# Istio Ambient Mode - ztunnel handles L4 mTLS, waypoints handle L7
profile: ambient

pilot:
  autoscaleEnabled: true
  autoscaleMin: 1
  autoscaleMax: 3
  resources:
    requests:
      cpu: 10m
      memory: 128Mi
    limits:
      memory: 512Mi
  env:
    PILOT_ENABLE_AMBIENT: "true"

# Use Istio CNI for ambient mesh networking (ztunnel traffic redirection)
cni:
  enabled: true

meshConfig:
  # ext_authz provider for Authentik forward-auth (via waypoint proxies)
  # In ambient mode, ext_authz is enforced by waypoint proxies, not sidecars.
  # Authentik's forward-auth endpoint is exposed under /outpost.goauthentik.io.
  extensionProviders:
    - name: authentik-ext-authz
      envoyExtAuthzHttp:
        # Route through Host-rewriting proxy (see authentik/ext-authz-proxy.yaml)
        # Authentik's embedded outpost only serves forward-auth on Host: auth.kube.huskypup.net
        service: ext-authz-proxy.authentik.svc.cluster.local
        port: 4180
        pathPrefix: /outpost.goauthentik.io/auth/traefik
        headersToDownstreamOnAllow:
          - set-cookie
        headersToUpstreamOnAllow:
          - cookie
          - set-cookie
          - authorization
          - x-authentik-username
          - x-authentik-groups
          - x-authentik-email
          - x-authentik-name
          - x-authentik-uid
        headersToDownstreamOnDeny:
          - set-cookie
          - content-type
          - location
        includeRequestHeadersInCheck:
          - cookie
          - authorization
        includeAdditionalHeadersInCheck:
          X-Forwarded-Proto: "%REQ(:SCHEME)%"
          X-Forwarded-Host: "%REQ(:AUTHORITY)%"
          X-Forwarded-Uri: "%REQ(:PATH)%"