apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

# Order is documented but not enforced here — Flux respects HelmRelease
# dependsOn declarations for actual install order. Listing in canonical
# Phase 0 sequence per SOVEREIGN-PROVISIONING.md §3.
resources:
  - 01-cilium.yaml
  - 02-cert-manager.yaml
  - 03-flux.yaml
  - 04-crossplane.yaml
  - 05-sealed-secrets.yaml
  - 06-spire.yaml
  - 07-nats-jetstream.yaml
  - 08-openbao.yaml
  - 09-keycloak.yaml
  - 10-gitea.yaml
  - 11-powerdns.yaml
  - 12-external-dns.yaml
  - 13-bp-catalyst-platform.yaml
  - 14-crossplane-claims.yaml
  - 15-external-secrets.yaml
  - 16-cnpg.yaml
  - 17-valkey.yaml
  - 18-seaweedfs.yaml
  - 19-harbor.yaml
  - 20-opentelemetry.yaml
  - 21-alloy.yaml
  - 22-loki.yaml
  - 23-mimir.yaml
  - 24-tempo.yaml
  - 25-grafana.yaml
  - 26-langfuse.yaml
  - 27-kyverno.yaml
  - 28-reloader.yaml
  - 29-vpa.yaml
  - 30-trivy.yaml
  - 31-falco.yaml
  - 32-sigstore.yaml
  - 33-syft-grype.yaml
  - 34-velero.yaml
  - 35-coraza.yaml
  # qa-loop iter-7 Fix #39 — exec fan-out (Apache Guacamole + per-node
  # k8s-ws-proxy DaemonSet). Slots 51/52. See
  # clusters/_template/bootstrap-kit/kustomization.yaml for the
  # cross-Sovereign canonical comment.
  - 51-bp-k8s-ws-proxy.yaml
  - 52-bp-guacamole.yaml
  # qa-loop iter-12 Fix #53C — EPIC-5 leftovers (NetBird zero-trust mesh
  # + DMZ vCluster isolation). Slots 53/54. Hubble UI ingress is enabled
  # via the catalystOverlay block in 01-cilium.yaml (no separate slot).
  - 53-bp-netbird.yaml
  - 54-bp-dmz-vcluster.yaml
  # qa-loop iter-12 Fix #54 Workstream 1 — bp-hcloud-ccm (slot 55).
  # The chroot omantel reconciles from clusters/_template/bootstrap-kit/
  # which carries the actual 55-bp-hcloud-ccm.yaml file. The line below
  # is intentionally omitted from this per-Sovereign overlay until Phase-2
  # cutover separates the chroot reconcile from the per-Sovereign one
  # (per the same pattern as 26-langfuse.yaml — present in this overlay
  # but NOT in _template, vs slot 55 — present in _template only). When
  # the per-Sovereign overlay becomes the canonical reconcile target,
  # copy clusters/_template/bootstrap-kit/55-bp-hcloud-ccm.yaml here AND
  # uncomment the resource list entry below.
  # - 55-bp-hcloud-ccm.yaml
