WIP keycloak stack (gate probe)

platform-config/kustomization.yaml

@@ -31,3 +31,17 @@ resources:
   - cilium/l2-announcement-policy.yaml
   # monitoring: PrometheusRule alert rules (need monitoring.coreos.com CRDs from kube-prometheus-stack)
   - ../platform/monitoring/alerts.yaml
+  # --- Phase 6 — Identity / SSO (ADR-0014) ---
+  # keycloak: the CNPG DB Cluster + Keycloak instance + realm import (CRs of the CNPG / Keycloak
+  # operator CRDs installed by platform/cnpg + platform/keycloak) + its ingress + ServiceMonitor.
+  # ${KEYCLOAK_REPLICAS} in keycloak-instance.yaml is resolved by this Kustomization's substituteFrom.
+  - ../platform/keycloak/postgres-cluster.yaml
+  - ../platform/keycloak/keycloak-instance.yaml
+  - ../platform/keycloak/keycloak-realm-import.yaml
+  - ../platform/keycloak/httproute.yaml
+  - ../platform/keycloak/servicemonitor.yaml
+  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
+  - ../platform/oauth2-proxy/httproute.yaml
+  - ../platform/oauth2-proxy/servicemonitor.yaml
+  # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
+  - ../platform/monitoring/grafana-httproute.yaml