WIP keycloak stack (gate probe)

platform/cnpg/helmrelease.yaml

@@ -0,0 +1,38 @@
+---
+# CloudNativePG operator (ghcr.io/cloudnative-pg images — NOT Bitnami, unaffected by the F-KY1 purge).
+# Installs the postgresql.cnpg.io CRDs + a cluster-wide operator. The keycloak database itself is a
+# `Cluster` CR carried by platform-config (dependsOn platform) — the controllers/configs split
+# (F-MON1): a CR of a CRD this HelmRelease registers must NOT apply in the same pass.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+  namespace: cnpg-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: ">=0.22.0 <1.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: cnpg-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # Single operator replica is plenty for a home cluster; it only reconciles CRs.
+    replicaCount: 1
+    resources:
+      requests:
+        cpu: 50m
+        memory: 100Mi
+      limits:
+        memory: 256Mi
+    # Expose operator metrics so the ServiceMonitor (platform-config) can scrape DB/operator health.
+    monitoring:
+      podMonitorEnabled: false      # we ship a ServiceMonitor for the Cluster instead (docs/10)