---
# platform-config — the CONFIGS half of the controllers/configs split (flux2 idiomatic).
#
# WHY: the `platform` Flux Kustomization installs the CONTROLLERS (HelmReleases) that register CRDs
# (cert-manager.io, kyverno.io, …). The custom resources BELOW use those CRDs, so applying them in
# the SAME pass fails atomically ("no matches for kind ClusterIssuer") and blocks the whole platform
# apply. This Kustomization carries the CRs and is gated `dependsOn: platform` (wait) so the CRDs
# exist first. See clusters/base/platform-config.yaml + DECISIONS-LOG.
#
# Files are referenced IN PLACE via ../platform/... (Flux builds with LoadRestrictionsNone, and the
# Kyverno policies must stay under platform/kyverno/ for the CI L0 `kyverno test` gate). Build/verify
# locally with: kubectl kustomize --load-restrictor LoadRestrictionsNone platform-config
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  # cert-manager: DNS-01 issuers (need cert-manager.io CRDs from the cert-manager HelmRelease)
  - ../platform/cert-manager/clusterissuers.yaml
  # gateway: the Gateway + wildcard Certificate (Certificate needs cert-manager.io; Gateway needs the
  # GatewayClass, which stays in platform/gateway as a controller resource)
  - ../platform/gateway/gateway.yaml
  - ../platform/gateway/wildcard-certificate.yaml
  # kyverno: ClusterPolicies (need kyverno.io CRDs from the Kyverno HelmRelease)
  - ../platform/kyverno/policies/require-default-deny-baseline.yaml
  - ../platform/kyverno/policies/validate-default-deny-shape.yaml
  - ../platform/kyverno/policies/restrict-host-namespaces.yaml
  - ../platform/kyverno/policies/require-egress-class-label.yaml
  - ../platform/kyverno/policies/require-auth-mode-label.yaml
  - ../platform/kyverno/admission/secret-provenance.yaml
  # cilium: L2 LB IP pool + announcement policy (cilium.io CRDs already registered by Cilium)
  - cilium/l2-ip-pool.yaml
  - cilium/l2-announcement-policy.yaml
  # monitoring: PrometheusRule alert rules (need monitoring.coreos.com CRDs from kube-prometheus-stack)
  - ../platform/monitoring/alerts.yaml