# Catalyst-curated values overlay for bp-external-secrets-stores.
#
# This chart owns the ClusterSecretStore CR(s) that the bp-external-secrets
# controller chart can no longer ship in-line (CRD-ordering deadlock; see
# Chart.yaml). All knobs that previously lived under
# `clusterSecretStore:` in bp-external-secrets/values.yaml move here
# unchanged — cluster overlays in clusters/<sovereign>/ that previously
# overrode `clusterSecretStore.*` continue to work via the same key path,
# they just target this chart now.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) every operationally
# meaningful value flows from this file; cluster overlays may set
# `clusterSecretStore.*` without rebuilding the Blueprint OCI artifact.

clusterSecretStore:
  enabled: true
  name: vault-region1
  server: "http://openbao.openbao.svc.cluster.local:8200"
  path: secret
  version: v2
  kubernetesAuth:
    mountPath: kubernetes
    role: external-secrets
    serviceAccountName: external-secrets
    serviceAccountNamespace: external-secrets-system

# Pre-install webhook gate (issue #137 / prov #20).
#
# Why this exists
# ===============
# bp-external-secrets-stores ships ClusterSecretStore CRs that go through
# the upstream ESO admission webhook (validate.clustersecretstore.external-secrets.io).
# Flux dependsOn `bp-external-secrets` only guarantees the upstream HR
# reaches Ready=True — which means the webhook Deployment's Pod is Ready.
# Pod-Ready does NOT mean the webhook Service has live endpoints OR that
# the cert-manager-issued TLS cert is mounted + serving on :10250. Without
# this gate, Helm install of this chart races the webhook and the
# apiserver returns "failed to call webhook ...: Post ...: connect:
# connection refused" → HR FAILED with `exceeded max retries`.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode), every knob is
# operator-overridable from cluster overlays.
webhookGate:
  enabled: true
  # Endpoint object the gate polls. Defaults to upstream chart's
  # generated webhook Service name (release-name `external-secrets`
  # in namespace `external-secrets-system` → svc `external-secrets-webhook`).
  # Override if upstream chart's `webhook.fullnameOverride` is changed.
  service:
    name: external-secrets-webhook
    namespace: external-secrets-system
  # Total wait budget. History:
  #   1.0.1 — 60s (issue #137 / prov #20): caught most cases but raced on
  #           prov #21 where convergence took 75-105s.
  #   1.0.2 — 300s (issue #141 / prov #21): ~3x headroom over observed
  #           75-105s, but STILL raced on provs #22+#23+#23retry where
  #           image pull (cold node, no warmed layer cache) + cert-manager
  #           transient retries earlier in the run pushed total webhook
  #           convergence past the 300s budget.
  #   1.0.3 — 600s (issue #147 / prov #23, this bump): defensive 10x hedge
  #           over the 60s realistic warm-start cold-path, sized for the
  #           pathological cold provision where:
  #             a. node has no image cache → ESO image pull adds 60-120s
  #             b. cert-manager itself was retrying earlier in the run,
  #                so the TLS Secret materialises later than its own HR
  #                Ready=True implies
  #             c. cainjector queue can be backed up patching multiple
  #                ValidatingWebhookConfiguration objects in parallel
  # Full convergence path:
  #   1. external-secrets-webhook image pull          (~60-120s cold)
  #   2. external-secrets-webhook Pod Ready           (~30-60s)
  #   3. cert-manager TLS Secret created + mounted    (~30-60s)
  #   4. cainjector patches ValidatingWebhookConfig CA(~10-30s)
  #   5. Endpoints object populates                   (~5-10s)
  # Worst-case total: ~135-280s; 600s gives ~2x headroom even at the
  # pathological end. This is target-state per docs/INVIOLABLE-PRINCIPLES.md
  # #4 — realistic max budget for cold-start, not a band-aid retry pad.
  # Still bounded (10min) so a genuinely broken upstream fails the HR
  # rather than wedging Flux indefinitely.
  timeoutSeconds: 600
  # Poll interval. 2s gives ~30 attempts in the 60s budget.
  intervalSeconds: 2
  # Hook image. bitnamilegacy/kubectl is the canonical chart-side tooling
  # across Catalyst Blueprints (see platform/guacamole/chart/templates/
  # recordings-pvc-migrate-hook.yaml). Versioned tag per
  # docs/INVIOLABLE-PRINCIPLES.md #4a.
  #
  # 2026-05-11 (Fix #163, MIRROR-EVERYTHING): explicit Harbor proxy-cache
  # prefix per CLAUDE.md inviolable rule. Node-level containerd mirror
  # (registries.yaml in cloudinit-control-plane.tftpl line 706) already
  # routes `docker.io/*` → `harbor.openova.io/proxy-dockerhub/*`, but
  # explicit references defeat upstream-deletion blast radius (cf.
  # bitnami/kubectl 2025-08 secure-images purge) AND make SBOM auditing
  # plus the Kyverno `harbor-proxy-pull` ClusterPolicy work consistently.
  # bitnamilegacy/* is Bitnami's deprecation-fallback path; kept because
  # rancher/kubectl is distroless and would break the hook's bash shim.
  image: harbor.openova.io/proxy-dockerhub/bitnamilegacy/kubectl:1.30.7
  imagePullPolicy: IfNotPresent
