Onboard Crafty Controller (Minecraft panel) with Keycloak-gated web UI

Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8)
as a platform component: a web panel that runs Java + Bedrock Minecraft servers as
subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath).

Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5
cannot do ext_authz on the shared Gateway:
- oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS
  UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins.
- Confidential `crafty` client provisioned live via kcadm + captured in the realm
  import; client secret + cookie secret via SOPS/age (mirrored in realm-clients).

- Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180.
- Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54),
  starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated.
- fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on
  the root:root Longhorn PVC (the seerr fsGroup lesson).
- Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config,
  wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate
  the platform.
- Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace,
  not app-namespace, so Kyverno does not auto-generate the baseline).

make -C ci gate green; kustomize build of platform/crafty, clusters/base,
clusters/dev clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/crafty.yaml

@@ -0,0 +1,42 @@
+---
+# Flux Kustomization: Crafty Controller — reconciles ./platform/crafty.
+#
+# POST-PLATFORM TIER (dependsOn platform-config). Crafty is a LEAF Minecraft-management UI that depends
+# on Keycloak (the oauth2-proxy sidecar authenticates against it) + the trusted wildcard TLS cert +
+# split-horizon DNS + the Gateway API CRDs + the Cilium L2 LoadBalancer pool (game-port VIP) — all
+# brought up by `platform` (controllers) and `platform-config` (Keycloak realm/CRs, the wildcard
+# Certificate, cilium L2 pool + announcement, Gateway). It therefore MUST NOT live inside the gating
+# `platform` tier: a UI whose pod can crashloop (image pull, DB init, sidecar OIDC discovery during a
+# cold start) would keep `platform` not-Ready, and while `platform` is not-Ready NOTHING downstream
+# reconciles — the exact incident behind the headlamp/oauth2-proxy/homepage moves (DECISIONS-LOG:
+# "Headlamp gating stall"). Same lesson, same fix: a leaf reconciles in its OWN post-platform tier.
+#
+# NON-GATING (wait:false): nothing in the graph dependsOn crafty, and its pod can be long-not-Ready
+# during a cold start (Longhorn attach + Crafty DB init) while it waits on Keycloak/DNS/TLS.
+# wait:false guarantees its health can NEVER gate anything, even if a future resource is (mistakenly)
+# pointed dependsOn it.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: crafty
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true
+  wait: false
+  dependsOn:
+    - name: platform-config   # Keycloak realm + wildcard TLS + split-horizon VIP + Gateway + L2 pool first
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./platform/crafty
+  # cluster-vars retained for parity with the other tiers / future overlay knobs (crafty references no
+  # ${VARS} today).
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars
+  # SOPS decryption for crafty-oauth2-proxy-credentials.sops.yaml is layered per-environment by the
+  # overlay (clusters/dev patches THIS Kustomization by name), identical to headlamp/oauth2-proxy.

clusters/base/kustomization.yaml

@@ -30,4 +30,8 @@ resources:
   # A leaf UI at home.keithjackson.dev; same non-gating rationale as headlamp/oauth2-proxy (a UI must
   # never gate the platform chain). Carries no SOPS secret, so clusters/dev adds no decryption patch.
   - homepage.yaml        # Flux Kustomization -> ./platform/homepage (dependsOn platform-config)
+  # Crafty Controller — Minecraft management UI, web UI Keycloak-gated by a per-pod oauth2-proxy
+  # reverse-proxy sidecar (Option B). POST-platform tier (dependsOn platform-config, wait:false); same
+  # non-gating leaf-UI rationale as headlamp/homepage/oauth2-proxy (a UI must never gate the platform).
+  - crafty.yaml          # Flux Kustomization -> ./platform/crafty (dependsOn platform-config)
   - cluster-vars.yaml    # overlay knob surface (base defaults)

clusters/dev/kustomization.yaml

@@ -91,6 +91,20 @@ patches:
           provider: sops
           secretRef:
             name: sops-age
+  # crafty has its own post-platform Flux Kustomization (clusters/base/crafty.yaml). It carries
+  # crafty-oauth2-proxy-credentials.sops.yaml, so it needs its own SOPS decryption stanza (same as
+  # headlamp/oauth2-proxy). The `sops-age` Secret is created out-of-band (name only).
+  - patch: |-
+      apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      metadata:
+        name: crafty
+        namespace: flux-system
+      spec:
+        decryption:
+          provider: sops
+          secretRef:
+            name: sops-age
   - patch: |-
       apiVersion: source.toolkit.fluxcd.io/v1
       kind: GitRepository