apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: dsh-gateway
  namespace: dsh-demo
  labels:
    app.kubernetes.io/part-of: dsh-demo
spec:
  parentRefs:
    - name: dsh-gateway
      namespace: dsh-demo
      sectionName: https
  hostnames:
    # TODO: replace with the actual public FQDN before applying.
    - dsh-demo.example.com
  rules:
    - backendRefs:
        # Route through oauth2-proxy (GitHub OAuth) first; it authenticates the
        # browser and forwards to dsh-gateway:8080 with X-Forwarded-User set.
        # The gateway only trusts that header when AUTH_PROXY_HEADER is set on
        # its Deployment — see 72-oauth2-proxy.yaml and ../README.md.
        - name: oauth2-proxy
          port: 4180