---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  # gluetun-gateway.yaml RETIRED 2026-08-24 (ADR-0015): the node-level host tunnel is validated +
  # conformance-green (egress-class + vpn-killswitch pass live); a Gluetun *pod* can't be a Cilium
  # egress-gateway target anyway. Steering now flows through the node tun0 via egress-steering.yaml.
  # NOTE: pia-credentials/pia-custom-ovpn secrets below are now UNUSED (creds are host-side in the
  # Ansible vault per docs/07) — retained temporarily, pending a follow-up cleanup change.
  - pia-credentials.sops.yaml
  - pia-custom-ovpn.sops.yaml   # (was gluetun's PIA .ovpn; superseded host-side — see note above)
  - egress-steering.yaml        # ADR-0015: steer egress-class=vpn pods to the node tun0 (validated 2026-08-24)