---
# Flux Kustomization: Crafty Controller — reconciles ./platform/crafty.
#
# POST-PLATFORM TIER (dependsOn platform-config). Crafty is a LEAF Minecraft-management UI that depends
# on Keycloak (the oauth2-proxy sidecar authenticates against it) + the trusted wildcard TLS cert +
# split-horizon DNS + the Gateway API CRDs + the Cilium L2 LoadBalancer pool (game-port VIP) — all
# brought up by `platform` (controllers) and `platform-config` (Keycloak realm/CRs, the wildcard
# Certificate, cilium L2 pool + announcement, Gateway). It therefore MUST NOT live inside the gating
# `platform` tier: a UI whose pod can crashloop (image pull, DB init, sidecar OIDC discovery during a
# cold start) would keep `platform` not-Ready, and while `platform` is not-Ready NOTHING downstream
# reconciles — the exact incident behind the headlamp/oauth2-proxy/homepage moves (DECISIONS-LOG:
# "Headlamp gating stall"). Same lesson, same fix: a leaf reconciles in its OWN post-platform tier.
#
# NON-GATING (wait:false): nothing in the graph dependsOn crafty, and its pod can be long-not-Ready
# during a cold start (Longhorn attach + Crafty DB init) while it waits on Keycloak/DNS/TLS.
# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
# pointed dependsOn it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: crafty
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: platform-config   # Keycloak realm + wildcard TLS + split-horizon VIP + Gateway + L2 pool first
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/crafty
  # cluster-vars retained for parity with the other tiers / future overlay knobs (crafty references no
  # ${VARS} today).
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # SOPS decryption for crafty-oauth2-proxy-credentials.sops.yaml is layered per-environment by the
  # overlay (clusters/dev patches THIS Kustomization by name), identical to headlamp/oauth2-proxy.