[noels]

Brings the add-opensearch branch (what ivylen currently tracks) onto main, so the cluster can be re-pinned to main and pick up CI + Renovate. Jira: GIT-29

What lands on main

• OpenSearch + OpenSearch Dashboards workload ApplicationSets (gitops/workloads/opensearch/) and default values
• ivylen home-assistant override: service.type: LoadBalancer
• home-assistant ApplicationSet fixes:
  • $workloads/cluster/... → $workloads/clusters/... (per-cluster values layer was never picked up)
  • targetRevision: main → {{.metadata.annotations.workloads_repo_revision}} (values ref now follows the cluster's tracked revision)

Branch = add-opensearch + a clean merge of main (no conflicts).

Rollout order (important)

1. Merge this PR.
2. Then set gitops_workloads_revision = "main" in on-prem tfvars and terraform apply. Re-pinning before merge would make Argo prune OpenSearch from ivylen (prune: true).
3. Delete add-opensearch once ivylen is Synced/Healthy on main.

🤖 Generated with Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}