49 lines
2.5 KiB
YAML
49 lines
2.5 KiB
YAML
{{- if eq .Values.client.ingress.host "change_me" }}
|
|
{{- fail "client.ingress.host must be overridden and not set to 'change_me'" }}
|
|
{{- end }}
|
|
|
|
{{- if eq .Values.server.ingress.host "change_me" }}
|
|
{{- fail "server.ingress.host must be overridden and not set to 'change_me'" }}
|
|
{{- end }}
|
|
|
|
{{- $serverProtocol := .Values.server.protocol }}
|
|
{{- if not (or (eq $serverProtocol "http") (eq $serverProtocol "https")) }}
|
|
{{- fail "server.protocol must be either 'http' or 'https'" }}
|
|
{{- end }}
|
|
|
|
{{- $clientProtocol := .Values.client.protocol }}
|
|
{{- if not (or (eq $clientProtocol "http") (eq $clientProtocol "https")) }}
|
|
{{- fail "client.protocol must be either 'http' or 'https'" }}
|
|
{{- end }}
|
|
|
|
{{/* Enforce protocol when TLS is enabled to avoid mixed-content */}}
|
|
{{- if and .Values.client.ingress.tls.enabled (ne $clientProtocol "https") }}
|
|
{{- fail "client.ingress.tls.enabled is true but client.protocol is not 'https'. Set client.protocol: https to avoid mixed content." }}
|
|
{{- end }}
|
|
|
|
{{- if and .Values.server.ingress.tls.enabled (ne $serverProtocol "https") }}
|
|
{{- fail "server.ingress.tls.enabled is true but server.protocol is not 'https'. Set server.protocol: https to ensure correct API base URL." }}
|
|
{{- end }}
|
|
|
|
{{/* If client runs on https, API must also be https to avoid mixed content */}}
|
|
{{- if and (eq $clientProtocol "https") (ne $serverProtocol "https") }}
|
|
{{- fail "client.protocol is 'https' but server.protocol is not. Set server.protocol: https to prevent browser mixed-content issues." }}
|
|
{{- end }}
|
|
|
|
{{/* Fail early if TLS enabled without cert-manager annotations (cluster-issuer or issuer) */}}
|
|
{{- $cAnn := .Values.client.ingress.annotations | default dict }}
|
|
{{- $sAnn := .Values.server.ingress.annotations | default dict }}
|
|
|
|
{{- $clientHasIssuer := or (hasKey $cAnn "cert-manager.io/cluster-issuer") (hasKey $cAnn "cert-manager.io/issuer") }}
|
|
{{- $serverHasIssuer := or (hasKey $sAnn "cert-manager.io/cluster-issuer") (hasKey $sAnn "cert-manager.io/issuer") }}
|
|
|
|
{{- if and .Values.client.ingress.tls.enabled (not $clientHasIssuer) }}
|
|
{{- fail "client.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
|
|
{{- end }}
|
|
|
|
{{- if and .Values.server.ingress.tls.enabled (not $serverHasIssuer) }}
|
|
{{- fail "server.ingress.tls.enabled is true but no cert-manager issuer annotation found. Add 'cert-manager.io/cluster-issuer' or 'cert-manager.io/issuer'." }}
|
|
{{- end }}
|
|
|
|
{{/* Secret name can be omitted; we default to <release>-client|server-tls in templates */}}
|