chore: consolidate manifest overlays from 10 to 5

.github/workflows/kustomize-check.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Build all overlays
         run: |
           failed=0
-          for overlay in production e2e kind kind-local local-dev; do
+          for overlay in production e2e kind crc hcmai; do
             echo "=== $overlay ==="
             if oc kustomize "components/manifests/overlays/$overlay" > /dev/null; then
               echo "OK"

Makefile

@@ -79,7 +79,7 @@ RUNNER_QUAY_TAG ?= latest
 RUNNER_PRELOAD_TAG ?= kind-preloaded
 RUNNER_PRELOAD_REF := localhost/acp_runner_openshell:$(RUNNER_PRELOAD_TAG)
 
-# kind-local overlay always references localhost/acp_* images.
+# kind overlay with LOCAL_IMAGES=true references localhost/acp_* images.
 # Podman produces this prefix natively; for Docker we tag before loading.
 KIND_IMAGE_PREFIX := localhost/
 
@@ -626,7 +626,7 @@ clean: ## Clean up Kubernetes resources
 # reload, guaranteeing a rollout even with imagePullPolicy: IfNotPresent.
 #
 # IMPORTANT: kind clusters do NOT run a container registry. Images are loaded directly
-# into the node's containerd via `ctr images import`. The kustomize kind-local overlay
+# into the node's containerd via `ctr images import`. The kustomize kind overlay
 # sets imagePullPolicy: IfNotPresent so kubelet uses the pre-loaded image instead of
 # trying to pull from a registry. If imagePullPolicy is set to Always, pods will fail
 # with ErrImagePull because there is no registry at localhost:443.
@@ -910,14 +910,15 @@ kind-up: preflight-cluster build-cli ## Start kind cluster and deploy the platfo
 		$(MAKE) --no-print-directory build-all; \
 		$(MAKE) --no-print-directory _kind-load-images; \
 		echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying with locally-built images..."; \
-		kubectl apply --validate=false -k components/manifests/overlays/kind-local/; \
+		kubectl apply --validate=false -k components/manifests/overlays/kind/; \
+		echo "$(COLOR_BLUE)▶$(COLOR_RESET) Patching images to use localhost references..."; \
+		for img in acp_api_server acp_ambient_ui acp_control_plane acp_claude_runner acp_runner_openshell acp_mcp acp_credential_github acp_credential_jira acp_credential_k8s acp_credential_google; do \
+			kubectl set image deployment -n $(NAMESPACE) --all --containers="*" \
+				"quay.io/ambient_code/$$img:latest=localhost/$$img:latest" 2>/dev/null || true; \
+		done; \
 		echo "$(COLOR_BLUE)▶$(COLOR_RESET) Restarting deployments to pick up freshly built images..."; \
 		kubectl rollout restart deployment -n $(NAMESPACE); \
-		echo "$(COLOR_BLUE)▶$(COLOR_RESET) Patching agent registry for local images..."; \
-		REGISTRY=$$(kubectl get configmap ambient-agent-registry -n $(NAMESPACE) -o jsonpath='{.data.agent-registry\.json}'); \
-		kubectl patch configmap ambient-agent-registry -n $(NAMESPACE) --type=merge \
-			-p "{\"data\":{\"agent-registry.json\":$$(echo "$$UPDATED" | jq -Rs .)}}"; \
-		echo "$(COLOR_GREEN)✓$(COLOR_RESET) Agent registry patched for local images"; \
+		echo "$(COLOR_GREEN)✓$(COLOR_RESET) Local images applied"; \
 	else \
 		echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying with Quay.io images..."; \
 		kubectl apply --validate=false -k components/manifests/overlays/kind/; \
@@ -1856,7 +1857,7 @@ local-stop-port-forward: ## Stop background port forwarding
 # ─── CRC (OpenShift Local) targets ───────────────────────────────────────────
 
 CRC_NAMESPACE ?= ambient-code
-CRC_OVERLAY   ?= components/manifests/overlays/openshift-local
+CRC_OVERLAY   ?= components/manifests/overlays/crc
 
 crc-up: build-cli ## Deploy the platform to CRC (OpenShift Local). LOCAL_IMAGES=true builds from source. Requires 'crc start' and 'oc login' beforehand
 	@echo "$(COLOR_BLUE)▶$(COLOR_RESET) Deploying to CRC (OpenShift Local)..."

components/ambient-control-plane/internal/gateway/manifests.go

@@ -230,7 +230,7 @@ func ApplyConfigOverrides(obj *unstructured.Unstructured, config GatewayConfig)
 		}
 	}
 
-	// Add image_pull_policy for LOCAL_IMAGES=true (kind-local development)
+	// Add image_pull_policy for LOCAL_IMAGES=true (kind local development)
 	if kind == "ConfigMap" && obj.GetName() == "openshell-gateway-config" && os.Getenv("LOCAL_IMAGES") == "true" && config.Config == "" {
 		data, found, err := unstructured.NestedMap(obj.Object, "data")
 		if err != nil || !found {

components/manifests/README.md

@@ -35,10 +35,10 @@ manifests/
 │
 ├── overlays/
 │   ├── production/                        # OpenShift production (ROSA / on-prem)
-│   ├── kind/                              # Local kind cluster (Quay images)
-│   ├── kind-local/                        # Local kind cluster (locally built images)
+│   ├── kind/                              # Local kind cluster development
 │   ├── e2e/                               # Cypress E2E test environment (kind)
-│   └── local-dev/                         # CRC / OpenShift Local developer environment
+│   ├── crc/                               # CRC (OpenShift Local) development
+│   └── hcmai/                             # HCMAI ROSA cluster deployment
 │
 └── observability/                         # Grafana dashboards, OTel collector, ServiceMonitors
 ```
@@ -51,9 +51,9 @@ The base manifests assume full TLS and JWT authentication. Overlays strip these
 |---|---|---|---|
 | `base` | enabled (HTTPS + gRPC TLS) | enabled (Red Hat SSO) | enabled |
 | `production` | enabled (OpenShift service-ca) | enabled (Red Hat SSO) | enabled |
-| `local-dev` | enabled (OpenShift service-ca) | enabled | enabled |
+| `crc` | disabled | OIDC (Keycloak) | enabled |
+| `hcmai` | enabled (OpenShift service-ca) | OIDC (Keycloak) | enabled |
 | `kind` | disabled | disabled | disabled |
-| `kind-local` | disabled | disabled | disabled |
 | `e2e` | disabled | disabled | disabled |
 
 ## Overlays
@@ -69,8 +69,8 @@ The base manifests assume full TLS and JWT authentication. Overlays strip these
 oc apply -k overlays/production/
 ```
 
-### `kind/` — Local kind cluster (Quay images)
-- **Images**: `quay.io/ambient_code/*` pulled directly
+### `kind/` — Local kind cluster
+- **Images**: `quay.io/ambient_code/*` pulled directly (or locally built with `LOCAL_IMAGES=true`)
 - **Networking**: NodePort services
 - **Auth**: JWT disabled, no-TLS patches applied
 - **Database**: Vanilla postgres with init scripts (`components/postgresql-init-scripts`)
@@ -80,13 +80,6 @@ make kind-up
 kubectl apply -k overlays/kind/
 ```
 
-### `kind-local/` — Local kind cluster (locally built images)
-Extends `kind/` — overrides image refs to locally loaded images (`imagePullPolicy: Never`).
-
-```bash
-make local-reload-api-server KIND_CLUSTER_NAME=<cluster>
-```
-
 ### `e2e/` — Cypress E2E test environment
 Kind-based environment used by `make test-e2e-local`. Adds test users, ingress, and
 Cypress-compatible service configuration on top of the kind overlay.
@@ -95,13 +88,23 @@ Cypress-compatible service configuration on top of the kind overlay.
 make test-e2e-local
 ```
 
-### `local-dev/` — OpenShift Local development
-- **Namespace**: Configurable (uses `namePrefix`)
-- **Auth**: OpenShift service-ca TLS, JWKS enabled
-- **Database**: RHEL PostgreSQL with init containers
+### `crc/` — CRC (OpenShift Local)
+- **Namespace**: `ambient-code`
+- **Auth**: Keycloak OIDC, Routes for browser access
+- **Database**: Uses external database (minio/postgresql scaled to 0)
+
+```bash
+make crc-up
+```
+
+### `hcmai/` — HCMAI ROSA cluster
+- **Namespace**: `ambient-api`
+- **Auth**: Keycloak OIDC with full client credentials
+- **Database**: RHEL PostgreSQL (`components/postgresql-rhel`, `components/ambient-api-server-db`)
+- **Removes**: minio, shared postgresql, LimitRange, NetworkPolicy
 
 ```bash
-oc apply -k overlays/local-dev/
+kustomize build overlays/hcmai | oc apply -n ambient-api -f -
 ```
 
 ## Reusable Components
@@ -112,8 +115,8 @@ Components are opt-in kustomize modules included via the `components:` block in
 | Component | Purpose | Used by |
 |---|---|---|
 | `oauth-proxy` | Adds OpenShift OAuth proxy sidecar to frontend | `production` |
-| `postgresql-rhel` | Patches PostgreSQL to use `registry.redhat.io/rhel10/postgresql-16` | `production`, `local-dev` |
-| `ambient-api-server-db` | Same RHEL patch for the ambient-api-server's dedicated DB | `production`, `local-dev` |
+| `postgresql-rhel` | Patches PostgreSQL to use `registry.redhat.io/rhel10/postgresql-16` | `production`, `hcmai` |
+| `ambient-api-server-db` | Same RHEL patch for the ambient-api-server's dedicated DB | `production`, `hcmai` |
 | `postgresql-init-scripts` | ConfigMap + volume for DB init SQL (vanilla postgres only) | `kind`, `e2e` |
 
 ## Prerequisites for New Deployments

components/manifests/overlays/hcmais/kustomization.yaml → components/manifests/overlays/hcmai/kustomization.yaml

@@ -34,7 +34,7 @@ patches:
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata: { name: minio-data }
-# --- Delete unwanted PostgreSQL (shared instance, not used by hcmais) ---
+# --- Delete unwanted PostgreSQL (shared instance, not used by hcmai) ---
 - target: { group: apps, version: v1, kind: Deployment, name: postgresql }
   patch: |
     $patch: delete