# ------------------------------------------------------------------------------
# ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
#
# Required by Gateway API spec when parentRef crosses namespace boundaries.
# `namespace` is required in the from stanza — use a specific namespace or
# create one ReferenceGrant per namespace that needs access.
#
# For a homelab cluster where all namespaces are trusted, we create a single
# catch-all by listing the namespaces we expect to use. Add entries as new
# app namespaces are created.
# ------------------------------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-httproutes
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: default
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: monitoring
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: argocd
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: authentik
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: gitea
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: fastpass-gateway