{{- if .Values.deployKF.gateway.tls.enabled }}
################
## If `deployKF.gateway.tls.redirect` is true:
##  - This VirtualService is here to redirect all HTTP traffic to HTTPS.
##  - NOTE: we can't use the `Gateway/spec.servers[*].tls.httpsRedirect` as it blindly swaps the schema from
##    `http://` to `https://` without changing the port (and we allow users to specify non-standard HTTPS ports).
##
## If `deployKF.gateway.tls.redirect` is false:
##  - This VirtualService proxies all HTTP requests back to the Gateway as HTTPS requests.
##    See `DestinationRule/https-redirect` and `EnvoyFilter/deploykf-istio-gateway--ext-authz` for more context.
################
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: https-redirect
  labels:
    helm.sh/chart: {{ include "deploykf-istio-gateway.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-istio-gateway.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
  gateways:
    - {{ .Release.Namespace }}/{{ .Values.deployKF.gateway.httpsRedirectName }}
  hosts:
    - {{ .Values.deployKF.gateway.hostname | quote }}
    - "*.{{ .Values.deployKF.gateway.hostname }}"
  http:
    - match:
        - scheme:
            exact: http
          port: {{ .Values.deployKF.gateway.ports.http | int }}
      {{- $public_https_port := .Values.deployKF.gateway.servicePorts.https | default .Values.deployKF.gateway.ports.https }}
      {{- if .Values.deployKF.gateway.tls.redirect }}
      redirect:
        scheme: https
        port: {{ $public_https_port }}
        redirectCode: 307
      {{- else }}
      route:
        - destination:
            host: {{ .Values.deployKF.gateway.hostname | quote }}
            port:
              number: {{ $public_https_port }}
      {{- end }}
{{- end }}