# TCP listeners for the authentik LDAP outpost. kinds must be set explicitly:
# TCP allows nothing by default and TLS defaults to TLSRoute.
- op: add
  path: /spec/listeners/-
  value:
    name: authentik-ldap
    protocol: TCP
    port: 389
    allowedRoutes:
      kinds:
        - group: gateway.networking.k8s.io
          kind: TCPRoute
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: authentik
- op: add
  path: /spec/listeners/-
  value:
    name: authentik-ldaps
    protocol: TLS
    port: 636
    # No hostname: LDAP clients cannot be relied on to send SNI
    tls:
      mode: Terminate
      certificateRefs:
        - group: ""
          kind: Secret
          name: authentik-ldap-tls
          namespace: envoy-gateway
    allowedRoutes:
      kinds:
        - group: gateway.networking.k8s.io
          kind: TCPRoute
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: authentik