feat(statehub): deploy empty railiance state hub

deploy/railiance/README.md

@@ -69,9 +69,11 @@ App promotion into `railiance-apps`:
 
 - copy `apps/charts/state-hub/` to `charts/state-hub/`;
 - copy `apps/helm/state-hub-values.yaml` to `helm/state-hub-values.yaml`;
+- apply or GitOps-manage `apps/manifests/state-hub-namespace.yaml`;
 - create `state-hub-env` in the `state-hub` namespace from the approved
   secret-delivery path;
-- deploy with Helm only after `state-hub-db` is healthy.
+- deploy with Helm using the production values file, which sets
+  `namespace.create=false`, only after `state-hub-db` is healthy.
 
 ## Runtime Secret Contract
 

deploy/railiance/apps/helm/state-hub-values.yaml

@@ -1,8 +1,11 @@
 # Production values for the State Hub Railiance chart handoff.
 # Non-secret values only. DATABASE_URL comes from the Secret `state-hub-env`.
 
+namespace:
+  create: false
+
 image:
   tag: "b536741"
 
 ingress:
-  enabled: false
+  enabled: false

deploy/railiance/apps/manifests/state-hub-namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: state-hub
+  labels:
+    railiance.io/layer: s5-app
+    railiance.io/postgres-client: state-hub-db

deploy/railiance/platform/state-hub-db-networkpolicies.yaml

@@ -17,9 +17,9 @@ spec:
   policyTypes:
     - Egress
   egress:
-    - to:
-        - namespaceSelector: {}
-      ports:
+    - ports:
+        - protocol: TCP
+          port: 443
         - protocol: TCP
           port: 6443
 ---