# Catalyst Blueprint values for bp-vcluster-helmrepo.
#
# Pre-stages the upstream loft-sh vcluster Helm chart source on the
# Sovereign cluster. Consumed by the Organization controller
# (core/controllers/organization) when spawning per-tenant vClusters.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) every value
# below is operator-overridable per-Sovereign.

vclusterHelmRepo:
  # The HelmRepository CR's namespace. Must match the value
  # CATALYST_VCLUSTER_HELMREPO_NAMESPACE that the Organization
  # controller is configured with (defaults to "vcluster-system" at
  # core/controllers/organization/cmd/main.go).
  namespace: "vcluster-system"

  # The HelmRepository CR's name. Must match the value
  # CATALYST_VCLUSTER_HELMREPO_NAME the Organization controller is
  # configured with (defaults to "loft").
  name: "loft"

  # Upstream loft-sh chart repo URL. Per docs/INVIOLABLE-PRINCIPLES.md
  # #4a (SHA-pinned / mirror-everything) operators MAY override this to
  # point at their Harbor proxy cache
  # (e.g. "https://harbor.openova.io/chartrepo/proxy-loft").
  url: "https://charts.loft.sh"

  # Source-controller reconcile interval. 15m matches every other
  # bootstrap-kit HelmRepository (bp-cilium / bp-cert-manager /
  # bp-gateway-api).
  interval: "15m"

  # Whether to create the namespace. Most Sovereigns will want this on;
  # operator-MAY turn it off to manage the namespace via a separate
  # Kustomization.
  createNamespace: true

# CRD installation gate (issue #1945, TBD-A53). When true, this chart
# also installs the `vclusters.vcluster.com` CustomResourceDefinition.
# That CRD is consumed by the Catalyst-API networking handler
# (`HandleNetworkingDMZ` at
# products/catalyst/bootstrap/api/internal/handler/networking.go) and
# by the k8scache dynamicinformer registry
# (products/catalyst/bootstrap/api/internal/k8scache/kinds.go) — both
# LIST `vcluster.com/v1alpha1 VClusters` to feed the Sovereign console
# DMZ tab + dashboard utilization overlay.
#
# Without the CRD on the cluster, `kubectl api-resources
# --api-group=vcluster.com` returns empty (caught on t34 walk
# 2026-05-19) and D29 zero-touch tenant materialisation cannot
# complete. See templates/vcluster-crd.yaml for the full rationale.
#
# Default-ON because every Sovereign needs the read surface to render
# its console panels. Operator MAY turn off in environments that
# install the CRD via a separate operator (e.g. cluster-api-provider-
# vcluster) to avoid duplicate-registration.
vclusterCRD:
  enabled: true
