WIP keycloak stack (gate probe)

platform/keycloak/httproute.yaml

@@ -0,0 +1,27 @@
+---
+# North-south ingress for Keycloak: attaches to the shared Gateway (docs/09) at
+# keycloak.home.keithjackson.dev. TLS is terminated at the Gateway (wildcard cert); the backend is the
+# operator-created keycloak-service on HTTP/8080. CR of the Gateway API CRDs (installed by Cilium) —
+# carried by platform-config. Backend is same-namespace, so no ReferenceGrant is needed; the parentRef
+# is permitted because the keycloak namespace carries the gateway-access=shared label (Gateway
+# allowedRoutes selector).
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: keycloak
+  namespace: keycloak
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - keycloak.home.keithjackson.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: keycloak-service
+          port: 8080