feat(balancer): clean design with shared-cluster cnpg + Envoy Gateway

.holo/branches/k8s-manifests/balancer/app/manifests.toml

@@ -0,0 +1,11 @@
+[holomapping]
+holosource = "balancer"
+root = "deploy/manifests/balancer/base"
+files = [
+    "namespace.yaml",
+    "deployment.yaml",
+    "service.yaml",
+]
+# Excludes the upstream `ingress.yaml` (replaced by per-cluster
+# _gateways/balancer.yaml) and `kustomization.yaml` (we compose our
+# own at balancer/app/kustomization.yaml).

.holo/sources/balancer.toml

@@ -1,3 +1,3 @@
 [holosource]
 url = "https://github.com/CodeForPhilly/balancer-main.git"
-ref = "refs/tags/v1.1.3"
+ref = "refs/tags/v1.1.5"

_gateways/balancer.yaml

@@ -0,0 +1,36 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: balancer
+  namespace: balancer
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  gatewayClassName: eg
+  listeners:
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: balancer.sandbox.k8s.phl.io
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: balancer-gw-tls
+      allowedRoutes:
+        namespaces:
+          from: Same
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: balancer
+  namespace: balancer
+spec:
+  parentRefs:
+    - name: balancer
+  hostnames:
+    - balancer.sandbox.k8s.phl.io
+  rules:
+    - backendRefs:
+        - name: balancer
+          port: 8000

balancer/app/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: balancer
+
+resources:
+  - manifests/namespace.yaml
+  - manifests/deployment.yaml
+  - manifests/service.yaml
+
+images:
+  - name: ghcr.io/codeforphilly/balancer-main/app
+    newTag: "0.0.0-dev.20260211012449"

balancer/cnpg/database.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: balancer
+  namespace: cloudnative-pg
+spec:
+  name: balancer
+  owner: balancer
+  cluster:
+    name: shared-cluster

balancer/cnpg/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# No namespace — database.yaml declares its own (cloudnative-pg). cnpg
+# requires the Database CR to live in the same namespace as the Cluster
+# it targets, so we keep it out of the balancer-app rewrite.
+resources:
+  - database.yaml

balancer/kustomization.yaml

@@ -1,22 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-namespace: balancer
-
+# No namespace here — each sub-kustomization sets its own:
+#   - app/ rewrites resources to `balancer`
+#   - cnpg/ leaves Database CR in its own `cloudnative-pg` namespace
+# kustomize emits a single stream; k8s-normalize routes by each
+# resource's metadata.namespace at deploy time.
 resources:
-  - manifests/namespace.yaml
-  - manifests/deployment.yaml
-  - manifests/service.yaml
-
-images:
-  - name: ghcr.io/codeforphilly/balancer-main/app
-    newTag: "0.0.0-dev.20260211012449"
-
-patches:
-  - target:
-      kind: Namespace
-      name: balancer
-    patch: |-
-      - op: replace
-        path: /metadata/name
-        value: dev
+  - app
+  - cnpg