fix: reconcile sops-secrets-operator from operators

README.md

@@ -50,7 +50,7 @@ Secrets are age-encrypted with field-level selective encryption. The `.sops.yaml
 
 ### sops-secrets-operator validation path
 
-`bootstrap/` installs `sops-secrets-operator` as the highest-priority child Application (`sync-wave: "-2"`) and waits for its CRD before the existing KSOPS-dependent waves continue. This is intentionally additive: KSOPS remains active until KMS-backed `SopsSecret` resources are proven and every existing age-encrypted Secret has been ported.
+`operators/` installs `sops-secrets-operator` as the highest-priority child Application within the actively reconciled `gitops-operators` tree (`sync-wave: "-2"`). This is intentionally additive: KSOPS remains active until KMS-backed `SopsSecret` resources are proven and every existing age-encrypted Secret has been ported.
 
 Future KMS-backed `SopsSecret` manifests should use the SOPS KMS recipient managed by the [`makeitworkcloud/tfroot-aws`](https://github.com/makeitworkcloud/tfroot-aws) repository with `encrypted_suffix: Templates`. Do not copy raw KMS key identifiers into docs or chat; use the applied OpenTofu output locally when encrypting migration manifests.
 

bootstrap/kustomization.yaml

@@ -2,9 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # Wave -2/-1: Install sops-secrets-operator before every other GitOps child.
-  - sops-secrets-operator-app.yaml
-  - wait-for-sops-secrets-operator.yaml
   # Wave 0: Configure ArgoCD (KSOPS + GitHub OAuth + RBAC)
   # NOTE: cluster-admin ClusterRoleBinding is managed by ansible-role-crc
   #       (ArgoCD cannot grant itself permissions it doesn't have)

operators/kustomization.yaml

@@ -3,6 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - sops-secrets-operator
   - arc
   - cert-manager
   - cloudflare

bootstrap/sops-secrets-operator-app.yaml → operators/sops-secrets-operator/application.yaml

@@ -1,7 +1,7 @@
 ---
-# Highest-priority child Application for validating a KSOPS replacement path.
-# The operator must exist before any future KMS-backed SopsSecret workloads are
-# introduced, so it deliberately syncs before the ArgoCD/KSOPS wave 0 resources.
+# Installs sops-secrets-operator from the actively reconciled gitops-operators
+# Application. This only installs the CRD/controller; KMS-backed SopsSecret
+# reconciliation needs follow-up ambient AWS auth.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -24,7 +24,7 @@ spec:
         namespaced: false
         resources: {}
         extraEnv:
-          # SOPS can infer the region from the KMS ARN, but setting the SDK
+          # SOPS can infer the region from KMS recipients, but setting the SDK
           # region keeps AWS client startup deterministic in the k3s cluster.
           - name: AWS_REGION
             value: us-west-2

operators/sops-secrets-operator/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - application.yaml