T-0.3 ServiceDefinition schema + renderer contract + examples (R-GITOPS-02)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

catalog/keycloak.yaml

@@ -0,0 +1,35 @@
+# ServiceDefinition: keycloak
+# Source of truth: spec docs/13-service-catalog.md row 0; docs/15-identity-and-access.md; ADR-0014.
+# public IdP | egress internet | PostgreSQL on Longhorn (irreplaceable, DR-critical) | auth native.
+# Keycloak IS the IdP (root of trust): its own admin login is local + MFA, so it does not federate.
+# Validates against schemas/servicedefinition.schema.json.
+name: keycloak
+kind: container
+source:
+  image: quay.io/keycloak/keycloak
+exposure: public              # login/redirect flows for internet-exposed services; hardened (docs/15; R-DNS/R-NET)
+egress: internet              # normal WAN egress (docs/03; R-NET-05)
+storage:
+  - name: db
+    size: 10Gi
+    class: longhorn           # PostgreSQL on 3-replica Longhorn; irreplaceable (docs/15, docs/04; R-STATE-02)
+dependencies:
+  - to: keycloak-db           # explicit allow: Keycloak -> its PostgreSQL (docs/13 graph; R-NET-02)
+    port: 5432
+    protocol: tcp
+ingressRoutes:
+  - host: keycloak.home.keithjackson.dev
+    port: 8080                # HTTP listener; TLS terminates at the Gateway (docs/08, docs/09)
+auth:
+  mode: native                # it IS the IdP; own admin login is local + MFA (docs/15; ADR-0014). Documented exception.
+update:
+  channel: stable             # R-UPD-01
+  range: ">=24.0.0"
+  cadence: "0 4 * * *"
+  autoRollbackOnFailedHealth: true   # R-UPD-03
+observability:
+  metrics: true
+  slis:
+    - up                      # IdP down/unhealthy is a critical alert (docs/10; R-OBS-01)
+backup:
+  policy: daily-offcluster    # DR-critical: rebuilds from DB + git realm config (docs/15, docs/04; R-STATE-03)