---
# cluster-vars — the overlay knob surface (R-ENV-02).
#
# This ConfigMap holds BASE DEFAULTS. Flux `postBuild.substituteFrom` injects these into every
# `${TOKEN}` in platform/ and apps/ manifests at reconcile time. dev/ and prod/ overlays STRATEGIC-
# MERGE PATCH this single ConfigMap — that patch is the *entire* difference between environments.
#
# Add a knob here (with a base default) before referencing `${KNOB}` in a component manifest, then
# give each overlay its env-scoped value. Never fork a base manifest to differ per environment.
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-vars
  namespace: flux-system
data:
  # --- identity of the environment ---
  CLUSTER_ENV: "base"                       # dev | prod  (overlays set this)

  # --- DNS / TLS ---
  BASE_DOMAIN: "home.keithjackson.dev"      # platform hostname suffix (same both envs; split-horizon)
  DNS_ZONE: "keithjackson.dev"              # the actual Cloudflare ZONE (BASE_DOMAIN is a subdomain of it);
                                            # ExternalDNS domain-filter must be the zone, not the subdomain
  ACME_CLUSTER_ISSUER: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)

  # --- storage (ADR-0003) ---
  LONGHORN_DEFAULT_REPLICA_COUNT: "3"       # default StorageClass replica count (3 on 3 nodes)

  # --- observability sizing (docs/10) ---
  MONITORING_PROMETHEUS_RETENTION: "7d"     # dev short | prod long
  MONITORING_PROMETHEUS_PVC_SIZE: "10Gi"
  MONITORING_LOKI_PVC_SIZE: "10Gi"

  # --- admission enforcement (Kyverno, ADR-0011). Base defaults are the STRICT/prod posture;
  #     the dev overlay softens them for bootstrap (Audit / Ignore / 1) so a cold cluster can
  #     come up before policies are proven and admission is HA. ---
  KYVERNO_VALIDATION_ACTION: "Enforce"            # dev: Audit (observe before enforcing)
  KYVERNO_FORCE_FAILURE_POLICY_IGNORE: "false"    # dev: "true" (chart forceFailurePolicyIgnore = fail-open)
  KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)

  # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml ---
  PIA_REGION: "SE Stockholm"                 # operator's choice (Sweden). PIA's OpenVPN region name is
                                             # "SE Stockholm" — PF-capable (NOT "SE Streaming Optimized",
                                             # which lacks PF; NOT a US region, which also lack PF)
  CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                             # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel

  # --- identity / auth (ADR-0014) ---
  KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)
  OAUTH2_PROXY_REPLICAS: "1"                 # dev 1 | prod 2 (HA)

  # --- backup / DR (ADR-0003, R-STATE-03) ---
  VELERO_BACKUP_SCHEDULE: "0 3 * * *"        # cron; overlays may differ
  VELERO_RETENTION: "168h"                   # dev short | prod long

  # --- placement ---
  PLATFORM_NODE_SELECTOR_KEY: "kubernetes.io/os"   # base no-op selector; prod may pin roles
  PLATFORM_NODE_SELECTOR_VALUE: "linux"