# bp-sealed-secrets — Catalyst bootstrap-kit Blueprint. Transient bootstrap-only — used during Phase 0 to ship initial secrets through GitOps. Replaced by OpenBao + ESO once those land.
#
# Wrapper chart: platform/sealed-secrets/chart/
# Catalyst-curated values: platform/sealed-secrets/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.

---
# kube-system is built into every Kubernetes cluster — never re-declare it.
# See 01-cilium.yaml for the full incident note. Sealed-Secrets installs
# INTO kube-system; the HelmRelease's targetNamespace below is sufficient.
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-sealed-secrets
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-sealed-secrets
  namespace: flux-system
spec:
  interval: 15m
  releaseName: sealed-secrets
  targetNamespace: kube-system
  dependsOn:
    - name: bp-cert-manager
  chart:
    spec:
      chart: bp-sealed-secrets
      version: 1.1.1
      sourceRef:
        kind: HelmRepository
        name: bp-sealed-secrets
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
