apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: iam
resources:
  - key-rotation-cronjob.yaml
# authentik-migrations-job.yaml removed — redundant + broken. The authentik
# `server` entrypoint runs migrations itself; this standalone job lacked the
# authentik-secrets envFrom (Secret key missing) and always failed.
# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time
# authentik/vault deployed via ArgoCD Helm source