pomerium-mcp: install CRDs via kustomization; add sample global config CR

Include ../crd in resources so `kubectl apply -k config/pomerium-mcp` is
self-sufficient, mirroring config/default. The Pomerium global-mcp CR is
customer-specific so it lives as a sibling pomerium-crd.yaml, applied
separately rather than via the kustomization.

Author: wasaga

config/pomerium-mcp/kustomization.yaml

@@ -3,17 +3,21 @@
 #   namespace          pomerium-mcp
 #   IngressClass       pomerium-mcp        (controller: pomerium.io/ingress-controller-mcp)
 #   StatefulSet + PVC  for file-based databroker persistence
-#   global config CR   global-mcp           (applied separately via pomerium-crd.yaml)
+#
+# The Pomerium global config CR (`global-mcp`) is customer-specific and lives
+# in pomerium-crd.yaml as a sibling — applied separately, not via this kustomization.
 #
 # Layout:
-#   namespace.yaml + ingressclass.yaml are unique to this overlay (cluster-scoped names
-#     must NOT be prefixed, so they live at the top level outside the namePrefix scope).
-#   ../pomerium/service/proxy.yaml is reused as-is — commonLabels rewrites the selector
-#     so it matches our renamed pods, and the metrics Service is intentionally skipped.
-#   ./inner pulls in ../../pomerium/rbac and ../../gen_secrets and applies a namePrefix
-#     so the cluster-scoped ClusterRole/Binding don't collide with the default install.
-#   The image override is set once here so both the StatefulSet and the gen-secrets Job
-#     pick up the same SHA.
+#   ../crd installs the CRD schemas, mirroring config/default.
+#   namespace.yaml + ingressclass.yaml are top-level resources whose names must
+#     stay exact, so they sit outside the inner namePrefix scope.
+#   ../pomerium/service is reused as-is — commonLabels rewrites the selector so
+#     it matches our renamed pods.
+#   ./inner pulls in ../../pomerium/rbac and ../../gen_secrets and applies a
+#     namePrefix so the cluster-scoped ClusterRole/Binding don't collide with
+#     the default install.
+#   The image override is set once here so both the StatefulSet and the
+#     gen-secrets Job pick up the same SHA.
 #
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -24,6 +28,7 @@ images:
   - name: pomerium/ingress-controller
     newTag: sha-3fddd34
 resources:
+  - ../crd
   - namespace.yaml
   - ingressclass.yaml
   - ../pomerium/service

config/pomerium-mcp/pomerium-crd.yaml

@@ -0,0 +1,22 @@
+#
+# Pomerium global config CR for the pomerium-mcp instance.
+# Cluster-scoped and applied separately from the kustomization:
+#
+#   kubectl apply -k config/pomerium-mcp
+#   kubectl apply -f config/pomerium-mcp/pomerium-crd.yaml
+#
+# The StatefulSet's `--pomerium-config=global-mcp` flag binds it to this CR.
+# `storage.file.path` lives on the PVC mounted at /data so the databroker
+# survives pod restarts.
+#
+apiVersion: ingress.pomerium.io/v1
+kind: Pomerium
+metadata:
+  name: global-mcp
+spec:
+  secrets: pomerium-mcp/bootstrap
+  storage:
+    file:
+      path: /data/pomerium.db
+  runtimeFlags:
+    mcp: true