---
# Path split between the authenticated UI and the unauthenticated machine API.
# Longest matching prefix wins, so the two UI rules take precedence over "/".
#
# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
#   /oauth2   oauth2-proxy sign_in / start / callback / sign_out
#   /ui       the human-facing SPA
#
# NOT AUTHENTICATED (artifactapi Service, unchanged):
#   /api/v1/{remote,local,virtual}/*   package proxy reads (yum/dnf, pip, ...)
#   /api/v2/remotes|virtuals|locals/*  management API + the UI's own XHR calls
#   /api/v2/remotes/{name}/files/*     CI publish uploads (PUT) and downloads
#   /v2/*                              Docker Registry V2 (containerd, buildah)
#   /terraform/v1/providers/*          Terraform provider registry
#   /.well-known/terraform.json        Terraform service discovery
#   /health, /version, /               probes and the redirect to /ui/
# Those clients cannot complete a browser OIDC flow, so they must never be
# routed through oauth2-proxy.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
  namespace: artifactapi
spec:
  hostnames:
    - artifactapi.k8s.syd1.au.unkin.net
  parentRefs:
    # Early-boot clients (anaconda/kickstart, yum in %post, PXE) need plain HTTP
    # for the rpm repos; serve the app directly on port 80 instead of redirecting.
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: http
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: artifactapi
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: oauth2
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /oauth2
    - backendRefs:
        - group: ""
          kind: Service
          name: oauth2
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /ui
    - backendRefs:
        - group: ""
          kind: Service
          name: artifactapi
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /