{{- $settings := fromYaml (include "garage.settings" .) }}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  ports:
    # The S3 endpoint. In-cluster consumers reach it at
    #   http://<release>-garage-service.<namespace>.svc.cluster.local:3900
    # with path-style addressing (bucket in the path), which needs no
    # root_domain and no DNS wildcard.
    - protocol: TCP
      port: {{ $settings.ports.s3 | int64 }}
      targetPort: s3
      name: s3
    # The admin endpoint. With this chart's configuration it serves exactly two
    # things without authentication - /health (token-free by design) and
    # /metrics (because metrics_require_token defaults to false) - and answers
    # everything else with 401/403 until an admin token exists, whether from
    # the config or from "garage admin-token create". So it is a monitoring
    # surface rather than a management one, and it is a ClusterIP port.
    - protocol: TCP
      port: {{ $settings.ports.admin | int64 }}
      targetPort: admin
      name: admin
    {{- if $settings.web.enabled }}
    - protocol: TCP
      port: {{ $settings.ports.web | int64 }}
      targetPort: web
      name: web
    {{- end }}
  # DELIBERATELY NO RPC PORT. Port 3901 exists on the pod because Garage binds
  # it either way, but nothing should reach it: a single node has no peers, and
  # this chart renders neither bootstrap_peers nor the kubernetes_discovery CRD.
  # A Service port would advertise a cluster interface that is not one.
  #
  # ClusterIP, and no value to change it. The S3 API authenticates every
  # request, but the way out of the cluster is an Ingress with a certificate
  # (ingress.enabled, off by default), not a NodePort that puts an object store
  # on a routable address by accident.
  type: ClusterIP