{{- if .Values.ingress.enabled -}}
{{- if and (not .Values.ingress.allowInsecure) (not .Values.ingress.tls) -}}
{{- fail "ingress.tls is required when ingress.enabled=true (set ingress.allowInsecure=true only for local/dev)" -}}
{{- end }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ include "cleveragents.fullname" . }}
  labels:
    {{- include "cleveragents.labels" . | nindent 4 }}
  {{- if or .Values.ingress.tls .Values.ingress.annotations }}
  annotations:
    {{- if and .Values.ingress.tls (not (hasKey (default dict .Values.ingress.annotations) "nginx.ingress.kubernetes.io/ssl-redirect")) }}
    # NOTE: This annotation is specific to the NGINX Ingress Controller.
    # If using a different controller (e.g., Traefik, HAProxy), adjust
    # or remove this annotation accordingly.  Omitted when the user
    # explicitly sets the annotation in ingress.annotations.
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    {{- end }}
    {{- with .Values.ingress.annotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- end }}
spec:
  {{- if .Values.ingress.className }}
  ingressClassName: {{ .Values.ingress.className }}
  {{- end }}
  {{- if .Values.ingress.tls }}
  tls:
    {{- range .Values.ingress.tls }}
    - secretName: {{ .secretName }}
      hosts:
        {{- range .hosts }}
        - {{ . | quote }}
        {{- end }}
    {{- end }}
  {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ .host | quote }}
      http:
        paths:
          {{- range .paths }}
          - path: {{ .path }}
            pathType: {{ .pathType }}
            backend:
              service:
                name: {{ include "cleveragents.fullname" $ }}
                port:
                  name: http
          {{- end }}
    {{- end }}
{{- end }}
