{{- /*
Catalyst HTTPRoute for Keycloak — bp-keycloak (issue #387, Cilium Gateway
API migration). Replaces the upstream chart's networking.k8s.io/v1.Ingress
on Sovereigns; the upstream `keycloak.ingress.enabled` is set to `false`
in values.yaml so this is the sole HTTP exposure.

Pattern from docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode):
  - `gateway.host` — operator-supplied; fails closed if absent
  - `gateway.parentRef` — defaults to cilium-gateway in kube-system
                          (the per-Sovereign Gateway from bootstrap-kit
                          01-cilium.yaml)

Backend reference: the upstream bitnami/keycloak chart's Service is
named `<release>-keycloak`. With `releaseName: keycloak` set in the
bootstrap-kit slot the Service is `keycloak-keycloak`. Operators can
override via `gateway.backendService` if a non-default release name is
used.
*/}}
{{- if and .Values.gateway .Values.gateway.enabled -}}
{{- if .Values.gateway.host }}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Values.gateway.name | default "keycloak" | quote }}
  namespace: {{ .Release.Namespace }}
  labels:
    catalyst.openova.io/blueprint: bp-keycloak
    catalyst.openova.io/component: keycloak
spec:
  parentRefs:
    - name: {{ .Values.gateway.parentRef.name | default "cilium-gateway" | quote }}
      namespace: {{ .Values.gateway.parentRef.namespace | default "kube-system" | quote }}
      {{- with .Values.gateway.parentRef.sectionName }}
      sectionName: {{ . | quote }}
      {{- end }}
  hostnames:
    - {{ .Values.gateway.host | quote }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: {{ .Values.gateway.path | default "/" | quote }}
      backendRefs:
        - name: {{ .Values.gateway.backendService | default (printf "%s-keycloak" .Release.Name) | quote }}
          port: {{ .Values.gateway.backendPort | default 80 }}
{{- end }}
{{- end }}
