---
# Enable SOPS decryption on the `platform` Flux Kustomization (ADR-0007, R-SEC-01).
#
# This REALISES the commented TODO in clusters/base/platform.yaml:
#     # decryption:
#     #   provider: sops
#     #   secretRef:
#     #     name: sops-age
# It is a strategic-merge patch (matched by apiVersion/kind/name/namespace) that ADDS the
# decryption stanza to the existing base Kustomization WITHOUT forking it (R-ENV-02).
#
# The `sops-age` Secret is created out-of-band (../../sops/age-key-secret.md); it is referenced
# BY NAME ONLY here — no key material in git.
#
# WIRING (clusters owner / PM — outside the security engineer's subtree): add this file to
# clusters/dev/kustomization.yaml `patches:` (path-relative), e.g.
#     patches:
#       - path: ../../bootstrap/flux/patches/platform-sops-decryption.yaml
# so the dev overlay reconciles platform manifests with decryption enabled. See ../README.md.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: platform
  namespace: flux-system
spec:
  decryption:
    provider: sops
    secretRef:
      name: sops-age