---
# UniFi OS Server VM (KubeVirt). Part of the non-gating `apps-vms` Flux Kustomization.
# 90-httproute-optional.yaml is intentionally omitted (optional L7 UI; needs BackendTLSPolicy —
# UOS serves HTTPS on :11443; browser access is via the L4 LoadBalancer VIP for now).
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - 10-default-deny.yaml
  - 20-datavolume.yaml
  - 30-virtualmachine.yaml
  - 40-networkpolicy.yaml
  - 50-service-l4.yaml
  # SOPS-encrypted. Carries the operator's UOS installer URL (+ optional SSH key) and is mounted
  # into the guest as the UOSDATA disk by 30-virtualmachine.yaml. Decrypted by the `apps-vms` Flux
  # Kustomization, which clusters/dev and clusters/prod patch with the `decryption` stanza — the
  # FIRST encrypted content under apps/vms, so that patch was added with this file. The plaintext
  # template + the operator hand-off steps live in the `.example` sibling of the file below, which
  # is deliberately NOT named here: the L0 no-plaintext-secrets check fails any kustomization whose
  # text contains an example template's filename, on the assumption it is being applied.
  - unifi-uos-installer.sops.yaml