---
# pm-agent — the Program Manager agent service. Reconciled by its OWN post-platform Flux
# Kustomization (clusters/base/pm-agent.yaml, dependsOn apps-wave-0, wait:false), NOT by the
# gating `platform` tier.
#
# WHY ITS OWN NON-GATING TIER, like crafty/headlamp/homepage: this is a leaf whose pod can be
# legitimately unhealthy for a long time — it CrashLoops by design while its credentials are
# still placeholders, and it depends on Gitea being up (apps-wave-0) to authenticate at
# startup. A workload like that inside the gating `platform` tier would keep `platform`
# not-Ready, and while `platform` is not-Ready NOTHING downstream reconciles. That is the
# headlamp gating stall, and it is not worth re-learning.
#
# dependsOn apps-wave-0 rather than platform-config: what this service actually needs is
# GITEA, not the Keycloak realm, the wildcard certificate or the Gateway — it serves no
# traffic and has no UI.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  # The dispatcher identity (may create worker Jobs here) and the worker identity (bound to
  # nothing). Read alongside platform/kyverno/admission/pm-agent-job-shape.yaml: that policy
  # is the boundary, this file is only its necessary half.
  - rbac.yaml
  - configmap.yaml
  # The Gitea token and the Anthropic subscription token — SOPS-encrypted, decrypted
  # per-environment by the pm-agent Kustomization (clusters/prod and clusters/dev patch it by
  # name, identically to crafty/headlamp/oauth2-proxy). Referenced by name only (R-IDP-04).
  #
  # THE COMMITTED VALUES ARE PLACEHOLDERS. The service is inert until the operator replaces
  # them; the hand-off steps are in the sibling `.example` template and in README.md.
  #
  # That template is named in prose rather than by filename ON PURPOSE: the L0 check
  # no-plaintext-secrets treats a mention of an unencrypted `.example` in a kustomization as
  # a REFERENCE and refuses it as a plaintext Secret that would be applied. It is right to —
  # the distance between naming a file in a comment and listing it under `resources:` is one
  # careless edit.
  - pm-agent-credentials.sops.yaml
  - deployment.yaml
  # default-deny baseline + the two egress allow policies (gitea, kube-apiserver for the
  # dispatcher only, tcp/443 for the model). NO ingress allow exists, by design.
  - networkpolicy.yaml