apiVersion: v2
name: bp-external-secrets-stores
# 1.0.3 (issue #147 / prov #23): bump webhookGate.timeoutSeconds 300 -> 600.
# Fix #141's 300s budget converged on provs #21 and #22 baseline, but
# raced on prov #23 (`3ea80c75e1568a5c`, 3rd consecutive FAIL of this HR)
# where the cold-start path was:
#   - ESO webhook image pull on a fresh node (no warmed layer cache):
#     +60-120s on top of the previously observed 75-105s
#   - cert-manager itself was retrying earlier in the run, so the TLS
#     Secret materialised later than the cert-manager HR Ready=True
#     implied
#   - cainjector queue backlog patching multiple ValidatingWebhookConfig
#     objects in parallel during the bootstrap-kit fan-out
# Pathological worst-case: ~135-280s; 600s gives ~2x headroom even at
# that end. 10min is the realistic max budget for a pathological cold
# Hetzner provision, not a band-aid — still bounded so a genuinely
# broken upstream fails the HR. Unblocks remaining 3/43 HRs that
# converge except this one.
#
# 1.0.2 (issue #141 / prov #21): bump webhookGate.timeoutSeconds 60 -> 300.
# Fix #137's 60s budget caught most cases but raced on prov #21
# (`f84f6c3ff2b60296`) where the full webhook convergence (Pod Ready +
# cert-manager TLS Secret mount + cainjector CA bundle patch + Endpoints
# populate) took 75-105s on a slow Hetzner cold-start node. 300s gives
# ~3x headroom while still failing fast on a genuinely broken upstream.
#
# 1.0.1 (issue #137 / prov #20): pre-install hook gates ClusterSecretStore
# apply on the upstream ESO admission webhook being dial-able. Closes the
# Pod-Ready ≠ webhook-serving race that wedged prov #20 with `exceeded
# max retries`.
#
# 1.0.4 (Fix #158, 2026-05-11): webhookGate hook image switched from
# docker.io/bitnami/kubectl:1.30.4 to docker.io/bitnamilegacy/kubectl:
# 1.30.7. Bitnami's 2025-08 secure-images cutover deleted every versioned
# tag from docker.io/bitnami/kubectl (only :latest + sha256-named tags
# remain), causing ImagePullBackOff on fresh Sovereign provisions.
# bitnamilegacy is Bitnami's deprecation-fallback path with bash/sh
# preserved (rancher/kubectl is distroless and would break the inline
# shell script).
#
# 1.0.5 (Fix #163, 2026-05-11, MIRROR-EVERYTHING): webhookGate hook image
# switched from bitnamilegacy/kubectl:1.30.7 to
# harbor.openova.io/proxy-dockerhub/bitnamilegacy/kubectl:1.30.7.
# Per CLAUDE.md inviolable rule, ALL chart-hook image references must
# pull through the Harbor proxy-cache explicitly — not just rely on
# the node-level containerd mirror in registries.yaml. This protects
# the bootstrap-kit from upstream Docker Hub deletions (Bitnami 2025-08
# is exactly such an incident) and satisfies the Kyverno
# `harbor-proxy-pull` ClusterPolicy.
version: 1.0.5
description: |
  Catalyst-curated Blueprint chart for the default ESO ClusterSecretStore(s)
  that wire each Sovereign's bp-external-secrets controller to its bp-openbao
  backend. Split from bp-external-secrets@1.0.0 (issue #331) to resolve
  CRD-ordering deadlock: the ClusterSecretStore CR must be applied AFTER ESO's
  CRDs are registered AND the controller is Ready, which Helm's
  `before-hook-creation` delete policy can't guarantee within a single
  HelmRelease (the policy's lookup runs before the upstream chart's CRDs
  finish registration → "no matches for kind ClusterSecretStore" — see
  bp-external-secrets@1.0.0 incident on otech.omani.works 2026-04-30).

  Mirrors the bp-crossplane / bp-crossplane-claims split shape (PR #247):
  controller chart owns the operator + CRDs, separate stores chart owns the
  CRs, Flux dependsOn orders them.

  Keeps zero upstream subchart deps — the chart is pure Catalyst templates
  applying CRs against the upstream-registered CRDs.
type: application
keywords: [catalyst, blueprint, external-secrets, eso, openbao, secrets, clustersecretstore]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

annotations:
  catalyst.openova.io/no-upstream: "true"
  catalyst.openova.io/depends-on: "bp-external-secrets,bp-openbao"
