# ------------------------------------------------------------------------------
# Gateway — fastpass-gateway
# Wave 5.5 — after cilium-config (4) and ingress-nginx (5)
#
# This is the central Gateway that all HTTPRoute resources attach to.
# Cilium operator creates a LoadBalancer service for this Gateway automatically,
# which will receive an IP from the cilium-gateway-pool (10.1.71.90-.99).
#
# Listeners:
#   - HTTP  (port 80)  — redirect to HTTPS or direct for internal services
#   - HTTPS (port 443) — TLS termination via cert-manager certificates
#   - TCP   (port configurable) — for non-HTTP services (future use)
#
# Usage: Applications create HTTPRoute resources that reference this Gateway:
#
#   spec:
#     parentRefs:
#       - name: fastpass-gateway
#         namespace: gateway-system
#
# ------------------------------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: fastpass-gateway
  namespace: gateway-system
  annotations:
    # Request a specific IP from the cilium-gateway-pool
    io.cilium/lb-ipam-ips: "10.1.71.90"
spec:
  gatewayClassName: cilium
  listeners:
    # HTTP listener — accepts from all namespaces
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All

    # HTTPS listener — TLS termination
    # Each service provides its own cert via cert-manager Certificate resource
    # and a ReferenceGrant allowing the Gateway to read it cross-namespace
    - name: https
      protocol: HTTPS
      port: 443
      allowedRoutes:
        namespaces:
          from: All
      tls:
        mode: Terminate
        certificateRefs:
          # ArgoCD TLS cert — first service on the Gateway
          # Add additional certs here as services are added, or use
          # a wildcard cert (*.local.mk-labs.cloud) once the pattern is proven
          - name: argocd-tls
            namespace: argocd