# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `keycloak:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).

catalystBlueprint:
  upstream: { chart: keycloak, version: "25.2.0", repo: "https://charts.bitnami.com/bitnami" }

# ─── Upstream chart values (subchart key: keycloak) ───────────────────────
# Generated by docs/PROVISIONING-PLAN.md tickets [F] chart Pass 105+.
keycloak:
  auth:
    adminUser: admin
  production: true
  # Chart 25.x renamed `proxy: edge` to `proxyHeaders: "xforwarded"`. Catalyst
  # fronts Keycloak with Cilium Gateway (which sets `X-Forwarded-*`), and we
  # require `proxyHeaders` to be set so chart-level production-mode validation
  # passes without forcing in-pod TLS.
  proxyHeaders: "xforwarded"
  # ─── Bitnami image-registry consolidation (issue #191) ──────────────────
  # Bitnami consolidated their tag scheme around 2025-09 (see
  # https://github.com/bitnami/charts/issues/30852). The original
  # `bitnami/keycloak:<x>-debian-12-rN` tags now 404 in the registry; the
  # preserved historic tags moved to `bitnamilegacy/*` (read-only archive,
  # explicitly published as "no longer updated, may be removed in the
  # future"). Override repository for every Bitnami image referenced by
  # this chart (keycloak app, keycloak-config-cli sidecar, postgresql,
  # postgres-exporter, os-shell init) so `helm install` resolves real
  # manifests. Verified existence with registry HEAD calls before pinning.
  # Tag stays the chart 25.2.0 default (`26.3.3-debian-12-r0`) — re-pin
  # when the chart bumps and we re-verify the new tag.
  image:
    registry: docker.io
    repository: bitnamilegacy/keycloak
    tag: 26.3.3-debian-12-r0
  keycloakConfigCli:
    image:
      registry: docker.io
      repository: bitnamilegacy/keycloak-config-cli
      tag: 6.4.0-debian-12-r11
  postgresql:
    enabled: true
    auth:
      username: keycloak
      database: keycloak
    image:
      registry: docker.io
      repository: bitnamilegacy/postgresql
      tag: 17.6.0-debian-12-r0
    metrics:
      image:
        registry: docker.io
        repository: bitnamilegacy/postgres-exporter
        tag: 0.17.1-debian-12-r15
    volumePermissions:
      image:
        registry: docker.io
        repository: bitnamilegacy/os-shell
        tag: 12-debian-12-r50
  ingress:
    enabled: false  # Catalyst uses Cilium Gateway, not the chart ingress
  resources:
    requests: { cpu: 250m, memory: 512Mi }
    limits: { memory: 2Gi }
  # Metrics + ServiceMonitor + PrometheusRule — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false). The upstream
  # bitnami/keycloak chart's `metrics.serviceMonitor.enabled` and
  # `metrics.prometheusRule.enabled` render monitoring.coreos.com/v1
  # resources which the apiserver rejects on a fresh Sovereign before
  # bp-kube-prometheus-stack ships the CRDs. Upstream already defaults
  # all three to false — set explicitly so a future upstream bump cannot
  # regress this. Operator opts in via per-cluster overlay (issue #182).
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
    prometheusRule:
      enabled: false
