---
# clusters/dev — the ACTIVE build target overlay.
#
# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
# TRANSITIONAL (Phase-2 bootstrap): this overlay reuses the base source + cluster-vars, but
# REPLACES the monolithic base `platform`/`apps` Kustomizations with a per-component NO-SECRET
# rollout (./rollout) — so dev brings up cilium/longhorn/monitoring/kyverno in order WITHOUT
# dragging in the secret-blocked components. It patches cluster-vars with dev values (R-ENV-02)
# and softens Kyverno for bootstrap. CONVERGENCE: delete ./rollout + the two $patch:delete
# below to return to the unified base graph once all operator hand-offs land. See DECISIONS-LOG.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
  - rollout
patches:
  # --- Drop the monolithic base platform/apps Kustomizations. They reconcile ALL 11 components
  #     as one unit (incl. secret-blocked cert-manager/externaldns/velero/keycloak/oauth2-proxy/
  #     image-automation/gateway/kubevirt); ./rollout replaces them with the per-component
  #     no-secret set for dev bootstrap. Remove these two deletes to re-adopt the unified graph.
  #     (No decryption patch is needed here: the rollout components carry no SOPS content, so
  #     the `sops-age` Secret is not required for the dev bootstrap tier.) ---
  - patch: |-
      $patch: delete
      apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: platform
        namespace: flux-system
  - patch: |-
      $patch: delete
      apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: apps
        namespace: flux-system
  - patch: |-
      apiVersion: source.toolkit.fluxcd.io/v1
      kind: GitRepository
      metadata:
        name: flux-system
        namespace: flux-system
      spec:
        # Phase-1 bootstrap source: a single Gitea container on the HOST (bootstrap/gitea/),
        # reachable from the cluster on the k3s-dev NAT gateway. PUBLIC repo => Flux needs no
        # creds (NAT-only). Phase 6 cutover -> in-cluster gitea.home.keithjackson.dev (docs/05).
        url: http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git
        ref:
          branch: main
  # --- dev-scoped cluster-vars (R-ENV-02) ---
  - target:
      kind: ConfigMap
      name: cluster-vars
    patch: |-
      - op: replace
        path: /data/CLUSTER_ENV
        value: "dev"
      # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
      - op: replace
        path: /data/ACME_CLUSTER_ISSUER
        value: "letsencrypt-staging"
      # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
      - op: replace
        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
        value: "3"
      # smaller retention / volumes to keep the dev workstation footprint light.
      - op: replace
        path: /data/MONITORING_PROMETHEUS_RETENTION
        value: "3d"
      - op: replace
        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
        value: "5Gi"
      - op: replace
        path: /data/MONITORING_LOKI_PVC_SIZE
        value: "5Gi"
      # single-replica control-plane addons in dev (no HA needed to iterate).
      - op: replace
        path: /data/KEYCLOAK_REPLICAS
        value: "1"
      - op: replace
        path: /data/OAUTH2_PROXY_REPLICAS
        value: "1"
      - op: replace
        path: /data/VELERO_RETENTION
        value: "72h"
      # dev-softened Kyverno for cold-start (base defaults Enforce/Fail/3 = prod posture).
      - op: replace
        path: /data/KYVERNO_VALIDATION_ACTION
        value: "Audit"
      - op: replace
        path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
        value: "Ignore"
      - op: replace
        path: /data/KYVERNO_ADMISSION_REPLICAS
        value: "1"
      # dev: no Grafana admin Secret yet → empty makes the chart use its default admin password
      # (dev-only, NAT-isolated). Prod keeps the by-name SOPS secret from the base default.
      - op: replace
        path: /data/GRAFANA_ADMIN_SECRET
        value: ""