# External customer production preparation

This overlay creates the isolated production namespace, workloads, PVC,
services, service account, observability target, and ExternalSecret resources
for the `external-customer` Investibook release line.

It intentionally does **not** create an Ingress, certificate, public DNS record,
or TiDB Cloud Gateway route. Until the explicit cutover change is reviewed, use
`kubectl port-forward` for readiness and smoke tests.

Before syncing this overlay:

1. Build the selected `external-customer` commit into the production ECR by
   running `Investibook External Customer Prod Promotion` with
   `publish_gitops=false`.
2. Store `RUN9_ACCESS_KEY` and `RUN9_SECRET_KEY` in AWS Secrets Manager at
   `prod/investibook/customer-facing/run9` in `us-west-2`. The credentials must
   be authorized for the Run9 project `Investibook-customer-prod`
   (`x0gjx5mw7sqh`).
3. Verify the customer-facing Bedrock secret exists at
   `prod/investibook/customer-facing/bedrock/profiles/default` in
   `ap-southeast-1`.
4. Promote the Run9 snapshot already tested in Dev through an Org-level shared
   snap, consume it into the `Investibook-customer-prod` project, and update
   `RUN9_SOURCE_SNAP_ID` to the resulting project-local snapshot. Never use a
   snapshot ID from a different Run9 project.

The production promotion workflow adds the `external-customer-prod` element to
`devops-service/app-registry/investibook.yaml` in the same GitOps bump PR that
sets the real image tag and Run9 snapshot. This keeps the placeholder overlay
from being synced prematurely. Public traffic remains unchanged until a
separate cutover PR adds the Gateway route and DNS/host configuration.