{{- $settings := fromYaml (include "garage.settings" .) }}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  ports:
    # The S3 endpoint. In-cluster consumers reach it at
    #   http://<release>-garage-service.<namespace>.svc.cluster.local:3900
    # with path-style addressing (bucket in the path), which needs no
    # root_domain and no DNS wildcard.
    - protocol: TCP
      port: {{ $settings.ports.s3 | int64 }}
      targetPort: s3
      name: s3
    # The admin endpoint. With no admin_token configured (see the ConfigMap)
    # this serves exactly two things without authentication, /health and
    # /metrics, and answers everything else with 401 - so it is a monitoring
    # surface, not a management one.
    - protocol: TCP
      port: {{ $settings.ports.admin | int64 }}
      targetPort: admin
      name: admin
    {{- if $settings.web.enabled }}
    - protocol: TCP
      port: {{ $settings.ports.web | int64 }}
      targetPort: web
      name: web
    {{- end }}
  # DELIBERATELY NO RPC PORT. Port 3901 exists on the pod because Garage binds
  # it either way, but nothing should reach it: a single node has no peers, and
  # this chart renders neither bootstrap_peers nor the kubernetes_discovery CRD.
  # A Service port would advertise a cluster interface that is not one.
  #
  # ClusterIP, and no value to change it. The S3 API authenticates every
  # request, but the way out of the cluster is an Ingress with a certificate
  # (ingress.enabled, off by default), not a NodePort that puts an object store
  # on a routable address by accident.
  type: ClusterIP