downstream:

  helm_repositories:
    - name: bitnami
      url: https://charts.bitnami.com/bitnami
    - name: longhorn
      url: https://charts.longhorn.io
    - name: sealed-secrets
      url: https://bitnami-labs.github.io/sealed-secrets

  helm_charts:

    longhorn:
      version: 1.4.1
      chart: longhorn/longhorn
      namespace: longhorn-system
      parse_logic: cat values.yaml | yq eval '.. | select(has("repository")) | .repository + ":" + .tag'
      chart_values: !unsafe |
        defaultSettings:
          createDefaultDiskLabeledNodes: true
          defaultDataPath: /mnt/blockstorage

    pinniped:
      version: 1.2.11  # (= Pinniped v0.25.0)
      chart: bitnami/pinniped
      namespace: pinniped-concierge
      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
      chart_values: !unsafe |
        supervisor:
          enabled: false
      extra_manifests:
        - src: jwtauthenticator.j2
          _template:
            name: metacluster-sso
            spec: !unsafe |2
                issuer: https://auth.{{ vapp['metacluster.fqdn'] }}/sso
                audience: "{{ vapp['workloadcluster.name'] | lower }}"
                tls:
                  certificateAuthorityData: "{{ (stepca_cm_certs.resources[0].data['intermediate_ca.crt'] ~ _newline ~ stepca_cm_certs.resources[0].data['root_ca.crt']) | b64encode }}"

    sealed-secrets:
      version: 2.8.1  # (= Sealed Secrets v0.20.2)
      chart: sealed-secrets/sealed-secrets
      namespace: sealed-secrets
      parse_logic: helm template . | yq --no-doc eval '.. | .image? | select(.)' | sort -u | awk '!/ /'
      # chart_values: !unsafe |
      #   # Empty