20  # 20% traffic to v2 (canary)

---
# TraefikService: Mirroring traffic for testing
apiVersion: traefik.io/v1alpha1
kind: TraefikService
metadata:
  name: api-mirrored-service
  namespace: default
spec:
  mirroring:
    name: api-backend-v1
    port: 8080
    # Mirror 10% of traffic to v2 for testing (responses are ignored)
    mirrors:
      - name: api-backend-v2
        port: 8080
        percent: 10

---
# Middleware: Security headers (defined earlier in traefik-ingress.yaml)
# Referenced here for clarity
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: default
spec:
  headers:
    sslRedirect: true
    stsSeconds: 31536000
    stsIncludeSubdomains: true
    stsPreload: true
    frameDeny: true
    contentTypeNosniff: true
    browserXssFilter: true

---
# Middleware: Compression
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: compression
  namespace: default
spec:
  compress:
    excludedContentTypes:
      - "text/event-stream"

---
# Middleware: Rate limiting
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
  namespace: default
spec:
  rateLimit:
    average: 100
    period: 1m
    burst: 200

---
# Middleware: API-specific rate limiting
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: api-rate-limit
  namespace: default
spec:
  rateLimit:
    average: 50
    period: 1m
    burst: 100

---
# Middleware: CORS headers
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cors-headers
  namespace: default
spec:
  headers:
    accessControlAllowMethods:
      - "GET"
      - "POST"
      - "PUT"
      - "DELETE"
      - "OPTIONS"
    accessControlAllowOriginList:
      - "https://example.com"
      - "https://app.example.com"
    accessControlAllowCredentials: true

---
# Middleware: IP whitelist
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: ip-whitelist
  namespace: default
spec:
  ipWhiteList:
    sourceRange:
      - "10.0.0.0/8"
      - "192.168.0.0/16"

---
# Middleware: Admin authentication
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: admin-auth
  namespace: default
spec:
  basicAuth:
    secret: admin-auth-credentials

---
# Middleware: WebSocket headers
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: websocket-headers
  namespace: default
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Proto: "https"

---
# Middleware: Error pages
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: error-pages
  namespace: default
spec:
  errors:
    status:
      - "400-599"
    service:
      name: error-page-service
      port: 80
    query: "/{status}.html"

---
# Service: Error pages
apiVersion: v1
kind: Service
metadata:
  name: error-page-service
  namespace: default
spec:
  selector:
    app: error-pages
  ports:
    - port: 80
      targetPort: 80

---
# Service: Web frontend
apiVersion: v1
kind: Service
metadata:
  name: web-frontend
  namespace: default
spec:
  selector:
    app: web-frontend
  ports:
    - port: 80
      targetPort: 8080

---
# Service: API backend v1
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v1
  namespace: default
  labels:
    version: v1
spec:
  selector:
    app: api-backend
    version: v1
  ports:
    - port: 8080
      targetPort: 8080

---
# Service: API backend v2
apiVersion: v1
kind: Service
metadata:
  name: api-backend-v2
  namespace: default
  labels:
    version: v2
spec:
  selector:
    app: api-backend
    version: v2
  ports:
    - port: 8080
      targetPort: 8080

---
# Service: Static assets
apiVersion: v1
kind: Service
metadata:
  name: static-assets
  namespace: default
spec:
  selector:
    app: static-assets
  ports:
    - port: 80
      targetPort: 8080

---
# Service: Admin backend
apiVersion: v1
kind: Service
metadata:
  name: admin-backend
  namespace: default
spec:
  selector:
    app: admin-backend
  ports:
    - port: 8080
      targetPort: 8080

---
# Service: WebSocket backend
apiVersion: v1
kind: Service
metadata:
  name: websocket-backend
  namespace: default
spec:
  selector:
    app: websocket-backend
  ports:
    - port: 8080
      targetPort: 8080

---
# Service: Versioned API backend
apiVersion: v1
kind: Service
metadata:
  name: versioned-api-backend
  namespace: default
spec:
  selector:
    app: versioned-api-backend
  ports:
    - port: 8080
      targetPort: 8080