k8s istio config

# Sample Istio config for Etherpad
#
# Three resources: Gateway (TLS + hostname), VirtualService (routing +
# websocket-friendly timeouts), DestinationRule (sticky sessions via the
# socket.io `io` cookie).
#
# Assumes:
#   - Istio >= 1.18
#   - A Service named `etherpad` in the `etherpad` namespace, port 9001
#   - A TLS secret `etherpad-tls` already provisioned in the gateway namespace
#   - Hostname etherpad.wikimedia.org — replace as needed
#
# IMPORTANT: sticky sessions are necessary but not sufficient for multi-replica
# Etherpad. Multi-replica also needs the socket.io Redis adapter so pad state
# is shared across pods. Without it, two clients on the same pad routed to
# different pods will see divergent state. See ether/etherpad-lite#3680.
# Recommendation: start with replicas: 1 + good failover, only go multi-replica
# once Redis adapter is wired up.

---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: etherpad
  namespace: etherpad
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: etherpad-tls
      hosts:
        - etherpad.wikimedia.org
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - etherpad.wikimedia.org
      tls:
        httpsRedirect: true

---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: etherpad
  namespace: etherpad
spec:
  hosts:
    - etherpad.wikimedia.org
  gateways:
    - etherpad
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: etherpad
            port:
              number: 9001
      # No per-request timeout — websockets and long-polling sit on the
      # connection indefinitely. Default is 15s, which kills WS upgrades.
      timeout: 0s

---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: etherpad
  namespace: etherpad
spec:
  host: etherpad
  trafficPolicy:
    loadBalancer:
      # Sticky sessions on the socket.io session cookie. Required so
      # long-polling fallback requests land on the same pod that owns the
      # session state. Pure-websocket clients don't need this, but you can't
      # rely on every client being able to upgrade.
      consistentHash:
        httpCookie:
          name: io
          ttl: 0s   # session cookie, expires with the browser tab
    connectionPool:
      tcp:
        maxConnections: 10000
      http:
        # Must exceed socket.io's pingInterval (25s) + pingTimeout (20s) by
        # a comfortable margin. 1h is conservative.
        idleTimeout: 3600s
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 1000