apiVersion: v2
name: bp-guacamole
# 0.1.1 (qa-loop iter-7 Fix #39): canonical short resource names
# (`guacd`, `guacamole-server`, `guacamole-recordings`); GHCR-mirrored
# upstream images so every Sovereign pulls from a registry we own;
# realm-patch ConfigMap lands in `keycloak` namespace (was: realm-name,
# which would have failed on every Sovereign); `realmConfig.namespace`
# override surface for non-default bp-keycloak placements.
# 0.1.3 (Fix #39 follow-up): default imagePullSecrets to [{name:
# ghcr-pull}] so the Deployments can pull from private GHCR without
# per-Sovereign overlay. The `ghcr-pull` secret is the canonical
# pull-credential surface across every Sovereign.
# 0.1.5 (Fix #39 follow-up): add /home/guacamole/.guacamole emptyDir
# mount so the webapp's first-start mkdir succeeds with
# readOnlyRootFilesystem=true. Without it pods crash-looped with
# `mkdir: cannot create directory '/home/guacamole/.guacamole':
# Read-only file system`.
# 0.1.9 (qa-loop iter-11 Fix #45 Cluster-A): pre-install/pre-upgrade
# Helm hook (Job + per-release ServiceAccount/Role/RoleBinding +
# cluster-scoped ClusterRole/ClusterRoleBinding for PV cleanup) that
# detects when the existing `guacamole-recordings` PVC is bound to a
# storageClass different from `.Values.guacamole.recordings.storageClass`
# and deletes the PVC + bound PV so the chart-side PVC manifest can
# recreate cleanly. Closes the live bp-guacamole HelmRelease wedge on
# omantel iter-11 (`PersistentVolumeClaim ... is invalid: spec:
# Forbidden: spec is immutable after creation`). Operator escape hatch:
# `.Values.guacamole.recordings.allowMigration: false` suppresses the
# hook for Sovereigns with long-lived recording state.
# 0.1.11 (Fix #45 Cluster-A follow-up): default `migrationImage` is
# now `docker.io/bitnamilegacy/kubectl:1.29.3` (the canonical kubectl
# surface used across every other Catalyst Blueprint). The 0.1.9
# default `bitnami/kubectl:1.30.4` 401'd on omantel because the
# Sovereign's Harbor docker.io proxy doesn't have it cached, leaving
# the migration Job in ImagePullBackOff and the bp-guacamole HR
# Reconciling forever.
# 0.1.15 (Fix #158, 2026-05-11): migrationImage bumped from
# bitnamilegacy/kubectl:1.29.3 -> bitnamilegacy/kubectl:1.30.7 to align
# with k3s 1.30 server version on Hetzner Sovereigns + template
# fallback default no longer references the deleted bitnami path.
# 0.1.17 (Fix #163, 2026-05-11, MIRROR-EVERYTHING): migrationImage AND
# oidc-secret-bootstrap-job both gain explicit
# harbor.openova.io/proxy-dockerhub prefix per CLAUDE.md inviolable rule.
version: 0.1.18
appVersion: "1.5.5"
description: |
  Catalyst-authored Blueprint chart for Apache Guacamole — a clientless
  HTML5 remote-desktop gateway that brokers SSH / RDP / VNC sessions
  AND kubectl-exec sessions through one browser-accessible surface.
  Sessions land authenticated via Keycloak SSO, are recorded to
  SeaweedFS for compliance, and reach Pods inside the same Sovereign
  via the per-node k8s-ws-proxy DaemonSet (bp-k8s-ws-proxy).

  Per ADR-0001 §11: ONE Guacamole per Sovereign — Manara-style
  multi-cluster fan-out is intentionally NOT supported (Sovereigns
  stay self-sufficient).

  This is a scratch chart — no upstream Guacamole Helm chart is
  bundled. The container images are upstream `guacamole/guacd` and
  `guacamole/guacamole`, SHA-pinned per
  docs/INVIOLABLE-PRINCIPLES.md #4a. CI populates the SHA tags via
  `yq eval -i .image.tag = "<sha>"` when promoting a build into
  clusters/<sovereign>/.

  Includes:
    - guacd Deployment + Service (RDP/VNC/SSH protocol backend)
    - guacamole-web Deployment + Service (Tomcat front-end with OIDC)
    - HTTPRoute (Cilium Gateway) for browser ingress
    - SeaweedFS PVC for session recordings (50Gi default)
    - SealedSecret placeholder for the Keycloak OIDC client secret
    - NetworkPolicy: default-deny + selective egress to k8s-ws-proxy
      and Keycloak
    - ConfigMap consumed by keycloak-config-cli post-deploy Job
      (mirrors the existing pattern from platform/keycloak/chart/)
type: application
keywords: [catalyst, blueprint, guacamole, remote-desktop, oidc, recording]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io
annotations:
  # Default values render zero resources (guacamole.enabled=false).
  # The blueprint-release smoke gate honors this annotation and
  # accepts a short default render; chart/tests/render.sh covers the
  # enabled-render path with full --set overrides.
  catalyst.openova.io/smoke-render-mode: default-off
# Scratch chart — the binary surface is fully owned by Apache. The
# `sigstore/common` library subchart below is included ONLY to satisfy
# the platform-wide blueprint-release.yaml hollow-chart gate (issue
# #181) — every umbrella MUST declare at least one dependency.
# `common` is a tiny library chart (helper templates only, zero
# runtime resources). Mirrors the same pattern used by
# bp-cert-manager-dynadot-webhook + bp-coraza for the same reason.
dependencies:
  - name: common
    version: "0.1.3"
    repository: "https://sigstore.github.io/helm-charts"
