Everything-is-an-app cutover: Storage & Database group (harbor, gitea, loki, kubeflow-pipelines)

[j-zimnowoda]

Parent

#3515

What to build

Cut the Storage & Database group of core apps over to the new git-driven layout. These apps are grouped because they share the same cross-cutting managed settings beyond the universal four: object storage buckets (obj.*) and CNPG-backed databases (databases.*).

Apps in this batch:

• harbor
• gitea
• loki
• kubeflow-pipelines

Note: harbor and gitea are also OIDC consumers — coordinate their OIDC managed-values wiring with the SSO/OIDC batch (they must emit both obj/databases and OIDC references into values.managed.yaml).

End-to-end behavior per app: enabled in env/settings/apps.yaml; vendor-shaped values.custom.yaml + operator-rendered values.managed.yaml under env/values/<ns>/<release>/; multi-source Application CR file; legacy env/apps/<app>.yaml + inline-values path removed. Storage/DB credentials appear only as Secret references — value files stay secret-free.

Acceptance criteria

• Each app reconciles Healthy in ArgoCD from its env/values/<ns>/<release>/{managed,custom}.yaml.
• obj bucket + CNPG database wiring emitted into values.managed.yaml; credentials only as Secret references.
• harbor/gitea also emit OIDC references (cross-dependency with the SSO/OIDC batch noted and handled).
• Legacy env/apps/<app>.yaml entries and inline-values path removed for this batch.
• Existing installed: gating still works from env/settings/apps.yaml.

Blocked by

• Everything-is-an-app: pilot cert-manager end-to-end (app-of-apps + settings + values) #3571
• Everything-is-an-app: validate values.custom.yaml against vendor values.schema.json #3572
• Everything-is-an-app: render cert-manager -artifacts into git manifests (one object per file) #3573