system=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m | sed -E 's/x86_/amd/' | sed -E 's/aarch/arm/')
release=v1.2.4
curl -L https://github.com/flomesh-io/fsm/releases/download/$release/fsm-$release-$system-$arch.tar.gz | tar -vxzf -
./$system-$arch/fsm version

fsm install \
    --set=fsm.fsmGateway.enabled=true

kubectl get gatewayclass
NAME              CONTROLLER                      ACCEPTED   AGE
fsm-gateway-cls   flomesh.io/gateway-controller   True       106s

helm repo add jetstack https://charts.jetstack.io --force-update
helm repo update

helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.14.5 \
  --set installCRDs=true

openssl genrsa 2048 > ca-key.pem

openssl req -new -x509 -nodes -days 365000 \
   -key ca-key.pem \
   -out ca-cert.pem \
   -subj '/CN=flomesh.io'

kubectl create secret generic -n cert-manager ca-key-pair \
  --from-file=tls.crt=./ca-cert.pem \
  --from-file=tls.key=./ca-key.pem

cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ca-issuer-sample
spec:
  ca:
    secretName: ca-key-pair
EOF

kubectl create namespace httpbin
cat <<EOF | kubectl apply -n httpbin -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
  template:
    metadata:
      labels:
        app: httpbin
    spec:
      containers:
      - name: httpbin
        image: kennethreitz/httpbin
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
spec:
  selector:
    app: httpbin
  ports:
    - protocol: TCP
      port: 8080
      targetPort: 80
EOF

cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: simple-gateway-cert
  namespace: httpbin
spec:
  secretName: simple-gateway-cert
  duration: 60m
  renewBefore: 59m
  subject:
    organizations:
      - flomesh-io
  commonName: foo.example.com
  issuerRef:
    name: ca-issuer-sample
    kind: ClusterIssuer
    group: cert-manager.io
EOF

kubectl get secret simple-gateway-cert
NAME                  TYPE                DATA   AGE
simple-gateway-cert   kubernetes.io/tls   3      20s

cat <<EOF | kubectl apply -n httpbin -f -
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: simple-fsm-gateway
spec:
  gatewayClassName: fsm-gateway-cls
  listeners:
  - name: https
    port: 8000
    protocol: HTTPS
    tls:
      certificateRefs:
      - kind: Secret
        name: simple-gateway-cert
      mode: Terminate
    allowedRoutes:
      namespaces:
        from: Same
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-route-foo
spec:
  parentRefs:
  - name: simple-fsm-gateway
    port: 8000
  hostnames:
    - foo.example.com
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: httpbin
      port: 8080
EOF

curl https://foo.example.com/headers  --connect-to foo.example.com:443:$GATEWAY_IP:8000
curl: (60) SSL certificate problem: unable to get local issuer certificate

curl --cacert ca-cert.pem https://foo.example.com/headers  --connect-to foo.example.com:443:$GATEWAY_IP:8000 -v
* Connecting to hostname: 198.19.249.153
* Connecting to port: 8000
*   Trying 198.19.249.153:8000...
* Connected to 198.19.249.153 (198.19.249.153) port 8000
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: ca-cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: O=flomesh-io; CN=foo.example.com
*  start date: May  8 14:59:33 2024 GMT
*  expire date: May  8 15:59:33 2024 GMT
*  common name: foo.example.com (matched)
*  issuer: CN=flomesh.io
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://foo.example.com/headers
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: foo.example.com]
* [HTTP/2] [1] [:path: /headers]
* [HTTP/2] [1] [user-agent: curl/8.4.0]
* [HTTP/2] [1] [accept: */*]
> GET /headers HTTP/2
> Host: foo.example.com
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/2 200
< server: gunicorn/19.9.0
< date: Wed, 08 May 2024 15:00:07 GMT
< content-type: application/json
< content-length: 141
< access-control-allow-origin: *
< access-control-allow-credentials: true
<
{
  "headers": {
    "Accept": "*/*",
    "Connection": "keep-alive",
    "Host": "foo.example.com",
    "User-Agent": "curl/8.4.0"
  }
}
* Connection #0 to host 198.19.249.153 left intact

kubectl describe certificate simple-gateway-cert
.
Events:
  Type    Reason     Age               From                                       Message
  ----    ------     ----              ----                                       -------
  Normal  Issuing    61s               cert-manager-certificates-trigger          Renewing certificate as renewal was scheduled at 2024-05-08 15:03:33 +0000 UTC
  Normal  Requested  61s               cert-manager-certificates-request-manager  Created new CertificateRequest resource "simple-gateway-cert-1"
  Normal  Issuing    1s                cert-manager-certificates-trigger          Renewing certificate as renewal was scheduled at 2024-05-08 15:04:33 +0000 UTC
  Normal  Reused     1s (x2 over 61s)  cert-manager-certificates-key-manager      Reusing private key stored in existing Secret resource "simple-gateway-cert"
  Normal  Requested  1s                cert-manager-certificates-request-manager  Created new CertificateRequest resource "simple-gateway-cert-2"
  Normal  Issuing    1s (x2 over 61s)  cert-manager-certificates-issuing          The certificate has been successfully issued