{{- /*
GCE L7 BackendConfig for supabase-kong.

GCE's default Ingress healthCheck is HTTP GET `/` on the backend port; Kong
returns 404 on any unrouted path, so the backend never goes HEALTHY and the
LB serves "Server Error" instead of reaching the proxy.

We wanted TCP liveness semantics (backend is alive as long as Kong accepts
connections) but GCE's BackendConfig CRD only accepts HTTP/HTTPS/HTTP2 --
it rejects `type: TCP` with
  `Protocol "TCP" is not valid, must be one of [HTTP,HTTPS,HTTP2]`

Workaround: HTTP against a dedicated `/healthz` route we add to Kong's
declarative config (templates/kong/config.yaml) with the request-termination
plugin returning 200 synchronously, no upstream call. Equivalent liveness
semantics via a protocol GCE accepts.

The companion Service template (kong/service.yaml) annotates the Service
with cloud.google.com/backend-config so GCE picks this up.

Only rendered when .Values.service.kong.backendConfigName is set
(render_supabase.py populates it in k8s/GKE mode).
*/ -}}
{{- if and .Values.deployment.kong.enabled (.Values.service.kong.backendConfigName | default "") -}}
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: {{ .Values.service.kong.backendConfigName | quote }}
  labels:
    {{- include "supabase.labels" . | nindent 4 }}
spec:
  healthCheck:
    type: HTTP
    requestPath: /healthz
    port: {{ .Values.service.kong.port | default 8000 }}
    checkIntervalSec: 15
    timeoutSec: 5
    healthyThreshold: 1
    unhealthyThreshold: 3
  connectionDraining:
    drainingTimeoutSec: 30
{{- end }}