# clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: vault-csi
  namespace: flux-system
  annotations:
    kustomize.toolkit.fluxcd.io/ssa: Override
spec:
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: flux-system
    namespace: flux-system
  path: ./infrastructure/vault-csi
  prune: true
  # A cordoned, unavailable node must not block unrelated workload rollouts.
  # Keep the CSI driver gate and require at least one observed healthy provider.
  wait: false
  healthChecks:
    - apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      name: secrets-store-csi-driver
      namespace: kube-system
    - apiVersion: apps/v1
      kind: DaemonSet
      name: vault-csi-provider
      namespace: kube-system
  healthCheckExprs:
    - apiVersion: apps/v1
      kind: DaemonSet
      current: >-
        has(status.observedGeneration) && has(metadata.generation) &&
        status.observedGeneration >= metadata.generation &&
        has(status.numberAvailable) && status.numberAvailable > 0
  targetNamespace: kube-system