apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# Stable secret name: the job mounts talos-repair-config by name, so the generated
# Secret must not get a hash suffix (same convention as k8s/argocd/secrets).
generatorOptions:
  disableNameSuffixHash: true
# ksops decrypts talosconfig-secret.enc.yaml into the Secret the job mounts.
# Kept local to this app on purpose: no edits to the shared secrets generator.
generators:
  - secret-generator.yaml
resources:
  - restart-kubelet.yaml