{{- $replicas := include "cyberchef.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.cyberchef.replicas) -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list .Values.ingress.domain -}}
{{- end -}}
CyberChef {{ .Chart.AppVersion }} — release {{ .Release.Name }} in namespace {{ .Release.Namespace }}.

{{- if .Values.ingress.enabled }}

ACCESS — INGRESS MODE (ingress.enabled: true, httpRoute.enabled: false)
  https://{{ .Values.ingress.domain }}

  The certificate is requested by cert-manager through the "{{ .Values.ingress.clusterIssuer }}"
  cluster issuer. Until it has been issued the browser shows a warning; follow it with

    kubectl -n {{ .Release.Namespace }} get certificate tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress

  This chart has no secrets and no volumes — the two ingress values above are
  everything an installation needs.
{{- else if $httpRoute.enabled }}

ACCESS — GATEWAY MODE (httpRoute.enabled: true, ingress.enabled: false)
{{- range $hostnames }}
  https://{{ . }}
{{- end }}

  This release renders an HTTPRoute ({{ .Release.Name }}-{{ .Chart.Name }}-httproute) and NOTHING else
  of the routing path — no Gateway, no class, no Certificate. Three things
  therefore belong to the cluster and not to this chart, and if any of them is
  missing the hostname above simply does not answer:

    1. The Gateway-API CRDs. Without them this install would have failed, so
       they are present — nothing to check.
    2. The Gateway named in httpRoute.parentRefs
{{- range $httpRoute.parentRefs }}
         {{ .name }}{{ if .namespace }} in namespace {{ .namespace }}{{ end }}{{ if .sectionName }}, listener {{ .sectionName }}{{ end }}
{{- end }}
       must exist AND its listener must allow routes from this namespace
       ({{ .Release.Namespace }}) in allowedRoutes. A rejected attachment is
       visible only in the route's status:

         kubectl -n {{ .Release.Namespace }} get httproute {{ .Release.Name }}-{{ .Chart.Name }}-httproute -o yaml

       Read status.parents[].conditions — "Accepted: True" and
       "ResolvedRefs: True" is what a working attachment looks like. An empty
       status means no controller has looked at the route at all.
    3. The TLS certificate for the hostname, on the Gateway's listener.
       ingress.clusterIssuer is NOT used in this mode and is not required —
       the chart renders no Certificate here, so there is no
       tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress secret and nothing for cert-manager to do
       on behalf of this release.

  ingress.annotations is also inert in this mode: the Gateway API has no
  annotation channel for controller behaviour. See the note below on who can
  use this instance.
{{- else }}

ACCESS — NEITHER INGRESS NOR HTTPROUTE
  ingress.enabled and httpRoute.enabled are both false, so this release has no
  Ingress, no HTTPRoute and no certificate; ingress.domain and
  ingress.clusterIssuer are not needed. The app is only reachable inside the
  cluster, as {{ .Release.Name }}-{{ .Chart.Name }}-service:80. To open it locally:

    kubectl -n {{ .Release.Namespace }} port-forward svc/{{ .Release.Name }}-{{ .Chart.Name }}-service 8080:80

  Then browse to http://localhost:8080. To publish it instead, set either
  ingress.enabled=true with ingress.domain and ingress.clusterIssuer, or
  httpRoute.enabled=true with ingress.domain and httpRoute.parentRefs.
{{- end }}
{{ if eq $replicas "0" }}
SCALED TO ZERO
  {{ if .Values.scaleDown }}scaleDown: true{{ else }}cyberchef.replicas: 0{{ end }} — the deployment runs with replicas: 0, so the endpoint
  above does not answer until you set it back and upgrade again. Service{{ if .Values.ingress.enabled }} and
  Ingress stay in place, so the certificate is not re-issued.{{ else if $httpRoute.enabled }} and
  HTTPRoute stay in place, so the route keeps pointing at a Service with no
  endpoints — the Gateway answers with an error of its own rather than with
  nothing.{{ else }} stays in
  place.{{ end }}
{{ end }}
ANYONE WHO REACHES THE URL CAN USE IT
{{- if $httpRoute.enabled }}
  CyberChef has no login, and this chart adds none. In GATEWAY MODE there is no
  place in this chart to put one either: the Gateway API has no annotation
  channel, so the ingress-nginx external-auth or basic-auth annotations that
  cover this in Ingress mode have NO counterpart here, and the chart renders no
  implementation-specific policy object on purpose (it would bind the chart to
  one Gateway implementation). Protection has to come from the Gateway itself —
  a listener that is not publicly reachable, or that implementation's own auth
  filter/policy, configured next to the Gateway and not here.
{{- else }}
  CyberChef has no login, and this chart adds none. If it must not be open to
  everyone, put authentication in front of it via ingress.annotations — the
  chart merges them into the Ingress, e.g. ingress-nginx external auth or
  basic auth annotations. Note that this escape hatch exists in Ingress mode
  only: httpRoute.enabled has no annotation channel at all.
{{- end }}

NOTHING TO BACK UP, NOTHING TO MIGRATE
  CyberChef is a static web app: recipes and inputs are processed in the
  visitor's browser and never reach the server. The pod only serves files and
  holds no state, so app-version upgrades and rollbacks carry no data risk and
  need no migration step.
{{- if .Values.cyberchef.env }}

cyberchef.env HAS NO EFFECT ON THE APP
  cyberchef.env is set. The entries reach the nginx process that serves the
  files, but the served CyberChef bundle is static and reads none of them —
  configuration has to happen in the browser.
{{- end }}