---
# Headlamp — Kubernetes dashboard with Keycloak native-OIDC login + per-user RBAC (ADR-0014).
# CONTROLLERS half: the HelmRepository + HelmRelease (chart installs the Deployment/Service/SA), the
# SOPS-encrypted OIDC credential (decrypted by the `platform` Flux Kustomization), and the
# default-deny + Cilium egress/ingress policies. The HTTPRoute is a Gateway API CR and lives in
# platform-config (dependsOn platform) so the Gateway CRDs exist first — same split as grafana.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: headlamp
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  # OIDC client credential (envFrom'd by the chart via config.oidc.externalSecret) — SOPS-encrypted,
  # referenced by name (R-IDP-04). The matching value is mirrored in keycloak-realm-clients.
  - headlamp-oidc-credentials.sops.yaml
  # default-deny baseline + Cilium ingress(gateway)/egress(apiserver+Keycloak) allows.
  - networkpolicy.yaml