---
# Lightweight nginx that reverse-proxies to the Kubernetes API server.
# Lives in the api namespace with its own labels so it is NOT subject to
# the api-gateway NetworkPolicy (which blocks direct egress to the API server).
# The gateway loader connects to this service instead of 10.96.0.1:443.
apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-api-proxy-config
  namespace: api
data:
  nginx.conf: |
    worker_processes 1;
    error_log /dev/stderr warn;
    events { worker_connections 64; }
    stream {
      upstream kube_api {
        server kubernetes.default.svc.cluster.local:443;
      }
      server {
        listen 8443;
        proxy_pass kube_api;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-api-proxy
  namespace: api
  labels:
    app: kube-api-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-api-proxy
  template:
    metadata:
      labels:
        app: kube-api-proxy
    spec:
      automountServiceAccountToken: false
      containers:
      - name: nginx
        image: nginx:1.27-alpine
        ports:
        - containerPort: 8443
        volumeMounts:
        - name: config
          mountPath: /etc/nginx/nginx.conf
          subPath: nginx.conf
          readOnly: true
        resources:
          requests:
            cpu: 10m
            memory: 16Mi
          limits:
            cpu: 50m
            memory: 32Mi
        securityContext:
          readOnlyRootFilesystem: false
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
      volumes:
      - name: config
        configMap:
          name: kube-api-proxy-config
---
apiVersion: v1
kind: Service
metadata:
  name: kube-api-proxy
  namespace: api
  labels:
    app: kube-api-proxy
spec:
  selector:
    app: kube-api-proxy
  ports:
  - port: 8443
    targetPort: 8443
    protocol: TCP