apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "2"
  name: authentik
  namespace: authentik
spec:
  hostnames:
    - auth.whyredfire.dev
  parentRefs:
    - kind: Gateway
      name: traefik-gateway
      namespace: traefik
      sectionName: websecure
  rules:
    # The ArgoCD Android app posts to the token endpoint without its trailing slash
    - backendRefs:
        - name: authentik-server
          port: 80
      filters:
        - type: URLRewrite
          urlRewrite:
            path:
              replaceFullPath: /application/o/token/
              type: ReplaceFullPath
      matches:
        - path:
            type: Exact
            value: /application/o/token
    - backendRefs:
        - name: authentik-server
          port: 80
      matches:
        - path:
            type: PathPrefix
            value: /