# Public traffic reaches the web Service and nothing else. The API is not exposed: the
# browser talks to one origin, the web server forwards /api inside the cluster, and the
# session cookie stays first party. SPEC.md is explicit that there is no CORS in v1, and
# an Ingress that published the API would be the thing that made CORS necessary.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: impuestos
  namespace: impuestos
  annotations:
    # A scan is a photograph.
    nginx.ingress.kubernetes.io/proxy-body-size: '12m'
spec:
  ingressClassName: nginx
  tls:
    - hosts: ['impuestos.example']
      secretName: impuestos-tls
  rules:
    - host: impuestos.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: impuestos-web
                port: { name: http }