T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/prod/kustomization.yaml

@@ -0,0 +1,47 @@
+---
+# clusters/prod — DESIGN-ONLY overlay. NOT a build target until roadmap Phase 7 opens prod
+# (spec roadmap/phases.md, AGENTS.md §6: "Never build directly on production").
+#
+# When Phase 7 is opened, `flux bootstrap ... --path=clusters/prod` points the prod cluster's Flux
+# here. Like dev, this overlay adds NO resources — it ONLY patches cluster-vars with prod-scoped
+# values (R-ENV-02). Promotion to prod is a change to THESE variables, never a base edit.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - target:
+      kind: ConfigMap
+      name: cluster-vars
+    patch: |-
+      - op: replace
+        path: /data/cluster_env
+        value: "prod"
+      # trusted, rate-limited real certs in prod — ADR-0006.
+      - op: replace
+        path: /data/acme_cluster_issuer
+        value: "letsencrypt-prod"
+      - op: replace
+        path: /data/longhorn_default_replica_count
+        value: "3"
+      # longer retention / larger volumes on prod NVMe.
+      - op: replace
+        path: /data/monitoring_prometheus_retention
+        value: "30d"
+      - op: replace
+        path: /data/monitoring_prometheus_pvc_size
+        value: "50Gi"
+      - op: replace
+        path: /data/monitoring_loki_pvc_size
+        value: "50Gi"
+      # HA control-plane addons in prod.
+      - op: replace
+        path: /data/keycloak_replicas
+        value: "2"
+      - op: replace
+        path: /data/oauth2_proxy_replicas
+        value: "2"
+      - op: replace
+        path: /data/velero_retention
+        value: "720h"
+      # TODO(WS-INFRA, Phase 7): pin prod node placement once the bare-metal role labels exist.