---
# Enable SOPS decryption on the app-tier Flux Kustomizations (ADR-0007, R-SEC-01).
#
# The app tier is now dependency-ordered WAVES (apps-wave-0..N), not a single `apps`
# Kustomization — so decryption is layered onto EACH wave, by name. clusters/dev inlines one
# such stanza per wave (see clusters/dev/kustomization.yaml); this file documents the shape.
# Strategic-merge patch — adds the decryption stanza without forking the base (R-ENV-02).
# `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
#
# WIRING (clusters owner / PM): the dev overlay carries one inlined patch per wave. When
# `render.py --emit-waves` introduces a NEW deepest wave, add a matching stanza there
# (metadata.name: apps-wave-<N>). Below is the template for a single wave (wave 0 shown):
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: apps-wave-0
  namespace: flux-system
spec:
  decryption:
    provider: sops
    secretRef:
      name: sops-age