---
# Flux Kustomization: PLATFORM services (cluster-wide). Reconciles ./platform.
# Phase 0 STUB. Realizes R-GITOPS-01/03 (pull-based reconcile + drift correction) and
# R-ENV-02 (env differences supplied ONLY via substituteFrom cluster-vars).
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: platform
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true          # drift correction: delete resources removed from git (R-GITOPS-03)
  wait: true           # block `apps` until platform is healthy
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform
  # R-ENV-02: the ONLY place environment differences enter platform manifests.
  # dev/prod overlays patch the cluster-vars ConfigMap; the base manifests are never forked.
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # TODO(WS-SEC, Phase 1): enable SOPS decryption once the age key exists (ADR-0007).
  #   decryption:
  #     provider: sops
  #     secretRef:
  #       name: sops-age
  # TODO(PM): the top-level ./platform/kustomization.yaml must include platform/kyverno/
  #           (owned by the policy engineer, WS-TEST). See platform/README.md integration TODO.