apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
metadata:
  name: data

# Layer 6: Data — stateful services (databases, message brokers)
# Dependencies: all previous layers (bootstrap, platform, etc.)
# Order: Applied last

# PostgreSQL cluster + schema initialization
# Required by: Authentik, Temporal, Vault, SQS
resources:
  - ddb-cluster.yaml
  - schemas.yaml
  - db-init-job.yaml
  - forgejo-database.yaml
  - authentik-database.yaml
  - temporal-database.yaml
  - temporal-visibility-database.yaml
# db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
# NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.