pelican: split wings into wings-mc and wings-ark domains

infra/envoy-gateway/kustomization.yaml

@@ -2,9 +2,15 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - envoy-gateway-namespace.yaml
   - gateway.yaml
   - gateway-public.yaml
 
+  # CrowdSec (public gateway hardening) — HELD pending enforcement-scope decision
+  # (EG v1.3.2 SecurityPolicy does not support sectionName; see it-tools-securitypolicy.yaml)
+  # - crowdsec/envoyproxy-public.yaml
+  # - crowdsec/it-tools-securitypolicy.yaml
+
   # Policies
   - pelican/pelican-wings-clienttrafficpolicy.yaml
   - minio-aistor/minio-aistor-clienttrafficpolicy.yaml
@@ -46,7 +52,8 @@ resources:
   - searxng/searxng-certificate.yaml
   - affine/affine-certificate.yaml
   - pelican/pelican-certificate.yaml
-  - pelican/pelican-wings-certificate.yaml
+  - pelican/pelican-wings-mc-certificate.yaml
+  - pelican/pelican-wings-ark-certificate.yaml
   - outline/outline-certificate.yaml
 
 patches:
@@ -266,7 +273,13 @@ patches:
       version: v1
       kind: Gateway
       name: gateway-internal
-    path: pelican/pelican-wings-gateway-patch.yaml
+    path: pelican/pelican-wings-mc-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: pelican/pelican-wings-ark-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1