# Kustomize entrypoint (task 46).
#
# Validate: `kustomize build deploy/k8s`
# Dry-run against a cluster: `kubectl apply --dry-run=server -k deploy/k8s`
#
# Release images: the workloads in `deployment.yaml` / `migrate-job.yaml`
# carry the mutable `:latest` tag directly, and no `images:` override is
# applied, so `kustomize build` emits `:latest` as-is.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: d-oauth
resources:
  - namespace.yaml
  - configmap.yaml
  - secret.yaml
  - service.yaml
  - deployment.yaml
  - migrate-job.yaml
  - pdb.yaml
  - networkpolicy.yaml
# NOTE: no Ingress resource is shipped on purpose. In-process mTLS
# verification needs L4/TCP passthrough (NLB gateway / TLSRoute); an L7
# ingress that terminates TLS strips the client certificate. Adding an
# Ingress while `D_OAUTH_TLS__CLIENT_CA_PATH` is set fails
# `scripts/check_manifests.py`. See docs/DEPLOYMENT.md. Pod egress and ingress
# are constrained by `networkpolicy.yaml` (default-deny egress except DNS +
# Postgres/Redis scoped to their namespace).