{{- /*
OFF BY DEFAULT (ingress.enabled: false), because the consumer this chart was
built for speaks S3 inside the cluster and needs no published endpoint. The
values exist anyway, built to this repo's ingress convention, so that
publishing the endpoint later is a values change rather than a chart change.

GUIDELINE 1, CHECKED IN BOTH DIRECTIONS (README, "Values that must not lie"):
nothing outside this template reads ingress.domain. The S3 API's vhost-style
suffix is its own value, garage.s3.rootDomain, because the two are not the same
thing - a wildcard vhost domain and the single host an Ingress answers on. So
with the Ingress switched off, BOTH domain and clusterIssuer are free, and
their required() lives here where it can actually fire.

WHAT IT PUBLISHES: the S3 API. There is no web UI to expose - Garage's admin
API is JSON and the authenticated half is closed in this chart (no token), and
the project's web interface is a separate program that is not part of this
image. Anyone publishing this should know what the object they are putting on
the internet is: an S3 endpoint that authenticates every request with a
signature, whose credentials are the two fields of the s3 vault item.
*/ -}}
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  annotations:
    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided (ingress.clusterIssuer)" .Values.ingress.clusterIssuer }}
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  ingressClassName: {{ .Values.ingress.className }}
  rules:
    - host: {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      http:
        paths:
          - backend:
              service:
                name: {{ .Release.Name }}-{{ .Chart.Name }}-service
                port:
                  name: s3
            path: /
            pathType: Prefix
  tls:
    - hosts:
        - {{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}
      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
{{- end }}