T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/platform.yaml

@@ -0,0 +1,32 @@
+---
+# Flux Kustomization: PLATFORM services (cluster-wide). Reconciles ./platform.
+# Phase 0 STUB. Realizes R-GITOPS-01/03 (pull-based reconcile + drift correction) and
+# R-ENV-02 (env differences supplied ONLY via substituteFrom cluster-vars).
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true          # drift correction: delete resources removed from git (R-GITOPS-03)
+  wait: true           # block `apps` until platform is healthy
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./platform
+  # R-ENV-02: the ONLY place environment differences enter platform manifests.
+  # dev/prod overlays patch the cluster-vars ConfigMap; the base manifests are never forked.
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars
+  # TODO(WS-SEC, Phase 1): enable SOPS decryption once the age key exists (ADR-0007).
+  #   decryption:
+  #     provider: sops
+  #     secretRef:
+  #       name: sops-age
+  # TODO(PM): the top-level ./platform/kustomization.yaml must include platform/kyverno/
+  #           (owned by the policy engineer, WS-TEST). See platform/README.md integration TODO.