{{- if and .Values.spiffe.grpc.enabled .Values.spiffe.grpc.gatewayAPI.enabled -}}
{{- $fullName := printf "%s-grpc-spiffe" (include "spire-identity-exchange.fullname" .) -}}
{{/* Passthrough only. This backend serves an X509-SVID, whose only SAN is a
     spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
{{- include "spire-lib.gateway-routes" (dict
      "root" .
      "gatewayAPI" .Values.spiffe.grpc.gatewayAPI
      "name" $fullName
      "namespace" (include "spire-identity-exchange.namespace" .)
      "svcName" $fullName
      "port" .Values.spiffe.grpc.service.port
      "labels" (include "spire-identity-exchange.labels" .)
      "routeKind" "TLSRoute"
      "backendTLS" false) }}
{{- end }}