Bring in observability policy and migrate submariner out

.github/linters/.jscpd.json

@@ -1,13 +1,7 @@
 {
+  "threshold": 20,
   "ignore": [
-    "templates/_helpers.tpl",
-    "templates/_ansible_bootstrap.tpl",
-    "templates/_ansible_configmap_data.tpl",
-    "templates/rbac-odf-dr-prerequisites.yaml",
-    "templates/rbac-odf-ramen-trusted-ca.yaml",
-    "templates/rbac-odf-ssl-certificate-precheck.yaml",
-    "templates/rbac-odf-ssl-extractor.yaml",
-    "templates/rbac-submariner-prerequisites.yaml",
-    "templates/rbac-submariner-sg-tag.yaml"
+    "**/node_modules/**",
+    "templates/rbac-odf-dr-prerequisites.yaml"
   ]
 }

Chart.yaml

@@ -1,11 +1,10 @@
 apiVersion: v2
 name: odf-dr-chart
 description: >
-  Standalone Helm chart for ODF storage infrastructure supporting Regional DR.
-  Deploys ODF SSL certificate extraction, Submariner network overlay, MirrorPeer
-  storage mirroring, ODF DR prerequisites.
+  ODF-specific Regional DR chart: MirrorPeer, ODF prerequisites, and observability
+  ObjectBucketClaim/storage policy. Submariner and s3-ssl live in opp-policy-chart.
 keywords:
   - odf
   - pattern
   - regionaldr
-version: 0.0.2
+version: 0.1.0

README.md

@@ -1,15 +1,20 @@
 # odf-dr-chart
 
-![Version: 0.0.2](https://img.shields.io/badge/Version-0.0.2-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)
 
-Standalone Helm chart for ODF storage infrastructure supporting Regional DR. Deploys ODF SSL certificate extraction, Submariner network overlay, MirrorPeer storage mirroring, ODF DR prerequisites.
+ODF-specific Regional DR chart: MirrorPeer, ODF prerequisites, and observability ObjectBucketClaim/storage policy. Submariner and s3-ssl live in opp-policy-chart.
 
-This chart deploys ODF storage infrastructure supporting Regional DR: SSL certificate extraction, Submariner network overlay, MirrorPeer storage mirroring, ODF DR prerequisites, and Ramen hub trusted-CA workloads.
-Consumed by the ramendr pattern as a dedicated ArgoCD application.
+Always deployed with **regionaldr-with-virt**. This chart supplies ODF-specific pieces: MirrorPeer, ODF prerequisites checker, and observability ObjectBucketClaim/storage policy.
+Submariner and s3-ssl live in **opp-policy-chart**. Cluster CA is owned by **vp-manage-proxy-cluster-ca**.
+Ramen `s3StoreProfiles` `caCertificates` injection is owned by **opp-policy-chart** (`s3CaInjector`).
 
 ## Notable changes
 
-v0.1.0 - Initial release
+v0.1.0 - Keep only ODF/MirrorPeer/observability; move Submariner and SSL to opp-policy; drop ramen trusted-CA job
+
+v0.0.3 - Add ObjectBucketClaim and policy-observability-storage (from opp-policy-chart)
+
+v0.0.1 - Initial release
 
 ## Values
 
@@ -19,25 +24,16 @@ v0.1.0 - Initial release
 | ansible.containerImage | string | `"quay.io/validatedpatterns/utility-container:latest"` | Container image used for Ansible post-install jobs. |
 | ansible.verbosity | int | `0` | Ansible-playbook verbosity level (0–4). |
 | clusterCaMgt.createNamespace | bool | `false` | Create clusterCaMgt.namespace when installing the chart. |
-| clusterCaMgt.namespace | string | `"cluster-ca-mgt"` | Namespace for ODF CA prerequisites and Ramen trusted-CA workloads. |
-| global.clusterDomain | string | `"cluster.example.com"` | Base domain shared by all clusters (e.g. example.com). Used to derive per-cluster baseDomain. |
-| global.clusterPlatform | string | `"AWS"` | Cloud platform type. AWS enables Hive ExternalSecret, ClusterDeployment platform.aws, Submariner gateway/credentials and SG-tag job. Use non-AWS (e.g. BareMetal) to skip those. |
+| clusterCaMgt.namespace | string | `"cluster-ca-mgt"` | Namespace for ODF CA prerequisites workloads. |
 | odf.drCluster.primaryS3ProfileName | string | `""` | S3 profile name for the primary DRCluster CR. Required only when postInstallFixesEnabled is false. |
 | odf.drCluster.secondaryS3ProfileName | string | `""` | S3 profile name for the secondary DRCluster CR. Required only when postInstallFixesEnabled is false. |
-| odf.postInstallFixesEnabled | bool | `true` | Enable ODF post-install automation (MirrorPeer, prerequisites checker, Ramen trusted-CA jobs/RBAC). |
-| odfRamenTrustedCa.pollInterval | int | `15` | Polling interval in seconds for readiness checks inside the trusted-CA job. |
-| odfRamenTrustedCa.ramenS3WaitSeconds | int | `3600` | Maximum seconds to wait for Ramen s3StoreProfiles to be populated before the trusted-CA job gives up. |
-| odfRamenTrustedCa.trustedCaWaitSeconds | int | `3600` | Maximum seconds to wait for the hub vp-pattern-proxy-ca-bundle trusted CA before the job gives up. |
-| odfSslCertificateExtractor.clusterReadinessMaxAttempts | int | `150` | Maximum number of attempts to check DR ManagedCluster readiness before the extractor job fails. |
-| odfSslCertificateExtractor.clusterReadinessSleepSeconds | int | `30` | Seconds to sleep between each ManagedCluster readiness poll attempt. |
-| odfSslCertificateExtractor.enabled | bool | `false` | When false, skip legacy SSL certificate extraction jobs (disable when using vp-manage-proxy-cluster-ca). |
-| regionalDR[0].globalnetEnabled | bool | `false` | Enable Submariner Globalnet. Required when primary and secondary cluster CIDRs overlap. |
-| regionalDR[0].name | string | `"resilient"` | Name of this DR pair set. Must be unique within the regionalDR list and match the ACM policy placement label. |
-| submariner.NATTEnable | bool | `true` | Enable NAT traversal (NAT-T) for Submariner IPsec tunnels. |
-| submariner.cableDriver | string | `"vxlan"` | Submariner cable driver (vxlan or libreswan). |
-| submariner.instanceType | string | `"m5.xlarge"` | EC2 instance type for Submariner gateway nodes. |
-| submariner.ipsecNatPort | int | `4500` | IPsec NAT-T UDP port used by Submariner. |
-| submariner.sgTagJobEnabled | bool | `false` | Enable EC2 security group tagging job. AWS only; requires global.clusterPlatform=AWS. |
+| odf.postInstallFixesEnabled | bool | `true` | Enable ODF post-install automation (MirrorPeer, prerequisites checker). |
+| odfDrPrerequisites.caBundleName | string | `"vp-pattern-proxy-ca-bundle"` | CA ConfigMap name to validate (vp-manage-proxy-cluster-ca configMapName). |
+| odfDrPrerequisites.caBundleNamespace | string | `"openshift-config"` | Namespace of the CA ConfigMap. |
+| odfDrPrerequisites.caMaterialMode | string | `"trust-bundle"` | CA completeness check mode. Use trust-bundle with vp-manage-proxy-cluster-ca (validates PEM and identical CA ConfigMaps). legacy expects '# CA from …' markers. |
+| regionalDR[0].clusters.primary.name | string | `"ocp-primary"` | ACM ManagedCluster name for the primary site. |
+| regionalDR[0].clusters.secondary.name | string | `"ocp-secondary"` | ACM ManagedCluster name for the secondary site. |
+| regionalDR[0].name | string | `"resilient"` | Name of this DR pair set. Must be unique within the regionalDR list. |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

README.md.gotmpl

@@ -5,12 +5,17 @@
 
 {{ template "chart.description" . }}
 
-This chart deploys ODF storage infrastructure supporting Regional DR: SSL certificate extraction, Submariner network overlay, MirrorPeer storage mirroring, ODF DR prerequisites, and Ramen hub trusted-CA workloads.
-Consumed by the ramendr pattern as a dedicated ArgoCD application.
+Always deployed with **regionaldr-with-virt**. This chart supplies ODF-specific pieces: MirrorPeer, ODF prerequisites checker, and observability ObjectBucketClaim/storage policy.
+Submariner and s3-ssl live in **opp-policy-chart**. Cluster CA is owned by **vp-manage-proxy-cluster-ca**.
+Ramen `s3StoreProfiles` `caCertificates` injection is owned by **opp-policy-chart** (`s3CaInjector`).
 
 ## Notable changes
 
-v0.1.0 - Initial release
+v0.1.0 - Keep only ODF/MirrorPeer/observability; move Submariner and SSL to opp-policy; drop ramen trusted-CA job
+
+v0.0.3 - Add ObjectBucketClaim and policy-observability-storage (from opp-policy-chart)
+
+v0.0.1 - Initial release
 
 {{ template "chart.homepageLine" . }}