Deploy monitoring stack

cluster/platform/gateway/referencegrant.yaml

@@ -1,13 +1,21 @@
 # ------------------------------------------------------------------------------
-# ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
+# ReferenceGrant — allow HTTPRoutes from app namespaces to attach to the Gateway
 #
-# Required by Gateway API spec when parentRef crosses namespace boundaries.
-# `namespace` is required in the from stanza — use a specific namespace or
-# create one ReferenceGrant per namespace that needs access.
+# IMPORTANT: Every new application namespace that needs to route traffic through
+# the Cilium Gateway MUST have an entry added here. This is a Gateway API
+# security requirement — the grant must live in the gateway namespace.
 #
-# For a homelab cluster where all namespaces are trusted, we create a single
-# catch-all by listing the namespaces we expect to use. Add entries as new
-# app namespaces are created.
+# When adding a new application:
+#   1. Add a new `from` entry below with the app namespace
+#   2. Push to main
+#   3. ArgoCD will sync the updated ReferenceGrant automatically
+#
+# Namespaces currently permitted:
+#   - default       (test workloads)
+#   - argocd        (ArgoCD UI)
+#   - monitoring    (Grafana)
+#   - authentik     (Authentik SSO — future)
+#   - gitea         (Gitea — future)
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
@@ -21,10 +29,10 @@ spec:
       namespace: default
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
-      namespace: monitoring
+      namespace: argocd
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
-      namespace: argocd
+      namespace: monitoring
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: authentik