---
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
# (clusters/base/platform.yaml, path: ./platform).
#
# Phase 0 scaffolding: lists every platform component EXCEPT kyverno (owned by the policy engineer,
# WS-TEST — see platform/README.md).
#
# ⚠️ INTEGRATION TODO(PM): once platform/kyverno/ is authored by the policy engineer, uncomment the
# `- kyverno` line below. Keep it FIRST so admission policies are present before other components
# reconcile. This workstream must NOT create files under platform/kyverno/.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  # - kyverno            # DEFERRED to Phase 2 (T-2.7): admission enforcement needs a cluster.
  #                        Scaffolding is present & buildable at platform/kyverno/; enable it first
  #                        (before other components) when T-2.7 activates. Kyverno's CI L0 gate is
  #                        already live now via .gitea/ + ci/ (no cluster needed).
  - cilium
  - longhorn
  - cert-manager
  - externaldns
  - gateway
  - monitoring
  - velero
  - kubevirt
  - image-automation
  - keycloak
  - oauth2-proxy