- MinIO 3-node site replication (az-a/b/c) - S3 backend for Loki chunks (10-day retention) - OIDC integration with Authentik - envFrom for secret injection
- Namespace setup script with PSP/RBAC - PodDisruptionBudgets for all services (zero-downtime drain)