{{- /*
OFF BY DEFAULT (ingress.enabled: false), because the consumer this chart was
built for speaks S3 inside the cluster and needs no published endpoint. The
values exist anyway, built to this repo's ingress convention, so that
publishing the endpoint later is a values change rather than a chart change.

GUIDELINE 1, CHECKED IN BOTH DIRECTIONS (README, "Values that must not lie"):
the S3 API's vhost-style suffix is its own value, garage.s3.rootDomain, because
the two are not the same thing - a wildcard vhost domain and the single host a
route answers on.

This template used to be able to add "and nothing outside it reads
ingress.domain", so that switching the Ingress off freed domain as well as
clusterIssuer. SINCE #114 THAT IS NO LONGER TRUE: garage.httproute.yaml reads
ingress.domain too, as its single hostname when httpRoute.hostnames is empty.
So domain is free only while BOTH routing modes are off. clusterIssuer is
unchanged - it is read nowhere but here, Gateway mode renders no Certificate,
and its required() below still lives where it can actually fire.

WHAT IT PUBLISHES: the S3 API. There is no web UI to expose - Garage's admin
API is JSON and the authenticated half is closed in this chart (no token), and
the project's web interface is a separate program that is not part of this
image. Anyone publishing this should know what the object they are putting on
the internet is: an S3 endpoint that authenticates every request with a
signature, whose credentials are the two fields of the s3 vault item.
*/ -}}
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  annotations:
    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided (ingress.clusterIssuer)" .Values.ingress.clusterIssuer }}
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  rules:
    - host: {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      http:
        paths:
          - backend:
              service:
                name: {{ .Release.Name }}-{{ .Chart.Name }}-service
                port:
                  name: s3
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
{{- end }}