apiVersion: catalyst.openova.io/v1alpha1
kind: Blueprint
metadata:
  name: bp-cert-manager
  labels:
    catalyst.openova.io/section: pts-3-3-security-and-policy
spec:
  version: 1.1.1
  card:
    title: cert-manager
    summary: TLS certificate automation. Lets Encrypt issuer with Dynadot DNS-01 for omani.works pool, HTTP-01 for BYO domains.
  visibility: unlisted              # mandatory infra, auto-installed by bootstrap kit
  manifests:
    chart: ./chart
  depends: []

  # ── Outputs advertised to dependent Blueprints (#113) ────────────────────
  # Blueprints that issue Certificates (cilium-gateway, harbor, gitea, etc.)
  # consume `issuerName` rather than hardcoding "letsencrypt-prod" so that
  # operators can swap the active issuer (DNS-01 vs HTTP-01) via the
  # bp-catalyst-platform umbrella values without editing every dependent
  # chart. The chart's templates/clusterissuer-letsencrypt-dns01.yaml ships
  # both issuers; this output names the one a dependent Blueprint should
  # default to in production.
  outputs:
    # Default issuer name. As of openova#159 (bp-cert-manager-dynadot-webhook
    # ships) the wildcard-capable DNS-01 issuer is enabled by default in
    # the chart's values.yaml — dependents that issue wildcard certs (the
    # Cilium Gateway's *.<sub>.<pool> TLS listener) reference this name
    # directly. Cluster overlays MAY revert to letsencrypt-http01-prod by
    # flipping certManager.issuers.dns01.enabled=false in the umbrella
    # chart values; the http01 issuer remains templated for that path.
    issuerName: letsencrypt-dns01-prod
    # Kind is always ClusterIssuer for Catalyst — the wildcard cert lives
    # in cilium-gateway and is consumed cluster-wide.
    issuerKind: ClusterIssuer
    # The TARGET-STATE wildcard issuer name. Equal to issuerName above now
    # that DNS-01 is the default; kept as a separate field so a dependent
    # Blueprint that explicitly needs the wildcard variant can pin to it
    # independent of which issuer is currently the default.
    wildcardIssuerName: letsencrypt-dns01-prod
