apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# Secrets managed by SOPS + age (FluxCD native decryption).
# L2 load balancing is provided by Cilium (see post-crds/cilium-l2.yaml).
resources:
  - namespaces/
  - cluster-settings/
  - cilium/
  - multus/
  - cert-manager/
  - snapshot-controller/
  - metrics-server/
  - intel-gpu-plugin/
  - traefik/
  - rook-ceph/
  - ceph-csi-drivers/
  - cloudnative-pg/
  - mariadb-operator/
  - coredns-config/
  - k8s-gateway/
  - image-automation/
  - flux-notifications/
  - spegel/
  - openbao/
  - external-secrets/
  - reloader/
  - admission-policies/
# The OpenBao ClusterSecretStore lives in post-crds/ (needs ESO's CRDs and
# an initialized OpenBao; see kubernetes/MIGRATION-sops-openbao.md).
# cnpg-barman-plugin/ lives in its own Flux Kustomization
# (`infrastructure-cnpg-barman`) so it can dependsOn infrastructure-crds
# where the cert-manager Certificates create the TLS Secrets its
# Deployment mounts. Including it here causes the Deployment to block
# on missing Secrets while infrastructure itself cannot finish without
# the Deployment becoming Ready — circular.
# bird/ and netbird-service-sync/ run images from Gitea's registry and live in
# infrastructure-inhouse/, which waits for Gitea.
# crowdsec/, external-dns-unifi/, netbird-ingress/ and velero/ consume Secrets
# from OpenBao and have Kustomizations of their own after infrastructure-crds
# (clusters/homelab/infrastructure-services.yaml); velero-schedules/ follows
# velero.