---
# Flux Kustomization: headlamp dashboard — reconciles ./platform/headlamp.
#
# POST-PLATFORM TIER (dependsOn platform-config). Headlamp is a LEAF Kubernetes-dashboard UI that
# depends on Keycloak (native-OIDC login) + the trusted wildcard TLS cert + split-horizon DNS + the
# Gateway API CRDs — all brought up by `platform` (controllers) and `platform-config` (Keycloak
# instance/realm CRs, the wildcard Certificate, cilium L2 VIP, Gateway). It therefore MUST NOT live
# inside the gating `platform` tier: a UI HelmRelease whose image/chart can crashloop (e.g. the
# upstream headlamp-0.40.1 `-session-ttl` chart/image desync, issue #4883) would keep `platform`
# not-Ready, and while `platform` is not-Ready NOTHING downstream reconciles — platform-config,
# oauth2-proxy, every apps-wave and apps-vms all stall on "dependency not ready". That is exactly
# how a single leaf UI stalled the whole chain (DECISIONS-LOG: "Headlamp gating stall"). This is the
# same lesson oauth2-proxy already encodes: a leaf that can be legitimately unhealthy must reconcile
# in its OWN post-platform Kustomization so its health can never gate the graph.
#
# NON-GATING (wait:false): nothing in the graph dependsOn headlamp (apps waves gate on
# platform-config, not on this), and a dashboard pod can be long-not-Ready during a cold start while
# it waits on Keycloak/DNS/TLS — same rationale as oauth2-proxy and apps-vms. wait:false guarantees
# its health can NEVER gate anything, even if a future resource is (mistakenly) pointed dependsOn it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: headlamp
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: platform-config   # Keycloak instance/realm + wildcard TLS + split-horizon VIP + Gateway first
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/headlamp
  # Same cluster-vars ConfigMap the platform tier fed it before the move (headlamp itself references
  # no ${VARS} today, but the substitution is retained for parity with the other tiers/future knobs).
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # SOPS decryption for headlamp-oidc-credentials.sops.yaml is layered per-environment by the overlay
  # (clusters/dev patches THIS Kustomization by name), identical to how it was decrypted via the
  # `platform` Kustomization before the move. See clusters/dev/kustomization.yaml.