# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `sealed-secrets:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

catalystBlueprint:
  upstream: { chart: sealed-secrets, version: "2.16.1", repo: "https://bitnami-labs.github.io/sealed-secrets" }

# ─── Upstream chart values (subchart key: sealed-secrets) ─────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
sealed-secrets:
  fullnameOverride: sealed-secrets-controller
  resources:
    requests: { cpu: 50m, memory: 64Mi }
    limits: { memory: 128Mi }
  # Prometheus ServiceMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). Upstream
  # sealed-secrets 2.16.1 already defaults `metrics.serviceMonitor.enabled`
  # to false, but we set it explicitly here so a future upstream bump
  # that flips the default cannot regress a fresh-Sovereign install.
  # Operator opts in via per-cluster overlay once bp-kube-prometheus-stack
  # reconciles (issue #182).
  metrics:
    serviceMonitor:
      enabled: false
