Vantage has been deployed as release "{{ .Release.Name }}" in namespace "{{ .Release.Namespace }}".

Services created:
{{- if .Values.redis.enabled }}
  - {{ .Release.Name }}-redis   (ClusterIP {{ .Values.redis.port }})
{{- else }}
  - Redis: not deployed, using external {{ .Values.redis.addr }}
{{- end }}
{{- if .Values.mongo.enabled }}
  - {{ .Release.Name }}-mongo   (ClusterIP {{ .Values.mongo.port }})
{{- else }}
  - MongoDB: not deployed, using the external server.env.mongoUri
{{- end }}
  - {{ .Release.Name }}-guacd   ({{ .Values.guacd.service.type }} {{ .Values.guacd.service.port }})
  - {{ .Release.Name }}-server  ({{ .Values.server.service.type }} http:{{ .Values.server.service.httpPort }} grpc:{{ .Values.server.service.grpcPort }})
  - {{ .Release.Name }}-web     ({{ .Values.web.service.type }} {{ .Values.web.service.port }})

Scaling (server.replicaCount / web.replicaCount):
  - Both scale. Pin the image tags first — replicas on different builds serve
    mismatched web asset hashes, and mixed server versions share one bus.
  - server replicas route agent commands, step results and console relays to
    each other over Redis, so every replica must use the SAME Redis. Workflow
    logs are in MongoDB, not on a volume.
  - Background work (monitor scheduler, Free reaper, log and audit retention,
    the offline sweep) runs on one replica at a time under a Redis leader lock.
  - server.persistence must be off to scale past one replica on a ReadWriteOnce
    volume. Nothing writes to it any more.
{{- if gt (int .Values.server.replicaCount) 1 }}
  - Console relays are reached by pod IP; guacd must be able to dial pod IPs
    directly (it can, inside the cluster network).
{{- end }}
{{- if .Values.server.migrationJob.enabled }}
  - Migrations run in the {{ .Release.Name }}-migrate Job before each upgrade;
    the pods skip them. Its logs are kept: kubectl logs job/{{ .Release.Name }}-migrate
{{- end }}

{{- if .Values.ingress.enabled }}

Ingress (Traefik):
  - Browsers:    https://{{ .Values.ingress.web.host }}
{{- range .Values.ingress.web.extraHosts }}
                 https://{{ . }}
{{- end }}
{{- if .Values.ingress.api.enabled }}
    {{ join ", " .Values.ingress.api.paths }} go straight to the server; everything else to web.
{{- else }}
    Everything goes to web, which proxies /api and /auth onward. Set
    ingress.api.enabled=true to route them at the edge instead.
{{- end }}
{{- if .Values.ingress.grpc.enabled }}
  - Agents:      {{ .Values.ingress.grpc.host }} (gRPC, h2c behind TLS)
    Agents dial server.env.grpcHost, currently {{ tpl .Values.server.env.grpcHost . }}.
    Point DNS for both hostnames at the Traefik load balancer.
{{- if not .Values.ingress.tls.enabled }}
  - WARNING: ingress.tls.enabled is false. Agent tokens and session cookies
    would cross the network in clear.
{{- else if and (not .Values.ingress.tls.certResolver) (not .Values.ingress.tls.secretName) }}
  - WARNING: TLS is on but neither ingress.tls.secretName nor
    ingress.tls.certResolver is set, so Traefik will serve its self-signed
    default certificate, which no agent and no browser will trust.
{{- end }}
{{- end }}
{{- end }}

By default the server/web/guacd services are ClusterIP only (no host port publishing,
unlike the original docker-compose file). To expose them externally, set
server.service.type / web.service.type / guacd.service.type to NodePort or LoadBalancer,
or add an Ingress on top of the -web and -server services.

Quick access via port-forward, e.g.:
  kubectl port-forward svc/{{ .Release.Name }}-web {{ .Values.web.service.port }}:{{ .Values.web.service.port }}
  kubectl port-forward svc/{{ .Release.Name }}-server {{ .Values.server.service.httpPort }}:{{ .Values.server.service.httpPort }}
