---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  # gluetun-gateway.yaml RETIRED 2026-08-24 (ADR-0015): the node-level host tunnel is validated +
  # conformance-green (egress-class + vpn-killswitch pass live); a Gluetun *pod* can't be a Cilium
  # egress-gateway target anyway. Steering now flows through the node tun0 via egress-steering.yaml.
  # pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml RETIRED 2026-08-24 (ADR-0015): unused after the
  # gluetun retirement — VPN creds are host-side in the Ansible vault (docs/07), not cluster SOPS Secrets.
  - egress-steering.yaml        # ADR-0015: steer egress-class=vpn pods to the node tun0 (validated 2026-08-24)