# Values for the upstream ingress-nginx chart, nested under
# `ingress-nginx:` (the dependency's name in Chart.yaml).
ingress-nginx:
  controller:
    service:
      type: LoadBalancer
      annotations:
        # Requests this specific address from MetalLB's BGP pool (see
        # docs/05-metallb.md) so it stays predictable across rebuilds.
        # Must fall inside apps/metallb/templates/ipaddresspool.yaml's
        # range, or MetalLB will never satisfy the request.
        metallb.io/loadBalancerIPs: "10.10.60.12"
    # ingress-nginx's default Pod Security posture (no hostNetwork, no
    # hostPath, only the baseline-allowed NET_BIND_SERVICE capability to
    # bind ports 80/443) already fits Kubernetes' baseline profile, unlike
    # MetalLB or Longhorn. No managedNamespaceMetadata override needed here.
    ingressClassResource:
      # Every Ingress resource in this cluster that doesn't name a class
      # explicitly uses this one automatically \u2014 the same "no
      # storageClassName needed" convenience Longhorn gives PVCs.
      default: true