---
# Flux Kustomization: PLATFORM CONFIGS — the custom resources (cert-manager ClusterIssuers, the
# wildcard Certificate + Gateway, Kyverno ClusterPolicies, Cilium L2 IP-pool/announcement) that
# depend on CRDs registered by the `platform` CONTROLLERS. Split out per the flux2 controllers/
# configs pattern so the CRDs exist BEFORE these apply — otherwise the single platform apply fails
# atomically with "no matches for kind ClusterIssuer" and nothing installs (see DECISIONS-LOG).
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: platform-config
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: true
  dependsOn:
    - name: platform          # controllers (which register the CRDs) must be healthy first
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform-config
  # No decryption: platform-config carries no SOPS-encrypted content (the encrypted Secrets live in
  # ./platform and are applied by the `platform` Kustomization).
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars     # ACME_CLUSTER_ISSUER, KYVERNO_VALIDATION_ACTION, …