# bp-dmz-vcluster — Catalyst bootstrap-kit Blueprint slot 54. DMZ
# isolated virtual Kubernetes cluster running inside the management
# cluster. Customer-internet-facing workloads land here; host-side
# NetworkPolicy + Cilium identity isolation keep them off the
# Catalyst control plane.
#
# Per ADR-0001 §3.2.8 + EPIC-5 leftovers slice DMZ #1100: every
# Sovereign that publishes customer-facing APIs / webhooks gets a
# DMZ vCluster.
#
# qa-loop iter-12 Fix #53C: matrix asserts dmz namespace + vcluster
# CRD registered + omantel-dmz kubeconfig context (TC-286, TC-287,
# TC-288). Without this slot the chart was authored but never installed.
#
# Wrapper chart: products/dmz-vcluster/chart/
# Reconciled by: Flux on the new Sovereign's k3s control plane.
#
# dependsOn:
#   - bp-cilium       — vCluster needs CNI for its synced Pods.
#   - bp-cert-manager — TLS for the DMZ ingress endpoints.
#   - bp-cnpg         — vCluster's optional state backend (default:
#                       in-cluster sqlite, swappable to PG via overlay).

---
apiVersion: v1
kind: Namespace
metadata:
  name: dmz
  labels:
    catalyst.openova.io/sovereign: omantel.omani.works
    catalyst.openova.io/isolation: dmz
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: bp-dmz-vcluster
  namespace: flux-system
spec:
  type: oci
  interval: 15m
  url: oci://ghcr.io/openova-io
  secretRef:
    name: ghcr-pull
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: bp-dmz-vcluster
  namespace: flux-system
spec:
  interval: 15m
  releaseName: dmz-vcluster
  targetNamespace: dmz
  dependsOn:
    - name: bp-cilium
    - name: bp-cert-manager
  chart:
    spec:
      chart: bp-dmz-vcluster
      # 0.1.1 (qa-loop iter-12 Fix #53C): pinned upstream loft-sh/vcluster
      # tag (0.20.0) so the chart renders + installs without a CI mirror
      # cycle. SHA-pin migration tracked separately.
      version: 0.1.1
      sourceRef:
        kind: HelmRepository
        name: bp-dmz-vcluster
        namespace: flux-system
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  # Per-Sovereign overlay surface.
  values:
    dmz:
      enabled: true
      hostNamespace: dmz
      vclusterName: omantel-dmz
