# ------------------------------------------------------------------------------
# HTTPRoute — ArgoCD
# Routes argocd.local.mk-labs.cloud → argocd-server service
#
# This is the first real Gateway API HTTPRoute in the cluster — ArgoCD
# dogfoods the Gateway it manages. Satisfying.
#
# TLS is terminated at the Gateway. cert-manager issues the certificate
# via the Certificate resource below. The Gateway listener references it.
#
# ArgoCD server runs in insecure mode (--insecure) when TLS is terminated
# upstream — this is correct and expected with a Gateway/proxy in front.
# ------------------------------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: argocd
  namespace: argocd
spec:
  parentRefs:
    - name: fastpass-gateway
      namespace: gateway-system
      sectionName: https
  hostnames:
    - argocd.local.mk-labs.cloud
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: argocd-server
          port: 80    # argocd-server listens on 80 in insecure mode

---
# HTTP → HTTPS redirect
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: argocd-http-redirect
  namespace: argocd
spec:
  parentRefs:
    - name: fastpass-gateway
      namespace: gateway-system
      sectionName: http
  hostnames:
    - argocd.local.mk-labs.cloud
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301