---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  # Scoped S3 credential for ${S3_BACKUP_ENDPOINT} (the `cloud` INI key the AWS plugin reads) —
  # SOPS-encrypted, decrypted per-env by the `velero` Flux Kustomization (clusters/dev).
  # ONE key lives in FOUR Secrets across three namespaces (this one + the three CNPG
  # *-db-backup-credentials). platform/backup/set-r2-credentials.sh writes all four with `sops set`
  # and proves they agree; do not hand-edit one of them. platform/backup/minio-credentials.sops.yaml
  # retains the PRE-MIGRATION MinIO key on purpose. See infra/BACKUP-R2.md.
  - velero-cloud.sops.yaml