apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
# NOTE: no top-level `namespace:` transformer (see iam/kustomization.yaml for
# the same fix) - minio-provision-paperless-job.yaml's RoleBinding
# deliberately targets namespace paperless (least-privilege access for the
# provisioner ServiceAccount to write Secrets there); a namespace transformer
# would silently rewrite it back to storage, breaking the RBAC. Every resource
# here already sets its own explicit metadata.namespace.
resources:
  - minio-tenant.yaml
  - minio-provision-paperless-job.yaml
# The operator creates the minio S3/console/headless Services and the
# declarative bucket + user from the Tenant spec — no hand-rolled Service or
# Bucket/User CRs (those kinds don't exist in the operator CRD set).