---
# North-south ingress for Keycloak: attaches to the shared Gateway (docs/09) at
# keycloak.home.keithjackson.dev. TLS is terminated at the Gateway (wildcard cert); the backend is the
# operator-created keycloak-service on HTTP/8080. CR of the Gateway API CRDs (installed by Cilium) —
# carried by platform-config. Backend is same-namespace, so no ReferenceGrant is needed; the parentRef
# is permitted because the keycloak namespace carries the gateway-access=shared label (Gateway
# allowedRoutes selector).
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: keycloak
  namespace: keycloak
spec:
  parentRefs:
    - name: shared
      namespace: gateway
      sectionName: https
  hostnames:
    - keycloak.home.keithjackson.dev
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: keycloak-service
          port: 8080