apiVersion: v2
name: bp-cilium
# 1.3.3 — qa-loop iter-16 Fix #70: Hubble UI HTTPRoute defaults corrected
# so every Sovereign exposes Hubble UI through the Cilium Gateway out of
# the box (TC-289 was NXDOMAIN on hubble.<sovereignFQDN>).
# Two real bugs in 1.3.2's HubbleUI overlay defaults:
#   - catalystOverlay.hubbleUI.gatewayRef.namespace was "cilium-gateway"
#     but the Sovereign Gateway lives in "kube-system" (see
#     clusters/_template/sovereign-tls/cilium-gateway.yaml + every other
#     bootstrap-kit HTTPRoute in clusters/_template/bootstrap-kit/).
#   - catalystOverlay.hubbleUI.serviceRef.namespace was "cilium" but the
#     bp-cilium HelmRelease installs Cilium into "kube-system"
#     (clusters/_template/bootstrap-kit/01-cilium.yaml `targetNamespace:
#     kube-system`), so hubble-ui Service is in kube-system.
# Plus: chart now derives hostname `hubble.<sovereignFQDN>` automatically
# when catalystOverlay.hubbleUI.sovereignFQDN is set (matches the
# canonical pattern used by gitea.<fqdn>, auth.<fqdn>, grafana.<fqdn>).
# 1.3.1 — qa-loop iter-12 Fix #54 Workstream 2: bpf.preallocateMaps=true
# + socketLB.hostNamespaceOnly=true defaults so fresh worker pods can
# resolve DNS reliably on first-join (cilium/cilium#28456 mitigation).
# Backward-compat: per-Sovereign overlays MAY override either knob.
version: 1.3.3
description: |
  Catalyst-curated Blueprint umbrella chart for Cilium. Depends on the
  upstream `cilium` chart as a Helm subchart so `helm dependency build`
  pulls the upstream payload into this artifact; the Catalyst overlay
  templates in templates/ (NetworkPolicy, ExternalSecret, ServiceMonitor)
  sit alongside the upstream subchart and Helm renders both at install
  time. Catalyst-curated values flow into the upstream subchart under the
  `cilium:` key in values.yaml.
type: application
keywords: [catalyst, blueprint, cilium]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

# Upstream chart pulled in as a Helm subchart so `helm dependency build`
# bundles it into the OCI artifact. Pinned to cilium/cilium 1.19.3 (matches
# platform/cilium/blueprint.yaml + values.yaml `catalystBlueprint.upstream
# .version`). Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) the
# version is operator-bumpable via PR + Blueprint release.
#
# 1.16.5 → 1.19.3 jump (2026-05-03): 1.16.x had buggy gateway-api hostNetwork
# mode where cilium-envoy NACK'd listeners with "cannot bind '0.0.0.0:80':
# Permission denied" and the loaded RDS for the Sovereign vhost only
# carried the default `/` route — `/auth/*` and `/api/*` HTTPRoute matches
# never reached envoy's live config. 1.18+ ships the mature Gateway API
# implementation (graduated from beta), 1.19 is the current stable line.
# Values shape verified compatible: gatewayAPI.hostNetwork.enabled,
# envoy.enabled, envoyConfig.enabled, encryption.type=wireguard,
# nodeEncryption — all unchanged.
dependencies:
  - name: cilium
    # Pinned to match Chart.lock (truth-on-disk). The previous "1.19.3"
    # value was provenance drift caught in EPIC-0 #1095 audit — Chart.lock
    # had been resolving to 1.16.5 the whole time. Aligning the declared
    # constraint with the locked version eliminates the lie. Bumping to a
    # newer Cilium minor is a separate slice that needs real upgrade
    # testing on a live data-plane cluster.
    version: "1.16.5"
    repository: "https://helm.cilium.io"
