---
# Keycloak CONTROLLERS half (F-MON1 split): the official Keycloak Operator (quay.io images) + its
# CRDs + the SOPS-encrypted admin credential. The Keycloak/KeycloakRealmImport CUSTOM RESOURCES live
# in ../../platform-config (dependsOn platform) so the CRDs registered here exist first.
#
# IMAGE STRATEGY (DECISIONS-LOG F-KY1): the old stub used the Bitnami Keycloak chart + bundled Bitnami
# PostgreSQL; Bitnami's free Docker Hub images were purged -> ImagePullBackOff. Replaced with the
# official Keycloak Operator (quay.io/keycloak/keycloak-operator + quay.io/keycloak/keycloak) and
# CloudNativePG (ghcr.io) for the DB (platform/cnpg) — both registries unaffected by the purge, and
# the Operator gives declarative Keycloak/realm CRs (R-IDP-03) + CNPG gives DR backup hooks (R-IDP-05).
#
# The operator manifests are pinned upstream RELEASE files pulled as remote bases (the same pattern the
# kubevirt stub documents). Renovate maintains the version. Offline `kubectl kustomize` fetches them;
# Flux fetches them at reconcile.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# Force the operator's namespaced resources (ServiceAccount/Role/RoleBinding/Service/Deployment, which
# ship without an explicit namespace) into `keycloak`. CRDs + ClusterRoles are cluster-scoped and pass
# through unchanged; the ClusterRoleBinding subject already targets namespace keycloak.
namespace: keycloak
resources:
  - namespace.yaml
  # --- Keycloak Operator v26.0.6 (pinned upstream release manifests) ---
  # The operator, its CRDs and the SERVER IMAGE move in lockstep: the Keycloak CR has no
  # spec.image, so the operator's RELATED_IMAGE_KEYCLOAK (quay.io/keycloak/keycloak:<same tag>)
  # is what runs. These three URLs are therefore THE Keycloak version. Each carries a Renovate
  # marker (custom.regex manager, renovate.json5) under ONE depName, so all three bump in ONE
  # branch, never auto-merged (packageRule "keycloak-operator"). Before merging a bump, re-check
  # passkey-reconciler.yaml's 26.0.6 Admin API assumptions — see README.md "Upgrading Keycloak".
  # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
  # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
  # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/kubernetes.yml
  # --- Admin (break-glass) credential — SOPS-encrypted, referenced by name (ADR-0007, R-IDP-04) ---
  - keycloak-admin-credentials.sops.yaml
  # --- OIDC client secrets (grafana + oauth2-proxy) the realm import injects via placeholders ---
  - keycloak-realm-clients.sops.yaml
  # --- PER-ENVIRONMENT S3 credential for the keycloak-db CNPG Barman backup (R-IDP-05), split
  #     2026-09-07. SOPS-encrypted, decrypted by the `platform` tier (which already has the
  #     decryption stanza). BOTH land in ns keycloak on BOTH clusters; the keycloak-db Cluster
  #     (platform-config) selects ONE by name via
  #     `keycloak-db-backup-credentials${BACKUP_CREDENTIALS_SUFFIX}` (cluster-vars: dev "",
  #     prod "-prod"). Two objects, so an R2 token rotation cannot silently break dev's MinIO
  #     WAL archiving — and archive_mode=on makes a broken archive a disk-full clock, not a
  #     degraded backup (see postgres-cluster.yaml).
  #       dev  -> keycloak-db-backup-credentials       (MinIO, s3://cnpg)
  #       prod -> keycloak-db-backup-credentials-prod  (Cloudflare R2, s3://k3s-prod-backup/barman)
  - keycloak-db-backup-credentials.sops.yaml
  - keycloak-db-backup-credentials-prod.sops.yaml
  # --- Grafana dashboard for Keycloak health (plain ConfigMap; R-OBS-03) ---
  - grafana-dashboard.yaml