---
# Cloudflare Tunnel connector. Reconciled by its OWN non-gating Flux Kustomization
# (clusters/base/cloudflared.yaml: dependsOn platform-config, wait:false) — NOT a line in
# platform/kustomization.yaml. See that file for why; in one line: this Deployment cannot become
# Ready until the operator enrols the tunnel, and in a gating tier that would stall every app wave.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# REQUIRED for the configMapGenerator: a generated ConfigMap inherits no namespace, and kustomize
# will not rewrite the Deployment's reference to its hashed name across a namespace boundary
# (measured on platform/vpn-ingress).
namespace: cloudflared
resources:
  - namespace.yaml
  - deployment.yaml      # Deployment (2 replicas, hard node spread) + PodDisruptionBudget
  # Namespace default-deny + the Prometheus scrape allow + the egress CiliumNetworkPolicy. Keep
  # them in ONE file: a baseline without its scrape allow silently empties the TSDB.
  - networkpolicy.yaml
  - servicemonitor.yaml  # headless metrics Service + ServiceMonitor (:2000)
  - alerts.yaml
  # The tunnel credentials JSON — the ONE secret here. SOPS-encrypted, decrypted per-env by the
  # `cloudflared` Flux Kustomization (both overlays patch it), referenced by name only. Its
  # plaintext template sibling is deliberately NOT named in this file (no-plaintext-secrets).
  # Ships with REPLACE-ME placeholders; runbooks/cloudflare-tunnel.md fills it.
  - cloudflared-credentials.sops.yaml

# config.yaml becomes the CONTENT-HASHED ConfigMap `cloudflared-config`, so an edit to the ingress
# rules or the tunnel UUID changes the pod template and rolls the Deployment. Do NOT set
# disableNameSuffixHash: the hash is the rollout mechanism.
configMapGenerator:
  - name: cloudflared-config
    files:
      - config.yaml
    options:
      labels:
        app.kubernetes.io/name: cloudflared