---
# Phase-2 NO-SECRET incremental rollout — DEV bootstrap scaffold.
#
# Per-component Flux Kustomizations for the components that need NO operator secret:
#   kyverno (admission, dev-softened) · cilium (adopt running CNI) · longhorn (storage)
#   · monitoring (dependsOn longhorn).
# Secret-blocked components (cert-manager, externaldns, gateway, velero, keycloak,
# oauth2-proxy, image-automation, kubevirt) are intentionally NOT created until their
# operator hand-offs arrive (DECISIONS-LOG A2 / hand-off table).
#
# TRANSITIONAL: this is the dev bootstrap graph. Once every hand-off lands, dev drops
# ./rollout and re-adopts the unified base monolith (clusters/base/platform.yaml) so dev
# and prod share one reconciliation graph again (R-ENV-02 convergence). See DECISIONS-LOG.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - kyverno.yaml       # first: admission present (Audit/Ignore in dev — non-blocking) before workloads
  - cilium.yaml        # adopt the running CNI (parity verified — no-op reconcile)
  - longhorn.yaml      # storage; monitoring depends on its StorageClass
  - monitoring.yaml    # dependsOn longhorn