# The `agents` namespace is shared by three agents from three repos. Kept in
# this Kustomization's inventory — Flux must be able to *create* it on a first
# apply — but marked so Flux will never *prune* it.
#
# Without the annotation below, deleting or renaming this repo's Kustomization
# (which is exactly what a rename like catalog-agent -> catalogue-agent does —
# the old Kustomization object goes away) prunes everything in that
# Kustomization's inventory, the Namespace included, taking every other agent
# in it down too. Learned the hard way on 2026-08-31: removing the resource
# from `resources:` looked like the fix and is actually the same accident by a
# different door — the next reconcile of the *live* Kustomization sees the
# object vanish from its rendered inventory and prunes it right then.
#
# kustomize.toolkit.fluxcd.io/prune: disabled is the documented way to opt one
# resource out of pruning while Flux keeps managing (creating/updating) it.
#
# kubectl apply -f k8s/namespace.yaml   # once, before anything else
#
# One namespace for the whole agent estate rather than one per agent. The agents
# share nothing but a trust boundary — no data, no storage, no service mesh
# policy — and splitting them would multiply the CA ConfigMap and the
# ExternalSecret without isolating anything that matters. What isolates them is
# their Keycloak client and the audiences it may request, not the namespace.
apiVersion: v1
kind: Namespace
metadata:
  name: agents
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled