k8s: add base namespace and pod disruption budgets

- Namespace setup script with PSP/RBAC
- PodDisruptionBudgets for all services (zero-downtime drain)

k8s/base/namespace-setup.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Reusable namespace setup script
+# Creates namespace and applies pod-security policy labels
+# Usage: bash k8s/base/namespace-setup.sh <namespace> [<namespace2> ...]
+set -euo pipefail
+
+if [ $# -eq 0 ]; then
+  echo "Usage: $0 <namespace> [<namespace2> ...]" >&2
+  exit 1
+fi
+
+for namespace in "$@"; do
+  kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -
+  kubectl label namespace "$namespace" \
+    pod-security.kubernetes.io/enforce=privileged \
+    pod-security.kubernetes.io/enforce-version=latest \
+    --overwrite
+  echo "✓ Namespace '$namespace' ready"
+done

k8s/base/poddisruptionbudgets.yaml

@@ -0,0 +1,322 @@
+# k8s/base/poddisruptionbudgets.yaml
+# PodDisruptionBudgets ensure zero-downtime cluster maintenance.
+# Allows Kubernetes to gracefully drain nodes during updates/maintenance
+# without violating availability guarantees.
+
+---
+# Observability stack
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: grafana
+  namespace: logging
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: grafana
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: loki
+  namespace: logging
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: loki
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: prometheus
+  namespace: monitoring
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: prometheus-operator
+  namespace: monitoring
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-prometheus-stack-operator
+
+---
+# IAM stack
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: authentik
+  namespace: iam
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: vault
+  namespace: iam
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vault
+
+---
+# CI/CD stack
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: argocd-server
+  namespace: cicd
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-server
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: argocd-repo-server
+  namespace: cicd
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: argocd-repo-server
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: forgejo
+  namespace: forge
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: forgejo
+
+---
+# Ingress & network
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+
+---
+# Certificate management
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cert-manager
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cert-manager-webhook
+  namespace: cert-manager
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cert-manager-webhook
+
+---
+# Storage & replication
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: minio-az-a
+  namespace: storage
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: minio
+      instance: az-a
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: minio-az-b
+  namespace: storage
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: minio
+      instance: az-b
+
+---
+# Database
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cnpg-cluster
+  namespace: ddb
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      cnpg.io/cluster: ddb-cluster
+
+---
+# Messaging
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: kafka-broker
+  namespace: sqs
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kafka
+      app.kubernetes.io/component: kafka-broker
+
+---
+# Workflow orchestration
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: temporal-cassandra
+  namespace: temporal
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: cassandra
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: temporal-server
+  namespace: temporal
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: temporal
+      app.kubernetes.io/component: server
+
+---
+# LLM inference
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: ollama
+  namespace: llm
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: ollama
+
+---
+# Cluster DNS
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: coredns
+  namespace: kube-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
+
+---
+# Cilium networking
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cilium-agent
+  namespace: kube-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      k8s-app: cilium
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cilium-operator
+  namespace: kube-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      io.cilium/app: operator
+
+---
+# Longhorn storage
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: longhorn-manager
+  namespace: longhorn-system
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: longhorn-manager
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: longhorn-csi-plugin
+  namespace: longhorn-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: csi-provisioner
+
+---
+# System components
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: kube-state-metrics
+  namespace: monitoring
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics