# bp-k8s-ws-proxy — Catalyst bootstrap-kit Blueprint slot 51 (exec
# fan-out, post-W2.K4). Per-node WebSocket exec proxy that bridges
# HMAC-signed
# upstream callers (catalyst-api, Guacamole) onto the local
# kube-apiserver /api/v1/.../pods/exec stream.
#
# DaemonSet → one pod per node. Service uses
# `internalTrafficPolicy: Local` so kube-proxy routes every caller
# onto the local-node pod (zero cross-node hops, zero apiserver
# round-trips through other nodes).
#
# Wrapper chart: platform/k8s-ws-proxy/chart/
# Catalyst-curated values: platform/k8s-ws-proxy/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.
#
# dependsOn:
#   - bp-cilium — DaemonSet pods need a working CNI before they bind
#     the host-network listen port.
#   - bp-sealed-secrets — the chart references a SealedSecret carrying
#     the HMAC shared key the proxy validates inbound requests against
#     (operator pre-seals via kubeseal before this slot reconciles).
#
# qa-loop iter-7 Fix #39 (closes the gap surfaced by Fix #36):
# bp-k8s-ws-proxy was previously chart-only, no CI workflow + no
# bootstrap-kit slot, so TC-236/TC-237 stayed FAIL with "daemonset
# NotFound". CI workflow .github/workflows/build-k8s-ws-proxy.yaml
# builds the binary, bumps Chart.yaml, dispatches blueprint-release;
# this slot installs the resulting OCI artifact on every Sovereign.
#
# install/upgrade.disableWait: true — DaemonSet readiness is signalled
# via Flux dependsOn, never via blanket spec.timeout watchdogs (per
# session-2026-04-30 architectural decision).

---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-k8s-ws-proxy
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-k8s-ws-proxy
  namespace: flux-system
  labels:
    catalyst.openova.io/slot: "51"
spec:
  interval: 15m
  releaseName: k8s-ws-proxy
  targetNamespace: catalyst-system
  dependsOn:
    - name: bp-cilium
    - name: bp-sealed-secrets
  chart:
    spec:
      chart: bp-k8s-ws-proxy
      # 0.1.5: 0.1.4 (default imagePullSecrets per this PR) +
      # post-merge CI auto-bump that materializes the new image.tag
      # in values.yaml. The imagePullSecrets default is required so
      # omantel pods can pull from private GHCR without per-Sovereign
      # overlay (the catalyst-system `ghcr-pull` secret is canonical).
      # 0.1.6 (qa-loop bounded-cycle Wave 5 Fix #78, Gap E): adds
      # pre-install hook-weight -10 Job that auto-generates the
      # `k8s-ws-proxy-hmac` Secret from /dev/urandom when absent.
      # Pre-this, every fresh Sovereign sat with three k8s-ws-proxy
      # pods ContainerCreating forever — the chart referenced a
      # Secret that nothing ever created. Idempotent on upgrade
      # (preserves the existing key — rotating it would invalidate
      # every in-flight catalyst-api signature).
      # 0.1.9 (qa-loop bounded-cycle Fix #95, regression of Fix #78):
      # explicit hook-weight ordering for the hmac-bootstrap quartet
      # (SA=-20, Role+RoleBinding=-15, Job=-10) so the SA lands BEFORE
      # the Job that references it. Pre-this, prov #8 failed with
      # `serviceaccount "k8s-ws-proxy-hmac-bootstrap" not found`
      # because the Job (weight -10, lower=earlier in Helm) was
      # applied before its SA (weight 0). Bumps Chart.yaml 0.1.7 ->
      # 0.1.8; CI promote auto-bumps to 0.1.9 with new image SHA.
      version: 0.1.10
      sourceRef:
        kind: HelmRepository
        name: bp-k8s-ws-proxy
        namespace: flux-system
  install:
    timeout: 15m
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    timeout: 15m
    disableWait: true
    remediation:
      retries: 3
  values:
    k8sWsProxy:
      # Default-OFF gate flipped ON by the bootstrap-kit slot. Operator
      # opts out per-Sovereign by removing this slot from
      # clusters/<sovereign>/bootstrap-kit/kustomization.yaml.
      enabled: true
