---
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
# (clusters/base/platform.yaml, path: ./platform).
#
# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
# the same pattern by which kyverno was previously deferred. Credentials each component needs are
# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
# component is never gated on a credential ask — only on its phase and readiness.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  # ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
  - kyverno            # admission enforcer FIRST — policies present before other components reconcile
  - cilium             # CNI (adopts the running Ansible-installed release; parity verified)
  - longhorn           # replicated block storage / CSI
  - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
  - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
  - gateway            # Gateway API listeners (ingress; replaces Traefik)
  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP, ADR-0013 amendment). Real root cause of the earlier
  #      failures: gluetun's bundled PIA server list was STALE (dialing retired 46.246.x IPs → timeouts);
  #      fix = UPDATER_PERIOD (fetch current servers) + OPENVPN_MTU/MSSFIX 1350 for the Cilium-VXLAN 1450
  #      pod MTU. See DECISIONS-LOG "Phase 3 VPN". ----
  - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
  # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
  - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
  # ---- Later phases: enabled when their phase opens ----
  # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
  # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
  # - kubevirt         # Phase 5 (IaaS proof): KubeVirt + CDI
  # - keycloak         # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
  # - oauth2-proxy     # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`