---
# clusters/prod — DESIGN-ONLY overlay. NOT a build target until roadmap Phase 7 opens prod
# (spec roadmap/phases.md, AGENTS.md §6: "Never build directly on production").
#
# When Phase 7 is opened, `flux bootstrap ... --path=clusters/prod` points the prod cluster's Flux
# here. Like dev, this overlay adds NO resources — it ONLY patches cluster-vars with prod-scoped
# values (R-ENV-02). Promotion to prod is a change to THESE variables, never a base edit.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
patches:
  - target:
      kind: ConfigMap
      name: cluster-vars
    patch: |-
      - op: replace
        path: /data/CLUSTER_ENV
        value: "prod"
      # trusted, rate-limited real certs in prod — ADR-0006.
      - op: replace
        path: /data/ACME_CLUSTER_ISSUER
        value: "letsencrypt-prod"
      - op: replace
        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
        value: "3"
      # longer retention / larger volumes on prod NVMe.
      - op: replace
        path: /data/MONITORING_PROMETHEUS_RETENTION
        value: "30d"
      - op: replace
        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
        value: "50Gi"
      - op: replace
        path: /data/MONITORING_LOKI_PVC_SIZE
        value: "50Gi"
      # HA control-plane addons in prod.
      - op: replace
        path: /data/KEYCLOAK_REPLICAS
        value: "2"
      - op: replace
        path: /data/OAUTH2_PROXY_REPLICAS
        value: "2"
      - op: replace
        path: /data/VELERO_RETENTION
        value: "720h"
      # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.