---
# platform/kured — the Kubernetes Reboot Daemon.
#
# Rendered by its OWN Flux Kustomization (clusters/base/kured.yaml, dependsOn platform), NOT by a
# line in platform/kustomization.yaml. The reasoning is the same one the Cilium split-out wrote down
# and intel-gpu-plugin reused: inside the shared `wait: true` platform tier, this component's health
# would be indistinguishable from eleven others, the only emergency valve would be suspending the
# whole tier, and that tier's 5m timeout is wrong for a 3-node DaemonSet rollout. It matters more
# than usual here, because `platform` gates platform-config which gates every apps wave — so a wedged
# reboot daemon placed there could stall every application in the cluster. A component whose entire
# purpose is to make maintenance safer must not be able to cause an outage.
#
# `namespace: kured` applies to every resource below, so none of them repeats it. Keep it: the
# CiliumNetworkPolicy in networkpolicy.yaml is a CR whose namespace kustomize would otherwise leave
# to chance.
#
# NO SECRET OF ANY KIND. kured authenticates to the API server with its own ServiceAccount token and
# talks to nothing off-cluster — no registry credential, no webhook URL, no notification token. So
# neither clusters/dev nor clusters/prod adds a SOPS decryption patch for this tier (same as
# homepage/runbooks/intel-gpu-plugin). If Slack or shoutrrr notifications are ever wanted, the chart
# takes them via `configuration.notifyUrl`, and THAT would need a SOPS-encrypted Secret plus a
# decryption patch — do not inline a webhook URL here.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kured
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml     # chart installs the DaemonSet / RBAC / SA / Service / ServiceMonitor
  # default-deny baseline + the Prometheus scrape ingress + the apiserver/Prometheus egress.
  # The scrape ingress is NOT optional decoration: without it the ServiceMonitor's targets are
  # discovered and every scrape times out, leaving the TSDB empty and all three rules in alerts.yaml
  # permanently quiet. See the header in that file for the measured Longhorn precedent.
  - networkpolicy.yaml
  # Three rules over kured's single metric, with a companion promtool unit test beside them.
  - alerts.yaml