---
# The CVE visibility scanner (docs/17, ADR-0027). Reconciled by its OWN non-gating Flux Kustomization
# (clusters/base/vuln-scanner.yaml: dependsOn platform-config, wait:false). A scanner that is failing,
# or a pod that cannot get its report store, is a thing to alert on, never a thing that stalls the
# platform. NOT a line in platform/kustomization.yaml.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# Required for the configMapGenerator (see platform/cloudflared/kustomization.yaml).
namespace: vuln-scanner
resources:
  - namespace.yaml
  - rbac.yaml
  - pvc.yaml
  # The per-pod oauth2-proxy credential. SOPS-encrypted, decrypted per-env by the vuln-scanner
  # Kustomization (both overlays patch it). Referenced by name only (R-IDP-04). Its template sibling
  # is deliberately not named here (no-plaintext-secrets).
  - vuln-scanner-oauth2-proxy-credentials.sops.yaml
  - deployment.yaml
  - service.yaml
  # Namespace default-deny, the three ingress paths and the egress allowances. One file, so a baseline
  # without its allows cannot ship alone and empty the TSDB.
  - networkpolicy.yaml
  - httproute.yaml
  - servicemonitor.yaml
  - alerts.yaml

# Scanner source and the risk-acceptance file, both as content-hashed ConfigMaps, so a change rolls
# the pod. No `disableNameSuffixHash`: the hash is the rollout mechanism.
configMapGenerator:
  - name: vuln-scanner-src
    files:
      - src/main.py
      - src/inventory.py
      - src/trivy.py
      - src/state.py
      - src/report.py
      - src/acceptances.py
      - src/page.py
      - src/metrics.py
      - src/server.py
      - src/report.schema.json
    options:
      labels:
        app.kubernetes.io/name: vuln-scanner
  - name: vuln-scanner-acceptances
    files:
      - acceptances.yaml
    options:
      labels:
        app.kubernetes.io/name: vuln-scanner