correction: credential-forward + unified graph; activate SOPS (author-first)

Operator directive: don't diverge architecture to avoid asking for credentials;
provision them upfront via SOPS and keep the existing (unified) graph.

Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so
cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2;
monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance.

Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's;
restore unified base graph (dev = ../base + cluster-vars + SOPS decryption,
R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential
improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes.

platform/kustomization.yaml now phased (single shared list): Phase-2 set =
kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components
commented with phase markers.

SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example
for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia);
bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines
in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real
secret values (operator encrypts).

Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert,
make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kustomization.yaml

@@ -2,27 +2,25 @@
 # Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
 # (clusters/base/platform.yaml, path: ./platform).
 #
-# Phase 0 scaffolding: lists every platform component EXCEPT kyverno (owned by the policy engineer,
-# WS-TEST — see platform/README.md).
-#
-# ⚠️ INTEGRATION TODO(PM): once platform/kyverno/ is authored by the policy engineer, uncomment the
-# `- kyverno` line below. Keep it FIRST so admission policies are present before other components
-# reconcile. This workstream must NOT create files under platform/kyverno/.
+# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
+# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
+# the same pattern by which kyverno was previously deferred. Credentials each component needs are
+# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
+# component is never gated on a credential ask — only on its phase and readiness.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - kyverno            # DEFERRED to Phase 2 (T-2.7): admission enforcement needs a cluster.
-  #                        Scaffolding is present & buildable at platform/kyverno/; enable it first
-  #                        (before other components) when T-2.7 activates. Kyverno's CI L0 gate is
-  #                        already live now via .gitea/ + ci/ (no cluster needed).
-  - cilium
-  - longhorn
-  - cert-manager
-  - externaldns
-  - gateway
-  - monitoring
-  - velero
-  - kubevirt
-  - image-automation
-  - keycloak
-  - oauth2-proxy
+  # ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
+  - kyverno            # admission enforcer FIRST — policies present before other components reconcile
+  - cilium             # CNI (adopts the running Ansible-installed release; parity verified)
+  - longhorn           # replicated block storage / CSI
+  - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
+  - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
+  - gateway            # Gateway API listeners (ingress; replaces Traefik)
+  # ---- Later phases: enabled when their phase opens (creds already provisioned via SOPS) ----
+  # - monitoring       # Phase 4 (Observability): kube-prometheus-stack + Loki + Alloy + Alertmanager
+  # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
+  # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
+  # - kubevirt         # Phase 5 (IaaS proof): KubeVirt + CDI
+  # - keycloak         # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
+  # - oauth2-proxy     # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`