T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kubevirt/README.md

@@ -0,0 +1,31 @@
+# platform/kubevirt
+
+**KubeVirt + CDI** — run application VMs (IaaS) as Kubernetes resources on the same control plane,
+network, storage, and GitOps flow as containers.
+
+- **Governing ADR:** [ADR-0005 — VM workloads: KubeVirt + CDI](../../../home-network-k3s/decisions/adr-0005-vm-workloads-kubevirt.md)
+- **Spec:** [docs/06 — VM Workloads (KubeVirt)](../../../home-network-k3s/docs/06-vm-workloads-kubevirt.md)
+- **Serves:** R-PLAT-03/04, R-STATE-01
+- **Owner:** WS-VM
+
+## What this stub is
+
+A Kustomization that will pull the pinned **KubeVirt operator** + **CDI operator** release manifests
+(commented TODO — added in Phase 5), plus the **`KubeVirt`** and **`CDI`** custom resources that tune
+them. VM disks land on **Longhorn** PVCs via CDI; VMs inherit Cilium default-deny + egress classes.
+
+> **Layer distinction (docs/01):** these are **Layer-2 application VMs** (a feature the platform
+> offers), NOT the Layer-1 cluster-node VMs (which WS-INFRA provisions with OpenTofu/libvirt). Do not
+> conflate them.
+
+## Cross-workstream prerequisite
+
+Nodes must expose **virtualization extensions** (nested virt in dev KVMs; native on prod) — a node
+baseline prerequisite owned by **WS-INFRA** (docs/02). Coordinate before Phase 5.
+
+## TODO (later phases — Phase 5, gated on Phases 2–3)
+
+- Add pinned operator release manifests as Kustomize bases; let Renovate maintain versions.
+- Run one representative application VM via a ServiceDefinition `kind: vm`; prove create/start/stop/
+  destroy via `kubectl`/`virtctl`, Longhorn-backed disk survives rebuild, default-deny + egress apply,
+  guest auto-updates (Phase-5 exit gates).

platform/kubevirt/cdi-cr.yaml

@@ -0,0 +1,11 @@
+---
+# CDI CR — Containerized Data Importer, provisions VM disks onto Longhorn PVCs (ADR-0005).
+# Phase 0 STUB; requires the CDI operator (added in Phase 5).
+apiVersion: cdi.kubevirt.io/v1beta1
+kind: CDI
+metadata:
+  name: cdi
+  namespace: cdi
+spec:
+  # TODO(WS-VM, Phase 5): scratch space storageClass (longhorn), upload/import proxy settings.
+  config: {}

platform/kubevirt/kubevirt-cr.yaml

@@ -0,0 +1,16 @@
+---
+# KubeVirt CR — tunes the KubeVirt install (ADR-0005). Phase 0 STUB; requires the KubeVirt operator
+# (added in Phase 5) and virtualization extensions on the nodes (nested virt in dev KVMs — a node
+# baseline prerequisite from docs/02, owned by WS-INFRA).
+apiVersion: kubevirt.io/v1
+kind: KubeVirt
+metadata:
+  name: kubevirt
+  namespace: kubevirt
+spec:
+  configuration:
+    developerConfiguration:
+      # TODO(WS-VM/WS-INFRA, Phase 5): enable only if hardware virt is unavailable in dev KVMs;
+      #   prefer real (nested) virt so the IaaS path mirrors prod.
+      featureGates: []
+  # TODO(WS-VM, Phase 5): workload placement, live-migration, evictionStrategy for the 3-node cluster.

platform/kubevirt/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+# KubeVirt + CDI. Installed via their OPERATORS (plain release manifests), then the KubeVirt/CDI
+# custom resources tune the deployment. Phase 0 STUB.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespaces.yaml
+  # TODO(WS-VM, Phase 5): add the pinned operator release manifests, e.g.
+  #   - https://github.com/kubevirt/kubevirt/releases/download/vX.Y.Z/kubevirt-operator.yaml
+  #   - https://github.com/kubevirt/containerized-data-importer/releases/download/vX.Y.Z/cdi-operator.yaml
+  #   (Flux can pull remote bases; pin versions and let Renovate maintain them.)
+  - kubevirt-cr.yaml
+  - cdi-cr.yaml

platform/kubevirt/namespaces.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubevirt
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cdi