feat: re-enable oauth2-proxy on the LE-prod-trusted wildcard cert (R-IDP-02)

platform-config/kustomization.yaml

@@ -50,9 +50,7 @@ resources:
   - ../platform/keycloak/httproute.yaml
   - ../platform/keycloak/servicemonitor.yaml
   # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
-  # TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable together
-  # once the wildcard cert is re-issued via LE-prod.
-  # - ../platform/oauth2-proxy/httproute.yaml
-  # - ../platform/oauth2-proxy/servicemonitor.yaml
+  - ../platform/oauth2-proxy/httproute.yaml
+  - ../platform/oauth2-proxy/servicemonitor.yaml
   # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
   - ../platform/monitoring/grafana-httproute.yaml

platform/kustomization.yaml

@@ -29,12 +29,9 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  # TEMP-DEFERRED (PM): oauth2-proxy sits in platform-core but depends on cert-manager's wildcard cert
-  # being LE-PROD-trusted (+ split-horizon DNS). While it's Failed, platform wait:true stays not-Ready,
-  # so platform-config can't reconcile the Certificate onto the prod issuer → deadlock. Deferring lets
-  # the prod cert issue; then re-enable so oauth2-proxy starts trusted. FOLLOW-UP: move oauth2-proxy to
-  # a post-platform tier (dependsOn platform-config) so it can never block its own dependencies.
-  # - oauth2-proxy     # forward-auth for non-OIDC UIs (re-enable after wildcard cert is LE-prod)
+  - oauth2-proxy       # forward-auth for non-OIDC UIs — wildcard cert now LE-prod-trusted + split-horizon DNS live
+  # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
+  # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate