gitops: adopt the kubectl-applied manifests into GitOps (keycloak, gitlab, provisioners, RBAC, gp3 SC, namespaces)

[ausbru87]

Goal

Adopt the kubectl-applied (non-Helm) manifests into GitOps in place. Plan:
docs/plans/gitops-adoption.md.

Workloads and sources

• keycloak (Kustomize): deploy/keycloak/ (deployment, service, ingress + configMapGenerator of realm-coder.json, disableNameSuffixHash: true).
• gitlab (StatefulSet): deploy/gitlab/statefulset.yaml, service.yaml, ingress.yaml, ServiceAccount.
• coder provisioner Deployments: deploy/coder/provisioners.yaml (coder-provisioner-alpha, coder-provisioner-bravo, ns coder).
• workspace RBAC: deploy/platform/workspace-rbac.yaml (Role + RoleBinding in coder-workspaces).
• gp3 StorageClass: live only, not in git today.
• namespaces: partly created via Helm --create-namespace / ad hoc.

Tasks

• Author the missing manifests into git first: reconstruct the gp3 StorageClass from kubectl get sc gp3 -o yaml (strip runtime fields, keep storageclass.kubernetes.io/is-default-class); author explicit Namespace manifests for coder, coder-workspaces, keycloak, gitlab, ingress-nginx, external-secrets (and the new monitoring).
• keycloak: Argo Application (Kustomize). The generated ConfigMap name keycloak-realm-coder is stable, so adoption is clean. Realm content is API state, handled in the keycloak-config-cli issue, not here.
• gitlab: annotation tracking + ServerSideApply=true, Replace=false, never prune the 3 volumeClaimTemplates PVCs (the only copy of GitLab + embedded Postgres data). Treat the StatefulSet selector and volumeClaimTemplates as immutable.
• provisioner Deployments: adopt after ESO so coder-provisioner-{alpha,bravo} secrets exist; the org-scoped provisioner keys are create-once API state (Coder API issue).
• workspace RBAC, gp3 StorageClass, namespaces: adopt in place; cluster-scoped objects have immutable key fields, never delete/recreate.
• Render, diff (metadata-only), sync per workload.

Landmines

• gitlab data PVCs (never Replace/prune).
• gp3 StorageClass and namespaces missing from git (author first).

Generated by Coder Agents.