{{- /*
GCE L7 BackendConfig for supabase-kong.

GCE's default Ingress healthCheck is HTTP GET `/` on the backend port; Kong
returns 404 on any unrouted path, so the backend never goes HEALTHY and the
LB serves "Server Error" instead of reaching the proxy. A TCP healthCheck on
the Kong proxy port is sufficient for our deployment shape -- the backend is
"alive" as long as Kong is accepting connections, and GCE only probes for
reachability; per-route health is not required here.

The companion Service template (kong/service.yaml) annotates the Service
with cloud.google.com/backend-config so GCE picks this up.

Only rendered when .Values.service.kong.backendConfigName is set
(render_supabase.py populates it in k8s/GKE mode).
*/ -}}
{{- if and .Values.deployment.kong.enabled (.Values.service.kong.backendConfigName | default "") -}}
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: {{ .Values.service.kong.backendConfigName | quote }}
  labels:
    {{- include "supabase.labels" . | nindent 4 }}
spec:
  healthCheck:
    type: TCP
    port: {{ .Values.service.kong.port | default 8000 }}
    checkIntervalSec: 15
    timeoutSec: 5
    healthyThreshold: 1
    unhealthyThreshold: 3
  connectionDraining:
    drainingTimeoutSec: 30
{{- end }}