# bp-k8s-ws-proxy — omantel-side bootstrap-kit slot. See
# clusters/_template/bootstrap-kit/36-bp-k8s-ws-proxy.yaml for the
# full canonical comment-block + dependency rationale.
#
# qa-loop iter-7 Fix #39: closes the gap surfaced by Fix #36's
# scope-narrow confession. CI workflow .github/workflows/build-k8s-ws-proxy.yaml
# builds the binary and publishes bp-k8s-ws-proxy:0.1.1 to GHCR;
# this slot installs it on omantel so TC-236/TC-237 flip PASS.

---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-k8s-ws-proxy
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-k8s-ws-proxy
  namespace: flux-system
spec:
  interval: 15m
  releaseName: k8s-ws-proxy
  targetNamespace: catalyst-system
  dependsOn:
    - name: bp-cilium
    - name: bp-sealed-secrets
  chart:
    spec:
      chart: bp-k8s-ws-proxy
      # 0.1.5: 0.1.4 (default imagePullSecrets) + CI auto-bumped
      # image.tag. imagePullSecrets default required for omantel pods
      # to pull from private GHCR.
      # 0.1.6 (qa-loop bounded-cycle Wave 5 Fix #78, Gap E): adds
      # pre-install hook-weight -10 Job that auto-generates the
      # `k8s-ws-proxy-hmac` Secret from /dev/urandom. Without this,
      # every fresh Sovereign provision left k8s-ws-proxy pods stuck
      # ContainerCreating forever — the chart referenced a Secret
      # that nothing ever created. Idempotent on upgrade (preserves
      # the existing key — rotating it would invalidate every
      # in-flight catalyst-api signature).
      # 0.1.9 (qa-loop bounded-cycle Fix #95, regression of Fix #78):
      # explicit hook-weight ordering for the hmac-bootstrap quartet
      # (SA=-20, Role+RoleBinding=-15, Job=-10) so the SA lands BEFORE
      # the Job that references it. Pre-this, prov #8 failed with
      # `serviceaccount "k8s-ws-proxy-hmac-bootstrap" not found`
      # because the Job (weight -10, lower=earlier in Helm) was
      # applied before its SA (weight 0). CI promote auto-bumps from
      # Chart.yaml 0.1.8 to 0.1.9 with the new image SHA on merge.
      version: 0.1.9
      sourceRef:
        kind: HelmRepository
        name: bp-k8s-ws-proxy
        namespace: flux-system
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  values:
    k8sWsProxy:
      enabled: true
