Consul Operations Hub deployed!

Deployment: {{ include "coh.fullname" . }}

{{- if .Values.consulGateway.enabled }}

━━━━ Consul API Gateway ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Gateway: {{ include "coh.gateway.name" . }}

Wait for the Gateway to get an external address:
  kubectl get gateway {{ include "coh.gateway.name" . }} -n {{ .Release.Namespace }} -w

Once the EXTERNAL-IP appears:
  export GW=$(kubectl get gateway {{ include "coh.gateway.name" . }} \
    -n {{ .Release.Namespace }} \
    -o jsonpath='{.status.addresses[0].value}')

  curl http://$GW/api/v1/datacenters

{{- if .Values.consulGateway.httpRoute.hostnames }}
Route hostname: {{ first .Values.consulGateway.httpRoute.hostnames }}
{{- end }}

{{- else }}

━━━━ Port-forward (consulGateway.enabled=false) ━━━━━━━━━━━━━━━━━━━━
  kubectl port-forward -n {{ .Release.Namespace }} \
    svc/{{ include "coh.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}

  curl http://127.0.0.1:{{ .Values.service.port }}/api/v1/datacenters
{{- end }}

{{- if .Values.connectInject.enabled }}

━━━━ Consul service mesh ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Connect sidecar injection is enabled. Verify pods joined the mesh:
  kubectl get pods -n {{ .Release.Namespace }} \
    -l "{{ include "coh.selectorLabels" . | replace ": " "=" | replace "\n" "," }}"
{{- end }}

{{- if and .Values.auth.enabled .Values.auth.oauth2proxy.enabled }}

━━━━ Auth addon (oauth2-proxy + ext_authz) ━━━━━━━━━━━━━━━━━━━━━━━━━
ext_authz is active on the API Gateway. Every /api request requires a
valid session cookie or Bearer token.
The static UI is public so it can render the sign-in page.

Login flow:
  GET {{ include "coh.auth.publicUrl" . }}/oauth2/sign_in?rd=/api/v1/datacenters

Sign out:
  GET {{ include "coh.auth.publicUrl" . }}/oauth2/sign_out?rd={{ include "coh.auth.publicUrl" . }}/oauth2/sign_in

{{- if .Values.auth.keycloak.enabled }}

Keycloak Admin Console (port-forward from inside the cluster):
  kubectl port-forward -n {{ .Release.Namespace }} \
    svc/{{ include "coh.keycloak.name" . }} {{ .Values.auth.keycloak.port }}:{{ .Values.auth.keycloak.port }}
  open http://localhost:{{ .Values.auth.keycloak.port }}/admin
{{- end }}
{{- end }}

{{- if .Values.config.mcp.enabled }}

━━━━ MCP server ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MCP (Model Context Protocol) is enabled on port {{ .Values.service.mcpPort }}.
Forward it for local AI-agent use:
  kubectl port-forward -n {{ .Release.Namespace }} \
    svc/{{ include "coh.fullname" . }} {{ .Values.service.mcpPort }}:{{ .Values.service.mcpPort }}
{{- end }}
