# Kustomize entrypoint (task 46).
#
# Validate: `kustomize build deploy/k8s`
# Dry-run against a cluster: `kubectl apply --dry-run=server -k deploy/k8s`
#
# Release pinning: CI resolves the floating tags below to immutable digests
# (`kustomize edit set image d-oauth-server=ghcr.io/...@sha256:<digest>`)
# after `docker buildx bake` pushes, so a rollout can never float. The
# committed file intentionally carries tags; the pinned build is what ships.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: d-oauth
resources:
  - namespace.yaml
  - configmap.yaml
  - secret.yaml
  - service.yaml
  - deployment.yaml
  - migrate-job.yaml
  - pdb.yaml
images:
  - name: ghcr.io/d-oauth/d-oauth-server
    newName: ghcr.io/d-oauth/d-oauth-server
    newTag: latest
# NOTE: no Ingress resource is shipped on purpose. In-process mTLS
# verification needs L4/TCP passthrough (NLB gateway / TLSRoute); an L7
# ingress that terminates TLS strips the client certificate. Adding an
# Ingress while `D_OAUTH_TLS__CLIENT_CA_PATH` is set fails
# `scripts/check_manifests.py`. See docs/DEPLOYMENT.md.