# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `spire:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace; spire is itself a meta-chart with its own
#      sub-subcharts spire-server/spire-agent/etc, which appear as
#      second-level keys nested under `spire:`).

catalystBlueprint:
  upstream: { chart: spire, version: "0.21.0", repo: "https://spiffe.github.io/helm-charts-hardened" }

# ─── Upstream chart values (subchart key: spire) ──────────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
spire:
  global:
    spire:
      clusterName: catalyst
      trustDomain: catalyst.local
      # Recommendations bundle — DEFAULT OFF.
      #
      # Per docs/INVIOLABLE-PRINCIPLES.md #4 and
      # docs/BLUEPRINT-AUTHORING.md §11.2 (Observability toggles must
      # default false). When `recommendations.enabled: true` the upstream
      # spire chart cascades `prometheus: true` into every spire-server /
      # spire-agent telemetry block, which can trigger ServiceMonitor
      # rendering. Upstream already defaults `enabled: false` — we set
      # it explicitly here so a future upstream bump cannot regress this
      # on a fresh Sovereign before bp-kube-prometheus-stack reconciles
      # (issue #182). Operator opts in via per-cluster overlay.
      recommendations:
        enabled: false
        prometheus: false
  spire-server:
    ca_subject:
      country: DE
      organization: OpenOva Catalyst
      common_name: SPIRE CA
  spire-agent:
    resources:
      requests: { cpu: 50m, memory: 64Mi }
      limits: { memory: 256Mi }
