# =============================================================================
# AI Software Factory — kustomization (cluster-local deployment)
#
# Usage:
#   kubectl apply -k infrastructure/kubernetes/
#
# Changing the image tag:
#   The image tag is a single variable in the `images:` block below (all four
#   images share the same tag, matching the release pipeline). Bump it by
#   editing `newTag` here (or in CI: `kustomize edit set image ...` / a
#   small script), then re-apply. The manifests themselves always say
#   `:TAG` and kustomize substitutes the value here — that is the single
#   source of truth for the deployed tag.
#
# Secrets:
#   `factory-secrets` and `factory-db` are NOT defined here. Create them
#   before the first apply (see secret.example.yaml for the strategy).
#   The apply of this directory will fail on envFrom references until they
#   exist — by design, so a half-configured cluster never runs.
# =============================================================================
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: factory

commonLabels:
  app.kubernetes.io/part-of: ai-software-factory

resources:
  - namespace.yaml
  - configmap.yaml
  # ---- PostgreSQL + PITR / backup (TASK-0135) ------------------------------
  - postgres/statefulset.yaml           # StatefulSet postgres + Service factory-db
  - postgres/configmap.yaml             # PITR config: archive_command, wal-g shims
  - postgres/cronjob-backup.yaml        # daily base backup, 05:00 UTC (wal-g)
  - postgres/cronjob-opensearch-snapshot.yaml  # daily OS snapshot, 05:30 UTC
  - postgres/pgbouncer.yaml             # transaction-mode pooler (per-app pool_size)
  - postgres/replica.yaml               # read replica (hot standby) for db.read()
  # NOT a k8s object (do not add): postgres/walg-iam-policy.yaml — the IAM
  # policy document for the backup identity (see its header).
  # -------------------------------------------------------------------------
  - redis.yaml
  - api.yaml
  - web.yaml
  - worker.yaml
  - realtime.yaml
  - ingress.yaml
  - pdb.yaml
  # ---- Observability (TASK-0135, phase-15) ----------------------------------
  # NetworkPolicy lives in `factory` (the apps' namespace) → appended here.
  # The monitoring STACK (observability/) is a STANDALONE APPLY ROOT — it must
  # live in namespace `monitoring`, and this file's `namespace: factory`
  # transformer would override the stack's pinned namespace onto `factory`
  # (verified, kustomize v5.3.0), breaking the FQDN the factory-config
  # configmap already points the apps' OTLP exporter at
  # (otel-collector.monitoring.svc.cluster.local). Conflict recorded in the
  # TASK-0135 report (AGENTS rule 29). Apply it separately:
  #   kubectl apply -k infrastructure/kubernetes/observability/
  - networkpolicy.yaml
  # - secret.example.yaml  # NEVER add this — see its header. Create real
  #                         # secrets via SealedSecrets/SOPS/ExternalSecrets.

# Single source of truth for the deployed image tag (see header).
# CI (workflows/release.yml) renders this value from the git tag.
images:
  - name: ghcr.io/ai-software-factory/api
    newTag: v0.1.0
  - name: ghcr.io/ai-software-factory/web
    newTag: v0.1.0
  - name: ghcr.io/ai-software-factory/worker
    newTag: v0.1.0
  - name: ghcr.io/ai-software-factory/realtime
    newTag: v0.1.0

# Pod-template annotations are intentionally kept simple; per-resource label
# overrides can be added here if you adopt a stricter label policy.