T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cilium/helmrelease.yaml

@@ -0,0 +1,55 @@
+---
+# Cilium — CNI, kube-proxy replacement, Gateway API, Egress Gateway, Hubble (ADR-0002).
+# Phase 0 STUB. Values are PLACEHOLDERS; fill in during Phase 1/2 (WS-NET).
+#
+# IMPORTANT (cross-workstream contract): Cilium's INITIAL install is performed by the Ansible
+# bootstrap (spec docs/02, Phase 1), replacing k3s flannel/kube-proxy. This HelmRelease manages
+# Cilium CONFIG going forward. Its values MUST match the Ansible bootstrap values (kubeProxyReplacement,
+# k8sServiceHost/Port) or Flux and the bootstrap will fight. Owner: WS-NET + WS-INFRA.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cilium
+      version: ">=1.16.0 <1.17.0"   # TODO(WS-NET): pin exact version at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: kube-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  # Placeholder values — see values.yaml for the annotated skeleton. Inlined here so the intent
+  # (Cilium REPLACES flannel + kube-proxy + Traefik) is visible at the release.
+  values:
+    # --- kube-proxy replacement (ADR-0001/0002: k3s kube-proxy disabled) ---
+    kubeProxyReplacement: true
+    # TODO(WS-INFRA): k8sServiceHost/k8sServicePort must equal the Ansible bootstrap's API endpoint.
+    k8sServiceHost: "REPLACE-ME"     # e.g. the k3s API VIP/host
+    k8sServicePort: 6443
+    # --- Gateway API (ingress; replaces Traefik) — docs/09, ADR-0002 ---
+    gatewayAPI:
+      enabled: true
+    # --- Egress Gateway (egress-class steering; part of VPN model with ADR-0013) ---
+    egressGateway:
+      enabled: true
+    # --- Hubble (flow observability / isolation audit) ---
+    hubble:
+      enabled: true
+      relay:
+        enabled: true
+      ui:
+        enabled: true   # exposure gated behind oauth2-proxy forward-auth later (ADR-0014)
+    # --- L2 announcement for the ingress VIP on the flat LAN (docs/09, OQ-1 resolved) ---
+    l2announcements:
+      enabled: true
+    # TODO(WS-NET, Phase 2): default-deny baseline, CiliumL2AnnouncementPolicy + IP pool,
+    #   Egress Gateway policies, Hubble metrics export to kube-prometheus-stack.