apiVersion: v1
kind: Secret
metadata:
  name: opens3-console-secrets
  namespace: minio
type: Opaque
stringData:
  # Endpoint S3 del server MinIO a cui la console si collega.
  # Cambialo con l'URL reale del tuo MinIO (Service interno o esterno).
  CONSOLE_MINIO_SERVER: "http://minio.minio.svc.cluster.local:9000"

  # Passphrase e salt usati da opens3/console per cifrare le sessioni
  # (PBKDF2). Generane di robusti, es.:
  #   openssl rand -base64 32
  CONSOLE_PBKDF_PASSPHRASE: "OHB576kn9SS4JdD7qG4+hyjRpa353HQqxPQ22z2Do0w="
  CONSOLE_PBKDF_SALT: "OBHOWF2INklmrtmyI+qNEb3dbV0yz9ZAxiJJCcC6GYw="
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opens3-console
  namespace: minio
  labels:
    app.kubernetes.io/name: opens3-console
    app.kubernetes.io/instance: opens3-console
spec:
  replicas: 1
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: opens3-console
      app.kubernetes.io/instance: opens3-console
  template:
    metadata:
      labels:
        app.kubernetes.io/name: opens3-console
        app.kubernetes.io/instance: opens3-console
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: console
          image: opens3/console:latest
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 9090
              protocol: TCP
          envFrom:
            - secretRef:
                name: opens3-console-secrets
          # Se il MinIO target usa certificati self-signed, decommenta:
          # env:
          #   - name: CONSOLE_MINIO_TLS_SKIP_VERIFICATION
          #     value: "on"
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 15
            periodSeconds: 20
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
---
apiVersion: v1
kind: Service
metadata:
  name: opens3-console
  namespace: minio
  labels:
    app.kubernetes.io/name: opens3-console
    app.kubernetes.io/instance: opens3-console
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: opens3-console
    app.kubernetes.io/instance: opens3-console
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httproute-minio-direct
spec:
  hostnames:
  - idcidp.pigreco66.it
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: main-gateway
    namespace: nginx-gateway
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: opens3-console
      port: 80
      weight: 1
    filters:
    - responseHeaderModifier:
        remove:
        - X-Frame-Options
        - Content-Security-Policy
        set:
        - name: X-Frame-Options
          value: SAMEORIGIN
        - name: Content-Security-Policy
          value: frame-ancestors 'self'
      type: ResponseHeaderModifier
    matches:
    - path:
        type: PathPrefix
        value: /minio-console