---
# Flux Kustomization: oauth2-proxy forward-auth — reconciles ./platform/oauth2-proxy.
#
# POST-PLATFORM TIER (dependsOn platform-config). oauth2-proxy is a LEAF forward-auth service that
# depends on Keycloak + the trusted wildcard TLS cert + split-horizon DNS — all of which are brought
# up by `platform` (controllers) and `platform-config` (Keycloak instance/realm CRs, the wildcard
# Certificate, cilium L2 VIP). It therefore MUST NOT live inside the gating `platform` tier: on a
# cold start it Fails until its dependencies exist, and while it Failed it kept `platform` not-Ready,
# so `platform-config` (which carries oauth2-proxy's own httproute/servicemonitor AND the Keycloak
# instance it needs) could never reconcile — a self-gating deadlock that bit TWICE (DECISIONS-LOG
# Session 7 + Session 9; roadmap follow-up "oauth2-proxy -> post-platform tier"). Moving it below
# platform-config breaks the cycle: platform reaches Ready without it, platform-config brings up
# Keycloak + TLS + DNS, THEN oauth2-proxy reconciles against dependencies that already exist.
#
# NON-GATING (wait:false): nothing in the graph dependsOn oauth2-proxy (apps waves gate on
# platform-config, not on this), and a forward-auth pod can be legitimately long-not-Ready during a
# cold start while it waits on Keycloak/DNS/TLS — same rationale as apps-vms. wait:false guarantees
# its health can NEVER gate anything, even if a future resource is (mistakenly) pointed dependsOn it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: oauth2-proxy
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: platform-config   # Keycloak instance/realm + wildcard TLS + split-horizon VIP exist first
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/oauth2-proxy
  # R-ENV-02: resolves ${OAUTH2_PROXY_REPLICAS} (dev 1 / prod 2) in the HelmRelease. Same cluster-vars
  # ConfigMap the platform tier fed it before the move.
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # SOPS decryption for oauth2-proxy-credentials.sops.yaml is layered per-environment by the overlay
  # (clusters/dev patches THIS Kustomization by name), identical to how it was decrypted via the
  # `platform` Kustomization before the move. See clusters/dev/kustomization.yaml.