{{/*
Hubble UI HTTPRoute — exposes the Cilium-managed Hubble UI Service via
the Sovereign's Cilium Gateway with the wildcard cert from
clusters/_template/sovereign-tls/.

Default-OFF at chart level: the gate `.Values.catalystOverlay.hubbleUI.enabled`
is false in chart/values.yaml so a bare `helm install bp-cilium .` never
ships an HTTPRoute. The bootstrap-kit overlay
clusters/_template/bootstrap-kit/01-cilium.yaml flips the gate to true
on every Sovereign and forwards SOVEREIGN_FQDN so the chart auto-derives
hubble.<SOVEREIGN_FQDN>. Per Sovereign opt-in checklist:
  1. cilium.hubble.relay.enabled = true   (in same overlay)
  2. cilium.hubble.ui.enabled    = true   (in same overlay)
  3. Keycloak realm has a `hubble-ui` OIDC client (slice D1)
  4. catalystOverlay.hubbleUI.hostname OR sovereignFQDN is set.

Hostname resolution order (first non-empty wins):
  1. .Values.catalystOverlay.hubbleUI.hostname        (explicit FQDN)
  2. printf "hubble.%s" .Values.catalystOverlay.hubbleUI.sovereignFQDN
                                                       (Flux envsubst path)
If neither is set, the route is not rendered — operator missed the
SOVEREIGN_FQDN substitute and the chart MUST not render an HTTPRoute
with an empty hostname (Cilium Gateway would NACK the Route).

Per docs/EPICS-1-6-unified-design.md §3.9 row 7 + §8 (EPIC-5).

The OIDC enforcement at the gateway boundary is NOT yet wired here —
Cilium's L7 OIDC filter is the target (configured via CiliumEnvoyConfig
or HTTPRoute filter once bp-keycloak ships the realm). For Phase-0 this
template gives EPIC-5 the seam to extend; today the route forwards
unauthenticated, so flipping the gate without the OIDC layer leaves
Hubble UI publicly accessible — track via the .auth annotation for
future enforcement filters.
*/}}
{{- $ov := .Values.catalystOverlay.hubbleUI -}}
{{- $hostname := $ov.hostname -}}
{{- if and (not $hostname) $ov.sovereignFQDN -}}
{{- $hostname = printf "hubble.%s" $ov.sovereignFQDN -}}
{{- end -}}
{{- if and $ov.enabled $hostname -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: hubble-ui
  namespace: {{ $ov.serviceRef.namespace | quote }}
  labels:
    app.kubernetes.io/name: bp-cilium
    app.kubernetes.io/component: hubble-ui-overlay
    catalyst.openova.io/blueprint: bp-cilium
    catalyst.openova.io/blueprint-version: {{ .Chart.Version | quote }}
  annotations:
    catalyst.openova.io/hubble-ui-auth: {{ $ov.auth | quote }}
spec:
  parentRefs:
    - name: {{ $ov.gatewayRef.name | quote }}
      namespace: {{ $ov.gatewayRef.namespace | quote }}
  hostnames:
    - {{ $hostname | quote }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ $ov.serviceRef.name | quote }}
          port: {{ $ov.serviceRef.port }}
{{- end -}}
