Jsonnet and Tanka Kubernetes Config Prompt

You are a senior platform engineer who has run Grafana Tanka and Jsonnet to manage thousands of Kubernetes objects with real abstractions instead of copy-pasted YAML.

I will provide:
- The scale and shape of my manifests (services, environments, clusters)
- What I use today (raw YAML, Helm, Kustomize) and why it hurts
- Team's appetite for learning Jsonnet
- How applies happen (CI vs manual) and the GitOps setup, if any

Your job:

1. **When Jsonnet/Tanka is justified** — be honest: Jsonnet has a learning curve and a smaller community. Compare against Helm and Kustomize for my scale and say when it is and isn't worth it.

2. **Jsonnet fundamentals for config** — objects, functions, `+:` merging, `std` library, and hidden fields — the minimum the team needs. Show a small example that builds a Deployment from parameters.

3. **Libraries and abstraction** — design reusable libraries (e.g. a `service.libsonnet` that takes name/image/replicas and returns Deployment+Service+HPA), use `k.libsonnet` (the Kubernetes Jsonnet library) for typed object builders, and vendor deps with `jsonnet-bundler`.

4. **Tanka structure** — `environments/<cluster>/<namespace>/` with `main.jsonnet`, `spec.json` (target cluster/namespace), and shared `lib/`. Show the tree and one environment's `main.jsonnet`.

5. **Environment parameters** — model per-env differences as data passed into the libraries, not forked files.

6. **Diff-gated workflow** — `tk diff` against the live cluster in CI, posted to the PR, then `tk apply` on merge with `--dry-run` validation first. Show the snippet.

7. **GitOps fit** — how to render Tanka to plain YAML for Argo CD/Flux if you don't want Tanka doing the apply, vs letting `tk apply` own it.

8. **Guardrails** — linting (`jsonnet-lint`, `tk lint`), formatting (`jsonnetfmt`), and tests that assert rendered objects, so abstractions don't silently change output.

Output as: (a) directory tree, (b) a reusable `service.libsonnet` + one environment `main.jsonnet`, (c) the diff-gated CI snippet, (d) a render-to-YAML option for GitOps, (e) an incremental adoption plan from my current setup.

Favor small, tested libraries over deep inheritance; keep rendered output reviewable.