# cyberchef: stateless, no secrets.
#
# THIS CHART IS INSTALLED IN GATEWAY MODE, NOT IN INGRESS MODE (Gitea #114),
# and that is a deliberate trade, because the install-test runs exactly ONE
# configuration per chart and the two modes are mutually exclusive.
#
# What is given up: the Ingress of this one chart is no longer installed
# anywhere. That costs little. An Ingress is a built-in, GA type whose schema
# the API server has validated for a decade, k3d's own ingress controller is
# traefik while this chart asks for the class "nginx", so nothing ever routed
# through it here either - the install only ever proved "the API server
# accepted an Ingress". And it keeps being proved, twenty times over, by every
# other chart in the repo plus `helm lint --strict`, which renders this chart's
# DEFAULTS, i.e. Ingress mode, on every pull request.
#
# What is gained: a real HTTPRoute, applied against the real Gateway-API CRDs
# (see ci/gateway-api-crds.sh), which is a CRD whose schema nothing else in
# this repository has ever exercised. That is where a malformed parentRefs or
# backendRefs is actually caught.
#
# Still NOT proved by this, and it cannot be: that traffic flows. No Gateway
# controller runs in k3d, so nothing routes. The install-test proves the object
# is schema-valid and the pod becomes Ready; ci/run-httproute-match-test.sh
# proves the route points at a Service the same render creates.
ingress:
  # The hostname is read by the HTTPRoute too (httpRoute.hostnames is empty, so
  # it falls back to ingress.domain) - it is the release's public name, not an
  # Ingress switch.
  domain: cyberchef.ci.local
  enabled: false

# TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE.
#
# The whole scope of Gitea #5 rests on one claim: that the install-test
# ENFORCES NetworkPolicies, so a policy which blocks the probe path goes red in
# CI instead of silently in production. k3d is created without
# --disable-network-policy, so k3s should bring its policy controller - but
# "should" read off a flag is not evidence, and 29 charts are about to be
# switched over on the strength of it.
#
# So: 192.0.2.11/32 is a documentation address (RFC 5737 TEST-NET-1). It is
# NOT the k3d node's IP and cannot be. Setting it restricts cyberchef's probe
# port 8080 to that one source, which means the kubelet's probes - which come
# from the node's own address - are dropped.
#
# EXPECTED: the pod never becomes Ready and `kubectl rollout status` times out,
# i.e. the install-test for cyberchef goes RED.
#
# If it goes GREEN instead, policies are not enforced in CI, the net under this
# rollout does not exist, and the scope has to be renegotiated rather than
# pushed through.
networkPolicy:
  probeSources:
    - 192.0.2.11/32
httpRoute:
  enabled: true
  # The Gateway does not exist in the CI cluster, and it does not need to: a
  # parentRef is resolved by the Gateway controller, of which there is none
  # here, so the reference is stored as written. What the real CRDs DO validate
  # is its shape.
  parentRefs:
    - name: ci-gateway
      namespace: default
      sectionName: https