correction: credential-forward + unified graph; activate SOPS (author-first)

Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 22:09:20 -05:00
1 parent e1c738fa63
commit a108d5ab98
@@ -12,7 +12,7 @@ metadata:
 spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: [email protected]        # TODO(WS-SEC): ACME account email
+    email: [email protected]        # ACME account email (LE expiry notices) — operator: confirm/change
    privateKeySecretRef:
      name: letsencrypt-staging-account-key
    solvers:
@@ -32,7 +32,7 @@ metadata:
 spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
-    email: [email protected]        # TODO(WS-SEC): ACME account email
+    email: [email protected]        # ACME account email (LE expiry notices) — operator: confirm/change
    privateKeySecretRef:
      name: letsencrypt-prod-account-key
    solvers:
@@ -6,3 +6,7 @@ resources:
  - helmrepository.yaml
  - helmrelease.yaml
  - clusterissuers.yaml
+  # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Operator flow:
+  # copy bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example here as
+  # cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
+  # - cloudflare-api-token.sops.yaml
@@ -5,3 +5,7 @@ resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
+  # SOPS-encrypted Cloudflare token (env CF_API_TOKEN) — SAME token as cert-manager, second copy in
+  # the external-dns namespace. Copy bootstrap/sops/secret-templates/cloudflare-api-token.external-dns.yaml.example
+  # here as cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
+  # - cloudflare-api-token.sops.yaml
@@ -2,27 +2,25 @@
 # Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
 # (clusters/base/platform.yaml, path: ./platform).
 #
-# Phase 0 scaffolding: lists every platform component EXCEPT kyverno (owned by the policy engineer,
-# WS-TEST — see platform/README.md).
-#
-# ⚠️ INTEGRATION TODO(PM): once platform/kyverno/ is authored by the policy engineer, uncomment the
-# `- kyverno` line below. Keep it FIRST so admission policies are present before other components
-# reconcile. This workstream must NOT create files under platform/kyverno/.
+# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
+# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
+# the same pattern by which kyverno was previously deferred. Credentials each component needs are
+# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
+# component is never gated on a credential ask — only on its phase and readiness.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - kyverno            # DEFERRED to Phase 2 (T-2.7): admission enforcement needs a cluster.
-  #                        Scaffolding is present & buildable at platform/kyverno/; enable it first
-  #                        (before other components) when T-2.7 activates. Kyverno's CI L0 gate is
-  #                        already live now via .gitea/ + ci/ (no cluster needed).
-  - cilium
-  - longhorn
-  - cert-manager
-  - externaldns
-  - gateway
-  - monitoring
-  - velero
-  - kubevirt
-  - image-automation
-  - keycloak
-  - oauth2-proxy
+  # ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
+  - kyverno            # admission enforcer FIRST — policies present before other components reconcile
+  - cilium             # CNI (adopts the running Ansible-installed release; parity verified)
+  - longhorn           # replicated block storage / CSI
+  - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
+  - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
+  - gateway            # Gateway API listeners (ingress; replaces Traefik)
+  # ---- Later phases: enabled when their phase opens (creds already provisioned via SOPS) ----
+  # - monitoring       # Phase 4 (Observability): kube-prometheus-stack + Loki + Alloy + Alertmanager
+  # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
+  # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
+  # - kubevirt         # Phase 5 (IaaS proof): KubeVirt + CDI
+  # - keycloak         # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
+  # - oauth2-proxy     # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`
@@ -62,7 +62,7 @@ spec:
        storageSpec:
          volumeClaimTemplate:
            spec:
-              storageClassName: ${MONITORING_STORAGE_CLASS}   # replicated tier (ADR-0003); cluster-vars knob
+              storageClassName: longhorn                  # replicated tier (ADR-0003)
              accessModes: ["ReadWriteOnce"]
              resources:
                requests:
@@ -80,24 +80,22 @@ spec:
            memory: 32Mi
          limits:
            memory: 96Mi
-        # SMTP is an OPERATOR HAND-OFF DEFERRED to Phase 4 — no creds yet, and the by-name
-        # `alertmanager-smtp` Secret does NOT exist. Mounting a missing Secret wedges Alertmanager
-        # in ContainerCreating, so the mount is DISABLED until the hand-off. Re-enable verbatim
-        # (uncomment) when the SOPS `alertmanager-smtp` Secret is delivered. TODO(Phase-4 SMTP).
-        # secrets:
-        #   - alertmanager-smtp
-      # Routing stays live; RECEIVERS ARE NULL until the SMTP hand-off (alerts still fire, route,
-      # and show in the Alertmanager UI + Grafana — they just aren't emailed). The smtp_* globals
-      # and email_configs are retained below, commented, so re-enabling is a pure uncomment.
+        # SMTP credentials are an OPERATOR HAND-OFF: a SOPS-encrypted Secret, referenced BY NAME
+        # only (docs/07). Mounted at /etc/alertmanager/secrets/<name>/ so the config below can read
+        # the password from a file (never inline plaintext).
+        secrets:
+          - alertmanager-smtp
+      # Routing/receivers. Non-secret SMTP endpoint fields (smarthost/from/to/username) are
+      # operator-supplied placeholders (REPLACE-ME, same convention as velero); the PASSWORD is
+      # read from the mounted SOPS secret via *_file. Both severities email; subject/route differ.
      config:
        global:
          resolve_timeout: 5m
-          # TODO(Phase-4 SMTP hand-off): uncomment together with the alertmanager-smtp Secret mount.
-          # smtp_smarthost: "smtp.example.com:587"
-          # smtp_from: "[email protected]"
-          # smtp_auth_username: "<smtp-login>"
-          # smtp_auth_password_file: /etc/alertmanager/secrets/alertmanager-smtp/smtp-password
-          # smtp_require_tls: true
+          smtp_smarthost: "REPLACE-ME:587"          # operator hand-off (e.g. smtp.gmail.com:587)
+          smtp_from: "REPLACE-ME"                    # operator hand-off (From: address)
+          smtp_auth_username: "REPLACE-ME"           # operator hand-off (SMTP login)
+          smtp_auth_password_file: /etc/alertmanager/secrets/alertmanager-smtp/smtp-password
+          smtp_require_tls: true
        route:
          group_by: ["alertname", "namespace"]
          group_wait: 30s
@@ -111,29 +109,25 @@ spec:
              group_wait: 10s
              repeat_interval: 1h
        receivers:
-          # NULL receivers until Phase-4 SMTP. email_configs retained (commented) for verbatim re-enable.
          - name: email-warning
-            # email_configs:
-            #   - to: "<alert-inbox>"
-            #     send_resolved: true
-            #     headers:
-            #       subject: '[WARNING] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
+            email_configs:
+              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
+                send_resolved: true
+                headers:
+                  subject: '[WARNING] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
          - name: email-critical
-            # email_configs:
-            #   - to: "<alert-inbox>"
-            #     send_resolved: true
-            #     headers:
-            #       subject: '[CRITICAL] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
+            email_configs:
+              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
+                send_resolved: true
+                headers:
+                  subject: '[CRITICAL] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'

    # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO ---
    grafana:
      enabled: true
      # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014).
-      # cluster-vars knob: prod = the SOPS `grafana-admin-credentials` Secret; dev = "" (empty),
-      # which makes the chart fall back to its default admin password (dev-only, NAT-isolated) so
-      # Grafana starts without an operator secret. TODO: supply a dev Secret if wider dev access.
      admin:
-        existingSecret: ${GRAFANA_ADMIN_SECRET}
+        existingSecret: grafana-admin-credentials
        userKey: admin-user
        passwordKey: admin-password
      # DEV TRIM: emptyDir (default). Dashboards are provisioned from ConfigMaps (sidecar), so no
@@ -60,7 +60,7 @@ spec:
      replicas: 1
      persistence:
        enabled: true
-        storageClass: ${MONITORING_STORAGE_CLASS}   # replicated tier (ADR-0003); cluster-vars knob
+        storageClass: longhorn          # replicated tier (ADR-0003)
        size: ${MONITORING_LOKI_PVC_SIZE}   # overlay knob (dev 5Gi / prod large)
      resources:
        requests: