apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# Order is documented but not enforced here — Flux respects HelmRelease
# dependsOn declarations for actual install order. Listing in canonical
# Phase 0 sequence per SOVEREIGN-PROVISIONING.md §3.
resources:
  - 01-cilium.yaml
  - 01a-gateway-api.yaml
  - 02-cert-manager.yaml
  - 03-flux.yaml
  - 04-crossplane.yaml
  - 05-sealed-secrets.yaml
  - 05a-reflector.yaml
  - 07-nats-jetstream.yaml
  - 08-openbao.yaml
  - 09-keycloak.yaml
  - 10-gitea.yaml
  - 11-powerdns.yaml
  - 12-external-dns.yaml
  - 13-bp-catalyst-platform.yaml
  - 14-crossplane-claims.yaml
  - 15-external-secrets.yaml
  - 15a-external-secrets-stores.yaml
  - 16-cnpg.yaml
  - 17-valkey.yaml
  - 18-seaweedfs.yaml
  - 19-harbor.yaml
  # 06a — Post-handover Self-Sovereignty Cutover (issue #791). Filename
  # carries the 06a prefix to colocate cohorts visually, but the slot's
  # dependsOn pins actual install order to AFTER bp-gitea (slot 10) and
  # bp-harbor (slot 19). Chart installs DORMANT — catalyst-api stamps
  # Jobs only on operator-driven cutover trigger.
  - 06a-bp-self-sovereign-cutover.yaml
  - 20-opentelemetry.yaml
  - 21-alloy.yaml
  - 22-loki.yaml
  - 23-mimir.yaml
  - 24-tempo.yaml
  - 25-grafana.yaml
  - 27-kyverno.yaml
  - 28-reloader.yaml
  - 29-vpa.yaml
  - 30-trivy.yaml
  - 31-falco.yaml
  - 32-sigstore.yaml
  - 33-syft-grype.yaml
  - 34-velero.yaml
  - 35-coraza.yaml
  - 49-bp-cert-manager-powerdns-webhook.yaml
  - 50-cluster-autoscaler.yaml
  # bp-newapi (slot 80) — multi-tenant LLM marketplace gateway. Sequenced
  # after the W2.K1 dependency wave (cnpg/keycloak/openbao Ready) so
  # NewAPI's ExternalSecret + DSN dependencies resolve on first reconcile.
  # See clusters/_template/bootstrap-kit/80-newapi.yaml for full
  # dependsOn rationale and per-Sovereign override surface.
  - 80-newapi.yaml
