# tidalDB STANDALONE instance backing thepeach's "discover" post feed.
# Apply with:
#   kubectl apply -k k8s/discover/
#
# ---------------------------------------------------------------------------
# STANDALONE, NEVER CLUSTER. A cluster node's POST /signals applies
# signal/entity/weight and never reads user_id/creator_id
# (tidal-server/src/cluster/node.rs:7461-7503) while still answering 204. A
# cluster deployment would therefore accept every behavioural signal, learn
# nothing, and leave no wire evidence. The consumer asserts
# mode:"standalone" from /health at boot for exactly this reason. Do not
# rebase this overlay onto k8s/cluster/.
# ---------------------------------------------------------------------------
#
# WHY THE MANIFESTS ARE VENDORED HERE INSTEAD OF `resources: [..]`:
# kustomize refuses both ways of reaching k8s/'s manifests from a directory
# nested inside k8s/ (verified with kubectl v1.35.0 / kustomize v5.7.1):
#   - `resources: [..]`            -> "cycle detected: candidate root .../k8s
#                                      contains visited root .../k8s/discover"
#   - `resources: [../statefulset.yaml]` (or a symlink to it)
#                                  -> "security; file .../k8s/statefulset.yaml
#                                      is not in or below .../k8s/discover"
# The sibling overlays (cluster-local-kind, cluster-t4-kind) work only because
# k8s/cluster/ is not their parent. So statefulset.yaml, service.yaml and
# poddisruptionbudget.yaml here are BYTE-IDENTICAL copies of the ones in k8s/,
# and every discover-specific difference lives in this file plus
# statefulset-patch.yaml. That keeps the divergence auditable:
#
#   for f in statefulset service poddisruptionbudget; do
#     diff -u "k8s/$f.yaml" "k8s/discover/$f.yaml" || echo "DRIFT: $f"
#   done      # must print nothing; refresh with `cp k8s/$f.yaml k8s/discover/`
#
# k8s/namespace.yaml is deliberately NOT vendored: thepeach-staging is created
# and owned by thepeach's own tofu, and kustomize's namespace transformer
# rewrites a vendored Namespace's metadata.name, which would make this overlay
# claim ownership of thepeach's namespace. k8s/schema-configmap.yaml is not
# vendored either — the discover schema below replaces it.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# Lives beside thepeach's own workloads so the api and companion-worker pods
# reach it by in-cluster DNS with no cross-namespace NetworkPolicy work. NOT
# tidalDB's own `tidaldb` namespace.
namespace: thepeach-staging

resources:
  - service.yaml
  - statefulset.yaml
  - poddisruptionbudget.yaml

# The schema is kept as a plain, reviewable YAML file and turned into a
# ConfigMap here rather than hand-embedded in a ConfigMap literal, so it stays
# diffable against thepeach's copy (thepeach: tidaldb_config/discover-schema.yaml)
# and loadable by a local `tidal-server standalone --schema` run.
# disableNameSuffixHash: the StatefulSet's schema volume and the tofu-side
# operator runbooks name this ConfigMap explicitly; a rolling hash would break
# both. The schema is read once at boot, so roll the StatefulSet to apply edits.
configMapGenerator:
  - name: tidaldb-discover-schema
    files:
      - schema.yaml
    options:
      disableNameSuffixHash: true

# The base image `tidaldb:deploy` is the LOCAL kind-loaded tag and would
# ImagePullBackOff on a real cluster. Pinned to the current published amd64
# PLATFORM-manifest digest (tag m12-agesort-20260901), the same image the live
# cluster set runs (k8s/cluster/statefulset.yaml:103). One image serves every
# subcommand; the StatefulSet's `standalone` args select the mode.
#
# Bumped from m12-poisonfix-20260831 (sha256:93a2929d) because THIS profile is
# the reason the age-aware ranking work exists: on that older image `score_hot`
# read no `created_at` at all and `Sort::New` scored by raw entity id, so
# deploying discover against it would reproduce exactly the limitation the
# `NO sort:` block in schema.yaml documents. Necessary but NOT sufficient —
# cold-start still ties, because hot's `log10(max(views,1))` numerator is
# exactly 0.0 at 0 or 1 views. See that block's STATUS: PENDING RE-MEASUREMENT.
images:
  - name: tidaldb
    newName: registry.threesix.ai/tidal/server
    digest: sha256:9234aacb197a275a67d1c1c8fbadb108e626aa48a779d4c653ad6109cda3df5a

labels:
  # Mirrors the label k8s/kustomization.yaml applies to the base set.
  - pairs:
      app.kubernetes.io/part-of: tidaldb
    includeSelectors: false
  # includeSelectors: the base selects purely on app.kubernetes.io/name=tidaldb.
  # In a shared namespace that would cross-match any other tidalDB instance
  # (e.g. a future companions instance), silently pointing this Service at the
  # wrong pods. Pinning `instance: discover` into the Service, PDB and
  # StatefulSet selectors plus the pod template makes the match exact.
  - pairs:
      app.kubernetes.io/instance: discover
    includeSelectors: true

patches:
  # Order matters: this patch targets the base name `tidaldb`, so it must run
  # before the renames below.
  - path: statefulset-patch.yaml
    target:
      kind: StatefulSet
      name: tidaldb
  # Rename the base's `tidaldb` triple to `tidaldb-discover`. Done with explicit
  # patches rather than `nameSuffix: -discover` because nameSuffix also rewrites
  # GENERATED resources, turning the ConfigMap above into
  # `tidaldb-discover-schema-discover` (verified). The StatefulSet's
  # spec.serviceName is set to match in statefulset-patch.yaml — a patch-driven
  # rename is opaque to kustomize's nameReference transformer, so nothing
  # rewires it for us.
  - target:
      kind: Service
      name: tidaldb
    patch: |-
      - op: replace
        path: /metadata/name
        value: tidaldb-discover
  - target:
      kind: PodDisruptionBudget
      name: tidaldb
    patch: |-
      - op: replace
        path: /metadata/name
        value: tidaldb-discover
  - target:
      kind: StatefulSet
      name: tidaldb
    patch: |-
      - op: replace
        path: /metadata/name
        value: tidaldb-discover