feat(ingress): add TLS configuration for staging hosts

Add TLS configuration for staging-shiny and staging-shiny-api 
hosts in the ingress resources. Create a new namespace for 
ingress-nginx to better organize resources. Update kustomization 
files to include new certificates and secrets. Streamline setup 
process with improved wait commands for pod readiness.

k8s/app/certificates.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ2ekNDQXRPZ0F3SUJBZ0lVSjVMNmRDaWNZMlByN2dZb3NmMjNtVElZV1dBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZTXhDekFKQmdOVkJBWVRBbE5GTVI0d0hBWURWUVFJREJWV3c0UENwSE4wY21FZ1I4T0R3clowWVd4aApibVF4RWpBUUJnTlZCQWNNQ1ZOMllXNWxjM1Z1WkRFd01DNEdBMVVFQ2d3blZXNWliM1Z1WkNCVGIyWjBkMkZ5ClpTQkVaWFpsYkc5d2JXVnVkQ0JUZG1WdWMydGhJRUZDTVE0d0RBWURWUVFEREFWc2IyTmhiREFnRncweU5URXkKTVRBd05qTTFOREJhR0E4ek1ESTFNRFF4TWpBMk16VTBNRm93Z1lNeEN6QUpCZ05WQkFZVEFsTkZNUjR3SEFZRApWUVFJREJWV3c0UENwSE4wY21FZ1I4T0R3clowWVd4aGJtUXhFakFRQmdOVkJBY01DVk4yWVc1bGMzVnVaREV3Ck1DNEdBMVVFQ2d3blZXNWliM1Z1WkNCVGIyWjBkMkZ5WlNCRVpYWmxiRzl3YldWdWRDQlRkbVZ1YzJ0aElFRkMKTVE0d0RBWURWUVFEREFWc2IyTmhiRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQgpBTFczUmxDOGpLVlZMem9xZ2NqYk90b0duSlE2UDZ2QTRHZ1kyR1QyR1NySVRpMWtjWnRYbitJaW5xM3RYNmtuCkoyU3JDVTdaT3hJVWJSMVo3ZTV2RVlBMFQ2dXpGNk1aOTNZeWp1ejhqQUN6V0o5MjdXWTRxUDRrNWpUS2t5VEsKUWloTDByTEJoM3EvalFkWXZuc2dMa2hNd0hkTVJ6aWxNNG1iay9JNmhzZUJWenBpaCtOQ1dIYVRLdFQvOWMraApYam1kNWRuK3VVK3dncUtzUDd5WWRubm1tM2ZLOVBUQkliRGdObEdSTkdBRkJqMzJOd3BmejNCckRXSTBaSFcrCkl5cHVHQTQwNm9GMzFSZVRJdzlaUTJvUnQ5Z2pEYWFvdUtOMHFPeTlnZ2dyTGliTDVNTlFRa0sraWJUQXgzUncKOFhhNVlTK05GQmIvZVJKTHZkcFVQcEVDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRkFyRmY3alEvRWN3UHNEcQpQdUJxYVZnTDVicUVNQjhHQTFVZEl3UVlNQmFBRkFyRmY3alEvRWN3UHNEcVB1QnFhVmdMNWJxRU1BOEdBMVVkCkV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQ044Ukx3azR2ajhzOEtHTTFhRHlkbFgKVWJIamRaVmE3Q2dxNm9DbS9MZTVEdUVxUkFjTnY2L0U2TFQ3ZzZuTXdtSlBSUk9oMjE3TVgyNitMY3JpZkxpRAoxZHBZSGw3OUErN1J2SFcyb2t2T3VjWGcrcU4wM3FTaGh2NzBqZ0p1MHE0QmZOSmpSbzI3dTBRb1VNbUpaNVpHCnZ5ZUxUaTcyZDNpdXdLdFBrNi9RN25VR01pR0ROOWNLWStHdk1CNjVVNHNXWDgwN1piZ3h0Zk9mQi9McmJ5ZG8KVUVRU3BNR2U2RGlEajVnWmN2SGNORUVQNlpHOHJpYUY0MDZBdDN5ODZMQTE5WGJZajRBSkkxeFpWUE8rZWIvQwptVzVDYU1yRGd5TGhHeDFYUm9WWTlLZldqekp6alIvQTFNUGV2cFZiQTFPb20wRGtWM09DZWFCY25jcjVmYUE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzF0MFpRdkl5bFZTODYKS29ISTJ6cmFCcHlVT2orcndPQm9HTmhrOWhrcXlFNHRaSEdiVjUvaUlwNnQ3VitwSnlka3F3bE8yVHNTRkcwZApXZTN1YnhHQU5FK3JzeGVqR2ZkMk1vN3MvSXdBczFpZmR1MW1PS2orSk9ZMHlwTWt5a0lvUzlLeXdZZDZ2NDBICldMNTdJQzVJVE1CM1RFYzRwVE9KbTVQeU9vYkhnVmM2WW9malFsaDJreXJVLy9YUG9WNDVuZVhaL3JsUHNJS2kKckQrOG1IWjU1cHQzeXZUMHdTR3c0RFpSa1RSZ0JRWTk5amNLWDg5d2F3MWlOR1IxdmlNcWJoZ09OT3FCZDlVWApreU1QV1VOcUViZllJdzJtcUxpamRLanN2WUlJS3k0bXkrVERVRUpDdm9tMHdNZDBjUEYydVdFdmpSUVcvM2tTClM3M2FWRDZSQWdNQkFBRUNnZ0VBQTFkNHJsdzJHRktwSEJPR2NFYkJhclVDQk8vTzR5Uis0bDVpbVNpMWJQa3YKb0hWRm5NU0NqV1FNeXZ1ZnVsUTJabkdHdzM1d3lhY2c2UFo0YUhkTE9SaTlMTHhhekIvYWhZeTYzb21lWitOSwoxeUN3WENSNm1rNnBBZWhTK2dBNVpOVWM3WjFyNG1QOXk0dVhjZlVCOGE1dURVT1VvN2M4YThzQ28zNGcxc21RCkZNYXJxS1dXRGVFZlF2NW5NTzlPRzZvOVdkR2pDaTZ4a3lCK244WmdSR0N0ZllPRWdPNVNEY3hCc2dMVWF2RisKTHd2K3hDZ0x5SkN0dE1nTzF2SGJucmRQSDJ1UFlWcmxpYmJYYktmSnhhVktwQWFybHV3MEFkMTdNWGpwR3ZEagpXMEZPdXRSand3V1BtWVV3WHV4Q2NlYU9lcjJ2S1VJVmptYm4xRStVU1FLQmdRRCsxbms5V1A1L1lmR1pYVWhyCkQwVytJOEZkMW9iKzNxVlRFc2lESG5iY0tJay93ZUd3ME93dlNRbFhGOURVT3l2cFlHNzdJSytTdkV2Tm8rVUsKazhRUjhoejU4cXExdms3bDZBcWxFTEtqTElmYmxTTXdsbVdqWG5nbW8zMVpnemF0Z2orMHdKNTcveVFSQTZXSApQa0FQNW1MNU9rMnJ5YU1NQ3RtWHRHYmwzd0tCZ1FDMmkyNHJWVHk3WHhETTFXdDFleGREQXk0akVBQ3QvWFoyCm9Zd3d5dk5Kc2h2Mmo3ZTZVUEYwdDQ0LzIreGhvdlNTYld2VWVtR29PWUVTTzFnRFdGcmtmY3A3YWhLVE9Ca2MKYldSbEh6Q2FmNEFkRUswd2FuUkFFOUN5YmNONkNGQUlJYnJyN0o3ZkhTeFBRUW95S3k1M2FJZng2N0ppMVl6dwpIS3lPVDlzSmp3S0JnUUNnOFhjVWhaWUZnU2dDZ2VWd3ArNldEU0xjVHRabk5Ob1l3eTRia1N2a0V6M0xKSG1UCkgvOXFSYWcrZHU0T2UyaGFOZXNoY3gwdmdQZ200YkdQb284Yi9scktpTFhEbm5OWnc5aWxNd3grL1dxNEJWSjYKSnlIOXNYWVVnUUJ6ZmVrVVg4UTROY1poN1ZzcjI2KzQ0Rm01TVBtbENXdHdhU0l1UXRQMWVadmE1UUtCZ1FDTApVa0dFV3lyZUN3R0VoRUxleUZLSnQ4eW53QmYwczJXTngyQjdBUHJNUFY3d1FPSkdGbThpMk5GOTFibEZENTFBCmdMankwM0RqZHZnVzFTb29hMi83d2pJZkhXY042NXZtd1dzRmJ0ZW1vemRCZDYvbkt1aU0yMUxHUzlZTXRubDIKcTEvQm5yZm1xNXBjNXRRRVZFYkRwZ2xUejhNM2dhdHV1MFBMM2hEYjZ3S0JnRTBKK2o0RGlxRGFqUGlCWkNDbQpMQ2hEeDA1WTFOMTF5bC9haWNsZnVVSjZheTFDQU5NKy9wRkZ0RHdoQzc1R3JvZzJoS242SVN1N1IxUTdPZjZ1CnpITDU5SXQ0UkRXdlREQlpaTk9FU2szemdueVJwOGgxb29lNitjeUJ3dXowQ0w1ekFjTFNPVnhYQ2N6ZUorYkEKSTgxZ1ZsNkc0MzBROHVWc1FOcmlUVGdrCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+kind: Secret
+metadata:
+  name: ca-key-pair
+  namespace: default
+type: Opaque
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-signed
+  namespace: default
+spec:
+  ca:
+    secretName: ca-key-pair
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: self-signed-cert
+  namespace: default
+spec:
+  subject:
+    organizations:
+    - shiny
+  dnsNames:
+  - shiny
+  - auth0
+  - staging-shiny.unbound.se
+  - staging-shiny-api.unbound.se
+  secretName: self-signed-cert-tls
+  issuerRef:
+    name: self-signed

k8s/app/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- certificates.yaml
+- secrets-store.yaml
+- local-proxy.yaml

k8s/app/local-proxy.yaml

@@ -0,0 +1,79 @@
+# Local development proxy configuration
+# Proxies traffic from KinD cluster to host machine for local development
+#
+# Add to /etc/hosts:
+#   192.168.228.2 staging-shiny.unbound.se staging-shiny-api.unbound.se
+#
+# Apply with: kubectl apply -f local-proxy.yaml
+# Delete with: kubectl delete -f local-proxy.yaml
+
+---
+# Frontend proxy (port 3300)
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-external
+spec:
+  type: ExternalName
+  externalName: host.docker.internal
+  ports:
+    - port: 3300
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: frontend
+  annotations:
+    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:3300"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - staging-shiny.unbound.se
+      secretName: self-signed-cert-tls
+  rules:
+    - host: staging-shiny.unbound.se
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: frontend-external
+                port:
+                  number: 3300
+---
+# API proxy (port 4444)
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-external
+spec:
+  type: ExternalName
+  externalName: host.docker.internal
+  ports:
+    - port: 4444
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api
+  annotations:
+    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:4444"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - staging-shiny-api.unbound.se
+      secretName: self-signed-cert-tls
+  rules:
+    - host: staging-shiny-api.unbound.se
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api-external
+                port:
+                  number: 4444

k8s/app/secrets-store.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: external-secrets
+spec:
+  provider:
+    fake:
+      data:
+      - key: "applications/shiny/accounting-service"
+        value: '{}'
+      - key: "applications/shiny/authz-service"
+        value: '{}'
+      - key: "applications/shiny/company-service"
+        value: '{}'
+      - key: "applications/shiny/consumer-service"
+        value: '{}'
+      - key: "applications/shiny/employee-service"
+        value: '{}'
+      - key: "applications/shiny/invoice-service"
+        value: '{}'
+      - key: "applications/shiny/notification-service"
+        value: '{}'
+      - key: "applications/shiny/salary-service"
+        value: '{}'
+      - key: "applications/shiny/supplier-service"
+        value: '{}'
+      - key: "applications/shiny/supplier-invoice-service"
+        value: '{}'
+      - key: "applications/shiny/time-service"
+        value: '{}'
+      - key: "applications/shiny/gateway"
+        value: '{"API_KEY": "us_ak_vUj37A1ukjIfhkJH"}'
+      - key: "rds/postgres/prod-psql"
+        value: '{"POSTGRES_URL": "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable", "DB_HOST": "postgres", "DB_NAME": "postgres", "DB_PASSWORD": "postgres", "DB_PORT": "5432", "DB_USERNAME": "postgres"}'
+      - key: "mq/rabbit/prod"
+        value: '{"AMQP_URL": "amqp://user:password@rabbitmq:5672/"}'
+      - key: "services/schemas"
+        value: '{"ISSUER": "auth0", "STRICT_SSL": "false"}'