---
# clusters/prod — DESIGN-ONLY overlay. NOT a build target until roadmap Phase 7 opens prod
# (spec roadmap/phases.md, AGENTS.md §6: "Never build directly on production").
#
# When Phase 7 is opened, `flux bootstrap ... --path=clusters/prod` points the prod cluster's Flux
# here. Like dev, this overlay adds NO resources — it ONLY patches cluster-vars with prod-scoped
# values (R-ENV-02). Promotion to prod is a change to THESE variables, never a base edit.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
patches:
  - target:
      kind: ConfigMap
      name: cluster-vars
    patch: |-
      - op: replace
        path: /data/cluster_env
        value: "prod"
      # trusted, rate-limited real certs in prod — ADR-0006.
      - op: replace
        path: /data/acme_cluster_issuer
        value: "letsencrypt-prod"
      - op: replace
        path: /data/longhorn_default_replica_count
        value: "3"
      # longer retention / larger volumes on prod NVMe.
      - op: replace
        path: /data/monitoring_prometheus_retention
        value: "30d"
      - op: replace
        path: /data/monitoring_prometheus_pvc_size
        value: "50Gi"
      - op: replace
        path: /data/monitoring_loki_pvc_size
        value: "50Gi"
      # HA control-plane addons in prod.
      - op: replace
        path: /data/keycloak_replicas
        value: "2"
      - op: replace
        path: /data/oauth2_proxy_replicas
        value: "2"
      - op: replace
        path: /data/velero_retention
        value: "720h"
      # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.