# istio-enterprise-mesh.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: enterprise-control-plane
  namespace: istio-system
spec:
  # Enterprise-grade configuration
  values:
    global:
      meshID: enterprise-mesh
      network: enterprise-network
      
      # Multi-cluster configuration
      remotePilotAddress: ""
      meshNetworks:
        enterprise-network:
          endpoints:
          - fromRegistry: kubernetes
          gateways:
          - address: istio-eastwestgateway.istio-system.svc.cluster.local
            port: 15443
      
      # Security configuration
      jwtPolicy: third-party-jwt
      
      # Proxy configuration
      proxy:
        # Resource allocation
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        
        # Logging configuration
        logLevel: warning
        componentLogLevel: "misc:error"
        
        # Performance tuning
        concurrency: 2
        
        # Security hardening
        privileged: false
        readinessInitialDelaySeconds: 10
        readinessPeriodSeconds: 5
        readinessFailureThreshold: 10
        
        # Proxy metadata
        proxyMetadata:
          PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION: true
          PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: true
          PILOT_TRACE_SAMPLING: "0.1"
  
  # Component-specific configurations
  components:
    pilot:
      k8s:
        # High availability configuration
        replicaCount: 3
        
        # Resource allocation
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
          limits:
            cpu: 1000m
            memory: 4096Mi
        
        # Pod disruption budget
        podDisruptionBudget:
          minAvailable: 2
        
        # Node affinity for control plane
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: istiod
              topologyKey: kubernetes.io/hostname
        
        # Environment variables
        env:
        - name: PILOT_ENABLE_STATUS
          value: "true"
        - name: PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION
          value: "true"
        - name: EXTERNAL_ISTIOD
          value: "false"
        - name: PILOT_TRACE_SAMPLING
          value: "1.0"
        
        # Service configuration
        service:
          type: LoadBalancer
          loadBalancerIP: 10.0.100.50
    
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        replicaCount: 3
        
        # Resource allocation
        resources:
          requests:
            cpu: 1000m
            memory: 1024Mi
          limits:
            cpu: 2000m
            memory: 2048Mi
        
        # Service configuration
        service:
          type: LoadBalancer
          loadBalancerIP: 10.0.100.100
          ports:
          - port: 15021
            targetPort: 15021
            name: status-port
          - port: 80
            targetPort: 8080
            name: http2
          - port: 443
            targetPort: 8443
            name: https
          - port: 15443
            targetPort: 15443
            name: tls
        
        # Pod disruption budget
        podDisruptionBudget:
          minAvailable: 2
        
        # Horizontal pod autoscaler
        hpaSpec:
          maxReplicas: 10
          minReplicas: 3
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-ingressgateway
          metrics:
          - type: Resource
            resource:
              name: cpu
              target:
                type: Utilization
                averageUtilization: 70
          - type: Resource
            resource:
              name: memory
              target:
                type: Utilization
                averageUtilization: 80
    
    - name: istio-eastwestgateway
      label:
        istio: eastwestgateway
        app: istio-eastwestgateway
      enabled: true
      k8s:
        replicaCount: 3
        
        # Service configuration for cross-cluster communication
        service:
          type: LoadBalancer
          loadBalancerIP: 10.0.100.101
          ports:
          - port: 15021
            targetPort: 15021
            name: status-port
          - port: 15443
            targetPort: 15443
            name: tls
        
        # Environment variables
        env:
        - name: ISTIO_META_ROUTER_MODE
          value: sni-dnat
        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
          value: enterprise-network
    
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        replicaCount: 2
        
        # Resource allocation
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1024Mi
---
# Advanced traffic management policies
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: enterprise-default-policies
  namespace: istio-system
spec:
  host: "*.local"
  
  # Traffic policy
  trafficPolicy:
    # Load balancing
    loadBalancer:
      simple: LEAST_CONN
      consistentHash:
        httpHeaderName: "x-user-id"
    
    # Connection pool settings
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 30s
        keepAlive:
          time: 7200s
          interval: 60s
          probes: 3
      
      http:
        http1MaxPendingRequests: 50
        http2MaxRequests: 100
        maxRequestsPerConnection: 10
        maxRetries: 3
        consecutiveGatewayErrors: 5
        interval: 30s
        baseEjectionTime: 30s
        maxEjectionPercent: 50
        minHealthPercent: 30
        splitExternalLocalOriginErrors: false
    
    # Circuit breaker
    outlierDetection:
      consecutiveGatewayErrors: 5
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30
      splitExternalLocalOriginErrors: false
  
  # Port-specific policies
  portLevelSettings:
  - port:
      number: 80
    loadBalancer:
      simple: ROUND_ROBIN
  - port:
      number: 443
    loadBalancer:
      simple: LEAST_CONN
    connectionPool:
      tcp:
        maxConnections: 50
---
# Virtual service for traffic routing
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: enterprise-api-routing
  namespace: production
spec:
  hosts:
  - api.company.com
  - internal-api.company.com
  
  gateways:
  - istio-system/enterprise-gateway
  
  http:
  # API versioning routing
  - match:
    - headers:
        api-version:
          exact: "v2"
    - uri:
        prefix: "/api/v2/"
    route:
    - destination:
        host: api-service-v2.production.svc.cluster.local
        port:
          number: 80
      weight: 100
    fault:
      delay:
        percentage:
          value: 0.1
        fixedDelay: 5s
    retries:
      attempts: 3
      perTryTimeout: 10s
      retryOn: 5xx,reset,connect-failure,refused-stream
  
  # Default v1 API routing
  - match:
    - uri:
        prefix: "/api/"
    route:
    - destination:
        host: api-service-v1.production.svc.cluster.local
        port:
          number: 80
      weight: 90
    - destination:
        host: api-service-v2.production.svc.cluster.local
        port:
          number: 80
      weight: 10
    
    # Traffic mirroring for testing
    mirror:
      host: api-service-canary.production.svc.cluster.local
      port:
        number: 80
    mirrorPercentage:
      value: 5.0
    
    # Request/response transformation
    headers:
      request:
        add:
          x-request-id: "%REQ(x-request-id)%"
          x-forwarded-proto: "https"
        remove:
        - x-internal-header
      response:
        add:
          x-content-type-options: "nosniff"
          x-frame-options: "DENY"
        remove:
        - server
    
    # Rate limiting
    match:
    - headers:
        x-user-type:
          exact: "premium"
    route:
    - destination:
        host: api-service-v1.production.svc.cluster.local
    fault:
      abort:
        percentage:
          value: 0
        httpStatus: 429
    
    timeout: 30s
    retries:
      attempts: 3
      perTryTimeout: 10s
      retryOn: 5xx,reset,connect-failure,refused-stream
      retryRemoteLocalities: true
---
# Security policies
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  # Require mTLS for all services
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-access-control
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-service
  
  rules:
  # Allow access from ingress gateway
  - from:
    - source:
        principals: ["cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"]
    to:
    - operation:
        methods: ["GET", "POST", "PUT", "DELETE"]
        paths: ["/api/*"]
  
  # Allow access from authenticated users
  - from:
    - source:
        requestPrincipals: ["https://auth.company.com/oauth2/default"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/v1/public/*"]
  
  # Deny access to admin endpoints except from admin service
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/admin-service"]
    to:
    - operation:
        methods: ["GET", "POST", "DELETE"]
        paths: ["/api/v1/admin/*"]
  
  # Rate limiting by user
  - from:
    - source:
        requestPrincipals: ["*"]
    when:
    - key: request.headers[x-user-id]
      values: ["*"]
    to:
    - operation:
        methods: ["*"]

# kong-enterprise-gateway.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kong-gateway
  namespace: kong
  labels:
    app: kong-gateway
spec:
  replicas: 3
  selector:
    matchLabels:
      app: kong-gateway
  template:
    metadata:
      labels:
        app: kong-gateway
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8100"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: kong
      
      # Anti-affinity for high availability
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - kong-gateway
              topologyKey: kubernetes.io/hostname
      
      containers:
      - name: kong
        image: kong/kong-gateway:3.4.0
        
        # Environment configuration
        env:
        - name: KONG_DATABASE
          value: "postgres"
        - name: KONG_PG_HOST
          value: "postgres.kong.svc.cluster.local"
        - name: KONG_PG_PORT
          value: "5432"
        - name: KONG_PG_USER
          valueFrom:
            secretKeyRef:
              name: kong-postgres
              key: username
        - name: KONG_PG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: kong-postgres
              key: password
        - name: KONG_PG_DATABASE
          value: "kong"
        
        # Proxy configuration
        - name: KONG_PROXY_ACCESS_LOG
          value: "/dev/stdout"
        - name: KONG_ADMIN_ACCESS_LOG
          value: "/dev/stdout"
        - name: KONG_PROXY_ERROR_LOG
          value: "/dev/stderr"
        - name: KONG_ADMIN_ERROR_LOG
          value: "/dev/stderr"
        - name: KONG_PROXY_LISTEN
          value: "0.0.0.0:8000, 0.0.0.0:8443 ssl"
        - name: KONG_ADMIN_LISTEN
          value: "0.0.0.0:8001"
        - name: KONG_STATUS_LISTEN
          value: "0.0.0.0:8100"
        
        # Enterprise features
        - name: KONG_ENFORCE_RBAC
          value: "on"
        - name: KONG_ADMIN_GUI_LISTEN
          value: "0.0.0.0:8002, 0.0.0.0:8445 ssl"
        - name: KONG_ADMIN_GUI_URL
          value: "https://kong-admin.company.com"
        
        # Performance tuning
        - name: KONG_WORKER_PROCESSES
          value: "auto"
        - name: KONG_WORKER_CONNECTIONS
          value: "4096"
        - name: KONG_NGINX_HTTP_CLIENT_BODY_BUFFER_SIZE
          value: "8k"
        - name: KONG_NGINX_HTTP_CLIENT_MAX_BODY_SIZE
          value: "100m"
        
        # Security configuration
        - name: KONG_REAL_IP_HEADER
          value: "X-Forwarded-For"
        - name: KONG_REAL_IP_RECURSIVE
          value: "on"
        - name: KONG_TRUSTED_IPS
          value: "0.0.0.0/0,::/0"
        
        # License configuration
        - name: KONG_LICENSE_DATA
          valueFrom:
            secretKeyRef:
              name: kong-enterprise-license
              key: license
        
        ports:
        - name: proxy
          containerPort: 8000
          protocol: TCP
        - name: proxy-ssl
          containerPort: 8443
          protocol: TCP
        - name: admin
          containerPort: 8001
          protocol: TCP
        - name: admin-gui
          containerPort: 8002
          protocol: TCP
        - name: status
          containerPort: 8100
          protocol: TCP
        
        # Resource allocation
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 4Gi
        
        # Health checks
        livenessProbe:
          httpGet:
            path: /status
            port: 8100
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        
        readinessProbe:
          httpGet:
            path: /status/ready
            port: 8100
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3
        
        # Security context
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
        
        # Volume mounts
        volumeMounts:
        - name: kong-config
          mountPath: /etc/kong
          readOnly: true
        - name: kong-logs
          mountPath: /var/log/kong
        - name: kong-tmp
          mountPath: /tmp
      
      volumes:
      - name: kong-config
        configMap:
          name: kong-config
      - name: kong-logs
        emptyDir: {}
      - name: kong-tmp
        emptyDir: {}
---
# Kong service configuration
apiVersion: v1
kind: Service
metadata:
  name: kong-proxy
  namespace: kong
  labels:
    app: kong-gateway
spec:
  type: LoadBalancer
  loadBalancerIP: 10.0.100.200
  
  ports:
  - name: proxy
    port: 80
    targetPort: 8000
    protocol: TCP
  - name: proxy-ssl
    port: 443
    targetPort: 8443
    protocol: TCP
  
  selector:
    app: kong-gateway
---
# Kong Ingress Controller configuration
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: rate-limiting-plugin
  namespace: production
plugin: rate-limiting
config:
  minute: 100
  hour: 1000
  policy: redis
  redis_host: redis.kong.svc.cluster.local
  redis_port: 6379
  redis_timeout: 2000
  hide_client_headers: false
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: cors-plugin
  namespace: production
plugin: cors
config:
  origins:
  - "https://company.com"
  - "https://*.company.com"
  methods:
  - GET
  - POST
  - PUT
  - DELETE
  - OPTIONS
  headers:
  - Accept
  - Accept-Version
  - Content-Length
  - Content-MD5
  - Content-Type
  - Date
  - X-Auth-Token
  - Authorization
  exposed_headers:
  - X-Auth-Token
  credentials: true
  max_age: 3600
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: jwt-auth-plugin
  namespace: production
plugin: jwt
config:
  uri_param_names:
  - jwt
  header_names:
  - authorization
  claims_to_verify:
  - exp
  - iat
  key_claim_name: iss
  secret_is_base64: false
  run_on_preflight: true
---
# Kong Ingress resource
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: kong
    konghq.com/plugins: rate-limiting-plugin,cors-plugin,jwt-auth-plugin
    konghq.com/preserve-host: "true"
    konghq.com/strip-path: "true"
spec:
  tls:
  - hosts:
    - api.company.com
    secretName: api-tls-secret
  
  rules:
  - host: api.company.com
    http:
      paths:
      - path: /api/v1
        pathType: Prefix
        backend:
          service:
            name: api-service-v1
            port:
              number: 80
      - path: /api/v2
        pathType: Prefix
        backend:
          service:
            name: api-service-v2
            port:
              number: 80