# Kubernetes Ingress NGINX TLS 1.3 Configuration
# Version: 1.0 | Date: 2026-04-02 | DPDPA Rule 6(1)(a)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dpdpa-api-ingress
  annotations:
    # TLS 1.3 only (disable TLS 1.0, 1.1, 1.2)
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.3"

    # Strong cipher suites (TLS 1.3)
    nginx.ingress.kubernetes.io/ssl-ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

    # Prefer server cipher order (though TLS 1.3 uses client preference)
    nginx.ingress.kubernetes.io/ssl-prefer-server-ciphers: "off"

    # HSTS (Strict-Transport-Security)
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload";
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Content-Type-Options: nosniff";

    # Automatic certificate provisioning via cert-manager
    cert-manager.io/cluster-issuer: "letsencrypt-prod"

    # Force HTTPS redirect
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

spec:
  ingressClassName: nginx

  tls:
  - hosts:
    - api.example.com  # Replace with your domain
    secretName: api-tls-secret  # cert-manager auto-provisions this

  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080

---
# cert-manager ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: security@example.com  # Replace with your email
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx