Onboard Crafty Controller (Minecraft panel) with Keycloak-gated web UI

Add Crafty Controller 4 (registry.gitlab.com/crafty-controller/crafty-4:4.10.8)
as a platform component: a web panel that runs Java + Bedrock Minecraft servers as
subprocesses in one pod + a 20Gi Longhorn PVC (mounted 5x by subPath).

Auth = Option B (per-app oauth2-proxy reverse-proxy sidecar), since Cilium 1.16.5
cannot do ext_authz on the shared Gateway:
- oauth2-proxy v7.8.1 sidecar (:4180) reverse-proxies to Crafty's self-signed HTTPS
  UI (127.0.0.1:8443), gated to Keycloak homelab realm group platform-admins.
- Confidential `crafty` client provisioned live via kcadm + captured in the realm
  import; client secret + cookie secret via SOPS/age (mirrored in realm-clients).

- Web UI: HTTPRoute crafty.home.keithjackson.dev -> Service :80 -> sidecar :4180.
- Game ports: Cilium L2 LoadBalancer on VIP 192.168.1.55 (next free after .53/.54),
  starter set TCP 25565-25567 (Java) + UDP 19132-19134 (Bedrock), NOT auth-gated.
- fsGroup:0 / runAsGroup:0 / runAsUser:1000 for the image's crafty:root identity on
  the root:root Longhorn PVC (the seerr fsGroup lesson).
- Own non-gating Flux tier clusters/base/crafty.yaml (dependsOn platform-config,
  wait:false) + sops-decryption patch in clusters/dev — a leaf UI must never gate
  the platform.
- Explicit default-deny NetworkPolicy + CiliumNetworkPolicies (platform namespace,
  not app-namespace, so Kyverno does not auto-generate the baseline).

make -C ci gate green; kustomize build of platform/crafty, clusters/base,
clusters/dev clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/crafty/networkpolicy.yaml

@@ -0,0 +1,98 @@
+---
+# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `crafty` is a PLATFORM
+# namespace so Kyverno does NOT auto-generate this (its policies match app-namespace=true) — we ship it
+# explicitly (defense in depth), same shape as the Kyverno-generated app baseline and as
+# headlamp/homepage. Cilium enforces the UNION of this NetworkPolicy and the CiliumNetworkPolicies
+# below (allow if ANY policy allows), so those add the Gateway/game/world paths on top of deny-all.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: crafty
+  labels:
+    homelab.keithjackson.dev/baseline: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+# INGRESS allows. The crafty pod runs BOTH containers (oauth2-proxy sidecar :4180 + Crafty :8443 + the
+# MC game-port subprocesses), all selected by app.kubernetes.io/name=crafty.
+#   - Gateway (Cilium `ingress` entity) -> oauth2-proxy sidecar :4180 ONLY. The Gateway can reach the
+#     GATE, never Crafty's :8443 directly (there is no Service for :8443 either).
+#   - LAN players + admins (`world` = off-cluster to Cilium) -> the raw game ports. NOT auth-gated:
+#     Minecraft protocols authenticate the player. `host`/`cluster` cover node-local health probes and
+#     any in-cluster caller.
+#   - `host` (the kubelet) -> :8443 and :4180 for the liveness/readiness probes.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crafty-allow-ingress
+  namespace: crafty
+  labels:
+    app.kubernetes.io/name: crafty
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: crafty
+  ingress:
+    # Gateway -> the oauth2-proxy gate. Kubelet (host) probes the gate too.
+    - fromEntities:
+        - ingress
+        - host
+      toPorts:
+        - ports:
+            - { port: "4180", protocol: TCP }
+    # LAN/world players -> raw game ports (starter set). Add ports here when new servers are created.
+    - fromEntities:
+        - world
+        - cluster
+        - host
+      toPorts:
+        - ports:
+            - { port: "25565", protocol: TCP }   # Java slot 0
+            - { port: "25566", protocol: TCP }   # Java slot 1
+            - { port: "25567", protocol: TCP }   # Java slot 2
+            - { port: "19132", protocol: UDP }   # Bedrock slot 0
+            - { port: "19133", protocol: UDP }   # Bedrock slot 1
+            - { port: "19134", protocol: UDP }   # Bedrock slot 2
+    # Kubelet (host) -> Crafty's HTTPS UI port for its TCP health probe.
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - { port: "8443", protocol: TCP }
+---
+# EGRESS allows (DNS already permitted by the default-deny baseline above).
+#   - Crafty must reach the INTERNET to download Minecraft server jars (Mojang/PaperMC/Purpur/Fabric,
+#     Bedrock binaries) when the operator creates/updates a server.
+#   - The oauth2-proxy sidecar must reach Keycloak at keycloak.home.keithjackson.dev, which coredns
+#     split-horizon resolves to the Gateway VIP (an L2-announced LoadBalancer IP Cilium classifies as
+#     `world`) — so `world` egress covers both the jar downloads AND the OIDC path (same as headlamp).
+#   - The sidecar -> Crafty hop is pod-local (127.0.0.1:8443) and is NOT subject to network policy.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: crafty-allow-egress
+  namespace: crafty
+  labels:
+    app.kubernetes.io/name: crafty
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: crafty
+  egress:
+    - toEntities:
+        - world