fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes

k8s/bootstrap/phase1-storage/longhorn-values.yaml

@@ -1,6 +1,10 @@
 # Longhorn Helm Values — Single Source of Truth
 # Used by both bootstrap.sh (Helm install) and ArgoCD (adoption)
 # Chart: https://github.com/longhorn/charts
+#
+# NOTE: Namespace requires PodSecurity=privileged labels (Longhorn needs host access).
+# bootstrap.sh applies namespace.yaml automatically. For manual install:
+#   kubectl apply -f k8s/bootstrap/phase1-storage/namespace.yaml
 
 defaultSettings:
   # 3-node HA configuration
@@ -26,6 +30,7 @@ persistence:
 
 # CSI plugin must tolerate control-plane taints
 csi:
+  iscsiadmPath: /usr/sbin/iscsiadm
   kubeletRootDir: /var/lib/kubelet
   attacherReplicaCount: 3
   provisionerReplicaCount: 3
@@ -51,6 +56,8 @@ longhornUI:
   replicas: 1
 
 # Monitoring (Prometheus ServiceMonitor)
+# Disabled during bootstrap (Prometheus CRDs not installed yet)
+# Re-enable via ArgoCD after Prometheus stack is deployed
 metrics:
   serviceMonitor:
-    enabled: true
+    enabled: false

k8s/bootstrap/phase1-storage/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

k8s/bootstrap/phase1-storage/storageclasses.yaml

@@ -2,8 +2,9 @@
 # The default 'longhorn' SC is created by Helm chart
 # These are additional specialized classes
 ---
-# CNPG-specific StorageClass with postgres UID/GID mount options
-# Fixes "read-only filesystem" error when PostgreSQL (UID 26) tries to write
+# CNPG-specific StorageClass for PostgreSQL volumes
+# CNPG handles filesystem ownership via securityContext.fsGroup (UID/GID 26)
+# Separate from default 'longhorn' to allow CNPG-specific tuning
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -19,9 +20,7 @@ parameters:
   fromBackup: ""
   dataLocality: "best-effort"
   fsType: "ext4"
-mountOptions:
-  - "noatime"
-  - "uid=26"   # postgres user
-  - "gid=26"   # postgres group
+# mountOptions removed - uid/gid are NOT valid for ext4 (only for FAT/VFAT)
+# CNPG handles ownership via securityContext.fsGroup automatically
 reclaimPolicy: Delete
 volumeBindingMode: Immediate