Add platform infrastructure configuration

infrastructure/namespaces/observability/README.md

@@ -0,0 +1,17 @@
+# Observability namespaces
+
+This kustomization owns exactly the `observability` and `observability-agent`
+Namespace objects. Both opt into observability discovery through
+`observability.hyeonworks.com/enabled: "true"`.
+
+`observability` enforces, audits, and warns at `restricted:latest`.
+`observability-agent` enforces `privileged:latest` so the narrowly scoped agent
+workloads can use their approved read-only host mounts, while audit and warn
+remain `restricted:latest`.
+
+`discovery-namespaces.txt` is an inventory for the later apply workflow. The
+five listed namespaces already exist and are deliberately not rendered here.
+That workflow may own only the
+`observability.hyeonworks.com/enabled` discovery label on those namespaces. It
+must preserve their existing Pod Security and purpose labels, and rollback must
+restore or remove only that exact discovery-label key.

infrastructure/namespaces/observability/discovery-namespaces.txt

@@ -0,0 +1,5 @@
+kube-system
+gitea
+keycloak
+platform-data
+object-storage

infrastructure/namespaces/observability/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - observability.yaml
+  - observability-agent.yaml

infrastructure/namespaces/observability/observability-agent.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: observability-agent
+  labels:
+    observability.hyeonworks.com/enabled: "true"
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest

infrastructure/namespaces/observability/observability.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: observability
+  labels:
+    observability.hyeonworks.com/enabled: "true"
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest