{{- if and .Values.grpcRoute.enabled .Values.grpcRoute.gateway.create }}
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {{ include "openshell.grpcRouteGatewayName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  gatewayClassName: {{ .Values.grpcRoute.gateway.className }}
  listeners:
    - name: {{ ternary "https" "http" (eq .Values.grpcRoute.gateway.listener.protocol "HTTPS") }}
      port: {{ .Values.grpcRoute.gateway.listener.port }}
      protocol: {{ .Values.grpcRoute.gateway.listener.protocol }}
      {{- if eq .Values.grpcRoute.gateway.listener.protocol "HTTPS" }}
      {{- if not .Values.grpcRoute.gateway.listener.tls.certificateRefs }}
      {{- fail "grpcRoute.gateway.listener.tls.certificateRefs is required when grpcRoute.gateway.listener.protocol is HTTPS" }}
      {{- end }}
      {{- if and (not .Values.server.disableTls) (not .Values.grpcRoute.backendTLSPolicy.enabled) }}
      {{- fail "grpcRoute.gateway.listener.protocol=HTTPS terminates TLS at the Gateway listener. Either set server.disableTls=true so the pod listens plaintext, or enable grpcRoute.backendTLSPolicy for end-to-end TLS re-encryption to the gateway pod." }}
      {{- end }}
      tls:
        mode: Terminate
        certificateRefs:
          {{- toYaml .Values.grpcRoute.gateway.listener.tls.certificateRefs | nindent 10 }}
      {{- end }}
      allowedRoutes:
        namespaces:
          from: {{ .Values.grpcRoute.gateway.listener.allowedRoutes }}
{{- end }}