# bp-cnpg — Catalyst bootstrap-kit Blueprint, W2.K1 slot 16.
# CloudNativePG operator. Per-Sovereign Postgres-as-a-service via
# postgresql.cnpg.io/v1.Cluster CRs. Required by every PG-backed bootstrap
# component: bp-powerdns (pdns-pg-app), bp-keycloak HA, bp-gitea metadata,
# bp-langfuse, bp-grafana config DB, bp-temporal, bp-matrix synapse,
# bp-llm-gateway, bp-bge, bp-nemo-guardrails, bp-openmeter (cnpg profile),
# pool-domain-manager (PDM).
#
# Per docs/BOOTSTRAP-KIT-EXPANSION-PLAN.md §2.3 (Tier 5 storage+DB
# foundation) — cnpg gates the entire downstream observability/AI/relay
# stack; placing it in the bootstrap-kit (instead of as an Application
# Blueprint) is what unblocks the omantel-1 day-1 control plane.
#
# Resolves issue #254 (bp-powerdns pod stuck in CreateContainerConfigError
# because pdns-pg-app Secret is generated by a CNPG Cluster CR; without
# the operator the secret never materializes).
#
# Wrapper chart: platform/cnpg/chart/
# Catalyst-curated values: platform/cnpg/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.

---
apiVersion: v1
kind: Namespace
metadata:
  name: cnpg-system
  labels:
    catalyst.openova.io/sovereign: SOVEREIGN_FQDN_PLACEHOLDER
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-cnpg
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-cnpg
  namespace: flux-system
  labels:
    catalyst.openova.io/slot: "16"
spec:
  interval: 15m
  releaseName: cnpg
  targetNamespace: cnpg-system
  # CNPG only needs Flux Ready (its own CRDs ship in the same chart;
  # consumers of postgresql.cnpg.io/v1.Cluster gate themselves on bp-cnpg).
  dependsOn:
    - name: bp-flux
  chart:
    spec:
      chart: bp-cnpg
      version: 1.0.0
      sourceRef:
        kind: HelmRepository
        name: bp-cnpg
        namespace: flux-system
  # Event-driven install per docs/INVIOLABLE-PRINCIPLES.md #3.
  install:
    timeout: 15m
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    timeout: 15m
    disableWait: true
    remediation:
      retries: 3
