# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `openbao:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

catalystBlueprint:
  upstream: { chart: openbao, version: "0.16.0", repo: "https://openbao.github.io/openbao-helm" }

# ─── Upstream chart values (subchart key: openbao) ────────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
openbao:
  server:
    ha:
      enabled: true
      replicas: 3
      raft:
        enabled: true
    resources:
      requests: { cpu: 100m, memory: 256Mi }
      limits: { memory: 512Mi }
    dataStorage:
      size: 10Gi
  ui:
    enabled: true
  # Injector metrics endpoint — DEFAULT OFF.
  injector:
    metrics:
      enabled: false
  # ServiceMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). The upstream
  # openbao chart's `serviceMonitor.enabled` renders a
  # monitoring.coreos.com/v1 ServiceMonitor which the apiserver rejects
  # on a fresh Sovereign before bp-kube-prometheus-stack ships the CRD.
  # Upstream already defaults to false — set explicitly so a future
  # upstream bump cannot regress this. Operator opts in via per-cluster
  # overlay (issue #182).
  serviceMonitor:
    enabled: false
