---
# Headlamp — Kubernetes dashboard with Keycloak native-OIDC login + per-user RBAC (ADR-0014).
# Rendered by its OWN post-platform Flux Kustomization (clusters/base/headlamp.yaml, dependsOn
# platform-config, wait:false) — NOT by the gating `platform` tier, where a crashlooping UI
# HelmRelease stalled the whole chain (DECISIONS-LOG "Headlamp gating stall"). This component owns
# the HelmRepository + HelmRelease (chart installs the Deployment/Service/SA), the SOPS-encrypted
# OIDC credential (decrypted per-env by the headlamp Kustomization), the default-deny + Cilium
# policies, AND the HTTPRoute. The httproute (a Gateway API CR) now travels WITH the component here
# rather than being referenced in-place from platform-config: the CRDs it needs
# (gateway.networking.k8s.io) are registered by platform, and platform is Ready before this tier's
# platform-config dependency completes, so ordering holds — same move oauth2-proxy already made.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: headlamp
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  # OIDC client credential (envFrom'd by the chart via config.oidc.externalSecret) — SOPS-encrypted,
  # referenced by name (R-IDP-04). The matching value is mirrored in keycloak-realm-clients.
  - headlamp-oidc-credentials.sops.yaml
  # default-deny baseline + Cilium ingress(gateway)/egress(apiserver+Keycloak) allows.
  - networkpolicy.yaml
  - httproute.yaml       # dashboard ingress (was referenced in-place by platform-config)