---
# Kyverno — in-cluster admission enforcer. DEV-SOFTENED via cluster-vars:
#   KYVERNO_VALIDATION_ACTION=Audit, KYVERNO_WEBHOOK_FAILURE_POLICY=Ignore,
#   KYVERNO_ADMISSION_REPLICAS=1 (base defaults Enforce/Fail/3 for prod).
# Non-blocking on today's cluster (policies match only `app-namespace=true` namespaces,
# none exist yet). No SOPS content. Listed first so admission is present before workloads.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: kyverno
  namespace: flux-system
spec:
  interval: 1h
  retryInterval: 2m
  timeout: 10m
  prune: true
  wait: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/kyverno
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars