apiVersion: v2
name: bp-dmz-vcluster
# 0.1.0 — initial implementation of DoD A4 vCluster topology
# (sovereign-multi-region-DoD invariant #4). Founder ruling
# 2026-05-16: every Sovereign region (primary AND secondary) must
# materialise a DMZ vCluster — it is the public-fronted vCluster
# AND the inter-region WireGuard hop per DoD A2.
#
# Slot 54 in the bootstrap-kit (renders on EVERY region — primary
# host the MGMT + DMZ pair, secondaries host the DMZ + RTZ pair).
#
# Supersedes the inert `bp-dmz-vcluster` slot 54 entry declared in
# scripts/expected-bootstrap-deps.yaml since qa-loop iter-12 Fix #53C
# (EPIC-5 leftovers slice DMZ #1100). The chart at products/dmz-
# vcluster/ remains a separate per-tenant marketplace artifact —
# this platform/ chart is the bootstrap-topology piece.
version: 0.1.0
appVersion: "0.20.0"
description: |
  Catalyst-curated Blueprint umbrella chart for the Sovereign DMZ
  vCluster. Implements docs/SOVEREIGN-MULTI-REGION-DOD.md A4
  ("each region runs a DMZ vCluster") as a Helm release of the
  upstream loft-sh/vcluster chart wrapped in Catalyst conventions
  (namespace, nodeSelector pin to the region's CP, fail-fast image
  guard, MIRROR-EVERYTHING Harbor proxy by default, NetworkPolicy
  isolation that allows world-ingress on Gateway ports only).

  Hosts the Sovereign public-fronted workloads:
    - Cilium Gateway (HTTPS L7 ingress)
    - Cilium WireGuard endpoint (inter-region peer per DoD A2)
    - Cilium ClusterMesh apiserver Service (type=LoadBalancer per DoD A3)
    - HTTPRoutes for console / auth / gitea / harbor / openova-flow

  Topology contract (re-read docs/SOVEREIGN-MULTI-REGION-DOD.md):
    primary    region → MGMT  + DMZ  vCluster (bp-mgmt-vcluster + this chart)
    secondary  region → DMZ   + RTZ  vCluster (this chart + bp-rtz-vcluster)

  The upstream chart is pulled in as a Helm subchart so
  `helm dependency build` bundles it into the OCI artifact — the
  same umbrella shape used by bp-cert-manager + bp-cilium +
  bp-hcloud-ccm.
type: application
annotations:
  # CI Blueprint Release smoke-render gate accepts the literal token
  # "default-off" to bypass the "render < 5 lines" failure for charts
  # whose top-level condition (dmzVcluster.enabled) is false at default
  # values. The bootstrap-kit slot 54 flips it on for every region via
  # postBuild.substitute (DMZ_VCLUSTER_ENABLED=true). The full-ON path
  # is exercised by chart/tests/render.sh which CI doesn't run as a
  # Release gate.
  catalyst.openova.io/smoke-render-mode: "default-off"
keywords: [catalyst, blueprint, vcluster, dmz, isolation, multi-region, dod-a4, wireguard]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

dependencies:
  - name: vcluster
    version: "0.20.0"
    repository: "https://charts.loft.sh"
    # The subchart only renders when the umbrella's top-level
    # `dmzVcluster.enabled` is true. Default-OFF therefore renders ZERO
    # resources (umbrella namespace + NetworkPolicy AND subchart). The
    # bootstrap-kit Kustomization flips this on every region (DMZ runs
    # everywhere per DoD A4).
    condition: dmzVcluster.enabled
