{{- /*
Cilium Gateway HTTPRoute for `newapi.<sovereign-fqdn>` (TBD-D35d, issue
#1778).

Sandbox runtimes hit the LLM gateway at the URL the sandbox controller
mints into their environment:

  NEWAPI_BASE_URL=https://newapi.<sovereign-fqdn>/v1

On a Sovereign with the Catalyst marketplace enabled, the catalyst chart
ships a `tenant-wildcard` HTTPRoute (hostnames=`*.<fqdn>`) that backend-
refs to the `console` Service in the `sme` namespace. Without a dedicated
HTTPRoute for `newapi.<fqdn>`, every Sandbox request to the LLM gateway
got absorbed by the wildcard and 502'd at the storefront — blocking the
entire BYOS Claude Code journey (D35d).

Gateway API hostname-matching prefers the most specific listener: an
exact `newapi.<fqdn>` HTTPRoute wins over `*.<fqdn>`, so this template
restores newapi's public reachability without modifying the marketplace
wildcard.

Same skip-render gate pattern as ingress.yaml: when the HTTPRoute is not
enabled OR no hostname can be derived, the template emits nothing — the
`helm template` smoke render still passes with default values, and a
Sovereign overlay forgetting to set the host surfaces as "no HTTPRoute
materialised" (caught by the bootstrap-kit smoke test).

Per docs/INVIOLABLE-PRINCIPLES.md #4 every operationally-meaningful
value (hostname, parentRef name/namespace/sectionName, backend port) is
operator-overridable via values.yaml.
*/ -}}
{{- if and .Values.newapi.enabled .Values.ingress.httpRoute .Values.ingress.httpRoute.enabled -}}
{{- $host := .Values.ingress.httpRoute.host -}}
{{- if and (not $host) .Values.sovereignFQDN -}}
{{- $host = printf "newapi.%s" .Values.sovereignFQDN -}}
{{- end -}}
{{- if $host -}}
{{- $parent := .Values.ingress.httpRoute.parentRef | default dict -}}
{{- $parentName := default "cilium-gateway" $parent.name -}}
{{- $parentNs := default "kube-system" $parent.namespace -}}
{{- /*
sectionName intentionally omitted when empty/unset — pinning to "https"
broke multi-zone Sovereigns whose Cilium Gateway renames HTTPS listeners
to https-<sanitised-zone> (PR #1888 / TBD-A40 / issue #1902). Gateway API
hostname-matching attaches the route to the right listener anyway.
*/ -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ include "bp-newapi.fullname" . }}-public
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
    catalyst.openova.io/component: newapi-public-route
spec:
  parentRefs:
    - name: {{ $parentName | quote }}
      namespace: {{ $parentNs | quote }}
      {{- with $parent.sectionName }}
      sectionName: {{ . | quote }}
      {{- end }}
  hostnames:
    - {{ $host | quote }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: "/"
      backendRefs:
        - name: {{ include "bp-newapi.fullname" . }}
          port: {{ .Values.service.port }}
{{- end }}
{{- end }}
