---
# Flux Kustomization: CILIUM (the CNI) — reconciles ./platform/cilium.
# Serves R-PLAT-01 (platform components reconciled by GitOps) and R-GITOPS-01/03.
#
# WHY CILIUM HAS ITS OWN KUSTOMIZATION (split out of `platform`, 2026-09-01)
#
# This is the MIRROR IMAGE of the oauth2-proxy / headlamp splits, not a repeat of them. Those are
# leaves that must NEVER gate a tier, so they left `platform` and run `wait: false` below it.
# Cilium is the one component that legitimately SHOULD gate everything — but inside the shared
# `platform` Kustomization its health was indistinguishable from eleven unrelated components:
#
#   * `platform`'s Ready condition could not tell you "the CNI is down" from "longhorn is slow".
#   * The only emergency valve was `flux suspend kustomization platform` — freezing the ENTIRE
#     tier (storage, TLS, DNS, ingress, monitoring, Keycloak, KubeVirt) to stop touching the CNI.
#     `flux suspend kustomization cilium` now freezes exactly the CNI and nothing else, which is
#     the valve the 2026-09-01 substitution incident wanted and did not have.
#   * `platform`'s 10m interval + 5m timeout are wrong for a CNI: a 3-node DaemonSet rollout with
#     `wait: true` can exceed 5m, and re-rendering the CNI every 10m buys nothing.
#
# GATING IS PRESERVED, NOT WEAKENED: `wait: true` here plus `platform.dependsOn: [cilium]` means
# nothing in the graph reconciles until the CNI is healthy — the same guarantee as before, now
# expressed as an explicit edge instead of an accident of co-tenancy.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: cilium
  namespace: flux-system
spec:
  # A CNI does not need a 10m re-render cadence. A git push still reconciles immediately —
  # kustomize-controller is source-triggered; `interval` is only the drift-correction floor.
  interval: 1h
  retryInterval: 2m
  # 10m (not the 5m `platform` uses): a 3-node Cilium DaemonSet rollout under `wait: true`,
  # rolled ONE NODE AT A TIME (maxUnavailable: 1, P2), legitimately exceeds 5m.
  timeout: 10m
  prune: true
  # TRUE, deliberately: this is the ONE component whose health should gate the whole platform.
  wait: true
  # Same revision-gating reason `platform` has it (2026-09-01 incident): `cluster-vars` is APPLIED
  # by the root `flux-system` Kustomization, and this Kustomization SUBSTITUTES from it. `dependsOn`
  # is revision-gated (kustomize-controller v1.4.0 `checkDependencies`), so this cannot render
  # revision N of helmrelease.yaml against the revision N-1 `cluster-vars`. That race is exactly how
  # `k8sServiceHost: ""` once reached the Cilium HelmRelease and took down 2/3 agents.
  dependsOn:
    - name: flux-system   # the ROOT Kustomization (sync.yaml) that applies cluster-vars
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/cilium
  # MANDATORY, not decorative: platform/cilium/helmrelease.yaml references ${K3S_API_HOST}.
  # kustomize-controller now runs --feature-gates=StrictPostBuildSubstitutions=true, so without
  # this stanza an undefined ${K3S_API_HOST} FAILS this Kustomization outright (it no longer
  # renders empty). That is the intended fail-closed behaviour — but it means the stanza is
  # load-bearing for the CNI coming up at all. Do not remove it.
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # No `decryption` stanza: platform/cilium carries no SOPS-encrypted resource (unlike
  # oauth2-proxy/headlamp/crafty/velero, whose overlays patch one in by name).