From 21baf112b949de5ce8ea050dd6901da427ec8d63 Mon Sep 17 00:00:00 2001
From: pieced-ci <ci@pieced.ch>
Date: Sat, 16 May 2026 20:44:36 +0000
Subject: [PATCH] Sync chart from pieced-operator 0.1.48

---
 deploy/helm/pieced-operator/Chart.yaml        |  4 ++--
 .../pieced-operator/templates/catalog-cm.yaml | 24 +++++++++++++++++++
 deploy/helm/pieced-operator/values.yaml       |  2 +-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/pieced-operator/Chart.yaml b/deploy/helm/pieced-operator/Chart.yaml
index 7c8c101..e475214 100644
--- a/deploy/helm/pieced-operator/Chart.yaml
+++ b/deploy/helm/pieced-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: pieced-operator
 description: PieCed IT tenant lifecycle operator
-version: 0.1.47
-appVersion: "0.1.47"
+version: 0.1.48
+appVersion: "0.1.48"
 type: application
diff --git a/deploy/helm/pieced-operator/templates/catalog-cm.yaml b/deploy/helm/pieced-operator/templates/catalog-cm.yaml
index ce5af67..b0d2c44 100644
--- a/deploy/helm/pieced-operator/templates/catalog-cm.yaml
+++ b/deploy/helm/pieced-operator/templates/catalog-cm.yaml
@@ -297,6 +297,30 @@ data:
         egress_rules:
           - namespace: threema-gateway
             port: 8080
+        # OpenClaw 2026.5.x loads external plugins from
+        # /data/extensions/<dir>/openclaw.plugin.json. Three gates must
+        # be open for the runtime to register an external plugin:
+        #   1. plugins.enabled: true             — feature flag
+        #   2. plugins.allow contains the id     — security allowlist
+        #   3. plugins.entries.<id>.enabled: true — per-plugin toggle
+        # Cedric's personal instance.yaml hand-codes the same three gates
+        # for his direct `openclaw-channel-threema` plugin; this patch
+        # generates them automatically for every tenant that enables
+        # threema. The init container that copies the plugin onto the
+        # PVC is emitted by the operator (plugin_image below).
+        config_patch:
+          plugins:
+            enabled: true
+            allow:
+              - "threema"
+            entries:
+              threema:
+                enabled: true
+                config: {}
+        plugin_image:
+          repository: registry.c5ai.ch/pieced/openclaw-channel-threema-relay
+          tag: "0.1.0"
+          target_dir: openclaw-channel-threema-relay
         customer_instructions: |
           1. Once enabled, register the Threema IDs you want to receive
              messages from under "Authorized Users → threema".
diff --git a/deploy/helm/pieced-operator/values.yaml b/deploy/helm/pieced-operator/values.yaml
index 80005a4..5b79c96 100644
--- a/deploy/helm/pieced-operator/values.yaml
+++ b/deploy/helm/pieced-operator/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: registry.c5ai.ch/pieced/pieced-operator
-  tag: "0.1.47"
+  tag: "0.1.48"
   pullPolicy: IfNotPresent
 
 imagePullSecrets: