contour:
  # This is your live `helm get values contour -n projectcontour` output,
  # verbatim. This is the ingress for everything else in this repo
  # (Gitea, ArgoCD, Vault all route through it) — don't tune this without
  # re-checking those still resolve afterward.
  #
  # hostPorts, not a Service type=LoadBalancer: claude.md issue #6 — MetalLB
  # got a floating IP fine, but this VM's host (VMware Workstation, Bridged
  # networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP
  # was never reachable from outside the VM. hostPort on Envoy binds
  # directly to the node's real NIC instead.
  #
  # Correction from an earlier version of this file: the keys below are
  # NOT what `helm get values` showed as "user-supplied" on the live
  # release (envoy.hostNetworking / envoy.hostPorts.enabled). Checked
  # directly against this chart's own values.yaml — this version reads
  # envoy.hostNetwork (singular) and envoy.useHostPort.http/https instead.
  # Helm doesn't validate unknown keys, so the old ones were silent no-ops.
  # hostPort on the live pods is actually coming from the raw `kubectl
  # patch` in claude.md issue #7 ("the actual working solution" — that
  # title is the tell), applied completely outside Helm. Getting the real
  # keys into this file is what finally makes hostPort GitOps-managed
  # instead of an unmanaged patch any future plain `helm upgrade` could
  # silently wipe.
  #
  # This is also why ArgoCD's default Ingress health check needed
  # overriding (see argocd-admin-prd/custom-values.yaml) — there's no
  # Service type=LoadBalancer here to ever populate
  # status.loadBalancer.ingress.

  contour:
    resources:
      limits:
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi

  envoy:
    dnsPolicy: ClusterFirstWithHostNet
    # Mistake in an earlier version of this file: this was `true`. claude.md
    # is explicit that hostPort was chosen specifically INSTEAD of
    # hostNetwork ("not full hostNetwork, which is heavier-handed and
    # affects pod DNS") — and hostNetwork: true also has a real API
    # constraint that broke sync: it requires hostPort == containerPort on
    # every port, which isn't the case here (containerPort 8080/8443 vs
    # hostPort 80/443). `false` is both what was actually decided and what
    # the API requires for this containerPort/hostPort combination.
    hostNetwork: false
    useHostPort:
      http: true
      https: true
    # Already the chart default (80/443) — pinned explicitly anyway so a
    # future chart bump changing its defaults can't silently change this.
    hostPorts:
      http: 80
      https: 443
    resources:
      limits:
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi
    service:
      type: ClusterIP
      # Chart default (Local) pairs with the default type: LoadBalancer —
      # only valid for LoadBalancer/NodePort services. Must be cleared for
      # ClusterIP, which is what the sync error actually said.
      externalTrafficPolicy: ""