Meerkat is starting.

  Application plane (your users):  {{ include "meerkat.fullname" . }}:{{ .Values.service.appPort }}
  Control plane (admin console):   {{ include "meerkat.fullname" . }}-admin:{{ .Values.service.adminPort }}
  Internal plane (your services):  {{ include "meerkat.fullname" . }}-internal:{{ .Values.service.internalPort | default 7070 }}
    the JWKS: http://{{ include "meerkat.fullname" . }}-internal:{{ .Values.service.internalPort | default 7070 }}/.well-known/jwks.json

{{- if eq (.Values.service.adminType | default "ClusterIP") "ClusterIP" }}
The console is NOT published. Reach it through a tunnel:

  kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "meerkat.fullname" . }}-admin {{ .Values.service.adminPort }}:{{ .Values.service.adminPort }}

A tunnel binds to ONE pod, so a rollout ends it. Where the console has to stay
reachable, set service.adminType (LoadBalancer, or NodePort with
service.adminNodePort) instead of relaunching the command.
{{- else }}
The console is published by a {{ .Values.service.adminType }} service on port {{ .Values.service.adminPort }}:

  kubectl -n {{ .Release.Namespace }} get svc {{ include "meerkat.fullname" . }}-admin

Publishing the control plane is a decision. Put it behind what your network
uses to say who may reach it.
{{- end }}

{{- if not .Values.plug.enabled }}

The developer tunnel is granted nothing (plug.enabled=false). The gateway still
OPENS it wherever its switches say so - developer mode and Infra, Plug, in the
console - and an agent with no rights says so in its log every minute:

  kubectl -n {{ .Release.Namespace }} logs deploy/{{ include "meerkat.fullname" . }} | grep plug
{{- else }}

The developer tunnel listens on {{ .Values.plug.port }} ({{ .Values.plug.service.type }} service
{{ include "meerkat.fullname" . }}-plug). It opens only where developer mode is on AND the
gateway can reach the cluster - if it cannot, it says so in one line and the
gateway serves as usual:

  kubectl -n {{ .Release.Namespace }} logs deploy/{{ include "meerkat.fullname" . }} | grep tunnel

Each developer deposits their own public key in their profile (Developer > key)
before it will let them in.
{{- end }}
