phase2-prep: per-component no-secret rollout + component hardening (author-first)

Prep only — nothing deployed; running cluster untouched.

Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/
= 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring,
monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base
platform/apps and adds ./rollout, so only the no-secret tier reconciles; the
secret-blocked components are simply not created until hand-offs arrive. The
no-secret tier carries no SOPS content, so it needs no sops-age key. prod is
untouched (still builds the monolith). Convergence path coded in (delete rollout/
+ the two deletes) — R-ENV-02 divergence flagged for architect review.

Component hardening via cluster-vars (prod keeps strict posture):
- KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY
  Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector
  excludes system+platform namespaces.
- MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default);
  Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers.

Cilium parity verified against the live CNI (no-op adopt). Validated:
kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/dev/kustomization.yaml

@@ -2,39 +2,38 @@
 # clusters/dev — the ACTIVE build target overlay.
 #
 # `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
-# This overlay adds NO resources of its own. Its ONLY job is to patch the shared cluster-vars
-# ConfigMap with dev-scoped values (R-ENV-02). The base reconciliation graph is reused verbatim.
+# TRANSITIONAL (Phase-2 bootstrap): this overlay reuses the base source + cluster-vars, but
+# REPLACES the monolithic base `platform`/`apps` Kustomizations with a per-component NO-SECRET
+# rollout (./rollout) — so dev brings up cilium/longhorn/monitoring/kyverno in order WITHOUT
+# dragging in the secret-blocked components. It patches cluster-vars with dev values (R-ENV-02)
+# and softens Kyverno for bootstrap. CONVERGENCE: delete ./rollout + the two $patch:delete
+# below to return to the unified base graph once all operator hand-offs land. See DECISIONS-LOG.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - rollout
 patches:
-  # --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) ---
-  # Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions.
-  # Realises the commented decryption TODOs in clusters/base and sets the real source URL.
-  # The `sops-age` Secret is created out-of-band (bootstrap/sops/install-age-key.sh) — name only.
+  # --- Drop the monolithic base platform/apps Kustomizations. They reconcile ALL 11 components
+  #     as one unit (incl. secret-blocked cert-manager/externaldns/velero/keycloak/oauth2-proxy/
+  #     image-automation/gateway/kubevirt); ./rollout replaces them with the per-component
+  #     no-secret set for dev bootstrap. Remove these two deletes to re-adopt the unified graph.
+  #     (No decryption patch is needed here: the rollout components carry no SOPS content, so
+  #     the `sops-age` Secret is not required for the dev bootstrap tier.) ---
   - patch: |-
+      $patch: delete
       apiVersion: kustomize.toolkit.fluxcd.io/v1
       kind: Kustomization
       metadata:
         name: platform
         namespace: flux-system
-      spec:
-        decryption:
-          provider: sops
-          secretRef:
-            name: sops-age
   - patch: |-
+      $patch: delete
       apiVersion: kustomize.toolkit.fluxcd.io/v1
       kind: Kustomization
       metadata:
         name: apps
         namespace: flux-system
-      spec:
-        decryption:
-          provider: sops
-          secretRef:
-            name: sops-age
   - patch: |-
       apiVersion: source.toolkit.fluxcd.io/v1
       kind: GitRepository
@@ -84,3 +83,18 @@ patches:
       - op: replace
         path: /data/VELERO_RETENTION
         value: "72h"
+      # dev-softened Kyverno for cold-start (base defaults Enforce/Fail/3 = prod posture).
+      - op: replace
+        path: /data/KYVERNO_VALIDATION_ACTION
+        value: "Audit"
+      - op: replace
+        path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
+        value: "Ignore"
+      - op: replace
+        path: /data/KYVERNO_ADMISSION_REPLICAS
+        value: "1"
+      # dev: no Grafana admin Secret yet → empty makes the chart use its default admin password
+      # (dev-only, NAT-isolated). Prod keeps the by-name SOPS secret from the base default.
+      - op: replace
+        path: /data/GRAFANA_ADMIN_SECRET
+        value: ""