# Ingress + sidecar Envoy + L4 NLB снаружи
apiVersion: v1
kind: Service
metadata:
  name: api
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local   # сохраняем client IP
  ports:
    - port: 443
      targetPort: 8443           # envoy sidecar TLS
  selector:
    app: api
---
# readiness отделён от liveness
readinessProbe:
  httpGet: { path: /readyz, port: 8080 }
  periodSeconds: 5
  failureThreshold: 2
livenessProbe:
  httpGet: { path: /healthz, port: 8080 }
  periodSeconds: 30
  failureThreshold: 5
# preStop для graceful drain
lifecycle:
  preStop:
    exec: { command: ["sleep", "15"] }

# ClusterIP + NodePort + L7 LB снаружи
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: NodePort
  externalTrafficPolicy: Cluster   # двойной hop, теряем client IP
  ports:
    - port: 443
      nodePort: 30443
      targetPort: 8080            # plaintext снаружи кластера

# один probe для всего
livenessProbe:
  httpGet: { path: /api/users   # deep check, дёргает БД
             port: 8080 }
  periodSeconds: 10
  failureThreshold: 3
# никакого preStop