# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `flux2:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream flux2 chart
  # exposes per-controller `flux2.<controller>.image.repository` knobs.
  # Per-Sovereign overlays wire those alongside this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  # Pinned to flux2 2.14.1 (= upstream Flux appVersion 2.4.0). MUST match
  # `infra/hetzner/cloudinit-control-plane.tftpl`'s install.yaml URL
  # (currently v2.4.0). See Chart.yaml comment block "CRITICAL VERSION-PIN
  # INVARIANT" for the full incident replay (omantel.omani.works,
  # 2026-04-29 — Flux controllers deleted by Helm rollback after a
  # double-install version-mismatch).
  upstream: { chart: flux2, version: "2.14.1", repo: "https://fluxcd-community.github.io/helm-charts" }

# ─── Catalyst overlay values ──────────────────────────────────────────────
catalyst:
  # Namespace where the Flux controllers run. Used by
  # templates/catalyst-cluster-reconciler-rbac.yaml to subject the
  # canonical helm-controller + kustomize-controller ServiceAccounts in a
  # ClusterRoleBinding to `cluster-admin`. See that file's header for the
  # full issue #338 context.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), this is
  # operator-overridable. The default is `flux-system` because that's the
  # canonical Catalyst install namespace (see
  # `clusters/_template/bootstrap-kit/03-flux.yaml` + cloud-init's flux2
  # install.yaml). Changing it requires a parallel change to cloud-init.
  fluxNamespace: flux-system

# ─── Upstream chart values (subchart key: flux2) ──────────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
flux2:
  installCRDs: true
  sourceController:
    resources:
      requests: { cpu: 50m, memory: 64Mi }
      limits: { memory: 256Mi }
  kustomizeController:
    resources:
      requests: { cpu: 50m, memory: 64Mi }
      limits: { memory: 256Mi }
  helmController:
    resources:
      requests: { cpu: 50m, memory: 64Mi }
      limits: { memory: 256Mi }
  # Prometheus PodMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). The upstream flux2
  # chart's `prometheus.podMonitor.create` renders a
  # monitoring.coreos.com/v1 PodMonitor which the apiserver rejects on a
  # fresh Sovereign before bp-kube-prometheus-stack ships the CRD.
  # Operator opts in via per-cluster overlay (issue #182).
  prometheus:
    podMonitor:
      create: false
