{{- if .Values.ingress.enabled }}
{{- if ne .Values.auth.domain "<your_auth_domain>" -}}
{{- $fullName := include "buzzfeed-sso.fullname" . -}}
{{- $authDomain := .Values.auth.domain -}}
apiVersion: {{ template "ingress.apiVersion" . }}
kind: Ingress
metadata:
  name: {{ $fullName }}
  labels:
    app: {{ template "buzzfeed-sso.name" . }}
    chart: {{ template "buzzfeed-sso.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
{{- range $key, $value := .Values.ingress.extraLabels }}
    {{ $key }}: {{ $value }}
{{- end }}
{{- with .Values.ingress.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
spec:
{{- if or (and .Values.auth.enabled .Values.auth.tls) .Values.ingress.tls }}
  tls:
  {{- if and (and .Values.auth.enabled .Values.auth.tls) .Values.auth.ingressEnabled }}
    - hosts:
        - {{ $authDomain }}
      secretName: {{ .Values.auth.tls.secretName -}}
  {{- end }}
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ printf "%s" . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
    # Upstreams that need SSO authentication
  {{- range .Values.ingress.hosts }}
    - host: {{ .domain }}
      http:
        paths:
          {{- $pathType := .pathType -}}
          {{- if .path }}
          - path: {{ .path }}
            {{- if $pathType }}
            pathType: {{ $pathType }}
            {{- end }}
            backend:
              serviceName: {{ $fullName }}-proxy
              servicePort: http
          {{- end }}
          {{- range .paths }}
          - path: {{ . }}
            {{- if $pathType }}
            pathType: {{ $pathType }}
            {{- end }}
            backend:
              serviceName: {{ $fullName }}-proxy
              servicePort: http
          {{- end }}
  {{- end }}
  {{- if and .Values.auth.enabled .Values.auth.ingressEnabled }}
    # Global SSO used in the callback for login
    - host: {{ $authDomain }}
      http:
        paths:
          - path: {{ .Values.auth.ingressPath }}
            backend:
              serviceName: {{ $fullName }}-auth
              servicePort: http
  {{- end }}
{{- end }}
{{- end }}
