# Catalyst Blueprint umbrella metadata — the upstream chart is now resolved
# as a Helm subchart via Chart.yaml `dependencies:`. This values.yaml carries
# both:
#   1. The catalystBlueprint metadata block (provenance + version) so
#      observability/audit pipelines can inspect the artifact and report
#      which upstream chart + version is bundled.
#   2. The upstream subchart values overlay under the `cert-manager:` key
#      (umbrella-chart convention — the dependency name from Chart.yaml is
#      the values namespace).
#   3. Catalyst overlay values consumed by templates/ (e.g. `certManager:`
#      governs templates/clusterissuer-letsencrypt-dns01.yaml).
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), every operationally-
# meaningful value is configurable; cluster overlays in clusters/<sovereign>/
# may override any of these without rebuilding the Blueprint OCI artifact.

catalystBlueprint:
  upstream: { chart: cert-manager, version: "v1.16.2", repo: "https://charts.jetstack.io" }

# ─── Upstream chart values (subchart key: cert-manager) ───────────────────
# `helm dependency build` resolves the upstream as a subchart; values here
# under the `cert-manager:` key flow into that subchart unchanged.
cert-manager:
  # Install CRDs as part of this chart. The Catalyst overlay's ClusterIssuer
  # template (templates/clusterissuer-letsencrypt-dns01.yaml) depends on the
  # cert-manager.io/v1 CRD being registered before the post-install hook
  # runs. The legacy `installCRDs:` flag is replaced by `crds.enabled` /
  # `crds.keep` in cert-manager v1.16+ — the two cannot both be set.
  crds:
    enabled: true
    keep: true
  # Prometheus scraping + ServiceMonitor — DEFAULT OFF.
  #
  # Per docs/INVIOLABLE-PRINCIPLES.md #4 and docs/BLUEPRINT-AUTHORING.md
  # §11.2 (Observability toggles must default false): the
  # `monitoring.coreos.com/v1` CRDs that back ServiceMonitor ship with
  # kube-prometheus-stack — an Application Blueprint that depends on the
  # bootstrap-kit. Defaulting `servicemonitor.enabled: true` creates a
  # circular CRD dependency that breaks bp-cert-manager install on a
  # fresh Sovereign. Operator opts in via per-cluster overlay after the
  # observability tier is reconciled (issue #182).
  prometheus:
    enabled: false
    servicemonitor:
      enabled: false
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      memory: 256Mi
  webhook:
    resources:
      requests:
        cpu: 50m
        memory: 64Mi

# ─── Catalyst-managed ClusterIssuers (templates/clusterissuer-letsencrypt-dns01.yaml) ──
# The Catalyst-curated wrapper ships TWO ClusterIssuers and lets the
# operator pick the active one via these values:
#
#   - letsencrypt-dns01-prod  (TARGET STATE: wildcard-capable, requires the
#                              cert-manager-dynadot-webhook image — disabled
#                              by default until that webhook is built)
#   - letsencrypt-http01-prod (INTERIM: explicit hostnames only, no
#                              wildcards, works today via Cilium ingress)
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 ("never hardcode") all knobs are
# runtime-configurable; cluster overlays in clusters/<sovereign>/ may set
# certManager.issuers.* to flip between issuers without rebuilding the
# Blueprint OCI artifact.
certManager:
  issuers:
    # ACME account email used for renewal notifications. Per Sovereign
    # convention this is ops@<pool-domain>.
    email: ops@openova.io
    # Production Let's Encrypt directory. Set to the staging URL during
    # bring-up to avoid Let's Encrypt rate limits:
    #   https://acme-staging-v02.api.letsencrypt.org/directory
    acmeServer: https://acme-v02.api.letsencrypt.org/directory
    dns01:
      # Disabled until cmd/cert-manager-dynadot-webhook ships. See the
      # runbook in templates/clusterissuer-letsencrypt-dns01.yaml.
      enabled: false
      webhookGroupName: acme.dynadot.openova.io
      webhookSolverName: dynadot
    http01:
      enabled: true
      ingressClassName: cilium
