refactor(argocd): phase3 reduced to authentik only (remove vault, temporal, ollama, story-crater)

k8s/hooks/phase3/phase3-hooks.yaml

@@ -1,4 +1,4 @@
-# ArgoCD Hook Jobs for Phase 3 releases
+# ArgoCD Hook Jobs for Phase 3 (IAM only)
 
 ---
 # ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────
@@ -58,128 +58,7 @@ spec:
           - |
             echo "Waiting for Authentik server..."
             kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true
-
-            echo "Authentik ready (OIDC provisioning requires bootstrap token from secrets)"
-            echo "✓ OIDC provisioning placeholder"
-
----
-# ── Vault — PreSync: MinIO Creds & Bucket ────────────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: vault-minio-setup
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: minio-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Creating Vault MinIO secrets..."
-            # Note: MinIO creds from secrets.enc.yaml should be available
-            echo "Vault MinIO setup (credentials from SOPS secrets)"
-            echo "✓ Vault MinIO placeholder"
-
----
-# ── Temporal — PreSync: Elasticsearch & Secrets ───────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: temporal-elasticsearch-setup
-  namespace: temporal
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: es-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Setting up Temporal Elasticsearch..."
-            kubectl create namespace temporal --dry-run=client -o yaml | kubectl apply -f -
-            kubectl apply -f k8s/temporal/elasticsearch.yaml || echo "ES already exists"
-            echo "✓ Elasticsearch setup"
-
----
-# ── Ollama — PreSync: Namespace & Secrets ────────────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ollama-namespace-setup
-  namespace: llm
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: ns-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Setting up Ollama namespace..."
-            kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f -
-            kubectl label namespace llm \
-              pod-security.kubernetes.io/enforce=baseline \
-              pod-security.kubernetes.io/enforce-version=latest \
-              --overwrite 2>/dev/null || true
-            echo "✓ Ollama namespace setup"
-
----
-# ── Story Crater Migrations — PostSync: Run Migrations ────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: story-crater-migrations-run
-  namespace: story-crater-backend
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: migrations
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Running Story Crater migrations..."
-            # Note: actual migrations require CNPG cluster to be ready
-            echo "Migrations placeholder (requires CNPG + Vault secrets)"
-            echo "✓ Migrations setup"
+            echo "✓ Authentik ready"
 
 ---
 # ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────
@@ -205,9 +84,6 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     verbs: ["list", "get"]
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "create"]
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1