apiVersion: v2
name: bp-flux
# 1.2.1 (Fix #158, 2026-05-11): stuckHelmReleaseRecovery CronJob image
# switched from docker.io/bitnami/kubectl:1.31 to
# docker.io/bitnamilegacy/kubectl:1.31.4. Bitnami's 2025-08 secure-images
# cutover deleted every versioned tag from docker.io/bitnami/kubectl.
# bitnamilegacy is Bitnami's deprecation-fallback path.
#
# 1.2.2 (Fix #163, 2026-05-11, MIRROR-EVERYTHING): stuckHelmReleaseRecovery
# CronJob image switched from bitnamilegacy/kubectl:1.31.4 to
# harbor.openova.io/proxy-dockerhub/bitnamilegacy/kubectl:1.31.4.
# Per CLAUDE.md inviolable rule, ALL chart-hook references MUST be
# explicit Harbor proxy-cache form.
#
# 1.2.3 (TBD-A66, issue #1989, 2026-05-19): stuckHelmReleaseRecovery
# script gains a SECOND detection branch for HRs stuck in
# Ready=Unknown despite `.status.history[0].status=deployed`. This is
# the slow-secondary-CP apiserver-flap failure mode (nbg1-2 / hel1-1 in
# the t37 canonical walk) where the existing suspend-toggle branch
# does NOT help because helm-controller's "release in storage" short-
# circuit never re-evaluates Ready. The new branch patches the status
# subresource directly to flip Ready=True with audit annotation
# `stuck-hr-recovery.openova.io/auto-corrected-at=<RFC3339>`. RBAC
# extended with `helmreleases/status` patch+update verbs (status
# subresource is a separate RBAC target). Idempotent: annotation
# guards re-runs.
#
# 1.2.4 (TBD-A66-followup, issue #1995, 2026-05-19): observability fix
# on the TBD-A66 branch. The 1.2.3 implementation redirected the
# critical `kubectl patch --subresource=status` stderr to /dev/null
# (`2>&1` to a discarded pipe), so silent failures looked identical to
# silent successes when the CronJob output was inspected. Agent
# ae9d7638 on t38 spent ~10 min discovering this the hard way (the
# patch was failing but the human-readable "RECOVER ... — patching" log
# line was indistinguishable from a real recovery). 1.2.4 captures
# stderr to a temp file and emits structured `[A66]` log lines:
#   - detection: `[A66] HR <ns>/<name> Ready=Unknown for <age>s, history[0]=deployed → attempting patch`
#   - success:   `[A66] HR <ns>/<name> patched to Ready=True`
#   - failure:   `[A66] HR <ns>/<name> patch FAILED: <stderr captured>`
# RBAC was already correct in 1.2.3 (helmreleases/status patch+update
# verbs grant exists); the silent failure was diagnostic-blind, not
# RBAC-blind. The Chart.yaml bump here exists so the bootstrap-kit
# pin auto-sync hook propagates the new image into fresh provs.
version: 1.2.4
description: |
  Catalyst-curated Blueprint umbrella chart for Flux. Depends on the
  upstream `flux2` chart (fluxcd-community) as a Helm subchart so
  `helm dependency build` pulls the upstream payload into this artifact;
  the Catalyst overlay templates in templates/ (NetworkPolicy,
  ExternalSecret, ServiceMonitor) sit alongside the upstream subchart and
  Helm renders both at install time. Catalyst-curated values flow into the
  upstream subchart under the `flux2:` key in values.yaml.
type: application
keywords: [catalyst, blueprint, flux]
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io

# Upstream chart pulled in as a Helm subchart so `helm dependency build`
# bundles it into the OCI artifact.
#
# CRITICAL VERSION-PIN INVARIANT — DO NOT BUMP IN ISOLATION
# ----------------------------------------------------------
# This subchart version MUST match the upstream Flux release that
# `infra/hetzner/cloudinit-control-plane.tftpl` installs at cluster
# bootstrap time, otherwise helm-controller's reconcile of bp-flux runs
# `helm install` on top of an already-installed Flux of a DIFFERENT
# version. The CRD `status.storedVersions` mismatch fails the install,
# Helm rolls back, and the rollback DELETES the running Flux controllers
# — leaving the cluster with no GitOps engine, unrecoverable in-place.
# Live verified on omantel.omani.works on 2026-04-29 (see
# docs/RUNBOOK-PROVISIONING.md §"bp-flux double-install").
#
# Mapping (community chart -> flux2 appVersion -> cloud-init install.yaml):
#   flux2 2.14.1  ->  appVersion 2.4.0  ->  cloud-init v2.4.0  <- CURRENT
#   flux2 2.13.0  ->  appVersion 2.3.0  ->  cloud-init v2.3.0
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) the version is
# operator-bumpable via PR + Blueprint release, but BOTH this dep version
# AND cloudinit-control-plane.tftpl's flux2 install.yaml URL must move
# together in the same PR. CI gate `tests/version-pin-replay.sh` rejects
# divergence.
dependencies:
  - name: flux2
    version: "2.14.1"
    repository: "https://fluxcd-community.github.io/helm-charts"
