{{- if and .Values.tags.haAgentCommon .Values.spireIdentityExchange.spiffe.rest.enabled .Values.spireIdentityExchange.spiffe.rest.gatewayAPI.enabled -}}
{{- $fullName := printf "%s-rest-spiffe" (include "spire-nested.identity-exchange-name" .) -}}
{{/* Passthrough only. These backends serve an X509-SVID, whose only SAN is a
     spiffe:// URI, so a BackendTLSPolicy hostname check could never match. */}}
{{- include "spire-lib.gateway-routes" (dict
      "root" .
      "gatewayAPI" .Values.spireIdentityExchange.spiffe.rest.gatewayAPI
      "name" $fullName
      "namespace" (include "spire-nested.server-namespace" .)
      "svcName" $fullName
      "port" .Values.spireIdentityExchange.spiffe.rest.service.port
      "labels" (include "spire-nested.labels" .)
      "routeKind" "TLSRoute"
      "backendTLS" false) }}
{{- end }}