# Isolated Stage 2 canary. TEN-WP-0009 moved production off a ReadWriteOnce
# PVC onto PostgreSQL with RollingUpdate, so a second pod is storage-feasible.
# Isolation is a distinct Deployment + Service selector, not a second replica
# behind the production Service — user-engine's NetworkPolicy still points at
# app.kubernetes.io/name=tenant-engine and must not start sending traffic here.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
patches:
  - target:
      kind: Deployment
      name: tenant-engine
    patch: |-
      - op: replace
        path: /metadata/name
        value: tenant-engine-canary
      - op: replace
        path: /spec/selector/matchLabels/app.kubernetes.io~1name
        value: tenant-engine-canary
      - op: replace
        path: /spec/template/metadata/labels/app.kubernetes.io~1name
        value: tenant-engine-canary
  - target:
      kind: Service
      name: tenant-engine
    patch: |-
      - op: replace
        path: /metadata/name
        value: tenant-engine-canary
      - op: replace
        path: /spec/selector/app.kubernetes.io~1name
        value: tenant-engine-canary
  - target:
      kind: NetworkPolicy
      name: tenant-engine
    patch: |-
      - op: replace
        path: /metadata/name
        value: tenant-engine-canary
      - op: replace
        path: /spec/podSelector/matchLabels/app.kubernetes.io~1name
        value: tenant-engine-canary
      - op: replace
        path: /spec/ingress
        value: []