apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# NO top-level `namespace:` transformer - each Role/RoleBinding here targets
# a different service namespace (logging/storage/cicd/dashboard/sqs/temporal/
# llm-serving); a transformer would collapse them all into one, same bug
# already fixed once in k8s/infra/minio and k8s/infra/iam. Every resource
# here sets its own explicit metadata.namespace.
resources:
  - grafana-operator-role.yaml
  - minio-operator-role.yaml
  - forgejo-operator-role.yaml
  - homarr-operator-role.yaml
  - portainer-operator-role.yaml
  - kmsvc-operator-role.yaml
  - temporal-operator-role.yaml
  - llm-serving-operator-role.yaml
  - poimen-memory-operator-role.yaml
# paperless's Role/RoleBinding lives in k8s/apps/paperless/rbac.yaml instead -
# that app already has its own kustomization + namespace, no need to
# duplicate it here. All of these stay inert (grant nothing) until
# kube-apiserver has --oidc-groups-claim=groups wired up.