# tidalDB CLUSTER deployment (m11p5 §4). Apply with:
#   kubectl apply -k k8s/cluster/
#
# MUTUALLY EXCLUSIVE with the standalone set (k8s/, namespace `tidaldb`). This
# set lives in namespace `tidaldb-cluster`. Deploy ONE or the OTHER per
# namespace — never both (they share the StatefulSet name `tidaldb` and the
# standalone set's replicas:1 is load-bearing).
#
# Create the credentials secret FIRST (deliberately excluded so no key is
# committed — see secret.example.yaml). m11p7 shape carries BOTH the bearer and
# the cluster key:
#   kubectl -n tidaldb-cluster create secret generic tidaldb-credentials \
#     --from-literal=TIDAL_API_KEY="$(openssl rand -hex 32)" \
#     --from-literal=TIDAL_CLUSTER_KEY="$(openssl rand -hex 32)"
#
# certs.yaml (m11p7 inter-node TLS) requires cert-manager. If you do NOT run
# cert-manager, comment certs.yaml out and provision the `tidaldb-cluster-tls`
# Secret with scripts/gen-cluster-certs.sh instead.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: tidaldb-cluster

resources:
  - namespace.yaml
  - schema-configmap.yaml
  - topology-configmap.yaml
  - certs.yaml
  - service-peers.yaml
  - service-client.yaml
  - statefulset.yaml
  - poddisruptionbudget.yaml
  # Public exposure (Traefik + Let's Encrypt). Remove for internal-only.
  - ingress.yaml

labels:
  - pairs:
      app.kubernetes.io/part-of: tidaldb
    includeSelectors: false