---
# Flux Kustomization: APPLICATION workloads. Reconciles ./apps AFTER platform is healthy.
# Phase 0 STUB. apps/ is owned by WS-APPS; this entrypoint is the GitOps contract that renders it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: apps
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: true
  # Ordering: the full platform (controllers + their configs) must be healthy first.
  # platform-config dependsOn platform, so depending on platform-config transitively waits for both.
  dependsOn:
    - name: platform-config
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./apps
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # TODO(WS-SEC, Phase 1): enable SOPS decryption (ADR-0007) — reference age secret by name only.