---
# Crafty Controller — Minecraft management panel, web UI Keycloak-gated by a per-pod oauth2-proxy
# reverse-proxy sidecar (Option B). Rendered by its OWN post-platform Flux Kustomization
# (clusters/base/crafty.yaml, dependsOn platform-config, wait:false) — NOT by the gating `platform`
# tier: a leaf UI whose pod can be legitimately unhealthy must never gate the platform chain
# (DECISIONS-LOG: "Headlamp gating stall"). Same non-gating pattern as headlamp/homepage/oauth2-proxy.
#
# The Gateway API CRs (httproute) + LoadBalancer Services travel WITH the component here: the CRDs they
# need (gateway.networking.k8s.io, cilium.io) are registered by `platform`, and `platform` is Ready
# before this tier's platform-config dependency completes, so ordering holds.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - pvc.yaml
  - deployment.yaml
  - service.yaml
  # oauth2-proxy sidecar client + cookie secrets — SOPS-encrypted, decrypted per-env by the crafty
  # Kustomization (clusters/dev patches it by name). Referenced by name only (R-IDP-04).
  - crafty-oauth2-proxy-credentials.sops.yaml
  # default-deny baseline + Cilium ingress(gateway/game)/egress(world) allows.
  - networkpolicy.yaml
  # web-UI ingress (crafty.home -> oauth2-proxy sidecar) + game-port L4 LoadBalancer (VIP .55).
  - httproute.yaml
  - service-l4.yaml