flux: reconcile definitions from Git and adopt active service state

clusters/atlas/flux-system/applications/bstein-dev-home-migrations/kustomization.yaml

@@ -5,7 +5,6 @@ metadata:
   name: bstein-dev-home-migrations
   namespace: flux-system
   annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
     atlas.bstein.dev/suspend-reason: "Migration jobs run only during portal schema changes."
 spec:
   interval: 10m

clusters/atlas/flux-system/applications/bstein-dev-home/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: bstein-dev-home
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/bstein-dev-home

clusters/atlas/flux-system/applications/cassandra-auth/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: cassandra-auth
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/cassandra-auth

clusters/atlas/flux-system/applications/cassandra/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: cassandra
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/cassandra

clusters/atlas/flux-system/applications/comms/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: comms
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   prune: true

clusters/atlas/flux-system/applications/crypto/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: crypto
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/crypto

clusters/atlas/flux-system/applications/finance/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: finance
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Finance apps are parked until the next storage and SSO pass."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/finance
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/game-stream/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: game-stream
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Game streaming is optional and resumes only for planned use."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/game-stream
   targetNamespace: game-stream
   prune: true

clusters/atlas/flux-system/applications/harbor/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: harbor
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/harbor
@@ -15,20 +13,20 @@ spec:
     kind: GitRepository
     name: flux-system
     namespace: flux-system
-  wait: true
+  wait: false
   timeout: 10m
   healthChecks:
-    - apiVersion: batch/v1
+    - apiVersion: apps/v1
-      kind: Job
+      kind: Deployment
-      name: harbor-hermes-agent-immutability-ensure-1
+      name: harbor-core
       namespace: harbor
-    - apiVersion: batch/v1
+    - apiVersion: apps/v1
-      kind: Job
+      kind: Deployment
-      name: harbor-hermes-webui-immutability-ensure-1
+      name: harbor-registry
       namespace: harbor
-    - apiVersion: batch/v1
+    - apiVersion: apps/v1
-      kind: Job
+      kind: Deployment
-      name: harbor-hermes-chat-router-immutability-ensure-1
+      name: harbor-jobservice
       namespace: harbor
   dependsOn:
     - name: core

clusters/atlas/flux-system/applications/health/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: health
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Health stack is staged pending account and mail flows."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/health
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/jellyfin/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: jellyfin
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Media stack stays paused while auth and storage changes are staged."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/jellyfin
   targetNamespace: jellyfin
   prune: true

clusters/atlas/flux-system/applications/keycloak/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: keycloak
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   prune: true

clusters/atlas/flux-system/applications/mailu/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: mailu
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Mail stack is staged and resumes only during mail rollout work."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   sourceRef:
     kind: GitRepository
     name: flux-system

clusters/atlas/flux-system/applications/monerod/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: monerod
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/crypto/monerod

clusters/atlas/flux-system/applications/nextcloud-mail-sync/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: nextcloud-mail-sync
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Mail sync resumes after Nextcloud and Mailu are active."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   prune: true
   sourceRef:
     kind: GitRepository

clusters/atlas/flux-system/applications/oauth2-proxy/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: oauth2-proxy
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   prune: true

clusters/atlas/flux-system/applications/openldap/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: openldap
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   prune: true

clusters/atlas/flux-system/applications/outline/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: outline
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Outline is staged until shared auth and mail are ready."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/outline
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/pegasus/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: pegasus
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/pegasus

clusters/atlas/flux-system/applications/planka/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: planka
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Planka is staged until shared auth and mail are ready."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/planka
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/quality/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: quality
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Quality stack changes resume only during quality-gate rollout work."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/quality
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/sui-metrics/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: sui-metrics
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/sui-metrics/overlays/atlas

clusters/atlas/flux-system/applications/typhon/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: typhon
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Climate automation is staged until sensor and control loops are verified."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/typhon
   prune: true
   sourceRef:

clusters/atlas/flux-system/applications/vault-hermes-jenkins-token-seed/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: vault-hermes-jenkins-token-seed
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   sourceRef:

clusters/atlas/flux-system/applications/vault/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: vault
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   sourceRef:
@@ -15,11 +13,15 @@ spec:
   path: ./services/vault
   targetNamespace: vault
   prune: true
-  wait: true
+  wait: false
   healthChecks:
-    - apiVersion: batch/v1
+    - apiVersion: apps/v1
-      kind: Job
+      kind: StatefulSet
-      name: vault-k8s-auth-hermes-11
+      name: vault
+      namespace: vault
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: vault-injector-agent-injector
       namespace: vault
   dependsOn:
     - name: longhorn

clusters/atlas/flux-system/applications/vaultwarden/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: vaultwarden
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Vaultwarden stays separate from SSO rollout and resumes by hand."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   sourceRef:
     kind: GitRepository
     name: flux-system

clusters/atlas/flux-system/applications/veles/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: veles
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/veles

clusters/atlas/flux-system/applications/wallet-monero-temp/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: wallet-monero-temp
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Temporary wallet RPC stack is opt-in for maintenance windows."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/crypto/wallet-monero-temp
   targetNamespace: crypto
   prune: true

clusters/atlas/flux-system/applications/xmr-miner/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: xmr-miner
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Mining workloads are disabled unless explicitly enabled for a short run."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./services/crypto/xmr-miner
   targetNamespace: crypto
   prune: true

clusters/atlas/flux-system/platform/cert-manager-cleanup/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: cert-manager-cleanup
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   path: ./infrastructure/cert-manager/cleanup

clusters/atlas/flux-system/platform/cert-manager/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: cert-manager
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   path: ./infrastructure/cert-manager

clusters/atlas/flux-system/platform/core/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: core
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./infrastructure/core

clusters/atlas/flux-system/platform/descheduler/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: descheduler
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Descheduler is paused during node recovery and placement stabilization."
 spec:
   interval: 30m
-  suspend: true
+  suspend: false
   path: ./infrastructure/descheduler
   prune: true
   sourceRef:

clusters/atlas/flux-system/platform/gitops-ui/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: gitops-ui
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "GitOps UI is optional and resumes only for operator access work."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   timeout: 10m
   path: ./services/gitops-ui
   prune: true

clusters/atlas/flux-system/platform/helm/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: helm
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   sourceRef:

clusters/atlas/flux-system/platform/logging/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: logging
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/logging

clusters/atlas/flux-system/platform/longhorn-adopt/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: longhorn-adopt
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   path: ./infrastructure/longhorn/adopt

clusters/atlas/flux-system/platform/longhorn-ui/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: longhorn-ui
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Longhorn UI ingress is optional and opened only for storage work."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./infrastructure/longhorn/ui-ingress
   targetNamespace: longhorn-system
   prune: true

clusters/atlas/flux-system/platform/longhorn/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: longhorn
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   path: ./infrastructure/longhorn/core

clusters/atlas/flux-system/platform/maintenance/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: maintenance
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/maintenance

clusters/atlas/flux-system/platform/metallb/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: metallb
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   sourceRef:

clusters/atlas/flux-system/platform/monitoring/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: monitoring
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./services/monitoring

clusters/atlas/flux-system/platform/postgres/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: postgres
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./infrastructure/postgres

clusters/atlas/flux-system/platform/resource-guardrails/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 metadata:
   name: resource-guardrails
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
-    atlas.bstein.dev/suspend-reason: "Guardrail rollout is paused until service resource requests are normalized."
 spec:
   interval: 10m
-  suspend: true
+  suspend: false
   path: ./infrastructure/resource-guardrails
   prune: true
   sourceRef:

clusters/atlas/flux-system/platform/traefik/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: traefik
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 10m
   path: ./infrastructure/traefik

clusters/atlas/flux-system/platform/vault-injector/kustomization.yaml

@@ -4,8 +4,6 @@ kind: Kustomization
 metadata:
   name: vault-injector
   namespace: flux-system
-  annotations:
-    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
 spec:
   interval: 30m
   path: ./infrastructure/vault-injector