# Kustomize entrypoint (task 46).
#
# Validate: `kustomize build deploy/k8s`
# Dry-run against a cluster: `kubectl apply --dry-run=server -k deploy/k8s`
#
# Release pinning: the `images` entry below carries a
# placeholder digest, never a floating tag. The `pin-digest` job in
# `.github/workflows/supply-chain.yml` overwrites `images[].digest` with the
# digest of the signed multi-arch build (`docker buildx bake`) after every
# push to main and re-runs `scripts/check_manifests.py --strict-digest`. The
# per-workload `image:` fields in `deployment.yaml` / `migrate-job.yaml` also
# carry the placeholder; this entry overrides them in `kustomize build`.
# `:latest` is never a shippable reference.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: d-oauth
resources:
  - namespace.yaml
  - configmap.yaml
  - secret.yaml
  - service.yaml
  - deployment.yaml
  - migrate-job.yaml
  - pdb.yaml
  - networkpolicy.yaml
images:
  - name: ghcr.io/d-oauth/d-oauth-server
    newName: ghcr.io/d-oauth/d-oauth-server
    # Placeholder (all zeroes), not a pullable reference: a rollout without
    # the pin step fails closed instead of silently floating on a tag. CI
    # replaces this with the released `sha256:<digest>` after signing.
    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
# NOTE: no Ingress resource is shipped on purpose. In-process mTLS
# verification needs L4/TCP passthrough (NLB gateway / TLSRoute); an L7
# ingress that terminates TLS strips the client certificate. Adding an
# Ingress while `D_OAUTH_TLS__CLIENT_CA_PATH` is set fails
# `scripts/check_manifests.py`. See docs/DEPLOYMENT.md. Pod egress and ingress
# are constrained by `networkpolicy.yaml` (default-deny egress except DNS +
# Postgres + Redis).