# Internal LoadBalancer exposing the DB-cluster Prometheus to the app cluster.
#
# Both knoe-dev-0 (app) and knoe-dev-cnpg-0 (DB) sit on the same VPC subnet
# (us-west3 default). An internal-LB IP from that subnet is reachable from
# pods in the app cluster, so the app-cluster Grafana can use this URL as a
# datasource without the metric stream ever leaving Google's network.
#
# Why an ILB instead of cluster-local DNS: cluster-local DNS (.svc.cluster.local)
# is NOT cross-cluster. The two GKE clusters have separate kube-dns; the app
# cluster can't resolve services in the DB cluster's DNS namespace. The ILB
# gives a stable VPC-routable IP that crosses the cluster boundary.
#
# Apply (DB cluster):
#   kubectl --context=$DB_CTX apply -f deploy/gcp/gke/cnpg-prometheus-ilb.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: prometheus-cnpg-ilb
  namespace: monitoring
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/instance: kps-kube-prometheus-stack-prometheus
    app.kubernetes.io/managed-by: knoe-installer
  annotations:
    # GKE internal LB (RFC1918 IP from the VPC default subnet).
    networking.gke.io/load-balancer-type: "Internal"
    # Don't expand allow-list to other VPCs/regions; same-region/same-VPC only.
    networking.gke.io/internal-load-balancer-allow-global-access: "false"
spec:
  type: LoadBalancer
  externalTrafficPolicy: Cluster   # OK for an ILB; source-IP preservation not needed
  selector:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/instance: kps-kube-prometheus-stack-prometheus
  ports:
    - name: http
      port: 9090
      targetPort: 9090
      protocol: TCP