---
# oauth2-proxy component. Rendered by its OWN post-platform Flux Kustomization
# (clusters/base/oauth2-proxy.yaml, dependsOn platform-config, wait:false) — NOT by the gating
# `platform` tier. The httproute + servicemonitor (Gateway API / monitoring CRs) travel WITH the
# controller here now, rather than being referenced in-place from platform-config: the CRDs they
# need (gateway.networking.k8s.io, monitoring.coreos.com) are registered by platform and platform
# is Ready before this tier's platform-config dependency completes, so ordering holds.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  - oauth2-proxy-credentials.sops.yaml
  - httproute.yaml       # forward-auth sign-in/callback ingress (was referenced in-place by platform-config)
  - servicemonitor.yaml  # Prometheus scrape (was referenced in-place by platform-config)
  # Alerting on whether the gates are OBSERVABLE at all. Travels with the servicemonitor above
  # for the same reason it does: monitoring.coreos.com CRDs are registered by the `platform`
  # tier, which is Ready before this tier's platform-config dependency completes.
  - auth-visibility-alerts.yaml