Deploy k8up backup operator in platform ArgoCD project

The k8up CRDs already exist in the cluster (managed by a separate k8up-crds
Helm release) but the operator itself was never deployed. Install it following
the cnpg-system pattern so k8up backup/restore custom resources are actually
reconciled.

- Add apps/base/k8up-system Namespace + kustomization
- Add au-syd1 overlay inflating the k8up chart 4.10.0 from the artifactapi
  virtual-helm proxy (replicaCount 2 with leader election, PDB minAvailable 1,
  sane operator resource requests/limits, ServiceMonitor/PrometheusRule off)
- Do not emit the chart CRDs: they live in the chart crds/ directory which the
  kustomize helm inflator skips, leaving CRD ownership with the existing
  k8up-crds Helm release so ArgoCD does not fight over them
- Register apps/overlays/*/k8up-system in the platform ApplicationSet

apps/base/k8up-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/k8up-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: k8up-system

apps/overlays/au-syd1/k8up-system/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/k8up-system
+  - poddisruptionbudget.yaml
+
+helmCharts:
+  - name: k8up
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "4.10.0"
+    releaseName: k8up
+    namespace: k8up-system
+    valuesFile: values.yaml

apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: k8up
+  namespace: k8up-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: k8up
+      app.kubernetes.io/instance: k8up

apps/overlays/au-syd1/k8up-system/values.yaml

@@ -0,0 +1,18 @@
+# CRDs are managed by the separate `k8up-crds` Helm release already present in
+# the cluster; the k8up chart ships CRDs via its crds/ directory, which the
+# kustomize helm inflator does not emit, so ArgoCD does not fight CRD ownership.
+replicaCount: 2
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 256Mi
+  requests:
+    cpu: 20m
+    memory: 128Mi
+
+metrics:
+  serviceMonitor:
+    enabled: false # Requires Prometheus Operator CRDs.
+  prometheusRule:
+    enabled: false # Requires Prometheus Operator CRDs.

argocd/applicationsets/platform.yaml

@@ -31,6 +31,7 @@ spec:
       - path: apps/overlays/*/grafana-system
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
+      - path: apps/overlays/*/k8up-system
       - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/netbox
       - path: apps/overlays/*/node-feature-discovery