T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cilium/values.yaml

@@ -0,0 +1,13 @@
+# Cilium Helm values — PLACEHOLDER skeleton (Phase 0). Authoritative values live inline in
+# helmrelease.yaml for now; this file documents the knobs WS-NET must set in Phase 1/2.
+#
+# MUST match the Ansible bootstrap (docs/02) for the fields the bootstrap also sets.
+#
+# kubeProxyReplacement: true            # k3s kube-proxy disabled (ADR-0001/0002)
+# k8sServiceHost / k8sServicePort       # = Ansible bootstrap API endpoint (WS-INFRA contract)
+# gatewayAPI.enabled: true              # ingress via Gateway API, no Traefik (docs/09)
+# egressGateway.enabled: true           # egress-class steering (ADR-0002, VPN model ADR-0013)
+# hubble.{enabled,relay,ui}             # flow observability + isolation audit
+# l2announcements.enabled: true         # ingress VIP on flat LAN (docs/09, OQ-1)
+# ipam / ipv4NativeRoutingCIDR          # TODO: pin to the cluster pod/LAN CIDRs at bring-up
+# encryption (wireguard/ipsec)          # TODO(WS-SEC/WS-NET): decide east-west encryption later