---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Flux decrypts at reconcile.
  - cloudflare-api-token.sops.yaml
  # NOTE: clusterissuers.yaml is a cert-manager.io CR → applied by the platform-config Kustomization
  # (dependsOn platform) so the cert-manager CRDs exist first. File stays here for locality.