apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - rbac-dashboard-rolebinding.yaml

# IAM provisioning is manual-only (security-sensitive).
# Script: scripts/iam/authentik-provision.py
# Run:
#   export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
#     -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
#   python3 scripts/iam/authentik-provision.py