apiVersion: v2
name: bp-rtz-vcluster
# 0.1.0 — initial implementation of DoD A4 vCluster topology
# (sovereign-multi-region-DoD invariant #4). Founder ruling
# 2026-05-16: every secondary region must materialise an RTZ
# vCluster for regional tenant workloads + caches.
#
# Slot 59 in the bootstrap-kit (renders ONLY on secondary regions —
# primaries host MGMT + DMZ, secondaries host DMZ + RTZ).
version: 0.1.0
appVersion: "0.20.0"
description: |
  Catalyst-curated Blueprint umbrella chart for the Sovereign RTZ
  vCluster. Implements docs/SOVEREIGN-MULTI-REGION-DOD.md A4
  ("each secondary region runs an RTZ vCluster for regional tenant
  workloads") as a Helm release of the upstream loft-sh/vcluster chart
  wrapped in Catalyst conventions.

  Hosts the per-region tenant workloads:
    - tenant pods (when a SME/marketplace tenant is regionalised)
    - regional caches (valkey-cache, etc.)
    - region-local observability shippers

  Topology contract (re-read docs/SOVEREIGN-MULTI-REGION-DOD.md):
    primary    region → MGMT  + DMZ  vCluster (bp-mgmt-vcluster + bp-dmz-vcluster)
    secondary  region → DMZ   + RTZ  vCluster (bp-dmz-vcluster  + this chart)

  Cross-vCluster intra-region traffic (RTZ ↔ DMZ within the same
  secondary region) stays inside the host k3s via Cilium endpoint
  identity routing. Cross-region traffic (RTZ ↔ MGMT primary) goes
  through the DMZ WireGuard hop per DoD A2.

  The upstream chart is pulled in as a Helm subchart so
  `helm dependency build` bundles it into the OCI artifact — the
  same umbrella shape used by bp-cert-manager + bp-cilium +
  bp-mgmt-vcluster + bp-dmz-vcluster.
type: application
annotations:
  # CI Blueprint Release smoke-render gate accepts the literal token
  # "default-off" to bypass the "render < 5 lines" failure for charts
  # whose top-level condition (rtzVcluster.enabled) is false at default
  # values. The bootstrap-kit slot flips it on for every secondary region
  # via postBuild.substitute. The full-ON path is exercised by
  # chart/tests/render.sh which CI doesn't run as a Release gate.
  catalyst.openova.io/smoke-render-mode: "default-off"
keywords: [catalyst, blueprint, vcluster, rtz, isolation, multi-region, dod-a4]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

dependencies:
  - name: vcluster
    version: "0.20.0"
    repository: "https://charts.loft.sh"
    # The subchart only renders when the umbrella's top-level
    # `rtzVcluster.enabled` is true. Default-OFF therefore renders ZERO
    # resources. The bootstrap-kit Kustomization flips this on ONLY
    # for secondary regions (per the DoD A4 topology contract).
    condition: rtzVcluster.enabled
