---
# Enable SOPS decryption on the `apps` Flux Kustomization (ADR-0007, R-SEC-01).
#
# REALISES the commented TODO in clusters/base/apps.yaml (same pattern as the platform patch).
# Strategic-merge patch — adds the decryption stanza to the base `apps` Kustomization without
# forking it (R-ENV-02). `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
#
# WIRING (clusters owner / PM): add to clusters/dev/kustomization.yaml `patches:` alongside the
# platform patch, e.g.
#     patches:
#       - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: apps
  namespace: flux-system
spec:
  decryption:
    provider: sops
    secretRef:
      name: sops-age