# Render-only overlay for ci/run-httproute-match-test.sh, applied LAST.
#
# Its one job is to put this chart into Gateway mode, because the convention
# ships with httpRoute.enabled: false and the test would otherwise be green
# over nothing. A chart that has an overlay here and still renders no
# HTTPRoute FAILS the test - that is the whole point of the file existing.
#
# An overlay and not a change to ci/sure/test-values.yaml: the install-test
# runs exactly ONE configuration per chart and the two modes are mutually
# exclusive, so switching the fixture would drop this chart's Ingress from the
# install for a CRD schema cyberchef's fixture already exercises against the
# real Gateway-API CRDs.
#
# ingress.enabled: false is not optional here - the chart aborts its own render
# when both modes are true. For THIS chart the combination also exercises
# sure.publishedOverTls: with the Ingress off and the route on, the render must
# still produce RAILS_ASSUME_SSL/RAILS_FORCE_SSL as "true", because TLS is
# terminated at the Gateway. That is not asserted by this test - it only looks
# at HTTPRoutes - but it is rendered here, so a regression shows up in the
# manifest this job parses rather than only in a cluster.
#
# ingress.domain comes from ci/sure/test-values.yaml and keeps feeding
# APP_DOMAIN, WEBAUTHN_RP_ID and WEBAUTHN_ALLOWED_ORIGINS in this mode too;
# httpRoute.hostnames is left empty on purpose, so the fallback to
# ingress.domain is what the test exercises.
ingress:
  enabled: false
httpRoute:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway
      sectionName: https