---
# clusters/prod — DESIGN-ONLY overlay. NOT a build target until roadmap Phase 7 opens prod
# (spec roadmap/phases.md, AGENTS.md §6: "Never build directly on production").
#
# When Phase 7 is opened, `flux bootstrap ... --path=clusters/prod` points the prod cluster's Flux
# here. Like dev, this overlay adds NO resources — it ONLY patches cluster-vars with prod-scoped
# values (R-ENV-02). Promotion to prod is a change to THESE variables, never a base edit.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
patches:
  - target:
      kind: ConfigMap
      name: cluster-vars
    patch: |-
      - op: replace
        path: /data/CLUSTER_ENV
        value: "prod"
      # trusted, rate-limited real certs in prod — ADR-0006.
      - op: replace
        path: /data/ACME_CLUSTER_ISSUER
        value: "letsencrypt-prod"
      - op: replace
        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
        value: "3"
      # longer retention / larger volumes on prod NVMe.
      - op: replace
        path: /data/MONITORING_PROMETHEUS_RETENTION
        value: "30d"
      - op: replace
        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
        value: "50Gi"
      # Size-cap below the 50Gi PVC (headroom for WAL + head + compaction scratch): prod may hit the
      # size cap before 30d if series volume is high, keeping the disk from filling either way.
      - op: replace
        path: /data/MONITORING_PROMETHEUS_RETENTION_SIZE
        value: "45GiB"
      - op: replace
        path: /data/MONITORING_LOKI_PVC_SIZE
        value: "50Gi"
      # HA control-plane addons in prod.
      - op: replace
        path: /data/KEYCLOAK_REPLICAS
        value: "2"
      - op: replace
        path: /data/OAUTH2_PROXY_REPLICAS
        value: "2"
      - op: replace
        path: /data/VELERO_RETENTION
        value: "720h"
      # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.
      # TODO(WS-NET, Phase 7): set GATEWAY_VIP to the prod LAN ingress VIP (add a `replace` op here)
      #   at the same time the prod Cilium LB IP pool range is supplied — the split-horizon
      #   coredns-custom (platform/coredns) answers *.home.keithjackson.dev with ${GATEWAY_VIP}, so
      #   the prod value must match the prod pool's Gateway address. Base default is the dev VIP.