# ------------------------------------------------------------------------------
# ReferenceGrant — allow HTTPRoutes from app namespaces to attach to the Gateway
#
# IMPORTANT: Every new application namespace that needs to route traffic through
# the Cilium Gateway MUST have an entry added here. This is a Gateway API
# security requirement — the grant must live in the gateway namespace.
#
# When adding a new application:
#   1. Add a new `from` entry below with the app namespace
#   2. Push to main
#   3. ArgoCD will sync the updated ReferenceGrant automatically
#
# Namespaces currently permitted:
#   - default       (test workloads)
#   - argocd        (ArgoCD UI)
#   - monitoring    (Grafana)
#   - authentik     (Authentik SSO — future)
#   - gitea         (Gitea — future)
# ------------------------------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-httproutes
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: default
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: argocd
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: monitoring
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: authentik
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: gitea
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: skyway
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: fastpass-gateway