feat(slashbay): add prd-apps Fleet manifests

[surrealwolf]

Summary

• Adds Slashbay to gitops-dev using the Coder overlay pattern: slashbay/base plus a self-contained slashbay/overlays/prd-apps Fleet path.
• Deploys to cluster prd-apps, namespace slashbay, image harbor.dataknife.net/library/slashbay. Ingress slashbay.dataknife.net for GitHub/GitLab issue webhooks (same nginx + *.dataknife.net style as Coder/MCP).
• Documents secrets and adds slashbay/overlays/prd-apps to fleet-gitrepo.yaml. If gitops-dev-prd-apps already exists, add that path to the live GitRepo instead of applying a second one.

Companion app PR: DataKnifeAI/slashbay feat/k8s-harbor-gitops.

Test plan

• kubectl kustomize slashbay/overlays/prd-apps
• Create slashbay-secrets and harbor-registry-secret in namespace slashbay (see slashbay/secrets/README.md)
• Wait for Harbor image library/slashbay from GitLab CI
• Add Fleet GitRepo path slashbay/overlays/prd-apps (or apply fleet-gitrepo.yaml if none exists)
• Confirm pod /healthz and that SLASHBAY_DRY_RUN stays true until Coder + secrets are ready
• DNS A/AAAA for slashbay.dataknife.net if public webhooks are required

Made with Cursor

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM
Using a mutable image tag (:latest) in a production deployment allows the runtime artifact to change without a corresponding Git change to this PR-managed manifest.

Impact: If an attacker (or compromised CI/registry credential) can retag/push that repository, the cluster can pull and run unreviewed code on restart/rollout, weakening GitOps integrity and enabling supply-chain compromise.

 

^{Reviewed by Cursor Security Reviewer for commit 448b5f5. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 448b5f5. Configure here.}

[cursor]

Ingress missing TLS configuration

High Severity

The Ingress sets ssl-redirect and comments that TLS uses the controller default certificate, but spec.tls is absent. Without a tls hosts entry, nginx-ingress does not enable HTTPS for slashbay.dataknife.net, so GitHub/GitLab webhook delivery over HTTPS fails and HTTP clients are redirected to a broken endpoint.

 

^{Reviewed by Cursor Bugbot for commit 448b5f5. Configure here.}

[cursor]

Left a non-blocking comment; not approved because Cursor Bugbot reported an unresolved high-severity finding and the Bugbot check completed as skipped. Human review is needed; no reviewers were assigned because this repo has no CODEOWNERS or other eligible reviewers besides the author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}