phase2-prep: per-component no-secret rollout + component hardening (author-first)

Prep only — nothing deployed; running cluster untouched.

Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/
= 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring,
monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base
platform/apps and adds ./rollout, so only the no-secret tier reconciles; the
secret-blocked components are simply not created until hand-offs arrive. The
no-secret tier carries no SOPS content, so it needs no sops-age key. prod is
untouched (still builds the monolith). Convergence path coded in (delete rollout/
+ the two deletes) — R-ENV-02 divergence flagged for architect review.

Component hardening via cluster-vars (prod keeps strict posture):
- KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY
  Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector
  excludes system+platform namespaces.
- MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default);
  Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers.

Cilium parity verified against the live CNI (no-op adopt). Validated:
kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/kyverno/admission/helmrelease.yaml

@@ -34,18 +34,32 @@ spec:
     remediation:
       retries: 3
   values:
-    # HA admission controller so a single pod restart cannot open an enforcement gap.
+    # Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
+    # restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
     admissionController:
-      replicas: 3
+      replicas: ${KYVERNO_ADMISSION_REPLICAS}
     backgroundController:
       enabled: true               # needed for generate (default-deny baseline) + sync
     reportsController:
       enabled: true
     cleanupController:
       enabled: true
-    # Fail-CLOSED: if the webhook is unreachable, reject rather than silently admit
-    # non-conforming resources (coordination-protocol.md #8). Tune per-resource in
-    # the policies' webhook config if a bootstrap deadlock appears.
+    # Webhook failure policy — cluster-vars knob (prod Fail / dev Ignore). Fail is fail-CLOSED
+    # (reject rather than silently admit when the webhook is unreachable, coordination-protocol.md
+    # #8); dev uses Ignore (fail-open) so a cold/unhealthy Kyverno cannot brick admission during
+    # bootstrap. The namespaceSelector ALSO excludes system + platform namespaces at the webhook
+    # layer — belt-and-suspenders: policies already scope to app-namespace=true, but this
+    # guarantees kube-system/flux-system/CNI/storage/monitoring admission never routes to Kyverno.
     config:
       webhooks:
-        - failurePolicy: Fail
+        - failurePolicy: ${KYVERNO_WEBHOOK_FAILURE_POLICY}
+          namespaceSelector:
+            matchExpressions:
+              - key: kubernetes.io/metadata.name
+                operator: NotIn
+                values:
+                  - kube-system
+                  - flux-system
+                  - kyverno
+                  - longhorn-system
+                  - monitoring

platform/kyverno/admission/secret-provenance.yaml

@@ -24,7 +24,7 @@ metadata:
     homelab.keithjackson.dev/requirements: R-SEC-01
     homelab.keithjackson.dev/scope: admission-only
 spec:
-  validationFailureAction: Enforce
+  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
   background: false
   rules:
     - name: secrets-must-be-flux-managed

platform/kyverno/policies/require-auth-mode-label.yaml

@@ -25,7 +25,7 @@ metadata:
       Pods in application namespaces must declare
       homelab.keithjackson.dev/auth-mode = oidc | forward-auth | native | none.
 spec:
-  validationFailureAction: Enforce
+  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
   background: true
   rules:
     - name: require-auth-mode

platform/kyverno/policies/require-egress-class-label.yaml

@@ -25,7 +25,7 @@ metadata:
       Pods in application namespaces must declare
       homelab.keithjackson.dev/egress-class = internet | vpn.
 spec:
-  validationFailureAction: Enforce
+  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
   background: true
   rules:
     - name: require-egress-class

platform/kyverno/policies/restrict-host-namespaces.yaml

@@ -24,7 +24,7 @@ metadata:
       Application-namespace pods must not use hostNetwork/hostPID/hostIPC (which
       bypass default-deny) or run privileged containers.
 spec:
-  validationFailureAction: Enforce
+  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
   background: true
   rules:
     - name: disallow-host-namespaces

platform/kyverno/policies/validate-default-deny-shape.yaml

@@ -20,7 +20,7 @@ metadata:
       to include both Ingress and Egress. Rejects a baseline that silently leaves
       a direction open.
 spec:
-  validationFailureAction: Enforce
+  validationFailureAction: ${KYVERNO_VALIDATION_ACTION}
   background: true
   rules:
     - name: baseline-must-deny-both-directions

platform/monitoring/kube-prometheus-stack.yaml

@@ -62,7 +62,7 @@ spec:
         storageSpec:
           volumeClaimTemplate:
             spec:
-              storageClassName: longhorn                  # replicated tier (ADR-0003)
+              storageClassName: ${MONITORING_STORAGE_CLASS}   # replicated tier (ADR-0003); cluster-vars knob
               accessModes: ["ReadWriteOnce"]
               resources:
                 requests:
@@ -80,22 +80,24 @@ spec:
             memory: 32Mi
           limits:
             memory: 96Mi
-        # SMTP credentials are an OPERATOR HAND-OFF: a SOPS-encrypted Secret, referenced BY NAME
-        # only (docs/07). Mounted at /etc/alertmanager/secrets/<name>/ so the config below can read
-        # the password from a file (never inline plaintext).
-        secrets:
-          - alertmanager-smtp
-      # Routing/receivers. Non-secret SMTP endpoint fields (smarthost/from/to/username) are
-      # operator-supplied placeholders (REPLACE-ME, same convention as velero); the PASSWORD is
-      # read from the mounted SOPS secret via *_file. Both severities email; subject/route differ.
+        # SMTP is an OPERATOR HAND-OFF DEFERRED to Phase 4 — no creds yet, and the by-name
+        # `alertmanager-smtp` Secret does NOT exist. Mounting a missing Secret wedges Alertmanager
+        # in ContainerCreating, so the mount is DISABLED until the hand-off. Re-enable verbatim
+        # (uncomment) when the SOPS `alertmanager-smtp` Secret is delivered. TODO(Phase-4 SMTP).
+        # secrets:
+        #   - alertmanager-smtp
+      # Routing stays live; RECEIVERS ARE NULL until the SMTP hand-off (alerts still fire, route,
+      # and show in the Alertmanager UI + Grafana — they just aren't emailed). The smtp_* globals
+      # and email_configs are retained below, commented, so re-enabling is a pure uncomment.
       config:
         global:
           resolve_timeout: 5m
-          smtp_smarthost: "REPLACE-ME:587"          # operator hand-off (e.g. smtp.gmail.com:587)
-          smtp_from: "REPLACE-ME"                    # operator hand-off (From: address)
-          smtp_auth_username: "REPLACE-ME"           # operator hand-off (SMTP login)
-          smtp_auth_password_file: /etc/alertmanager/secrets/alertmanager-smtp/smtp-password
-          smtp_require_tls: true
+          # TODO(Phase-4 SMTP hand-off): uncomment together with the alertmanager-smtp Secret mount.
+          # smtp_smarthost: "smtp.example.com:587"
+          # smtp_from: "[email protected]"
+          # smtp_auth_username: "<smtp-login>"
+          # smtp_auth_password_file: /etc/alertmanager/secrets/alertmanager-smtp/smtp-password
+          # smtp_require_tls: true
         route:
           group_by: ["alertname", "namespace"]
           group_wait: 30s
@@ -109,25 +111,29 @@ spec:
               group_wait: 10s
               repeat_interval: 1h
         receivers:
+          # NULL receivers until Phase-4 SMTP. email_configs retained (commented) for verbatim re-enable.
           - name: email-warning
-            email_configs:
-              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
-                send_resolved: true
-                headers:
-                  subject: '[WARNING] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
+            # email_configs:
+            #   - to: "<alert-inbox>"
+            #     send_resolved: true
+            #     headers:
+            #       subject: '[WARNING] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
           - name: email-critical
-            email_configs:
-              - to: "REPLACE-ME"                     # operator hand-off (alert inbox)
-                send_resolved: true
-                headers:
-                  subject: '[CRITICAL] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
+            # email_configs:
+            #   - to: "<alert-inbox>"
+            #     send_resolved: true
+            #     headers:
+            #       subject: '[CRITICAL] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
 
     # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO ---
     grafana:
       enabled: true
       # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014).
+      # cluster-vars knob: prod = the SOPS `grafana-admin-credentials` Secret; dev = "" (empty),
+      # which makes the chart fall back to its default admin password (dev-only, NAT-isolated) so
+      # Grafana starts without an operator secret. TODO: supply a dev Secret if wider dev access.
       admin:
-        existingSecret: grafana-admin-credentials
+        existingSecret: ${GRAFANA_ADMIN_SECRET}
         userKey: admin-user
         passwordKey: admin-password
       # DEV TRIM: emptyDir (default). Dashboards are provisioned from ConfigMaps (sidecar), so no

platform/monitoring/loki.yaml

@@ -60,7 +60,7 @@ spec:
       replicas: 1
       persistence:
         enabled: true
-        storageClass: longhorn          # replicated tier (ADR-0003)
+        storageClass: ${MONITORING_STORAGE_CLASS}   # replicated tier (ADR-0003); cluster-vars knob
         size: ${MONITORING_LOKI_PVC_SIZE}   # overlay knob (dev 5Gi / prod large)
       resources:
         requests: