{{- /*
Shared env blocks — the Kubernetes equivalent of the YAML anchors in
infra/docker-compose.yml (&oz-env, &nrc-env, &objecttypen-env, &objecten-env).
A workload picks them up with `envFrom`, so the web/celery/init variants of an
upstream image stay guaranteed-identical, and `kubectl get cm oz-env -o yaml`
shows what a pod actually got.

The *file* inputs (setup_configuration data.yaml, Keycloak realms, BPMN/DMN, the
seed scripts) are NOT here: they live in the repo and are turned into ConfigMaps
by infra/helm/seed-configmaps.sh, exactly as infra/seed-config.sh streams them
into the compose config volumes. Copying them into the chart would fork them.
*/ -}}
{{- range $group, $env := .Values.envGroups }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ $group }}-env
  labels:
{{- include "big.labels" (dict "root" $ "name" (printf "%s-env" $group)) | nindent 4 }}
data:
{{- range $k, $v := $env }}
  {{ $k }}: {{ tpl (toString $v) $ | quote }}
{{- end }}
{{- end }}
{{- /*
Portal OIDC config. The images bake config.json with the compose authority
(keycloak:8080), which a browser outside the cluster cannot resolve; these
ConfigMaps mount over it with the node address Keycloak's issuer is pinned to
(KC_HOSTNAME below), so the token the browser gets and the issuer the BFF
discovers are the same string. Same mechanism as infra/host-browser.yml.
*/ -}}
{{- range $realm := list "digid" "medewerker" }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: portal-config-{{ $realm }}
  labels:
{{- include "big.labels" (dict "root" $ "name" (printf "portal-config-%s" $realm)) | nindent 4 }}
data:
  config.json: |
    { "authority": "{{ printf "http://%s:%v" $.Values.host (index $.Values.nodePorts "keycloak") }}/realms/{{ $realm }}" }
{{- end }}