# The console, the admin API and the DoH endpoint, behind TLS.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: fancy-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
  annotations:
    k8s-helper.io/name: "fancy-dns"
    k8s-helper.io/description: "Recursive DNS resolver and admin dashboard"
    k8s-helper.io/group: "Infrastructure"
    k8s-helper.io/icon: "network"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  rules:
    - host: dns.k6n.net
      http:
        paths:
          # DoH must be matched before the catch-all below, and both are
          # Prefix paths on distinct roots so the order is not load-bearing.
          - path: /dns-query
            pathType: Prefix
            backend:
              service:
                name: fancy-dns-web
                port:
                  name: doh
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: fancy-dns-web
                port:
                  name: admin
          # The embedded console.
          - path: /
            pathType: Prefix
            backend:
              service:
                name: fancy-dns-web
                port:
                  name: admin
  tls:
    - hosts: [dns.k6n.net]
      secretName: fancy-dns-tls
---
# Two replicas means one of them can always be taken away for a node drain.
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: fancy-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: fancy-dns