# Google-managed TLS certificate for GitLab on GKE GCE ingress.
#
# Why this file exists
#   The GitLab Ingress uses ingressClassName: gce (Google Cloud Load Balancer).
#   With GCLB, the idiomatic cert option is ManagedCertificate + FrontendConfig:
#     - ManagedCertificate: Google provisions + auto-renews an ACME cert.
#     - FrontendConfig:     redirects http:// -> https:// at the LB.
#
# Prereqs (already done per CLAUDE.md / user confirmation)
#   - DNS: git.knoe.dev -> GCLB external IP (the ingress's address).
#   - The ingress (gitlab/gitlab-kong-ingress) must carry these annotations:
#       networking.gke.io/managed-certificates: gitlab-managed-cert
#       networking.gke.io/v1beta1.FrontendConfig: gitlab-frontend-config
#     (applied by scripts/fix_gitlab_tls.sh or etc/init_gitlab.sh).
#
# Namespace
#   Both resources are namespaced and MUST live in the same namespace as the
#   Ingress (gitlab).  If you deploy GitLab to a different namespace, update
#   metadata.namespace here.
#
# Apply on the APP cluster (knoe-dev-0):
#   kubectl --context=gke_plenary-truck-485623-p7_us-west3_knoe-dev-0 \
#     apply -f k8s/knoe/gitlab-managed-cert.yaml
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: gitlab-managed-cert
  namespace: gitlab
spec:
  domains:
    - git.knoe.dev
---
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: gitlab-frontend-config
  namespace: gitlab
spec:
  redirectToHttps:
    enabled: true
    responseCodeName: MOVED_PERMANENTLY_DEFAULT