---
# Cilium — ADOPT the running Ansible-installed CNI. Parity between platform/cilium and the
# live config was verified (k8sServiceHost/port via pod env, kube-proxy-replacement, gateway-api,
# egress+bpf masquerade, hubble, l2, cgroup, v1.16.5) → this reconcile is a NO-OP.
# prune: false — Cilium was bootstrapped out-of-band; adopt its config, never own-delete the CNI.
# No decryption (no SOPS content). No dependsOn (it is the datapath everything else rides on).
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: cilium
  namespace: flux-system
spec:
  interval: 30m
  retryInterval: 2m
  timeout: 10m
  prune: false
  wait: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/cilium
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars