# bp-spire — Catalyst bootstrap-kit Blueprint. Workload identity. SPIFFE/SPIRE issues 5-min rotating SVIDs to every Pod. Required by NATS JetStream and OpenBao below for SVID-based auth.
#
# Wrapper chart: platform/spire/chart/
# Catalyst-curated values: platform/spire/chart/values.yaml
# Reconciled by: Flux on the new Sovereign's k3s control plane.

---
apiVersion: v1
kind: Namespace
metadata:
  name: spire-system
  labels:
    catalyst.openova.io/sovereign: otech.omani.works
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-spire
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-spire
  namespace: flux-system
spec:
  interval: 15m
  releaseName: spire
  targetNamespace: spire-system
  dependsOn:
    - name: bp-cert-manager
  chart:
    spec:
      chart: bp-spire
      version: 1.1.4
      sourceRef:
        kind: HelmRepository
        name: bp-spire
        namespace: flux-system
  # Event-driven install: Helm completes when manifests apply, not when
  # pods reach Ready. spire-server StatefulSet has a multi-minute Ready
  # path (controller-manager waits for CRD informer cache sync, which is
  # itself triggered by the spire-crds subchart's CRD install). Flux's
  # `dependsOn` on downstream HRs (bp-nats-jetstream, bp-openbao) checks
  # Ready=True on this HR independently, so disableWait is the correct
  # shape — replaces the blanket spec.timeout: 15m band-aid from PR #221.
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
