---
# Flux Kustomization: the PM agent service — reconciles ./platform/pm-agent.
#
# POST-APP TIER (dependsOn apps-wave-0). What this service actually depends on is GITEA: the
# dispatcher authenticates to it at startup, reads issue threads from it, and every worker
# clones and pushes to it. Gitea is in apps-wave-0, so that is the dependency — not
# platform-config, which brings up the Keycloak realm, the wildcard certificate, the Gateway
# and the L2 pool. This service has no UI, serves no traffic, takes no ingress and holds no
# certificate, so none of those are prerequisites and claiming them would be a lie that
# delays its reconcile behind four things it does not use.
#
# NON-GATING (wait:false), and here that is not merely prudent — the pod is EXPECTED to be
# unhealthy for a while:
#   * the committed credentials are PLACEHOLDERS, so until the operator replaces them the
#     dispatcher fails its Gitea authentication at startup and CrashLoops, by design
#     (platform/pm-agent/pm-agent-credentials.sops.yaml.example);
#   * the image digest is likewise a placeholder until the operator pushes the image, so
#     before that the pod cannot even pull.
# Either of those inside a wait:true tier would stall everything downstream of it. wait:false
# guarantees this service's health can NEVER gate anything, even if some future resource is
# mistakenly pointed dependsOn it. Same non-gating leaf rationale as
# headlamp/homepage/crafty/backup — with a stronger reason than any of them.
#
# PRUNE: true. The whole namespace is disposable — the dispatcher keeps no durable state (the
# Gitea issue thread is its state) and worker Jobs are ephemeral by construction. So removing
# this service from git really should remove it from the cluster, with nothing to orphan.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: pm-agent
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: apps-wave-0   # Gitea: the repository this service reads issues from and pushes to
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/pm-agent
  # cluster-vars is substituted for parity with every other tier. NOTE for anyone editing
  # platform/pm-agent/: envsubst runs over the WHOLE rendered manifest, comments included, so
  # a `${...}` meant for a shell would be replaced with the empty string before the container
  # starts (the hazard catalog/README.md documents at length — it silently killed gitea's and
  # nextcloud's OIDC registration for days). Nothing under platform/pm-agent/ uses a `${}`
  # token today, and the two scripts that DO contain shell live in the image, not in a
  # manifest, which is one more reason they are baked in rather than mounted from a ConfigMap.
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # SOPS decryption for pm-agent-credentials.sops.yaml is layered per-environment by the
  # overlay (clusters/prod and clusters/dev patch THIS Kustomization by name), identical to
  # crafty/headlamp/oauth2-proxy/backup.