# bp-cilium — Catalyst bootstrap-kit Blueprint. CNI must come first; k3s started with --flannel-backend=none precisely so Cilium can take over.
#
# Wrapper chart: platform/cilium/chart/
# Catalyst-curated values: platform/cilium/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.

---
# kube-system is built into every Kubernetes cluster — never re-declare it.
# Earlier revisions of 01-cilium.yaml AND 05-sealed-secrets.yaml both
# declared it, which collided when kustomize tried to merge the two:
#   "may not add resource with an already registered id:
#    Namespace.v1.[noGrp]/kube-system.[noNs]"
# This Blueprint installs Cilium INTO kube-system; the HelmRelease's
# targetNamespace field below is sufficient.
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-cilium
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-cilium
  namespace: flux-system
spec:
  interval: 15m
  releaseName: cilium
  targetNamespace: kube-system
  chart:
    spec:
      chart: bp-cilium
      version: 1.1.1
      sourceRef:
        kind: HelmRepository
        name: bp-cilium
        namespace: flux-system
  # Event-driven install: Helm completes when manifests apply, not when
  # cilium-agent reaches Ready (agent waits for envoyconfig CRDs that the
  # SAME chart installs — legitimate slow-Ready). Replaces blanket
  # spec.timeout: 15m band-aid from PR #221.
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  values:
    cilium:
      # Enable L7 proxy so Cilium's chart installs the
      # ciliumenvoyconfigs / ciliumclusterwideenvoyconfigs CRDs that the
      # cilium-agent waits for at startup. Without this, agent crash-loops
      # forever and the node.cilium.io/agent-not-ready taint never lifts.
      l7Proxy: true
      prometheus:
        enabled: false
        serviceMonitor:
          enabled: false
      hubble:
        metrics:
          enabled: null
          serviceMonitor:
            enabled: false
        relay:
          enabled: false
        ui:
          enabled: false
