openova/platform/wordpress-tenant/blueprint.yaml

apiVersion: catalyst.openova.io/v1alpha1
kind: Blueprint
metadata:
  name: bp-wordpress-tenant
  labels:
    catalyst.openova.io/category: tenant-app
    catalyst.openova.io/section: pts-7-sme-tenant
spec:
  version: 0.2.0
  card:
    title: WordPress Tenant
    summary: |
      Turnkey, SSO-pre-wired WordPress per SME tenant. Runs in the SME's
      vcluster, namespace = SME tenant namespace. SSO via the SME-vcluster
      Keycloak realm (openid-connect-generic plugin), Postgres via bp-cnpg
      (Cluster CR in tenant ns), persistent /var/www/html/wp-content via
      PVC (default 10Gi), ingress at https://wordpress.<sme-domain> with
      cert-manager TLS. Default theme + admin user pre-seeded at install
      time so the SME admin's first browser hit lands on /wp-admin
      authenticated. No install wizard, no manual config.      
    icon: wordpress.svg
    category: tenant-app
    tags: [wordpress, cms, sme, tenant, sso, keycloak, oidc, postgres]
    documentation: https://wordpress.org/documentation/
    license: GPL-2.0-or-later
  visibility: listed
  owner:
    team: platform
    contact: catalyst@openova.io
  configSchema:
    type: object
    required: [smeDomain, oidc, adminUser]
    properties:
      smeDomain:
        type: string
        description: |
          The SME tenant's domain (e.g. `acme.<otech-fqdn>` for free-
          subdomain tenants, or `acme.com` for BYO). Used to derive the
          default ingress host as `wordpress.<smeDomain>`. Per
          docs/INVIOLABLE-PRINCIPLES.md #4 there is no default — the
          tenant-provisioning pipeline supplies this at install time.          
      replicas:
        type: integer
        default: 1
        minimum: 1
        maximum: 8
      oidc:
        type: object
        required: [issuerURL, clientSecretName]
        properties:
          enabled:
            type: boolean
            default: true
            description: Master toggle — when false the post-install Job is rendered but short-circuits.
          issuerURL:
            type: string
            description: |
              Discovery URL of the per-tenant Keycloak realm. Example:
              `https://keycloak.<sme-domain>/realms/sme-<subdomain>`.
              The openid-connect-generic plugin uses this to derive the
              token / userinfo / authorization / end-session endpoints.              
          clientId:
            type: string
            default: wordpress
            description: OIDC client ID registered in the per-tenant realm.
          clientSecretName:
            type: string
            default: wordpress-oidc-client-secret
            description: |
              K8s Secret carrying the OIDC client secret (key
              `client-secret`). Provisioned by the bp-keycloak chart
              (PR #918) at the same time as the realm import.              
          defaultRole:
            type: string
            default: subscriber
            description: |
              WordPress role assigned to a brand-new SSO user when
              `create_if_does_not_exist=1`. Set to empty string to
              create SSO users with no role.              
          identityKey:
            type: string
            default: preferred_username
            description: Keycloak claim used to match id_token back to a WP user.
      keycloak:
        type: object
        description: |
          DEPRECATED — preserved as a backward-compat alias for chart
          0.1.x clusters whose orchestrator overlays still emit
          `keycloak.{realmURL,clientID,clientSecretName}`. New overlays
          MUST emit `oidc.*`. Folded into oidc.* by _helpers.tpl when
          oidc.* is at its values.yaml defaults.          
        properties:
          realmURL:
            type: string
          clientID:
            type: string
          clientSecretName:
            type: string
      database:
        type: object
        properties:
          cnpgClusterName:
            type: string
            default: wordpress-db
            description: |
              Name of the `Cluster.postgresql.cnpg.io` provisioned for
              this WordPress instance. Per-tenant unique within the SME
              namespace.              
      adminUser:
        type: object
        required: [email]
        properties:
          email:
            type: string
            description: |
              Email of the SME admin (must match the `email` claim
              Keycloak issues). The admin-user Job pre-seeds a wp_user
              row with this email and the administrator role.              
          displayName:
            type: string
            description: Display name shown in the WP admin bar. Defaults to the local-part of the email.
      defaultTheme:
        type: string
        default: twentytwentyfive
        description: WordPress theme slug installed + activated at first install.
      persistence:
        type: object
        properties:
          wpContent:
            type: object
            properties:
              size:
                type: string
                default: 10Gi
              storageClass:
                type: string
                default: local-path
      ingress:
        type: object
        properties:
          host:
            type: string
            description: Override the derived `wordpress.<smeDomain>` ingress host.
          tls:
            type: object
            properties:
              issuer:
                type: string
                default: letsencrypt-prod
                description: cert-manager ClusterIssuer name.
  placementSchema:
    modes: [single-region]
    default: single-region
  manifests:
    chart: ./chart
  depends:
    - blueprint: bp-cnpg
      version: ^1.0
      alias: db
    - blueprint: bp-keycloak
      version: ^1.0
      alias: idp
    - blueprint: bp-reflector
      version: ^1.0
      alias: reflector
    - blueprint: bp-cert-manager
      version: ^1.0
      alias: tls
  upgrades:
    from: ["0.x"]
  observability:
    metrics: prometheus
    logs: stdout