refactor: 폴더 구조 변경

gitops/clusters/lab/main/README.md

@@ -0,0 +1,22 @@
+# lab / main cluster entrypoints
+
+현재 `lab`은 readiness 경계를 가진 push-based staged deployment를 사용합니다.
+
+```text
+namespaces
+stages/
+├── 00-platform
+├── 10-vault
+├── 20-secrets
+├── 30-data
+├── 35-registry
+├── 40-operations
+└── 50-apps
+```
+
+- `namespaces`와 각 stage는 독립적으로 렌더 가능한 cluster 배포 entrypoint입니다.
+- `scripts/bin/bootstrap.sh lab`만 준비 상태를 확인하며 순차 적용합니다.
+- `all/`은 모든 stage를 합친 감사용 Kustomization입니다. apply하거나 GitOps
+  controller root로 연결하지 않습니다.
+- Argo CD를 채택하면 stage별 Application/sync-wave/health gate를, Flux를
+  채택하면 Kustomization `dependsOn`/`healthChecks`를 먼저 설계한 뒤 전환합니다.

gitops/clusters/lab/main/all/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Audit/render entrypoint only. Do not apply this aggregate: controllers and
+# one-shot operations have readiness boundaries that Kustomize cannot express.
+resources:
+  - ../stages/00-platform
+  - ../stages/10-vault
+  - ../stages/20-secrets
+  - ../stages/30-data
+  - ../stages/35-registry
+  - ../stages/40-operations
+  - ../stages/50-apps

gitops/clusters/lab/main/namespaces/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Namespace creation is a separate cluster entrypoint because server-side
+# dry-run cannot create a Namespace and validate namespaced resources against
+# it in the same request.
+resources:
+  - ../../../../tenants/mnt/base
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/00-platform/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Cluster prerequisites and the deny-by-default policy are applied before any
+# workload. This stage is intentionally free of application CRs.
+resources:
+  - ../../../../../tenants/mnt/base
+  - ../../../../../platform/cert-manager/overlays/lab
+  - ../../../../../platform/keycloak-operator/overlays/lab
+  - ../../../../../platform/traefik/overlays/lab
+  - ../../../../../policies/baseline/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/10-vault/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../platform/vault/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/20-secrets/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# The VSO controller is installed by the bootstrap task before this stage.
+resources:
+  - ../../../../../platform/secret-delivery/overlays/lab/operator
+  - ../../../../../platform/secret-delivery/overlays/lab/identity
+  - ../../../../../platform/secret-delivery/overlays/lab/storage
+  - ../../../../../platform/secret-delivery/overlays/lab/apps
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/30-data/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../apps/identity-postgres/overlays/lab
+  - ../../../../../platform/minio/overlays/lab
+  - ../../../../../platform/keycloak/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/35-registry/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../platform/secret-delivery/overlays/lab/storage/registry-minio
+  - ../../../../../platform/registry/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/40-operations/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# One-shot resources. bootstrap.sh waits for their prerequisites before apply.
+resources:
+  - ../../../../../apps/auth-migration/overlays/lab
+  - ../../../../../apps/keycloak-realm-import/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true

gitops/clusters/lab/main/stages/50-apps/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../../../apps/auth-server/overlays/lab
+  - ../../../../../platform/forward-auth/overlays/lab
+
+labels:
+  - pairs:
+      example.com/environment: lab
+      example.com/owner-team: platform
+    includeSelectors: false
+    includeTemplates: true