# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `cilium:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

global:
  # When set, ALL image pulls in this chart route through this registry.
  # Used post-handover when the Sovereign's own Harbor takes over the
  # proxy_cache role from contabo's central Harbor. Empty = no rewrite
  # (image references use upstream defaults). The upstream cilium subchart
  # does not expose a single `image.registry` knob; per-Sovereign overlays
  # should set specific image paths (e.g. `cilium.image.repository`) in
  # conjunction with this value. Tracked under #560.
  imageRegistry: ""

catalystBlueprint:
  upstream: { chart: cilium, version: "1.19.3", repo: "https://helm.cilium.io" }

# Catalyst-curated Cilium values per platform/cilium/README.md.
#
# Defaults assume a Catalyst Sovereign on bare-metal/VM Kubernetes (k3s on
# Hetzner is the canonical target). Cilium replaces both flannel and
# kube-proxy; k3s must be started with --flannel-backend=none and
# --disable-network-policy.

cilium:
  # kube-proxy replacement (faster + simpler than iptables)
  kubeProxyReplacement: true
  # k8sServiceHost: CP's stable private IP on the Sovereign's 10.0.1.0/24
  # subnet (cp1=10.0.1.2 per infra/hetzner/main.tf). Multi-node-aware:
  # works on the CP itself (10.0.1.2 IS its own private IP) AND on
  # workers (which need the CP's IP because k3s agents do NOT expose the
  # apiserver on localhost — only the supervisor on :6444). Previously
  # `127.0.0.1` here, which crashloop'd Cilium on every worker for
  # multi-node Sovereigns (issue #733). For air-gap / multi-CP / non-
  # Hetzner Sovereigns the canonical fix is to point this at the in-
  # cluster apiserver Service (kubernetes.default.svc.cluster.local) —
  # but that requires DNS up before Cilium, which is the chicken-egg
  # this whole config exists to solve. The Sovereign template subnet
  # is fixed at 10.0.1.0/24 so 10.0.1.2 is a stable load-bearing value.
  k8sServiceHost: 10.0.1.2
  k8sServicePort: 6443

  # eBPF-host-routing — bypasses iptables stack
  bpf:
    masquerade: true

  # IPAM — k8s mode uses the k8s pod CIDR allocator (works with k3s defaults)
  ipam:
    mode: kubernetes

  # WireGuard mTLS for transparent encryption between every pod (per
  # platform/cilium/README.md "mTLS via WireGuard"). This is the
  # CANONICAL east-west mTLS layer for OpenOva Sovereign clusters —
  # 100% mesh enforcement at the kernel transport level. SPIFFE-based
  # workload identity is intentionally NOT enabled here; bp-spire was
  # dropped from the bootstrap-kit (founder direction 2026-05-03)
  # because (a) Cilium WireGuard already gives every connection
  # transparent encryption + node-level identity, and (b) ESO→OpenBao
  # auth uses K8s ServiceAccount auth method (TokenReview), not
  # JWT-SVID. Federation across Sovereigns or per-workload-fingerprint
  # attestation can re-introduce SPIRE later as an opt-in blueprint.
  encryption:
    enabled: true
    type: wireguard
    nodeEncryption: true

  # Hubble — network observability (L3/L4/L7 flows, DNS, drop, http metrics).
  #
  # DEFAULT OFF per docs/BLUEPRINT-AUTHORING.md §11.2 (Observability toggles
  # must default false) + INVIOLABLE-PRINCIPLES.md #4 (never hardcode).
  #
  # Hubble relay/ui depend on the kube-prometheus-stack
  # `monitoring.coreos.com/v1` ServiceMonitor CRD AND on Hubble metrics
  # being scraped — neither exists on a fresh Sovereign before the
  # observability tier (Application Blueprint bp-kube-prometheus-stack)
  # is reconciled. Worse: enabling `hubble.metrics.enabled` with values
  # like `dns:query;ignoreAAAA` causes the upstream Cilium chart to render
  # a ServiceMonitor unconditionally (verified on omantel.omani.works
  # 2026-04-29 — install fails with "no matches for kind ServiceMonitor in
  # version monitoring.coreos.com/v1").
  #
  # `metrics.enabled: null` (NOT [] and NOT a populated list) is the
  # exact value that makes the upstream Cilium chart skip the metrics
  # ServiceMonitor template branch — verified by reading the upstream
  # cilium 1.19.3 chart's _hubble.tpl.
  #
  # Operator opts in via clusters/<sovereign>/bootstrap-kit/01-cilium.yaml
  # values overlay once bp-kube-prometheus-stack reconciles (issue #182).
  hubble:
    enabled: true
    relay:
      enabled: false
    ui:
      enabled: false
    metrics:
      # `null` — not a list. Disables the upstream chart's metrics
      # ServiceMonitor template entirely.
      enabled: null
      serviceMonitor:
        enabled: false

  # Gateway API — replaces traditional ingress controllers
  gatewayAPI:
    enabled: true
    gatewayClass:
      # Force GatewayClass creation regardless of CRD presence at Helm
      # render time. Upstream default is "auto" which skips creation when
      # the gateway.networking.k8s.io CRDs are absent (Capabilities check
      # at helm install time). During bootstrap, bp-gateway-api runs AFTER
      # bp-cilium, so "auto" silently skips the GatewayClass — leaving
      # every HTTPRoute orphaned until the operator is manually restarted.
      # Forcing "true" ensures GatewayClass/cilium is always created.
      # Permanent fix for the cilium-gateway race (issue #503).
      create: "true"
    # hostNetwork mode — bind gateway listeners directly to the host's
    # 80/443 ports (instead of Service-of-type-LoadBalancer with random
    # nodePort allocation). Required for the Hetzner Cloud Load Balancer
    # forwarding chain: HCLB listens on public 80/443 and forwards via
    # the private network to the CP node's 80/443 (NOT to a random
    # nodePort). With nodePort mode, Cilium's BPF L7LB Proxy Port doesn't
    # match what cilium-envoy actually binds, breaking TLS termination
    # entirely (cilium service list shows the redirect, but envoy isn't
    # listening on the proxy port). Caught live on otech45 — TCP connects
    # but TLS handshake never completes.
    hostNetwork:
      enabled: true

  # L7 proxy via Envoy — for HTTPRoute, gRPCRoute, L7 NetworkPolicy
  envoy:
    enabled: true

  # L2 LoadBalancer announcements (alternative to MetalLB for bare-metal)
  l2announcements:
    enabled: false  # Catalyst uses Hetzner LB on cloud Sovereigns; flip true for bare-metal

  # Operator HA — single replica is fine for solo, bump to 2-3 for HA
  operator:
    replicas: 1

  # Pod resource requests/limits — tuned for k3s on cx32 (8 vCPU / 16 GB)
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 1Gi

  # Prometheus scraping + ServiceMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) and
  # docs/BLUEPRINT-AUTHORING.md §11.2 (Observability toggles must default
  # false): observability toggles MUST default `false` because the
  # `monitoring.coreos.com/v1` CRDs that back ServiceMonitor / PrometheusRule
  # ship with kube-prometheus-stack — a second-tier Application Blueprint
  # that itself depends on the bootstrap-kit (cilium first). Defaulting
  # `serviceMonitor.enabled: true` here creates a circular CRD dependency:
  # bp-cilium wants the CRD that bp-kube-prometheus-stack provides, but
  # bp-kube-prometheus-stack cannot install before bp-cilium. The
  # `trustCRDsExist=true` mitigation only suppresses Helm's render-time
  # gate; at install time the apiserver still rejects ServiceMonitor with
  # "no matches for kind ServiceMonitor in version monitoring.coreos.com/v1
  # — ensure CRDs are installed first" (verified on omantel.omani.works
  # 2026-04-29, issue #182).
  #
  # Operator opts in once the observability tier is reconciled. The opt-in
  # is a per-cluster values overlay at clusters/<sovereign>/bootstrap-kit/
  # 01-cilium.yaml `spec.values.cilium.prometheus.serviceMonitor.enabled:
  # true` — no rebuild of the Blueprint OCI artifact is required.
  prometheus:
    enabled: false
    serviceMonitor:
      enabled: false
