# Render-only overlay for ci/run-httproute-match-test.sh, applied LAST.
#
# Its one job is to put this chart into Gateway mode, because the convention
# ships with httpRoute.enabled: false and the test would otherwise be green
# over nothing. A chart that has an overlay here and still renders no
# HTTPRoute FAILS the test - that is the whole point of the file existing.
#
# An overlay and not a change to ci/bulwark/test-values.yaml: the install-test
# runs exactly ONE configuration per chart, and this chart's fixture installs
# the StatefulSet with its PVC and both 1Password items. Trading its Ingress
# for a CRD schema check that cyberchef's fixture already performs against the
# real Gateway-API CRDs would be a bad swap. The install keeps the Ingress; the
# route is held here, at render level, which is where its silent failure modes
# live.
#
# ingress.enabled: false is not optional here - ingress.enabled is this chart's
# routing switch and defaults to TRUE, so without this line the chart aborts
# its own render with both modes on.
#
# ONE ROUTING OBJECT, WHICH IS ALL THIS CHART HAS. #114's measured table and
# the header of ci/run-httproute-match-test.sh both expected two Ingresses and
# a rewrite-target here; neither is the case, and the reason is in
# bulwark.httproute.yaml. In short: Bulwark cannot be served under a sub-path
# (NEXT_PUBLIC_BASE_PATH is compiled into the bundle), so there is one object,
# one rule, at "/", and no URLRewrite filter for the #118 prefix/redirect
# assurance to pair up with. Every "rewrite-target" string in this chart is an
# explanation of why it does not work, and a grep counted those as
# occurrences.
#
# WHAT THIS OVERLAY COVERS:
#
#   - ingress.domain comes from the fixture, so the route renders with its
#     hostname from that single source of truth - httpRoute.hostnames stays
#     empty on purpose, because the fallback is the path every installation
#     will actually use.
#   - the route's backendRef is checked against the serving Service of the same
#     render, by PORT NUMBER (bulwark.port) rather than by the name "http" the
#     Ingress uses, because backendRefs takes a PortNumber. This overlay is
#     what holds that number against the Service's.
#
# NOT covered here, and it cannot be: that the hostname answers. No Gateway
# controller runs in CI and no route reaches "Accepted: True". Nor the thing
# this chart actually loses in this mode - the operator's
# proxy-body-size: 25m, which has no counterpart in the specification. That
# loss is documented in values.yaml and printed by NOTES.txt, and documentation
# is not something a test can assert.
ingress:
  enabled: false
httpRoute:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway
      sectionName: https