---
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
# (clusters/base/platform.yaml, path: ./platform).
#
# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
# the same pattern by which kyverno was previously deferred. Credentials each component needs are
# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
# component is never gated on a credential ask — only on its phase and readiness.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  # ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
  - kyverno            # admission enforcer FIRST — policies present before other components reconcile
  - cilium             # CNI (adopts the running Ansible-installed release; parity verified)
  - longhorn           # replicated block storage / CSI
  - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
  - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
  - gateway            # Gateway API listeners (ingress; replaces Traefik)
  - coredns            # split-horizon in-cluster DNS: *.home.keithjackson.dev -> Gateway VIP (R-DNS-01/03)
  # ---- Phase 3 — Egress / VPN (ADR-0015): node-level host OpenVPN split-tunnel (Ansible role
  #      vpn_egress_gateway) steered by a Cilium Egress Gateway policy, with a host nftables kill-switch.
  #      No in-cluster gateway pod (Gluetun retired). See ADR-0015 + DECISIONS-LOG "Phase 3 VPN". ----
  - vpn-egress         # CiliumEgressGatewayPolicy steering egress-class=vpn pods to the node tun0 (ADR-0015)
  # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
  - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
  # ---- Phase 6 — Identity / SSO (ADR-0014): foundational IdP, onboarded early. Keycloak Operator +
  #      CloudNativePG DB + oauth2-proxy forward-auth. Controllers here; the Keycloak/RealmImport/CNPG
  #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
  - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
  - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
  # - oauth2-proxy     # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak,
  #                    # which lives in platform-config (dependsOn platform) — so it crashloops and
  #                    # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is
  #                    # green (Keycloak live). Proper fix = move to a post-platform-config tier
  #                    # (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
  # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
  # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
  # ---- Later phases: enabled when their phase opens ----
  # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
  # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
  # ---- Phase 5 — IaaS proof (KubeVirt): operator CONTROLLERS only; the KubeVirt/CDI CRs +
  #      ServiceMonitors/alerts/dashboard are applied by platform-config (dependsOn platform, F-MON1). ----
  # TEMP-DISABLED (memory relief; KubeVirt conformance already certified — re-enable when RAM grows):
  # - kubevirt           # KubeVirt + CDI operators (register kubevirt.io / cdi.kubevirt.io CRDs)