apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "kubeapps.frontend-config.fullname" . }}
  labels:{{ include "kubeapps.extraAppLabels" . | nindent 4 }}
    app: {{ template "kubeapps.frontend-config.fullname" . }}
data:
  k8s-api-proxy.conf: |-
    # Disable buffering for log streaming
    proxy_buffering off;
    # Hide Www-Authenticate to prevent it triggering a basic auth prompt in
    # the browser with some clusters
    proxy_hide_header Www-Authenticate;

    # Keep the connection open with the API server even if idle (the default is 60 seconds)
    # Setting it to 1 hour which should be enough for our current use case of deploying/upgrading apps
    # If we enable other use-cases in the future we might need to bump this value
    # More info here https://github.com/kubeapps/kubeapps/issues/766
    proxy_read_timeout 1h;

    {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
    # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
    proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
    {{- end }}
  {{- range .Values.clusters }}
  {{- if .certificateAuthorityData }}
  {{ .name }}-ca.pem: {{ .certificateAuthorityData }}
   {{- end }}
  {{- end}}
  vhost.conf: |-
    # Retain the default nginx handling of requests without a "Connection" header
    map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
    }

    # Allow websocket connections
    proxy_set_header Upgrade    $http_upgrade;
    proxy_set_header Connection $connection_upgrade;

    server {
      listen 8080;
  {{- if .Values.frontend.largeClientHeaderBuffers }}
      large_client_header_buffers {{ .Values.frontend.largeClientHeaderBuffers }};
  {{- end }}
  {{- if .Values.enableIPv6 }}
      listen [::]:8080;
  {{- end}}
      server_name _;

      location /healthz {
        access_log off;
        default_type text/plain;
        return 200 "healthy\n";
      }

      # Ensure each cluster can be reached (should only be
      # used with an auth-proxy where k8s credentials never leave
      # the cluster). See clusters option.
      {{- range .Values.clusters }}
      location ~* /api/clusters/{{ .name }} {
        rewrite /api/clusters/{{ .name }}/(.*) /$1 break;
        rewrite /api/clusters/{{ .name }} / break;
        proxy_pass {{ default "https://kubernetes.default" .apiServiceURL }};
        {{- if .certificateAuthorityData }}
        proxy_ssl_trusted_certificate "./server_blocks/{{ .name }}-ca.pem";
        {{- end }}
        include "./server_blocks/k8s-api-proxy.conf";
      }
      {{- end }}

      # TODO: The following location is left for backwards compat but will no longer
      # be needed once clients are sending the cluster name.
      # Using regexp match instead of prefix one because the application can be
      # deployed under a specific path i.e /kubeapps
      location ~* /api/kube {
        rewrite /api/kube/(.*) /$1 break;
        rewrite /api/kube / break;
        proxy_pass https://kubernetes.default;
        include "./server_blocks/k8s-api-proxy.conf";
      }

      location ~* /api/assetsvc {
        rewrite /api/assetsvc/(.*) /assetsvc/$1 break;
        rewrite /api/assetsvc /assetsvc break;

        {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
        # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
        proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
        {{- end }}

        proxy_pass {{ include "kubeapps.frontend-config.proxy_pass" . -}};
      }

      location ~* /api/tiller-deploy {
        # Keep the connection open with the API server even if idle (the default is 60 seconds)
        # Setting it to 10 minutes which should be enough for our current use case of deploying/upgrading/deleting apps
        proxy_read_timeout 10m;
        rewrite /api/tiller-deploy/(.*) /$1 break;
        rewrite /api/tiller-deploy / break;
        proxy_pass {{ include "kubeapps.frontend-config.proxy_pass" . -}};

        {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
        # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
        proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
        {{- end }}
      }

      # The route for the Kubeapps backend API is not prefixed.
      location ~* /api/ {
        rewrite /api/(.*) /backend/$1 break;
        rewrite /api/ /backend break;

        {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
        # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
        proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
        {{- end }}

        proxy_pass {{ include "kubeapps.frontend-config.proxy_pass" . -}};
      }

      location / {
        # Add the Authorization header if exists
        add_header Authorization $http_authorization;

        proxy_pass http://{{ template "kubeapps.dashboard.fullname" . }}:{{ .Values.dashboard.service.port }};
      }
    }
