# Catalyst Blueprint umbrella metadata — the upstream chart is resolved as
# a Helm subchart via Chart.yaml `dependencies:`. Catalyst-curated values
# under the `reloader:` key flow into the upstream subchart unchanged.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), every operationally-
# meaningful value is configurable; cluster overlays in clusters/<sovereign>/
# may override any of these without rebuilding the Blueprint OCI artifact.

catalystBlueprint:
  upstream:
    chart: reloader
    version: "2.2.11"
    repo: "https://stakater.github.io/stakater-charts"

# ─── Upstream chart values (subchart key: reloader) ──────────────────────
reloader:
  # Reloader controller — single replica (the upstream chart uses leader
  # election when scaled, but a single-pod restart only delays a rotation
  # by ≤30s in practice).
  reloader:
    replicaCount: 1

    # Pin upstream image tag — DO NOT use floating tags per
    # docs/INVIOLABLE-PRINCIPLES.md.
    deployment:
      image:
        name: ghcr.io/stakater/reloader
        tag: "v1.4.16"
        pullPolicy: IfNotPresent

      resources:
        requests:
          cpu: 50m
          memory: 64Mi
        limits:
          cpu: 200m
          memory: 256Mi

      # Cluster-wide watch — Reloader watches every namespace by default.
      # Per-Sovereign overlays MAY narrow via `--namespaces-to-watch`.
      env:
        open: []

      # SecurityContext — non-root.
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]

    # Reload strategy — `env-vars` (sets a checksum env var that triggers a
    # rollout) is upstream default; `annotations` mode is also supported.
    reloadStrategy: "env-vars"

    # ServiceMonitor — DEFAULT FALSE per docs/BLUEPRINT-AUTHORING.md §11.2.
    serviceMonitor:
      enabled: false

    # RBAC — chart manages its own ClusterRole + ServiceAccount.
    rbac:
      enabled: true
    serviceAccount:
      create: true

    # Watchers — both ConfigMaps and Secrets, the default Catalyst posture.
    watchGlobally: true
    isOpenshift: false

# ─── Catalyst overlay values (consumed by templates/ in this chart) ──────
# Reserved for Catalyst-side overlays (NetworkPolicy) added in a follow-up
# PR once bp-reloader is consumed in clusters/_template/.
reloaderOverlay:
  networkPolicy:
    enabled: false
