apiVersion: catalyst.openova.io/v1alpha1
kind: Blueprint
metadata:
  name: bp-rtz-vcluster
  labels:
    catalyst.openova.io/section: pts-3-2-control-plane-isolation
    catalyst.openova.io/category: platform
spec:
  version: 0.1.0
  card:
    title: RTZ vCluster
    summary: |
      Per-secondary-region RTZ vCluster — the regional tenant-workload
      vCluster on each secondary region. Hosts tenant workloads +
      regional caches. Cross-vCluster intra-region traffic to/from DMZ
      stays inside host k3s via Cilium. Implements DoD A4 — each
      secondary region runs a DMZ + RTZ vCluster.
    icon: vcluster.svg
    category: platform
  visibility: unlisted              # mandatory bootstrap topology
  placementSchema:
    modes: [secondary-only]
    minRegions: 0
    maxRegions: 15
  upgrades:
    from: ["0.x"]
  manifests:
    chart: ./chart
  depends:
    - blueprint: bp-cilium
      version: ^1
    - blueprint: bp-cert-manager
      version: ^1

  outputs:
    hostNamespace: rtz
    vclusterName: rtz
    kubeconfigSecretName: vc-rtz
    role: secondary
