{{/*
Cilium ClusterMesh per-peer config CR — slice EPIC-5 leftovers CM
#1100. Documents the operator-side `cilium clustermesh connect` runbook
in the chart so a fresh-eyes operator can trace from the values overlay
to the live-cluster command sequence.

EPIC-6 slice C-DB-1's bp-cnpg-pair Service carries
`service.cilium.io/global: "true"` (per ADR-0001 §8 — ClusterMesh is the
canonical inter-cluster transport). For that annotation to actually
forward traffic to peer-cluster Pods, the per-cluster
clustermesh-apiserver Pod must be running AND the per-peer Cilium
config CR (this template) must be present AND the operator must have
completed `cilium clustermesh enable` + `cilium clustermesh connect`
on both peers.

This template ships the chart-side render. It is gated by
`.Values.cilium.clustermesh.config.enabled` AND the upstream Cilium
chart's `cluster.name` / `cluster.id` non-empty checks (which the
upstream chart performs at install time when ClusterMesh is on).

The CR shape mirrors the upstream Cilium chart's expectation: each
peer in `.Values.cilium.clustermesh.config.clusters[]` becomes one
entry. Operators populate that list via the per-Sovereign overlay
once `cilium clustermesh connect` has issued the certs that make a
real peer connection possible.

Operator-action gate: the rendered CR is the DECLARATION of the mesh
shape, NOT the live trust handshake. The actual cert exchange happens
out-of-band via the cilium CLI (see operator runbook in
`values-clustermesh.yaml`). The chart template is therefore a NO-OP
on a fresh Sovereign that hasn't run `cilium clustermesh enable` —
the empty `clusters: []` default renders an empty mesh declaration.
That's intentional: the chart never auto-peers without operator
consent.
*/}}
{{- if and .Values.cilium.clustermesh.useAPIServer .Values.cilium.clustermesh.config.enabled .Values.cilium.cluster.name -}}
apiVersion: v1
kind: ConfigMap
metadata:
  # NOTE: distinct name from the upstream Cilium chart's
  # `cilium-clustermesh` Secret (managed by the upstream subchart's
  # clustermesh-config templates). This Catalyst overlay ConfigMap is
  # consumed by operator runbooks + Sovereign-management tooling
  # (catalyst-api can read this to surface the per-Sovereign mesh
  # identity in the console) — NOT by Cilium itself.
  name: catalyst-clustermesh-config
  namespace: kube-system
  labels:
    app.kubernetes.io/name: bp-cilium
    app.kubernetes.io/component: clustermesh-config
    catalyst.openova.io/blueprint: bp-cilium
    catalyst.openova.io/blueprint-version: {{ .Chart.Version | quote }}
data:
  # Per-cluster identity — must match what the upstream Cilium chart
  # consumes for the cluster-mesh peer cert SAN. Empty `clusters:` list
  # means this Sovereign has no peers yet; operator runs
  # `cilium clustermesh connect` to populate.
  cluster-name: {{ .Values.cilium.cluster.name | quote }}
  cluster-id: {{ .Values.cilium.cluster.id | quote }}
  domain: {{ .Values.cilium.clustermesh.config.domain | default "mesh.cilium.io" | quote }}
  # JSON-encoded peer list. Each entry: {"name": "<peer-name>",
  # "address": "<peer-clustermesh-apiserver-LB>", "port": 2379}.
  # Populated post-`cilium clustermesh connect` on each peer.
  peers: {{ .Values.cilium.clustermesh.config.clusters | toJson | quote }}
{{- end -}}
