apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: mnt

resources:
  - ../../../base/app/identity/auth/stateless/auth-server
  - ../../../base/managing/migration-flyway
  - ingress.yaml
  - networkpolicy.yaml

images:
  - name: registry.example.com/auth-platform/auth-server
    newName: registry.project.com/auth-platform/auth-server
    newTag: manual-20260512071751

patches:
  - target:
      kind: ConfigMap
      name: auth-server-config
    patch: |-
      - op: add
        path: /data/APP_SECURITY_KEYCLOAK_ISSUER_URI
        value: http://keycloak.local.test/realms/platform
      - op: add
        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI
        value: http://keycloak.local.test/realms/platform
      - op: add
        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI
        value: http://keycloak/realms/platform/protocol/openid-connect/certs
      - op: add
        path: /data/SERVER_MAX_HTTP_REQUEST_HEADER_SIZE
        value: 64KB
  - target:
      kind: ServiceAccount
      name: auth-server-sa
    patch: |-
      - op: add
        path: /imagePullSecrets
        value:
          - name: docker-registry-pull-credentials
  - target:
      kind: Job
      name: migration-flyway
    patch: |-
      - op: add
        path: /metadata/annotations
        value:
          argocd.argoproj.io/sync-wave: "-1"
          argocd.argoproj.io/hook: PreSync