FEAT(velero): Add Velero, Falco,

- and CNPG infrastructure components
Add three critical infrastructure components via GitOps:

- Velero: Backup and disaster recovery solution
  - Configured with Minio S3 backend
  - Daily full cluster backups (30-day retention)
  - Hourly backups for critical namespaces (7-day retention)
  - Credentials managed via External Secrets from Vault

- Falco: Runtime security monitoring
  - eBPF-based threat detection
  - Custom rules for container security
  - Falcosidekick for alert forwarding
  - Prometheus metrics enabled

- CNPG (CloudNativePG): PostgreSQL operator
  - Kubernetes-native PostgreSQL management
  - Automated failover and backups
  - Will replace Bitnami PostgreSQL

All components follow existing GitOps patterns:
- Helm charts deployed via ArgoCD
- Values managed in Git
- Automated sync with selfHeal enabled

cnpg/argocd/cnpg.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cnpg
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  sources:
+    # Helm chart from CloudNativePG repository
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      targetRevision: 0.23.0
+      helm:
+        valueFiles:
+          - $values/cnpg/helm-values/cnpg.yaml
+    # Values file from Git repository
+    - repoURL: https://gitea0213.kro.kr/bluemayne/cluster-infrastructure.git
+      targetRevision: main
+      ref: values
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cnpg-system
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+
+    syncOptions:
+      - CreateNamespace=true
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+      - ServerSideApply=true
+
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+
+  revisionHistoryLimit: 10

cnpg/helm-values/cnpg.yaml

@@ -0,0 +1,78 @@
+# CloudNativePG Operator Helm Values
+# Chart: https://github.com/cloudnative-pg/charts
+
+# Operator image
+image:
+  repository: ghcr.io/cloudnative-pg/cloudnative-pg
+  tag: 1.25.1
+  pullPolicy: IfNotPresent
+
+# Replica count for operator
+replicaCount: 1
+
+# Resource requests for operator
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+# RBAC
+rbac:
+  create: true
+
+# Service Account
+serviceAccount:
+  create: true
+  name: cnpg-operator
+
+# Monitoring
+monitoring:
+  # Enable Prometheus PodMonitor
+  podMonitorEnabled: true
+
+# Webhook configuration
+webhook:
+  port: 9443
+  mutating:
+    create: true
+  validating:
+    create: true
+
+# Operator configuration
+config:
+  # Data checksums for PostgreSQL
+  data:
+    INHERITED_ANNOTATIONS: "cert-manager.io/*, argocd.argoproj.io/*"
+    INHERITED_LABELS: "app.kubernetes.io/*"
+
+    # Monitoring queries interval
+    MONITORING_QUERIES_CONFIGMAP: ""
+    MONITORING_QUERIES_SECRET: ""
+
+# CRD configuration
+crds:
+  create: true
+
+# Node selector
+nodeSelector: {}
+
+# Tolerations
+tolerations: []
+
+# Affinity
+affinity: {}
+
+# Security context
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 10001
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault

cnpg/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  # ArgoCD Application 리소스는 root kustomization.yaml에서 관리
+  # - argocd/cnpg.yaml