---
# FINAL step: hand off to Flux + SOPS (T-1.4). Calls into bootstrap/ (authored by
# the Security + GitOps Engineers) — this play does not author that subtree.
#
# TARGET (R-ENV-02): `k3s_hosts` defaults to dev's `k3s_servers`; prod is
#   ansible-playbook playbooks/flux-bootstrap.yml -e k3s_hosts=k3s_prod
# NOTE the Flux PATH is a separate concern: roles/flux_bootstrap shells out to
# bootstrap/flux/bootstrap.sh, which bootstraps --path=clusters/dev. Prod needs
# --path=clusters/prod, which is a bootstrap/ change, NOT a target-group change
# (infra/PROD-PROVISIONING.md §7 tracks it).
- name: Flux + SOPS bootstrap hand-off
  hosts: "{{ k3s_hosts | default('k3s_servers') }}"
  become: false
  gather_facts: false
  roles:
    - role: flux_bootstrap