apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: guacamole
  namespace: guacamole
spec:
  hosts:
    - guacamole.kube.huskypup.net
  gateways:
    - istio-system/edge
  http:
    - route:
        - destination:
            host: guacamole.guacamole.svc.cluster.local
            port:
              number: 8080

---
# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
# Without this, the OIDC callback can hit a different pod than the one that generated
# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: guacamole
  namespace: guacamole
spec:
  host: guacamole.guacamole.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpCookie:
          name: GUAC_ROUTE
          ttl: 3600s