WIP keycloak stack (gate probe)

platform/keycloak/kustomization.yaml

@@ -1,7 +1,28 @@
 ---
+# Keycloak CONTROLLERS half (F-MON1 split): the official Keycloak Operator (quay.io images) + its
+# CRDs + the SOPS-encrypted admin credential. The Keycloak/KeycloakRealmImport CUSTOM RESOURCES live
+# in ../../platform-config (dependsOn platform) so the CRDs registered here exist first.
+#
+# IMAGE STRATEGY (DECISIONS-LOG F-KY1): the old stub used the Bitnami Keycloak chart + bundled Bitnami
+# PostgreSQL; Bitnami's free Docker Hub images were purged -> ImagePullBackOff. Replaced with the
+# official Keycloak Operator (quay.io/keycloak/keycloak-operator + quay.io/keycloak/keycloak) and
+# CloudNativePG (ghcr.io) for the DB (platform/cnpg) — both registries unaffected by the purge, and
+# the Operator gives declarative Keycloak/realm CRs (R-IDP-03) + CNPG gives DR backup hooks (R-IDP-05).
+#
+# The operator manifests are pinned upstream RELEASE files pulled as remote bases (the same pattern the
+# kubevirt stub documents). Renovate maintains the version. Offline `kubectl kustomize` fetches them;
+# Flux fetches them at reconcile.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+# Force the operator's namespaced resources (ServiceAccount/Role/RoleBinding/Service/Deployment, which
+# ship without an explicit namespace) into `keycloak`. CRDs + ClusterRoles are cluster-scoped and pass
+# through unchanged; the ClusterRoleBinding subject already targets namespace keycloak.
+namespace: keycloak
 resources:
   - namespace.yaml
-  - helmrepository.yaml
-  - helmrelease.yaml
+  # --- Keycloak Operator v26.0.6 (pinned upstream release manifests) ---
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/kubernetes.yml
+  # --- Admin (break-glass) credential — SOPS-encrypted, referenced by name (ADR-0007, R-IDP-04) ---
+  - keycloak-admin-credentials.sops.yaml