Merge fix/k1-substitution-var-case into main

clusters/base/cluster-vars.yaml

@@ -14,28 +14,28 @@ metadata:
   namespace: flux-system
 data:
   # --- identity of the environment ---
-  cluster_env: "base"                       # dev | prod  (overlays set this)
+  CLUSTER_ENV: "base"                       # dev | prod  (overlays set this)
 
   # --- DNS / TLS ---
-  base_domain: "home.keithjackson.dev"      # same in both envs (split-horizon per docs/09)
-  acme_cluster_issuer: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)
+  BASE_DOMAIN: "home.keithjackson.dev"      # same in both envs (split-horizon per docs/09)
+  ACME_CLUSTER_ISSUER: "letsencrypt-staging" # dev: staging | prod: letsencrypt-prod (ADR-0006)
 
   # --- storage (ADR-0003) ---
-  longhorn_default_replica_count: "3"       # default StorageClass replica count (3 on 3 nodes)
+  LONGHORN_DEFAULT_REPLICA_COUNT: "3"       # default StorageClass replica count (3 on 3 nodes)
 
   # --- observability sizing (docs/10) ---
-  monitoring_prometheus_retention: "7d"     # dev short | prod long
-  monitoring_prometheus_pvc_size: "10Gi"
-  monitoring_loki_pvc_size: "10Gi"
+  MONITORING_PROMETHEUS_RETENTION: "7d"     # dev short | prod long
+  MONITORING_PROMETHEUS_PVC_SIZE: "10Gi"
+  MONITORING_LOKI_PVC_SIZE: "10Gi"
 
   # --- identity / auth (ADR-0014) ---
-  keycloak_replicas: "1"                     # dev 1 | prod 2 (HA)
-  oauth2_proxy_replicas: "1"                 # dev 1 | prod 2 (HA)
+  KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)
+  OAUTH2_PROXY_REPLICAS: "1"                 # dev 1 | prod 2 (HA)
 
   # --- backup / DR (ADR-0003, R-STATE-03) ---
-  velero_backup_schedule: "0 3 * * *"        # cron; overlays may differ
-  velero_retention: "168h"                   # dev short | prod long
+  VELERO_BACKUP_SCHEDULE: "0 3 * * *"        # cron; overlays may differ
+  VELERO_RETENTION: "168h"                   # dev short | prod long
 
   # --- placement ---
-  platform_node_selector_key: "kubernetes.io/os"   # base no-op selector; prod may pin roles
-  platform_node_selector_value: "linux"
+  PLATFORM_NODE_SELECTOR_KEY: "kubernetes.io/os"   # base no-op selector; prod may pin roles
+  PLATFORM_NODE_SELECTOR_VALUE: "linux"

clusters/dev/kustomization.yaml

@@ -54,33 +54,33 @@ patches:
       name: cluster-vars
     patch: |-
       - op: replace
-        path: /data/cluster_env
+        path: /data/CLUSTER_ENV
         value: "dev"
       # DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
       - op: replace
-        path: /data/acme_cluster_issuer
+        path: /data/ACME_CLUSTER_ISSUER
         value: "letsencrypt-staging"
       # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
       - op: replace
-        path: /data/longhorn_default_replica_count
+        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
         value: "3"
       # smaller retention / volumes to keep the dev workstation footprint light.
       - op: replace
-        path: /data/monitoring_prometheus_retention
+        path: /data/MONITORING_PROMETHEUS_RETENTION
         value: "3d"
       - op: replace
-        path: /data/monitoring_prometheus_pvc_size
+        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
         value: "5Gi"
       - op: replace
-        path: /data/monitoring_loki_pvc_size
+        path: /data/MONITORING_LOKI_PVC_SIZE
         value: "5Gi"
       # single-replica control-plane addons in dev (no HA needed to iterate).
       - op: replace
-        path: /data/keycloak_replicas
+        path: /data/KEYCLOAK_REPLICAS
         value: "1"
       - op: replace
-        path: /data/oauth2_proxy_replicas
+        path: /data/OAUTH2_PROXY_REPLICAS
         value: "1"
       - op: replace
-        path: /data/velero_retention
+        path: /data/VELERO_RETENTION
         value: "72h"

clusters/prod/kustomization.yaml

@@ -15,33 +15,33 @@ patches:
       name: cluster-vars
     patch: |-
       - op: replace
-        path: /data/cluster_env
+        path: /data/CLUSTER_ENV
         value: "prod"
       # trusted, rate-limited real certs in prod — ADR-0006.
       - op: replace
-        path: /data/acme_cluster_issuer
+        path: /data/ACME_CLUSTER_ISSUER
         value: "letsencrypt-prod"
       - op: replace
-        path: /data/longhorn_default_replica_count
+        path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
         value: "3"
       # longer retention / larger volumes on prod NVMe.
       - op: replace
-        path: /data/monitoring_prometheus_retention
+        path: /data/MONITORING_PROMETHEUS_RETENTION
         value: "30d"
       - op: replace
-        path: /data/monitoring_prometheus_pvc_size
+        path: /data/MONITORING_PROMETHEUS_PVC_SIZE
         value: "50Gi"
       - op: replace
-        path: /data/monitoring_loki_pvc_size
+        path: /data/MONITORING_LOKI_PVC_SIZE
         value: "50Gi"
       # HA control-plane addons in prod.
       - op: replace
-        path: /data/keycloak_replicas
+        path: /data/KEYCLOAK_REPLICAS
         value: "2"
       - op: replace
-        path: /data/oauth2_proxy_replicas
+        path: /data/OAUTH2_PROXY_REPLICAS
         value: "2"
       - op: replace
-        path: /data/velero_retention
+        path: /data/VELERO_RETENTION
         value: "720h"
       # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.