// ❌ Application-managed TLS — 9 services, 9 certificate configurations
// payment-service/server.ts
import https from 'https'
import fs from 'fs'

const server = https.createServer({
  cert: fs.readFileSync('/etc/certs/payment-service.crt'), // Manually provisioned
  key:  fs.readFileSync('/etc/certs/payment-service.key'),  // Manually rotated
  ca:   fs.readFileSync('/etc/certs/internal-ca.crt'),      // Shared CA cert — must distribute manually
  requestCert: true,        // Require client cert — mTLS
  rejectUnauthorized: true, // Reject if client cert is not from our CA
}, app)

// Problems:
// - Certificate rotation requires restarting the service (downtime)
// - Each new service must be manually provisioned with a cert from the CA
// - Cert expiry monitoring must be implemented per service
// - A misconfigured service can silently fall back to no TLS

# iptables rules injected by istio-init container (simplified)
# All outbound TCP traffic is redirected to Envoy's outbound port
iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-port 15001

# All inbound TCP traffic is redirected to Envoy's inbound port
iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-port 15006

# The application thinks it is talking directly to payment-service:3001
# Envoy intercepts the connection, performs mTLS, and forwards to the destination Envoy
# The destination Envoy decrypts and forwards to the local application on localhost

# Kubernetes Service definition — creates a stable DNS name
apiVersion: v1
kind: Service
metadata:
  name: payment-service
  namespace: production
spec:
  selector:
    app: payment-service
  ports:
    - port: 3001
      targetPort: 3001

# DNS name: payment-service.production.svc.cluster.local
# Resolves to: ClusterIP (virtual IP), which load-balances across all ready pods
# When pods restart with new IPs, the DNS record is updated by kube-dns/CoreDNS automatically

// ✅ Services reference each other by DNS name — never by IP
const paymentServiceUrl = 'http://payment-service.production.svc.cluster.local:3001'

// Kubernetes short form (within same namespace):
const paymentServiceUrl = 'http://payment-service:3001'

# consul/service-registration.hcl
service {
  name    = "payment-service"
  id      = "payment-service-1"
  address = "10.0.1.45"
  port    = 3001

  check {
    http     = "http://10.0.1.45:3001/health/ready"
    interval = "10s"
    timeout  = "2s"
  }

  tags = ["v2.1.0", "production"]
  meta = {
    version = "2.1.0"
    region  = "us-east-1"
  }
}

// Consul DNS query — returns healthy instances automatically
// payment-service.service.consul:3001
// Unhealthy instances (failing health check) are removed from DNS within one interval

// ❌ Service-to-service auth via shared API key — static, shared, leakable
const response = await fetch('http://inventory-service/stock', {
  headers: {
    'X-Service-Token': process.env.INVENTORY_API_KEY, // Shared secret
    // If this secret leaks (logs, environment dump, git commit), any process can impersonate order-service
    // Rotation requires updating the secret in all consumers simultaneously
  }
})

# Istio PeerAuthentication — enforce mTLS for all services in the production namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # PERMISSIVE allows plaintext (migration); STRICT rejects all non-mTLS

---
# Istio AuthorizationPolicy — service-level RBAC via workload identity
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-service
  rules:
    - from:
        - source:
            principals:
              # Only the order-service workload identity (SPIFFE URI) can call payment-service
              - "cluster.local/ns/production/sa/order-service"
      to:
        - operation:
            methods: ["POST"]
            paths: ["/charges"]

# Istio VirtualService — 5% canary traffic to payment-service v2
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: payment-service-routing
  namespace: production
spec:
  hosts:
    - payment-service
  http:
    - route:
        - destination:
            host: payment-service
            subset: v1   # Stable version (95% of traffic)
          weight: 95
        - destination:
            host: payment-service
            subset: v2   # Canary version (5% of traffic)
          weight: 5

---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: payment-service-subsets
  namespace: production
spec:
  host: payment-service
  subsets:
    - name: v1
      labels:
        version: "1.0.0"
    - name: v2
      labels:
        version: "2.0.0"

# Istio VirtualService — declarative retry and timeout policies
# No application code changes required
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: inventory-service-policy
spec:
  hosts:
    - inventory-service
  http:
    - timeout: 3s   # Total request timeout — 3 seconds
      retries:
        attempts: 3
        perTryTimeout: 800ms
        # Only retry on connection failures and 503s — NOT 500s (could indicate non-idempotent failure)
        retryOn: "connect-failure,refused-stream,503"
      route:
        - destination:
            host: inventory-service

# Istio Telemetry config — no application code changes needed for golden signals
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: production
spec:
  metrics:
    - providers:
        - name: prometheus
  tracing:
    - providers:
        - name: otel
      randomSamplingPercentage: 1.0   # 1% head-based sampling; override per service
  accessLogging:
    - providers:
        - name: otel