apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: agent-monitor
  namespace: agent-monitor
  labels:
    app.kubernetes.io/name: agent-monitor
    app.kubernetes.io/instance: agent-monitor
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/component: ingress
    app.kubernetes.io/managed-by: kustomize
  annotations:
    # NGINX Ingress Controller annotations
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    # WebSocket upgrade support
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
    # Sticky sessions for WebSocket
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/affinity-mode: persistent
    nginx.ingress.kubernetes.io/session-cookie-name: agent-monitor-affinity
    nginx.ingress.kubernetes.io/session-cookie-max-age: "10800"
    nginx.ingress.kubernetes.io/session-cookie-samesite: Strict
    nginx.ingress.kubernetes.io/session-cookie-secure: "true"
    # Security headers
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/hsts: "true"
    nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
    nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - agent-monitor.example.com
      secretName: agent-monitor-tls
  rules:
    - host: agent-monitor.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: agent-monitor
                port:
                  name: http