apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# NOTE: no top-level `namespace:` transformer here (removed) - it used to
# force-rewrite metadata.namespace to "iam" on every resource in this
# kustomization, which was harmless while every manifest here only ever
# targeted the iam namespace itself. authentik-provision-job.yaml's
# RoleBindings deliberately target cicd/argocd/logging/storage (least-
# privilege access for the authentik-provisioner ServiceAccount to touch
# Secrets in those namespaces) - the namespace transformer would have
# silently rewritten all of them back to iam, breaking the RBAC. Every
# manifest in this directory already sets its own explicit
# metadata.namespace, so dropping the transformer changes nothing for the
# existing resources/.
resources:
  - key-rotation-cronjob.yaml
  - authentik-provision-job.yaml

# Provisioning/verification python lives in scripts/*.py (real files, linted +
# diff-friendly) and is generated into ConfigMaps here rather than embedded in
# the job YAML. disableNameSuffixHash keeps the names stable so the Jobs'
# configMap volume refs and PostSync hook-delete semantics keep working; each
# hook Job is recreated per sync so it always mounts the latest script.
configMapGenerator:
  - name: authentik-provision-script
    namespace: iam
    files:
      - authentik-provision.py=scripts/authentik-provision.py

generatorOptions:
  disableNameSuffixHash: true
# authentik-migrations-job.yaml removed — redundant + broken. The authentik
# `server` entrypoint runs migrations itself; this standalone job lacked the
# authentik-secrets envFrom (Secret key missing) and always failed.
# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time
# authentik/vault deployed via ArgoCD Helm source