feat(ecommerce-staging): governance para el nuevo namespace de Staging

ResourceQuota/LimitRange/NetworkPolicy livianos para
ecommerce-staging -- una sola réplica del frontend, sin backend propio
(comparte Medusa/Postgres/Meilisearch con Producción). Contraparte de
ecommerce-staging-app en apps-registry.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012Y4df3Z7odr9Cg8F2nw6uV

ecommerce-staging-governance/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ecommerce-staging
+resources:
+  - resourcequota.yaml
+  - limitrange.yaml
+  - networkpolicy.yaml

ecommerce-staging-governance/limitrange.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: ecommerce-staging-default-limits
+  namespace: ecommerce-staging
+spec:
+  limits:
+    - type: Container
+
+      defaultRequest:
+        cpu: 50m
+        memory: 128Mi
+
+      default:
+        cpu: 500m
+        memory: 512Mi
+
+      min:
+        cpu: 10m
+        memory: 16Mi
+
+      max:
+        cpu: "1"
+        memory: 512Mi

ecommerce-staging-governance/networkpolicy.yaml

@@ -0,0 +1,11 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ecommerce-staging-network-security
+spec:
+  podSelector: {} # Aplica a todos los pods del namespace
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector: {} # Permite tráfico desde Traefik y comunicación interna entre microservicios

ecommerce-staging-governance/resourcequota.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: ecommerce-staging-quota
+spec:
+  hard:
+    requests.cpu: "1"
+    requests.memory: 1Gi
+    limits.cpu: "2"
+    limits.memory: 2Gi
+
+    pods: "4"
+    persistentvolumeclaims: "0"