agc_with_azfw.azcli

# Application Gateway for containers (aka kubic, aka traffic controller, aka AppGW for containers, aka AGICv2)
# This script creates AGC in spoke1 and AKS in spoke2, joint by a common hub VNet with AzFW.
#
# As far as I have tested, this is not supported today: AGC and AKS need to be in the same VNet.
#
# There are 2 steps to create AGC:
# 1. Create ALB Controller: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-deploy-application-gateway-for-containers-alb-controller?tabs=install-helm-windows
# 2. Create AGC
#    Option a - Managed: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-create-application-gateway-for-containers-managed-by-alb-controller?tabs=new-subnet-aks-vnet
#    Option b - BYOD: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/quickstart-create-application-gateway-for-containers-byo-deployment?tabs=existing-vnet-subnet

# Control
mode=byod                        # managed or byod
waf=yes                          # yes or no
waf_type=default                 # default, bot or OWASP (only default supported!)
cni=overlay                      # azure_pod_subnet, azure or overlay
tls=yes                          # yes or no
alb_controller_version=1.8.12    # Check the latest version in https://learn.microsoft.com/azure/application-gateway/for-containers/alb-controller-release-notes
flowlogs=yes                     # yes or no
test_cmds=no                     # yes or no
backup_service=no                # yes or no: whether creating a backup application to test load balancing
istio=no                         # yes or no: whether installing Istio for service mesh
istio_mode=community             # community or azure (managed Istio). Only community supported by ALB controller as of October 2025
bookapp=no                       # yes or no: whether installing Bookinfo sample app for Istio
interspoke_peering=yes           # yes or no: whether to create VNet peering between AKS and AGC spokes

# Variables
rg=agchnsbyod
location=swedencentral                  # eastasia, eastus, etc
hub_vnet_name=hubVnet
hub_vnet_prefix=10.12.0.0/16
azfw_subnet_name=AzureFirewallSubnet
azfw_subnet_prefix=10.12.1.0/24
azfw_name=agcfw
azfw_pip_name=agcfw-pip
azfw_policy_name=agcfw-policy
aks_name=agc
aks_node_size=Standard_B2ms
aks_vnet_name=aksVnet
aks_vnet_prefix=10.13.0.0/16
aks_subnet_name=aks1stpool
aks_subnet_prefix=10.13.76.0/24  # Min /25 with Azure CNI!
pod_subnet_name=pods
pod_subnet_prefix=10.13.80.0/24
aks_service_cidr=10.0.0.0/16
aks_id_name=aksid
alb_id_name=albid
alb_deployment_ns=alb
alb_controller_ns=azure-alb-system
alb_ns_name=alb-infra
app_ns=yada
agc_name=appgw4c
agc_frontend_name=agc-frontend
agc_vnet_name=agcVnet
agc_vnet_prefix=10.14.0.0/16
agc_subnet_name=subnet-alb
agc_subnet_prefix=10.14.100.0/24
# TLS
pem_file="$HOME/onedrive/Admin/Certs/cloudtrooper.net/2025/star_cloudtrooper_net_fullchain.pem"
key_file="$HOME/onedrive/Admin/Certs/cloudtrooper.net/2025/CSR/star_cloudtrooper_net.key"
secret_name=cloudtrooper-tls
tls_app_fqdn=yada.cloudtrooper.net
tls_app_ns=yadatls
# WAF
waf_policy_name=agc-waf-policy
sec_policy_name=agc-sec-policy

# Register required resource providers on Azure.
echo "INFO: Registering resource providers..."
az provider register --namespace Microsoft.ContainerService --only-show-errors
az provider register --namespace Microsoft.Network --only-show-errors
az provider register --namespace Microsoft.NetworkFunction --only-show-errors
az provider register --namespace Microsoft.ServiceNetworking --only-show-errors

# Install Azure CLI extensions.
az extension add -n alb --upgrade --only-show-errors
az extension add -n aks-preview --upgrade --only-show-errors
az extension add -n azure-firewall --upgrade --only-show-errors

# Create RG and VNets
echo "INFO: Creating resource group $rg and VNets in $location..."
az group create -n $rg -l $location -o none --only-show-errors
az network vnet create -g $rg -n $aks_vnet_name --address-prefix $aks_vnet_prefix -l $location -o none
az network vnet subnet create -g $rg -n $aks_subnet_name --vnet-name $aks_vnet_name --address-prefix $aks_subnet_prefix -o none --only-show-errors
az network vnet subnet create -g $rg -n $pod_subnet_name --vnet-name $aks_vnet_name --address-prefix $pod_subnet_prefix -o none --only-show-errors
aks_subnet_id=$(az network vnet subnet show -n $aks_subnet_name --vnet-name $aks_vnet_name -g $rg --query id -o tsv)
pod_subnet_id=$(az network vnet subnet show -n $pod_subnet_name --vnet-name $aks_vnet_name -g $rg --query id -o tsv)
az network vnet create -g $rg -n $agc_vnet_name --address-prefix $agc_vnet_prefix -l $location -o none
az network vnet create -g $rg -n $hub_vnet_name --address-prefix $hub_vnet_prefix -l $location -o none
az network vnet subnet create -g $rg -n $azfw_subnet_name --vnet-name $hub_vnet_name --address-prefix $azfw_subnet_prefix -o none --only-show-errors
az network vnet peering create -g $rg -n ${aks_vnet_name}-to-${hub_vnet_name} --vnet-name $aks_vnet_name --remote-vnet ${hub_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
az network vnet peering create -g $rg -n ${hub_vnet_name}-to-${aks_vnet_name} --vnet-name $hub_vnet_name --remote-vnet ${aks_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
az network vnet peering create -g $rg -n ${agc_vnet_name}-to-${hub_vnet_name} --vnet-name $agc_vnet_name --remote-vnet ${hub_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
az network vnet peering create -g $rg -n ${hub_vnet_name}-to-${agc_vnet_name} --vnet-name $hub_vnet_name --remote-vnet ${agc_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
if [[ "$interspoke_peering" == "yes" ]]; then
    az network vnet peering create -g $rg -n ${aks_vnet_name}-to-${agc_vnet_name} --vnet-name $aks_vnet_name --remote-vnet ${agc_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
    az network vnet peering create -g $rg -n ${agc_vnet_name}-to-${aks_vnet_name} --vnet-name $agc_vnet_name --remote-vnet ${aks_vnet_name} --allow-vnet-access --allow-forwarded-traffic -o none --only-show-errors
fi

# Create AzFW in the hub
echo "INFO: Creating Azure Firewall $azfw_name in subnet $azfw_subnet_name and VNet $hub_vnet_name..."
az network public-ip create -g $rg -n $azfw_pip_name --sku standard --allocation-method static -l $location -o none
azfw_ip=$(az network public-ip show -g $rg -n $azfw_pip_name --query ipAddress -o tsv)
az network firewall policy create -n $azfw_policy_name -g $rg -o none
az network firewall policy rule-collection-group create -n ruleset01 --policy-name $azfw_policy_name -g $rg --priority 1000 -o none
# Allow any-to-any rule
echo "INFO: Creating rule to allow SSH and HTTP..."
az network firewall policy rule-collection-group collection add-filter-collection --policy-name $azfw_policy_name --rule-collection-group-name ruleset01 -g $rg \
    --name allowall --collection-priority 101 --action Allow --rule-name allowall --rule-type NetworkRule --description "Allow all" \
    --destination-addresses 0.0.0.0/0 --source-addresses 0.0.0.0/0 --ip-protocols Any --destination-ports '*' -o none 2>/dev/null
# az network firewall application-rule create -f $azfw_name -g $rg -c AllowAll \
#  --protocols Http=80 Https=443 --target-fqdns "*" --source-addresses "0.0.0.0/0" \
#  -n Allow-all --priority 200 --action Allow -o none
az network firewall create -n $azfw_name -g $rg --policy $azfw_policy_name -l $location -o none 2>/dev/null
azfw_id=$(az network firewall show -n $azfw_name -g $rg -o tsv --query id 2>/dev/null)
az network firewall ip-config create -f $azfw_name -n azfw-ipconfig -g $rg --public-ip-address $azfw_pip_name --vnet-name $hub_vnet_name -o none 2>/dev/null
az network firewall update -n $azfw_name -g $rg -o none 2>/dev/null
azfw_private_ip=$(az network firewall show -n $azfw_name -g $rg -o tsv --query 'ipConfigurations[0].privateIPAddress' 2>/dev/null)
echo "INFO: Azure Firewall deployed with private IP $azfw_private_ip and public IP $azfw_ip."

# Create route table for spokes
echo "INFO: Creating route table for spokes to route traffic to Azure Firewall in the hub..."
rt_name=spoke-rt
az network route-table create -g $rg -n $rt_name -l $location -o none
az network route-table route create -g $rg --route-table-name $rt_name -n default-route --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $azfw_private_ip -o none
az network vnet subnet update -g $rg --vnet-name $aks_vnet_name -n $aks_subnet_name --route-table $rt_name -o none
az network vnet subnet update -g $rg --vnet-name $aks_vnet_name -n $pod_subnet_name --route-table $rt_name -o none

# Create/retrieve identity for AKS
id_id=$(az identity show -n $aks_id_name -g $rg --query id -o tsv 2>/dev/null)
if [[ -z "$id_id" ]]
then
    echo "INFO: Identity $aks_id_name not found, creating a new one..."
    az identity create -n $aks_id_name -g $rg -o none
    id_id=$(az identity show -n $aks_id_name -g $rg --query id -o tsv)
else
    echo "INFO: Identity $aks_id_name found with ID $id_id"
fi
id_principal_id=$(az identity show -n $aks_id_name -g $rg --query principalId -o tsv)
aks_vnet_id=$(az network vnet show -n $aks_vnet_name -g $rg --query id -o tsv)
sleep 15 # Time for creation to propagate
echo "INFO: Assigning Contributor role to AKS identity $aks_id_name in VNet $aks_vnet_name..."
az role assignment create --scope $aks_vnet_id --assignee $id_principal_id --role Contributor -o none

# Create AKS cluster with workload identity enabled.
# 'AGC supports Azure CNI Pod Subnet for both dynamic and static allocation': https://github.com/Azure/AKS/issues/4681
if [[ "$cni" == "azure_pod_subnet" ]]; then
    cni_options="--network-plugin azure --network-policy azure --vnet-subnet-id $aks_subnet_id --pod-subnet $pod_subnet_prefix"
elif [[ "$cni" == "azure_pod_subnet" ]]; then
    cni_options="--network-plugin azure --network-policy azure --vnet-subnet-id $aks_subnet_id"
elif [[ "$cni" == "overlay" ]]; then
    cni_options="--network-plugin azure --network-policy cilium --network-dataplane cilium --network-plugin-mode overlay --vnet-subnet-id $aks_subnet_id"
else  # Default to Azure without pod subnet
    cni_options="--network-plugin azure --vnet-subnet-id $aks_subnet_id"
fi

# AKS number of nodes
if [[ "$istio" == "yes" ]]; then
    aks_node_count=2
else
    aks_node_count=1
fi

# Istio installation
if [[ "$istio" == "yes" ]] && [[ "$istio_mode" == "addon" ]]; then
    istio_options="--enable-azure-service-mesh"
else
    istio_options=""
fi

# Create cluster
echo "INFO: Creating AKS cluster $aks_name in resource group $rg in $cni CNI mode..."
az aks create -g $rg -n $aks_name -l $location -o none --only-show-errors \
    --enable-oidc-issuer --enable-workload-identity \
    -c $aks_node_count -s $aks_node_size --generate-ssh-keys -u $(whoami) --service-cidr $aks_service_cidr \
    --enable-managed-identity --assign-identity $id_id \
    ${(z)cni_options} \
    ${(z)istio_options} \
    --outbound-type userDefinedRouting \
    --load-balancer-sku Standard \
    --node-resource-group "$aks_name"-iaas-"$RANDOM"
echo ""   # New line after az command
az aks get-credentials -n $aks_name -g $rg --overwrite-existing --only-show-errors

# For existing clusters
# az aks update -g $rg -n $aks_name --enable-oidc-issuer --enable-workload-identity -o none

# Deploy Istio community if required
# REVIEW
if [[ "$istio" == "yes" ]] && [[ "$istio_mode" == "community" ]]; then
    istio_version=1.27.1
    echo "INFO: Deploying Istio community edition version $istio_version..."
    curl -L https://istio.io/downloadIstio | ISTIO_VERSION=$istio_version sh -
    export PATH=$PATH:$PWD/istio-$istio_version/bin
    istioctl install --set profile=default -y
    # istio_revision=$(kubectl get namespace istio-system -o jsonpath='{.metadata.labels.istio\.io/rev}')
    # echo "INFO: Istio community edition installed with revision $istio_revision"
    # rm -rf istio-$istio_version     # we may need istioctl later
fi

# Verify cluster created with right plugin
if [[ "$test_cmds" == "yes" ]]; then
    echo "INFO: Verifying CNI plugin for AKS cluster $aks_name in resource group $rg..."
    az aks list -g $rg --only-show-errors --query '[].{Name:name, Plugin:networkProfile.networkPlugin, Dataplane:networkProfile.networkDataplane, Policy:networkProfile.networkPolicy, PluginMode:networkProfile.networkPluginMode, NetworkMode:networkProfile.networkMode}' -o table
    if [[ "$istio" == "yes" ]] && [[ "$istio_mode" == "addon" ]]; then
        echo "INFO: Verifying Istio installation..."
        installed_service_mesh=$(az aks show -g $rg -n $aks_name --query "serviceMeshProfile.mode" -o tsv)
        echo "INFO: Service mesh installed in the cluster is: $installed_service_mesh"
    fi
fi

# If Istio, get the revision
if [[ "$istio" == "yes" ]] && [[ "$istio_mode" == "addon" ]]; then
    istio_revision=$(az aks show -n $aks_name -g $rg --query 'serviceMeshProfile.istio.revisions' -o tsv)
    echo "INFO: Istio revision installed is $istio_revision"
fi

# Create identity for AGC and configure federation with AKS OIDC issuer
node_rg=$(az aks show -n $aks_name -g $rg --query "nodeResourceGroup" -o tsv --only-show-errors)
node_rg_id=$(az group show -n $node_rg --query id -o tsv)
rg_id=$(az group show -n $rg --query id -o tsv)
echo "INFO: Creating ALB identity $alb_id_name in resource group $rg..."
az identity create -n $alb_id_name -g $rg -o none --only-show-errors
alb_id_principal_id="$(az identity show -n $alb_id_name -g $rg --query principalId -o tsv)"
echo "INFO: Waiting 15 seconds to allow for replication of the identity..."
sleep 15
echo "INFO: Applying Reader role to the AKS resource groups for the newly provisioned identity..."
reader_role=acdd72a7-3385-48ef-bd42-f606fba81ae7
az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --role $reader_role --scope $node_rg_id -o none --only-show-errors
az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --role $reader_role --scope $rg_id -o none --only-show-errors
echo "INFO: Setting up federation with AKS OIDC issuer..."
aks_oidc_issuer="$(az aks show -n "$aks_name" -g "$rg" --query "oidcIssuerProfile.issuerUrl" -o tsv --only-show-errors)"
az identity federated-credential create -n $alb_id_name -g $rg -o none --only-show-errors \
    --identity-name $alb_id_name --issuer "$aks_oidc_issuer" --subject "system:serviceaccount:azure-alb-system:alb-controller-sa"

# Deploy Helm chart
echo "INFO: Deploying helm chart for ALB, version ${alb_controller_version}..."
kubectl create ns $alb_deployment_ns
# The --namespace flag doesnt seem to have any effect
helm install alb-controller oci://mcr.microsoft.com/application-lb/charts/alb-controller \
      --namespace $alb_deployment_ns \
      --version $alb_controller_version \
      --set albController.namespace=$alb_controller_ns \
      --set albController.podIdentity.clientID=$(az identity show -g $rg -n $alb_id_name --query clientId -o tsv)

# Verify
if [[ "$test_cmds" == "yes" ]]; then
    kubectl get pods -n $alb_controller_ns
    echo "INFO: Waiting 20 seconds for the ALB controller to start..."
    sleep 20
    kubectl get gatewayclass azure-alb-external -o yaml
fi

# If using the service mesh extension, install it
# The attribute albServiceMeshExtension.image should not be required in the future
#      --set albServiceMeshExtension.image.tag=$alb_controller_version
echo "INFO: Installing service mesh extension for ALB via Helm..."
helm install alb-controller-servicemesh-extension oci://mcr.microsoft.com/application-lb/charts/alb-controller-servicemesh-extension \
     --namespace $alb_deployment_ns \
     --version $alb_controller_version

#############################
#          Managed          #
#############################
if [[ "$mode" == "managed" ]]; then
    # Create AppGW for containers
    echo "INFO: Creating subnet for AGC..."
    az network vnet subnet create -g $rg --vnet-name $agc_vnet_name -n $agc_subnet_name --address-prefix $agc_subnet_prefix --delegations 'Microsoft.ServiceNetworking/trafficControllers' -o none --only-show-errors
    az network vnet subnet update -g $rg --vnet-name $agc_vnet_name -n $agc_subnet_name --route-table $rt_name -o none
    agc_subnet_id=$(az network vnet subnet show -g $rg --vnet-name $agc_vnet_name -n $agc_subnet_name --query id --output tsv)

    # Delegate roles to the ALB identity
    echo "INFO: Adding roles for ALB identity..."
    node_rg=$(az aks show -n $aks_name -g $rg --query "nodeResourceGroup" -o tsv)
    node_rg_id=$(az group show -n $node_rg --query id -o tsv)
    rg_id=$(az group show -n $rg --query id -o tsv)
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $node_rg_id --role "fbc52c3f-28ad-4303-a892-8a056630b8f1" -o none  # AppGw for Containers Configuration Manager role
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $rg_id --role "fbc52c3f-28ad-4303-a892-8a056630b8f1" -o none  # AppGw for Containers Configuration Manager role
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $agc_subnet_id --role "4d97b98b-1d4f-4787-a291-c67834d212e7" -o none # Network Contributor

    # Create ALB with subnet association
    echo "INFO: Creating AGC and frontend in managed mode..."
    kubectl create ns $alb_ns_name
    kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: ApplicationLoadBalancer
metadata:
  name: $agc_name
  namespace: $alb_ns_name
spec:
  associations:
  - $agc_subnet_id
EOF
    # kubectl get ApplicationLoadBalancer -n $alb_ns_name
    # kubectl describe ApplicationLoadBalancer -n $alb_ns_name

    # Wait for the ALB to be created (a loop would probably be better)
    sleep 20

    # Create Gateway in k8s
    alb_id=$(az network alb list -g $node_rg --query '[0].id' -o tsv)
    alb_name=$(az network alb list -g $node_rg --query '[0].name' -o tsv)
    echo "INFO: Creating Gateway in k8s associated to ALB ID $alb_id..."
    if [[ "$tls" == "yes" ]]; then
        kubectl create secret tls $secret_name --cert=$pem_file --key=$key_file -n default
        kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: $agc_name
  annotations:
    alb.networking.azure.io/alb-namespace: $alb_ns_name
    alb.networking.azure.io/alb-id: $alb_id
spec:
  gatewayClassName: azure-alb-external
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
  - name: https
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - kind : Secret
        group: ""
        name: $secret_name
EOF
    else
        kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: $agc_name
  annotations:
    alb.networking.azure.io/alb-namespace: $alb_ns_name
    alb.networking.azure.io/alb-id: $alb_id
spec:
  gatewayClassName: azure-alb-external
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
EOF
    fi

    if [[ "$test_cmds" == "yes" ]]; then
        kubectl get gateway
    fi
fi

#############################
# Bring your own deployment #
#############################

if [[ "$mode" == "byod" ]]; then
    # Create ALB and frontend
    echo "INFO: Creating AGC and frontend in Bring-Your-Own-Deployment mode..."
    az network alb create -g $rg -n $agc_name -o none --only-show-errors
    az network alb frontend create -g $rg --alb-name $agc_name -n $agc_frontend_name -o none --only-show-errors
    az network vnet subnet create -g $rg --vnet-name $agc_vnet_name -n $agc_subnet_name --address-prefix $agc_subnet_prefix --delegations 'Microsoft.ServiceNetworking/trafficControllers' -o none --only-show-errors
    agc_subnet_id=$(az network vnet subnet show -g $rg --vnet-name $agc_vnet_name -n $agc_subnet_name --query id --output tsv)

    # Delegate roles to the ALB identity
    echo "INFO: Adding roles for ALB identity..."
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $node_rg_id --role "fbc52c3f-28ad-4303-a892-8a056630b8f1" -o none  # AppGw for Containers Configuration Manager role
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $rg_id --role "fbc52c3f-28ad-4303-a892-8a056630b8f1" -o none  # AppGw for Containers Configuration Manager role
    az role assignment create --assignee-object-id $alb_id_principal_id --assignee-principal-type ServicePrincipal --scope $agc_subnet_id --role "4d97b98b-1d4f-4787-a291-c67834d212e7" -o none # Network Contributor

    # Associate the AGC with the subnet
    echo "INFO: Associating the AGC with the subnet..."
    association_name='AppGW4Cassociation'
    az network alb association create -g $rg -n $association_name --alb-name $agc_name --subnet $agc_subnet_id -o none --only-show-errors

    # Create Gateway in k8s
    agc_id=$(az network alb list -g $rg --query '[0].id' -o tsv)
    # agc_name=$(az network alb list -g $rg --query '[0].name' -o tsv)
    # agc_frontend_name=$(az network alb frontend list --alb-name $agc_name -g $rg --query '[0].name' -o tsv)
    echo "INFO: Creating Gateway in k8s associated to ALB ID $agc_id and frontend $agc_frontend_name..."
    if [[ "$tls" == "yes" ]]; then
        kubectl create namespace $alb_ns_name
        kubectl create secret tls $secret_name --cert=$pem_file --key=$key_file -n default
        kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: $agc_name
  annotations:
    alb.networking.azure.io/alb-namespace: $alb_ns_name
    alb.networking.azure.io/alb-id: $agc_id
spec:
  gatewayClassName: azure-alb-external
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
  - name: https
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
        # from: Selector
        # selector:
        #   matchLabels:
        #     kubernetes.io/metadata.name: $tls_app_ns
    tls:
      mode: Terminate
      certificateRefs:
      - kind : Secret
        group: ""
        name: $secret_name
  addresses:
  - type: alb.networking.azure.io/alb-frontend
    value: $agc_frontend_name
EOF
    else
        kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: $agc_name
  annotations:
    alb.networking.azure.io/alb-namespace: $alb_ns_name
    alb.networking.azure.io/alb-id: $agc_id
spec:
  gatewayClassName: azure-alb-external
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
  addresses:
  - type: alb.networking.azure.io/alb-frontend
    value: $agc_frontend_name
EOF
    fi

    if [[ "$test_cmds" == "yes" ]]; then
        kubectl get gateway
        kubectl describe gateway
    fi
fi

##################################
#       Diagnostic settings      #
##################################

# Create log analytics workspace
logws_name=$(az monitor log-analytics workspace list -g $rg --query '[0].name' -o tsv)
if [[ -z "$logws_name" ]]
then
    logws_name=log$RANDOM
    echo "INFO: Creating new Log Analytics workspace $logws_name"
    az monitor log-analytics workspace create -n $logws_name -g $rg -o none
else
    echo "INFO: Log Analytics workspace $logws_name found in resource group $rg."
fi
echo "INFO: Getting the ID of Log Analytics workspace $logws_name..."
logws_id=$(az resource list -g $rg -n $logws_name --query '[].id' -o tsv)
logws_customerid=$(az monitor log-analytics workspace show -n $logws_name -g $rg --query customerId -o tsv)
# Enable diagnostics settings for AGC
echo "INFO: Looking for AGC in the main resource group $rg..."
agc_id=$(az network alb list -g $rg --query '[0].id' -o tsv)
if [[ -z "$agc_id" ]]
then
    echo "INFO: AGC not found in main resource group, looking for AGC in node resource group $node_rg..."
    agc_id=$(az network alb list -g $node_rg --query '[0].id' -o tsv)
fi
if [[ -z "$agc_id" ]]; then
    echo "INFO: AGC not found in node resource group $node_rg, exiting..."
else
    echo "INFO: AGC found with ID $agc_id, configuring diagnostics settings..."
    az monitor diagnostic-settings create --name agc-diagnostics --resource $agc_id --workspace $logws_id -o none --only-show-errors \
      --logs '[{"category": "TrafficControllerAccessLog", "enabled": true, "retentionPolicy": {"days": 0, "enabled": false}},
               {"category": "TrafficControllerFirewallLog", "enabled": true, "retentionPolicy": {"days": 0, "enabled": false}}]'
fi
# Enable diagnostics for Azure Firewall
azfw_id=$(az network firewall show -n $azfw_name -g $rg --query id -o tsv)
az monitor diagnostic-settings create -n mydiag --resource $azfw_id --workspace $logws_id \
    --logs '[{"category": "AzureFirewallApplicationRule", "enabled": true, "retentionPolicy": {"days": 0, "enabled": false}}, 
            {"category": "AzureFirewallNetworkRule", "enabled": true, "retentionPolicy": {"days": 0, "enabled": false}}]' -o none

# Get logs
query="AGCAccessLogs | where TimeGenerated > ago(5m) | project TimeGenerated, ClientIp, HostName, RequestUri, FrontendName, FrontendPort, BackendHost, BackendIp, HttpStatusCode"
if [[ "$test_cmds" == "yes" ]]; then
    az monitor log-analytics query -w $logws_customerid --analytics-query "$query" -o table
fi

##################################
#      VNet Flow Logs            #
##################################

if [[  "$flowlogs" == "yes" ]]; then
    storage_account_name=$(az storage account list -g $rg -o tsv --query '[0].name' 2>/dev/null | head -1)
    if [[ -z "$storage_account_name" ]]; then
        storage_account_name="logs$RANDOM"  # max 24 characters
        echo "INFO: No storage account found in resource group $rg, creating one..."
        az storage account create -n $storage_account_name -g $rg --sku Standard_LRS --kind StorageV2 -l $location -o none
    else
        echo "INFO: Storage account $storage_account_name found in $location, using it for VNet flow flogs"
    fi
    echo "INFO: Enabling VNet Flow Logs for VNet $aks_vnet_name in storage account $storage_account_name and Log Analytics workspace $logws_name..."
    az network watcher flow-log create -l $location -g $rg --name "aksflowlog-$location" --vnet $aks_vnet_name \
        --storage-account $storage_account_name --workspace $logws_name --interval 10 --traffic-analytics true -o none
    echo "INFO: Enabling VNet Flow Logs for VNet $agc_vnet_name in storage account $storage_account_name and Log Analytics workspace $logws_name..."
    az network watcher flow-log create -l $location -g $rg --name "agcflowlog-$location" --vnet $agc_vnet_name \
        --storage-account $storage_account_name --workspace $logws_name --interval 10 --traffic-analytics true -o none
fi

####################################
# Wait until gateway is programmed #
####################################

wait_interval=15
max_wait_time=600
echo "INFO: Waiting for gateway $agc_name to finish provisioning..."
start_time=`date +%s`
state=$(kubectl get gateway $agc_name -o json | jq -r '.status.conditions[] | select(.type=="Programmed") | .status')
run_time=0
until [[ "$state" == "True" ]] || [[ run_time -gt $max_wait_time ]] || [[ -z "$state" ]]; do
  sleep $wait_interval
  state=$(kubectl get gateway $agc_name -o json | jq -r '.status.conditions[] | select(.type=="Programmed") | .status')
  run_time=$(expr `date +%s` - $start_time)
done
if [[ -z "$state" ]]
then
  echo "INFO: I could not retrieve the state of the gateway $agc_name"
else
  ((minutes=${run_time}/60))
  ((seconds=${run_time}%60))
  echo "INFO: Gateway Programmed state is $state, wait time $minutes minutes and $seconds seconds"
fi

##################################
#         Frontend TLS           #
##################################

if [[ "$tls" == "yes" ]]; then
    # echo "INFO: Creating secret $secret_name for frontend TLS from file $pem_file..."     # Secret must have been created earlier
    # kubectl create secret tls $secret_name --cert=$pem_file --key=$key_file
    echo "INFO: Creating FrontendTLSPolicy for gateway $agc_name..."
    # A TLS policy only needed if you need MTLS, maybe we could create a frontend policy for other purposes such as TLS version?
    #    According to the docs, only mTLS supported: https://learn.microsoft.com/en-us/azure/application-gateway/for-containers/api-specification-kubernetes#alb.networking.azure.io/v1.FrontendTLSPolicyConfig
#     kubectl apply -f - <<EOF
# apiVersion: alb.networking.azure.io/v1
# kind: FrontendTLSPolicy
# metadata:
#   name: mtls-policy
#   namespace: default
# spec:
#   targetRef:
#     group: gateway.networking.k8s.io
#     kind: Gateway
#     name: $agc_name
#     namespace: default
#     sectionNames:
#     - mtls-listener
#   default:
#     verify:
#       caCertificateRef:
#         name: ca.bundle
#         group: ""
#         kind: Secret
#         namespace: $secret_name
# EOF
fi

##################################
# Sample workload in the cluster #
##################################

# See https://gateway-api.sigs.k8s.io/guides/multiple-ns/
# See https://github.com/microsoft/YADA/tree/main/api

echo "INFO: Creating sample app in namespace $app_ns..."
kubectl create ns $app_ns
if [[ "$istio" == "yes" ]]; then
    echo "INFO: Labeling namespace $app_ns for Istio injection with revision $istio_revision..."
    if [[ "$istio_mode" == "addon" ]]; then
        kubectl label namespace $app_ns istio.io/rev=${istio_revision}
    fi
    kubectl label namespace $app_ns istio-injection=enabled
    kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: $app_ns
spec:
  mtls:
    mode: STRICT
EOF
fi
kubectl create deployment yadaapi -n $app_ns --image=erjosito/yadaapi:1.0 --port=8080 --replicas=1
kubectl expose deploy yadaapi -n $app_ns --port=8080 --target-port=8080
# Or if you need more control when creating the service:
# kubectl apply -f - <<EOF
# apiVersion: v1
# kind: Service
# metadata:
#   annotations:
#     service.beta.kubernetes.io/azure-load-balancer-internal: "true"
#   name: yadaapi
#   namespace: $app_ns
# spec:
#   selector:
#     app: yadaapi
#   type: ClusterIP
#   ports:
#   - port: 8080
# EOF

# HTTP route
echo "INFO: Creating HTTPRoute for sample app..."
fqdn=$(kubectl get gateway -n default $agc_name -o jsonpath='{.status.addresses[0].value}') && echo "INFO: The frontend FQDN is $fqdn"
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: yadaapi
  namespace: $app_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: http
  hostnames:
  - "$fqdn"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api/
  - backendRefs:
    - name: yadaapi
      namespace: $app_ns
      port: 8080
EOF

# HTTPS route
echo "INFO: Creating HTTPRoute for sample app for TLS frontend..."
fqdn=$(kubectl get gateway $agc_name -o jsonpath='{.status.addresses[0].value}') && echo "INFO: The frontend FQDN is $fqdn"
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: yadaapitls
  namespace: $app_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: https
  hostnames:
  - "$fqdn"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api/
  - backendRefs:
    - name: yadaapi
      namespace: $app_ns
      port: 8080
EOF

# Health check policy
echo "INFO: Creating health check policy for sample app..."
kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: HealthCheckPolicy
metadata:
  name: healthcheck-yada-active
  namespace: $app_ns
spec:
  targetRef:
    group: ""
    kind: Service
    namespace: $app_ns
    name: yadaapi
  default:
    interval: 5s
    timeout: 3s
    healthyThreshold: 1
    unhealthyThreshold: 1
    port: 8080
    http:
      host: contoso.com
      path: /api/healthcheck
      match:
        statusCodes: 
        - start: 200
          end: 299
    useTLS: false
EOF

if [[ "$test_cmds" == "yes" ]]; then
    # Check
    kubectl get httproute -n $app_ns
    kubectl describe httproute yadaapi -n $app_ns

    # Scale out
    kubectl scale deploy yadaapi -n $app_ns --replicas=2

    # Test
    curl "http://${fqdn}/api/healthcheck"
    curl "http://${fqdn}/api/headers"
    curl "http://${fqdn}/api/ip"
    while true; do mydate=$(date); echo -n "${mydate}: "; curl -s "http://${fqdn}/api/ip" | jq -r '.my_private_ip'; sleep 1; done
    while true; do mydate=$(date); echo -n "${mydate}: "; ip=$(curl -s "http://${fqdn}/api/ip" | jq -r '.my_private_ip'); [[ -z "$ip" ]] && echo "INFO: No answer" || echo "INFO: $ip"; sleep 1; done
fi

#####################
#  Backup service   #
#####################

if [[ "$backup_service" == "yes" ]]; then
    kubectl create deployment yadaapi-backup -n $app_ns --image=erjosito/yadaapi:1.0 --port=8080 --replicas=1
    kubectl expose deploy yadaapi-backup -n $app_ns --port=8080 --target-port=8080

    # HTTP route
    fqdn=$(kubectl get gateway $agc_name -o jsonpath='{.status.addresses[0].value}') && echo $fqdn
    kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: yadaapi
  namespace: $app_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: http
  hostnames:
  - "$fqdn"
  rules:
  - backendRefs:
    - name: yadaapi
      port: 8080
      weight: 999
    - name: yadaapi-backup
      port: 8080
      weight: 1
EOF

    # HTTPS route
    if [[ "$tls" == "yes" ]]; then
      kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: yadaapitls    # lowercase
  namespace: $app_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: https
  hostnames:
  - "$fqdn"
  rules:
  - backendRefs:
    - name: yadaapi
      port: 8080
      weight: 999
    - name: yadaapi-backup
      port: 8080
      weight: 1
EOF
    fi

    # Health check policy
    kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: HealthCheckPolicy
metadata:
  name: healthcheck-yada-backup
  namespace: $app_ns
spec:
  targetRef:
    group: ""
    kind: Service
    namespace: $app_ns
    name: yadaapi-backup
  default:
    interval: 5s
    timeout: 3s
    healthyThreshold: 1
    unhealthyThreshold: 1
    port: 8080
    http:
      host: contoso.com
      path: /api/healthcheck
      match:
        statusCodes: 
        - start: 200
          end: 299
    useTLS: false
EOF
fi

##################################
#         Book info app          #
##################################

if [[ "$bookapp" == "yes" ]]; then
    book_ns=bookinfo
    echo "INFO: Creating bookinfo app in namespace $book_ns..."
    kubectl create ns $book_ns
    if [[ "$istio" == "yes" ]]; then
        echo "INFO: Labeling namespace $book_ns for Istio injection with revision $istio_revision..."
        if [[ "$istio_mode" == "addon" ]]; then
            kubectl label namespace $book_ns istio.io/rev=${istio_revision}
        fi
        kubectl label namespace $app_ns istio-injection=enabled
    fi
    kubectl apply -n $book_ns -f https://raw.githubusercontent.com/istio/istio/release-1.18/samples/bookinfo/platform/kube/bookinfo.yaml
    # Create HTTP route
    kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: bookinfo
  namespace: $book_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: http
  hostnames:
  - "$fqdn"
  rules:
  - backendRefs:
    - name: productpage
      port: 9080
EOF
    kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: HealthCheckPolicy
metadata:
  name: healthcheck-productpage
  namespace: $book_ns
spec:
  targetRef:
    group: ""
    kind: Service
    namespace: $book_ns
    name: productpage
  default:
    interval: 5s
    timeout: 3s
    healthyThreshold: 1
    unhealthyThreshold: 1
    port: 9080
    http:
      host: contoso.com
      path: /
      match:
        statusCodes: 
        - start: 200
          end: 299
    useTLS: false
EOF
fi


#####################
#        WAF        #
#####################

if [[ "$waf" == "yes" ]]; then
    waf_policy_id=$(az network application-gateway waf-policy list -g $rg --query '[0].id' -o tsv --only-show-errors)
    if [[ -z "$waf_policy_id" ]]; then
        echo "INFO: No WAF policy found in resource group $rg, creating a new one..."
    else
        echo "INFO: WAF policy found with ID $waf_policy_id, deleting first..."
        az network application-gateway waf-policy delete -g $rg -n $waf_policy_name -o none --only-show-errors
    fi
    echo "INFO: Creating WAF policy..."
    if [[ "$waf_type" == "default" ]]; then
        az network application-gateway waf-policy create -g $rg -n $waf_policy_name --type Microsoft_DefaultRuleSet --version 2.1 -o none --only-show-errors
    elif [[ "$waf_type" == "OWASP" ]]; then
        az network application-gateway waf-policy create -g $rg -n $waf_policy_name --type OWASP --version 3.2 -o none --only-show-errors
    elif [[ "$waf_type" == "bot" ]]; then
        az network application-gateway waf-policy create -g $rg -n $waf_policy_name --type Microsoft_BotProtection --version 1.1 -o none --only-show-errors
    else
        echo "INFO: WAF type $waf_type not recognized, supported types are: default, OWASP, bot"
    fi
    echo "INFO: Enabling policy (per default disabled)"
    az network application-gateway waf-policy policy-setting update --policy-name $waf_policy_name -g $rg --state Enabled -o none
    # Create security policy (only in BYOD mode)
    if [[ "$mode" == "byod" ]]; then
        # https://learn.microsoft.com/en-us/rest/api/applicationgatewaycontainers/security-policies-interface/create-or-update?view=rest-applicationgatewaycontainers-2025-01-01&tabs=HTTP
        echo "INFO: Creating security policy linked to WAF policy..."
        subscription_id=$(az account show --query id -o tsv)
        waf_policy_id=$(az network application-gateway waf-policy show -g $rg -n $waf_policy_name --query id -o tsv)
        url="https://management.azure.com/subscriptions/${subscription_id}/resourceGroups/${rg}/providers/Microsoft.ServiceNetworking/trafficControllers/${agc_name}/securityPolicies/${sec_policy_name}?api-version=2025-01-01"
        body="{ \"location\": \"$location\", \"properties\": { \"wafPolicy\": { \"id\": \"$waf_policy_id\" } } }"
        az rest --method put --uri "$url" --body "$body" -o none --only-show-errors
    fi
    # Create custom rule based on geolocation
    echo "INFO: Creating custom rules in WAF policy..."
    # match_conditions="[{'variables': [{'variableName': 'RemoteAddr'}],'operator':'GeoMatch','values': ['US'], 'transforms': ['lowerCase']}]"
    # az network application-gateway waf-policy custom-rule create -g $rg --policy-name $waf_policy_name -n customrule00 --priority 10 --action Block \
    #   --rule-type MatchRule --action Block --match-conditions "$match_conditions" \
    #   -o none --only-show-errors
    # Create custom rule based on custom header
    match_conditions="[{'variables': [{'variableName': 'RequestHeaders', 'selector': 'User-Agent'}],'operator':'Contains','values': ['evilbot'], 'transforms': ['lowerCase']}]"
    az network application-gateway waf-policy custom-rule create -g $rg --policy-name $waf_policy_name -n customrule01 --priority 20 --action Block \
      --rule-type MatchRule --action Block --match-conditions "$match_conditions" \
      -o none --only-show-errors
    # Create k8s WAF policy and attach to HTTP route
    waf_policy_id=$(az network application-gateway waf-policy show -g $rg -n $waf_policy_name --query id -o tsv)
    echo "INFO: Attaching the WAF policy to the HTTP routes"
    kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: WebApplicationFirewallPolicy
metadata:
  name: $waf_policy_name
  namespace: $app_ns
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: yadaapi
    namespace: $app_ns
    #sectionNames: ["pathA"]    # Must be corrected in the docs???
  webApplicationFirewall:
    id: $waf_policy_id
EOF
    # WAF policy attached to TLS listener
    if [[ "$tls" == "yes" ]]; then
      kubectl apply -f - <<EOF
apiVersion: alb.networking.azure.io/v1
kind: WebApplicationFirewallPolicy
metadata:
  name: ${waf_policy_name}-tls
  namespace: default
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: $agc_name
    namespace: default
    sectionNames: [ https ]  # Must be corrected in the docs???
  webApplicationFirewall:
    id: $waf_policy_id
EOF
    fi

if [[ "$test_cmds" == "yes" ]]; then
    az network application-gateway waf-policy list -g $rg -o table
    az network application-gateway waf-policy policy-setting list -g $rg --policy-name $waf_policy_name -o jsonc
    kubectl get WebApplicationFirewallPolicy -n $app_ns
    kubectl describe WebApplicationFirewallPolicy -n $app_ns
    kubectl describe httproute yadaapi -n $app_ns
fi

if [[ "$test_cmds" == "yes" ]]; then
    echo "INFO: This should work:"
    curl "http://${fqdn}/api/healthcheck"
    echo "INFO: This should be blocked:"
    curl -A evilbot "http://${fqdn}/api/healthcheck"
fi

#####################
#    TLS service    #
#####################

###### WIP!!! #######

# Maybe not required, since we can use the Istio extension to speak mTLS to the backend services??

if [[ $tls == "yes" ]]; then

    # Create namespace
    kubectl create ns $tls_app_ns

    # Create nginx secret
    # ssl_crt=$(cat $pem_file | base64)
    # ssl_key=$(cat $key_file | base64)
    kubectl create secret tls yadatls-cert --cert=$pem_file --key=$key_file -n $tls_app_ns

    # Create deployment
    kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-conf
  namespace: $tls_app_ns
data:
  nginx.conf: |
    user nginx;
    worker_processes auto;
    events {
      worker_connections 1024;
    }
    pid /var/run/nginx.pid;
    http {
        server {
            listen 443 ssl;
            server_name localhost;
            ssl_protocols              TLSv1.2;
            ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
            ssl_prefer_server_ciphers  on;
            ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
            ssl_session_timeout  24h;
            keepalive_timeout 300; # up from 75 secs default
            add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
            ssl_certificate /etc/nginx/ssl/tls.crt;
            ssl_certificate_key /etc/nginx/ssl/tls.key; 
            # ssl_certificate      /etc/nginx/ssl.crt;
            # ssl_certificate_key  /etc/nginx/ssl.key;
            location /api/ {
                proxy_pass http://127.0.0.1:8080 ;
                proxy_set_header Connection "";
                proxy_set_header Host \$host;
                proxy_set_header X-Real-IP \$remote_addr;
                proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
                # proxy_set_header X-Forwarded-For \$remote_addr;
            }
        }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: yadatls
  name: yadatls
  namespace: $tls_app_ns
spec:
  replicas: 1
  selector:
    matchLabels:
      run: yadatls
  template:
    metadata:
      labels:
        run: yadatls
    spec:
      containers:
      - name: api
        image: erjosito/yadaapi:1.0
        ports:
        - containerPort: 8080
          protocol: TCP
      - name: nginx
        image: mcr.microsoft.com/oss/nginx/nginx:1.15.5-alpine
        ports:
        - containerPort: 443
          protocol: TCP
        volumeMounts:
            - name: nginx-conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: certs
              mountPath: /etc/nginx/ssl
      volumes:
      - name: nginx-conf
        configMap:
          name: nginx-conf
          items:
            - key: nginx.conf
              path: nginx.conf
      - name: certs
        secret:
           secretName: yadatls-cert
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: yadatls8080
  namespace: $tls_app_ns
spec:
  type: ClusterIP
  ports:
  - port: 8080
    targetPort: 8080
  selector:
    run: yadatls
---
apiVersion: v1
kind: Service
metadata:
  name: yadatls443
  namespace: $tls_app_ns
spec:
  type: ClusterIP
  ports:
  - port: 443
    targetPort: 443
  selector:
    run: yadatls
---
apiVersion: alb.networking.azure.io/v1
kind: BackendTLSPolicy
metadata:
  name: yadatlspolicy
  namespace: $tls_app_ns
spec:
  targetRef:
    group: ""
    kind: Service
    name: yadatls443
    namespace: $tls_app_ns
  default:
    sni: $tls_app_fqdn
    ports:
    - port: 443
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tlsyadaapi
  namespace: $tls_app_ns
spec:
  parentRefs:
  - name: $agc_name
    namespace: default
    sectionName: https
  hostnames:
  - "$tls_app_fqdn"
  rules:
  - backendRefs:
    - name: yadatls443
      port: 443
---
apiVersion: alb.networking.azure.io/v1
kind: HealthCheckPolicy
metadata:
  name: healthcheck-yada-tls
  namespace: $tls_app_ns
spec:
  targetRef:
    group: ""
    kind: Service
    namespace: $tls_app_ns
    name: yadatls443
  default:
    interval: 5s
    timeout: 3s
    healthyThreshold: 1
    unhealthyThreshold: 1
    port: 443
    http:
      host: contoso.com
      path: /api/healthcheck
      match:
        statusCodes: 
        - start: 200
          end: 299
    useTLS: true
EOF

    ip_address=$(dig +short $fqdn)
    if [[ "$test_cmds" == "yes" ]]; then
        curl --resolve "${tls_app_fqdn}:443:${ip_address}" "https://${tls_app_fqdn}/api/ip"
    fi
fi

#####################
# Azure Diagnostics #
#####################

agc_name=$(az network alb list -g $node_rg --query '[0].name' -o tsv)
if [[ "$test_cmds" == "yes" ]]; then
    az network alb list -g $node_rg -o table
    az network alb association list --alb-name $agc_name -g $node_rg -o table
    az network alb frontend list --alb-name $agc_name -g $node_rg -o table
fi

##########################
# Kubernetes Diagnostics #
##########################

if [[ "$test_cmds" == "yes" ]]; then
    # Check AKS and network config
    az aks list -g $rg --only-show-errors --query '[].{Name:name, Plugin:networkProfile.networkPlugin, Dataplane:networkProfile.networkDataplane, Policy:networkProfile.networkPolicy, PluginMode:networkProfile.networkPluginMode, NetworkMode:networkProfile.networkMode}' -o table
    # Check the helm deployment
    kubectl get deployment -n azure-alb-system -o wide
    # Check the AGC pods
    kubectl get pods -n azure-alb-system
    # Check the logs in the AGC pods
    # Some potential errors:
    # AGC and AKS in different VNets:
    # failed to reconcile overlay resources: Overlay extension config azure-alb-system/alb-overlay-extension-config-0c3df5e1 failed with error: OEC IP range 10.14.100.0/24 is not within any of the VNet CIDRs 10.13.0.0/16
    agc_pods=$(kubectl get pods -n azure-alb-system --no-headers | awk '{print $1}')
    for pod in $agc_pods; do kubectl logs $pod -n azure-alb-system; done
    # Check the logs in the AGC pods excluding info messages
    agc_pods=$(kubectl get pods -n azure-alb-system --no-headers | awk '{print $1}')
    echo "INFO: $agc_pods" | while IFS= read -r pod; do kubectl logs $pod -n azure-alb-system | jq 'select(.level != "info")'; done
    # Check the logs in the AGC istio extension pods excluding info messages
    istio_extension_ns=alb
    istio_extension_pods=$(kubectl get pods -n $istio_extension_ns --no-headers | awk '{print $1}')
    echo "INFO: $istio_extension_pods" | while IFS= read -r pod; do kubectl logs $pod -n $istio_extension_ns | jq 'select(.level != "info")'; done
    # Same with no JSON
    echo "INFO: $istio_extension_pods" | while IFS= read -r pod; do kubectl logs $pod -n $istio_extension_ns | jq -r '[.Timestamp, .message] | @tsv'; done
    # Verify the ALB in Azure
    az network alb list -g $rg -o table
    alb_name=$(az network alb list -g $rg --query '[0].name' -o tsv)
    az network alb frontend list -g $rg --alb-name $alb_name -o table
    # Verify the ALB in k8s
    kubectl get applicationLoadBalancer
    # Verify the gatewayclass
    kubectl get gatewayclass azure-alb-external -o yaml
    # Gateways
    # Some potential errors:
    # Cannot get configuration endpoint for undeployed or unknown Application Gateway for Containers resource
    kubectl get gateway
    kubectl describe gateway
    # HTTP routes
    kubectl get httproute -n $app_ns
    kubectl describe httproute yadaapi -n $app_ns
    # Istio
    az aks show -n $aks_name -g $rg --query 'serviceMeshProfile.istio.revisions' -o tsv
    kubectl get ns --show-labels
    kubectl get peerauthentication -n $app_ns
fi

###########
# Cleanup #
###########

# !!! Danger !!!
# az group delete -n $rg -y --no-wait
# rm -rf istio-$istio_version     # we may need istioctl later