---
# Flux Kustomization: Velero backup controller — reconciles ./platform/velero.
#
# OWN NON-GATING TIER (dependsOn platform-config, wait:false) — the same rationale as headlamp/
# oauth2-proxy/crafty. Velero is a BACKUP CONTROLLER; it must NEVER gate the platform graph. Its
# HelmRelease (chart + AWS plugin init-container + node-agent DaemonSet) can legitimately be
# not-Ready during a cold start (image pulls, the node-agent rolling out on every node, the BSL
# doing its first reachability probe against MinIO). If it sat in the gating `platform` tier, that
# transient unhealth would stall platform-config + every apps wave/vm on "dependency not ready" —
# exactly the failure headlamp already encodes. Nothing in the graph dependsOn backup, and wait:false
# guarantees its health can NEVER gate anything even if a future resource is (mistakenly) pointed at it.
#
# It reconciles AFTER platform-config only so the storage/CRD surface it backs up already exists; the
# backup path itself (Velero pods → http://192.168.1.9:9000) is independent of the rest of the graph.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: velero
  namespace: flux-system
spec:
  interval: 10m
  retryInterval: 2m
  timeout: 5m
  prune: true
  wait: false
  dependsOn:
    - name: platform-config
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: ./platform/velero
  # cluster-vars feeds the backup cadence/retention knobs (${VELERO_BACKUP_SCHEDULE}, ${VELERO_RETENTION}).
  postBuild:
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars
  # SOPS decryption for velero-cloud.sops.yaml (the scoped MinIO `cloud` credential) is layered per
  # environment by the overlay (clusters/dev patches THIS Kustomization by name), identical to how
  # headlamp/oauth2-proxy/crafty decrypt their own SOPS secrets. See clusters/dev/kustomization.yaml.