# Render-only overlay for ci/run-httproute-match-test.sh, applied LAST.
#
# Its one job is to put this chart into Gateway mode, because the convention
# ships with httpRoute.enabled: false and the test would otherwise be green
# over nothing. A chart that has an overlay here and still renders no
# HTTPRoute FAILS the test - that is the whole point of the file existing.
#
# An overlay and not a change to ci/keycloak/test-values.yaml: the install-test
# runs exactly ONE configuration per chart, and this chart's fixture is the
# expensive and informative one - two replicas against a throwaway PostgreSQL,
# two init containers, `kc.sh build` under readOnlyRootFilesystem, and the
# Infinispan cluster forming over jdbc-ping (see that file for the four things
# only a real install can prove). Trading all of it for a CRD schema check that
# cyberchef's fixture already performs against the real Gateway-API CRDs would
# be a bad swap. The install keeps the two Ingresses; the two routes are held
# here, at render level, which is where their silent failure modes live.
#
# ingress.enabled: false is not optional here. The two modes are mutually
# exclusive and the chart aborts its own render when both are true, so an
# overlay that only switched httpRoute on would turn this test red.
#
# WHAT THIS OVERLAY COVERS, WHICH IS BOTH ROUTING OBJECTS:
#
#   - ingress.domain comes from the fixture (keycloak.ci.example.com), so the
#     PUBLIC route renders with its hostname from that single source of truth
#     (httpRoute.hostnames stays empty on purpose - the fallback is the path
#     that every installation will actually use).
#   - ingress.admin.enabled is true in the fixture with
#     ingress.admin.domain set, so the ADMIN route renders too, and its
#     parentRefs fall back to httpRoute.parentRefs below - the empty-admin
#     branch, which is the one an installation hits unless it wants an
#     internal Gateway.
#   - both routes' backendRef is checked against the serving Service of the
#     same render. Both point at the SAME Service, by PORT NUMBER
#     (keycloak.ports.http) rather than by the name "http" the Ingress uses,
#     because backendRefs takes a PortNumber - so this overlay is what holds
#     that number against the Service's.
#
# NOT covered here, and it cannot be: that either hostname answers. No Gateway
# controller runs in CI, no route reaches "Accepted: True", and the
# proxy-buffer-size/proxy-buffers-number annotations this chart's live
# installation relies on have no counterpart in this mode at all - that loss is
# documented in values.yaml and printed by NOTES.txt, and documentation is not
# something a test can assert.
ingress:
  enabled: false
httpRoute:
  enabled: true
  parentRefs:
    - name: public
      namespace: gateway
      sectionName: https