---
apiVersion: v1
kind: Service
metadata:
  name: ambassador
  annotations:
    getambassador.io/config: |
      ---
      apiVersion: ambassador/v0
      kind:  Mapping
      name:  diag_mapping
      prefix: /ambassador/
      rewrite: /ambassador/
      service: 127.0.0.1:8877
      ---
      apiVersion: ambassador/v0
      kind:  Module
      name:  tls
      config:
        server:
          enabled: True
          redirect_cleartext_from: 80
          # These are optional.
          cert_chain_file: /etc/certs/tls.crt
          private_key_file: /etc/certs/tls.key

        # client:
        #   enabled: True,
        #   # These are optional.
        #   cert_required: True
        #   cacert_chain_file: /etc/ca_cert_chain/tls.crt

        # This is an upstream context. Use tls: upstream in a 
        # mapping to reference it.
        upstream:
          cert_chain_file: /etc/certs/upstream/tls.crt
          private_key_file: /etc/certs/upstream/tls.key
      ---
      apiVersion: ambassador/v0
      kind: Module
      name:  authentication
      config:
        auth_service: https://auth
        allowed_headers:
        - "x-hurkle"
spec:
  selector:
    app: ambassador
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 443
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
  type: NodePort
