# Project catalog ownership

| Catalog | Ownership |
| --- | --- |
| `apps/auth-server` | API workload와 lab ingress |
| `apps/identity-postgres` | auth platform 전용 PostgreSQL |
| `apps/auth-migration` | versioned Flyway migration Job |
| `apps/keycloak-realm-import` | versioned realm/client import |
| `platform/forward-auth` | oauth2-proxy와 Traefik ForwardAuth component |
| `platform/keycloak` | Keycloak instance와 ingress |
| `platform/minio` | MinIO Tenant |
| `platform/registry` | Docker registry |
| `platform/vault` | Vault workload |
| `platform/secret-delivery` | VSO auth/connection, Helm values와 VaultStaticSecret |
| `platform/*-operator` | cluster-scoped controller source와 environment patch |
| `policies/baseline` | namespace 보안 baseline |
| `tenants/mnt` | `mnt` namespace 경계 |

Catalog는 직접 controller root로 지정하지 않습니다. 실제 환경은
`gitops/clusters/<...>` 아래 entrypoint에서 필요한 catalog만 선택합니다.