values.yaml

# Default values for ditto-umbrella-chart.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  debug: false
  trace: false

  #Create a storage class for local k8s clusters or k8s clusters that do not use dynamic provisioners out of box
  # Default provisioner is for rancher cluster
  # Disable if you have a k8s cluster with a default dynamic provisioner
  storageClass:
    create: false

  privateCA: false

  # comma separated list of domains or ip addresses that will not use the proxy
  noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local

  imagePullSecrets: []

  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  podAnnotations: {}

  podSecurityContext:
    {}
    # fsGroup: 2000

  securityContext:
    {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  nodeSelector: {}
  tolerations: []
  affinity: {}

# -- Configure the ingresses for the chart here.
# Additional ingresses can be added by adding a dictionary key similar to the 'main' ingress.
# @default -- See below
ingress:
  main:
    # -- Enables or disables the ingress
    enabled: false

    # -- Make this the primary ingress (used in probes, notes, etc...).
    # If there is more than 1 ingress, make sure that only 1 ingress is marked as primary.
    primary: true

    # -- Override the name suffix that is used for this ingress.
    nameOverride:

    # -- Provide additional annotations which may be required.
    annotations:
      {}
      # kubernetes.io/ingress.class: traefik
      # kubernetes.io/tls-acme: "true"

    # -- Provide additional labels which may be required.
    labels: {}

    # -- Set the ingressClass that is used for this ingress.
    # Requires Kubernetes >=1.19
    ingressClassName: # "traefik"

    ## Configure the hosts for the ingress
    hosts:
      - # -- Host address. Helm template can be passed.
        host: chart-example.local
        ## Configure the paths for the host
        paths:
          - # -- path.  helm template can be passed.
            path: /_ditto
            # -- ignored if not kubeversion >= 1.14-0
            pathtype: prefix
            service:
              # -- overrides the service name reference for this path
              name: ditto-bp-hydra-subscription
              # -- overrides the service port reference for this path
              port: 8080

          - # -- path.  helm template can be passed.
            path: /
            # -- ignored if not kubeversion >= 1.14-0
            pathtype: prefix
            service:
              # -- overrides the service name reference for this path
              name: ditto-bp-hydra-subscription
              # -- overrides the service port reference for this path
              port: 10080

    # -- Configure TLS for the ingress. Both secretName and hosts can process a Helm template.
    tls: []

########################################################################
# Hades Default Values
# Custom Resource Definitions
# This application requires the `hydracluster.hades.app.ditto.live`
# custom resource definition be installed on the target k8s cluster.
########################################################################

hades:
  enabled: true
  replicaCount: 1
  image:
    name: quay.io/ditto-external/big-peer-store-controller:1.39.2
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.

  podAnnotations: {}
  podLabels: {}
  podSecurityContext:
    {}
    # fsGroup: 2000

  securityContext:
    {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  nodeSelector: {}

  tolerations: []

  affinity: {}

  volumeMounts: []
  volumes: []

  autoscaling:
    enabled: false

  nameOverride: ""
  fullnameOverride: ""

  env:
    logFormatter: json
    rustLog: hades=info,kube=warn,kube_coordinate=info,k8s_controller=warn,k8s_helpers=info,hades::k8s::controllers::cluster_config=debug

  deployment:
    containerPort: 8080
    livenessProbe:
      enabled: true
    readinessProbe:
      enabled: true
    configReadOnlyMode: false
    controllers:
      - HydraPartition
      - HydraReplica
      - HydraPartitionStatus
      - ClusterConfig

  # ensure compatibility with hades v1 by default
  compat: false
  deployGlobal: false

  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  #Service
  service:
    type: ClusterIP
    port: 80

  resources:
    {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

###################################################################
# Hydra Consul Default Values
# For more information see consul helm chart link
# https://github.com/hashicorp/consul-k8s/tree/v1.2.0/charts/consul
#####################################################################

hydra-consul:
  enabled: true

  # Default values for hydra-consul.
  consul:
    fullnameOverride: ditto-hydra-consul
    # Holds values that affect multiple components of the chart.
    global:
      enabled: false
    # Values that configure running a Consul client on Kubernetes nodes.
    client:
      # If true, the chart will install all
      # the resources necessary for a Consul client on every Kubernetes node. This _does not_ require
      # `server.enabled`, since the agents can be configured to join an external cluster.
      # @type: boolean
      enabled: false
    # Configures the automatic Connect sidecar injector.
    connectInject:
      # True if you want to enable connect injection. Set to "-" to inherit from
      # global.enabled.
      enabled: false

    # Configuration for DNS configuration within the Kubernetes cluster.
    # This creates a service that routes to all agents (client or server)
    # for serving DNS requests. This DOES NOT automatically configure kube-dns
    # today, so you must still manually configure a `stubDomain` with kube-dns
    # for this to have any effect:
    # https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#configure-stub-domain-and-upstream-dns-servers
    dns:
      enabled: false
    # Server, when enabled, configures a server cluster to run. This should
    # be disabled if you plan on connecting to a Consul cluster external to
    # the Kube cluster.
    server:
      # If true, the chart will install all the resources necessary for a
      # Consul server cluster. If you're running Consul externally and want agents
      # within Kubernetes to join that cluster, this should probably be false.
      # @default: global.enabled
      # @type: boolean
      enabled: true
      connect: false
      replicas: 1
      extraConfig: |
        {
          "leave_on_terminate": true
        }
  #Enables you to configure network access to the components enabled in the hydra-consul install.
  networkPolicies:
    enabled: false
    ingress:
      httpApi:
        - podSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                  - hydra-subscription
                  - hydra-api

    # Egress Rules for the Hydra Consul, these can be templated and refer to other Values if needed.
    # In the spec.egress field, you can specify multiple to conditions and ports that the egress rule applies to.
    egress:
      - to:
          - namespaceSelector: {}
            podSelector:
              matchLabels:
                k8s-app: kube-dns
        ports:
          - port: 1053
            protocol: UDP
          - port: 1053
            protocol: TCP

#################################
# Hydra Store Default Values
################################

hydra-store:
  enabled: true

  # Default values for hydra.
  # This is a YAML-formatted file.
  # Declare variables to be passed into your templates.

  image:
    # fully specified image name, including the registry
    name: quay.io/ditto-external/big-peer-store:1.39.2
    # whether to pull the image from the registry before running or not. "IfNotPresent", "Always", and "Never"
    pullPolicy: IfNotPresent

  version: v1alpha3

  # imagePullSecrets[] -- secret references for access to private image repositories
  imagePullSecrets: []

  serviceAccount:
    # -- Specifies whether a service account should be created
    create: true
    # -- Annotations to add to the service account
    annotations: {}
    # -- The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  podAnnotations: {}

  podLabels: {}

  podSecurityContext:
    {}
    # fsGroup: 2000

  securityContext:
    capabilities:
      add:
        - IPC_LOCK
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    # -- the port exposed by the service, used by other pods to access HyDRA
    port: 8080

  # -- the RUST_LOG for the server pods
  rustLog: "info,hydra_store=debug,hydra_common=debug"

  additionalEnv:
    TRACING_FORMAT: json

  resources:
    {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary.
    # these defaults have been added here to match the existing manifests.
    # limits:
    #   cpu: "200m"
    #   memory: "128Mi"
    # requests:
    #   cpu: "200m"
    #   memory: "128Mi"

  persistence:
    size: 1Gi
    ## set on cluster to appropriate values
    # storageClassName: standard

  nodeSelector: {}

  tolerations: []

  affinity: {}

  partitioning:
    standard:
      partitions: 1
      replicationFactor: 1

  # partitionSpreadConstraints:
  #   - topologyKey: "kubernetes.io/hostname"
  #     type: required
  #     labelKeys:
  #       - "hades.app.ditto.live/hydrapartition"

  # used to manage the kafkatopic resource
  kafka:
    # -- name of the kafka cluster that the topic should be created in (template)
    clusterName: "{{.Release.Name}}-kafka"
    # -- namespace of the kafka cluster that the topic should be created in (template)
    namespace: "{{ .Release.Namespace }}"
    # -- broker service (template)
    brokerService: "{{ tpl $.Values.kafka.clusterName . }}-kafka-brokers.{{ tpl $.Values.kafka.namespace . }}:9092"
    # -- whether to create the `KafkaTopic` resource for the transaction topic.
    #    This can be disabled if the topic is managed externally or if you're not using Strimzi
    createTopic: true
    # -- name of the topic for transactions (template)
    transactionsTopic: '{{ include "hydra.fullname" . }}-{{ .Release.Namespace }}-transactions'
    topicReplication: 1
    # -- additional topic level configuration for the transaction topic
    topicConfig:
      "cleanup.policy": "delete"
      "max.message.bytes": 104857600

  serviceMonitor:
    # serviceMonitor.enabled -- If true, creates a Prometheus Operator ServiceMonitor.
    enabled: false
    # serviceMonitor.interval -- Interval that Prometheus scrapes metrics.
    interval: 5s
    ## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1)
    ## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters)
    # serviceMonitor.selector -- Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install.
    selector:
      release: prometheus-operator
    # serviceMonitor.path -- The path to scrape for metrics; autoscaler exposes `/metrics` (this is standard)
    path: /metrics
    # serviceMonitor.relabelings -- The list of [metric relabeling configs](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#relabelconfig) for prometheus
    # @default -- automatically adds labels that contain app.ditto.live or app.kubernetes.io under `pod_label_<label-name>`
    relabelings:
      - action: labelmap
        regex: "__meta_kubernetes_pod_label_(app_ditto_live_.*|.*_app_ditto_live_.*|app_kubernetes_io_.*)"
        replacement: "pod_label_$1"

######################################
# Hydra Subscription Default Values
# Dependencies: Hydra-Store, Hades
#####################################
hydra-subscription:
  enabled: true

  replicaCount: 1

  image:
    name: quay.io/ditto-external/big-peer-subscription:1.39.2
    pullPolicy: IfNotPresent

  service:
    wsPort: 8080
    httpPort: 10080

  clusterDomain: local

  ingress:
    enabled: false
    annotations: {}
    # ingress.publicDomain -- The base domain for public app specific routes (templated)
    publicDomain: "{{ $.Values.clusterDomain }}"
    # ingress.internalDomain -- The base domain for internal cluster specific routes (templated)
    internalDomain: "{{ $.Values.clusterDomain }}"
    # ingress.internalHosts -- A list of inputs for internal ingresses
    internalHosts:
      - name: development
        subdomain: "subscriptions-{{ .Release.Namespace }}"
        additionalAnnotations: {}
    appSpecific:
      []
      # - appId: "00000000-0000-0000-0000-000000000002"
      #   appName: "test2"
      #   organization: "test2"
      #   additionalAnnotations: {}
      #   websocketAnnotations: {}
      # - appId: "16f982f2-0cf3-4227-9212-b5dff105f1ca"
      #   appName: "cool-app-1"
      #   organization: "WeMakeApps"
      #   additionalAnnotations: {}
      #   websocketAnnotations:
      #     thisisa: websocketingress
      #   httpAnnotations:
      #     thisisa: httpingress

  dataVolumeSizeLimit: 1Gi

  hydraCluster:
    # -- The name of the HydraCluster object to target
    name: "ditto-bp-hydra-store"
    # -- The query url of the HydraCluster (templated)
    queryUrl: "http://{{ $.Values.hydraCluster.name }}:8080/"
    # -- The session url of the HydraCluster (templated)
    sessionUrl: "dnssrv+_http._tcp.{{ $.Values.hydraCluster.name }}-session"
    # -- The transactions topic of the HydraCluster where writes are written (templated)
    transactionsTopic: "{{ $.Values.hydraCluster.name }}-{{ $.Release.Namespace }}-transactions"
    # transactionsTopic: '{{ include "hydra.fullname" . }}-{{ .Release.Namespace }}-transactions'

  # used to manage the kafkatopic resource
  kafka:
    # -- name of the kafka cluster that the topic should be created in (template)
    clusterName: "{{.Release.Name}}-kafka"
    # -- namespace of the kafka cluster that the topic should be created in (template)
    namespace: "{{ .Release.Namespace }}"

  env:
    dataPath: /subscription-server
    logLevel: info,hydra_subscription=debug,hydra_common=debug,ditto_auth=debug
    logFormatter: json
    kafkaBootstrapHost: "{{ tpl $.Values.kafka.clusterName . }}-kafka-brokers.{{ tpl $.Values.kafka.namespace . }}:9092"
    tracingHost: ""
    consulHttpAddr: ditto-hydra-consul-server:8500
    authAPIKeyServerUrl: "http://ditto-bp-dummy-auth-webhook.service"

  additionalEnv: {}

  podAnnotations: {}

  podSecurityContext:
    {}
    # fsGroup: 2000

  securityContext:
    {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  resources: {}

  nodeSelector: {}

  tolerations: []

  affinity: {}

  serviceMonitor:
    # serviceMonitor.enabled -- If true, creates a Prometheus Operator ServiceMonitor.
    enabled: false

  attachmentStore:
    # attachmentStore.enabled -- If true, stores attachments in a blob store.
    enabled: false

  serviceAccount:
    # serviceAccount.create -- If true, create a service account
    create: true
    # serviceAccount.name -- The name of the service account to use (templated)
    name: ""
    # serviceAccount.annotations -- Annotations to add to the service account
    annotations: {}

  # auth - configuration for JWT authentication
  auth:
    # auth.secretName - the name of the secret that contains the JWT encoding and decoding keys (templated)
    secretName: '{{ include "subscription-server.fullname" . }}-jwt-tokens'
    # auth.encodingKeyRef - the key in the secret that contains the JWT encoding key
    encodingKeyRef: "tls.key"
    # auth.decodingKeyRef - the key in the secret that contains the JWT decoding key
    decodingKeyRef: "tls.crt"
    # auth.additionalDecodingKeys - list of additional valid JWT decoding keys
    additionalDecodingKeys: []
    certificate:
      # auth.certificate.create - create a cert-manager certificate for the JWT keys
      create: true
      # auth.certificate.name - the name of the cert-manager certificate (templated)
      name: "cert"
      # auth.certificate.commonName - the common name of the cert-manager certificate (templated)
      commonName: "dev-jwt-issuer"
      # auth.certificate.issuerRef - the name of the cert-manager issuer to use
      issuerRef: "{{ .Values.certManager.selfSignedIssuer.name }}"

  # deviceAuth - configuration for offline peer to peer device certificate authentication
  deviceAuth:
    # deviceAuth.secretName - the name of the secret that contains the device CA certificate and key (templated)
    secretName: '{{ include "subscription-server.fullname" . }}-device-certs'
    # deviceAuth.caEncodingKeyRef - the key in the secret that contains the device CA private key, used for signing device certificates (caEncodingKey literal value takes precedence over caEncodingKeyRef)
    caEncodingKeyRef: "tls.key"
    # deviceAuth.additionalCATrustedCerts - list of additional CA certificates to trust for device authentication
    additionalCATrustedCerts: []
    certificate:
      # deviceAuth.certificate.create - create a cert-manager certificate for the device CA
      create: true
      # deviceAuth.certificate.name - the name of the cert-manager certificate (templated)
      name: "device-cert"
      # deviceAuth.certificate.commonName - the common name of the cert-manager certificate (templated)
      commonName: "dev-device-cert-issuer"
      # deviceAuth.certificate.issuerRef - the name of the cert-manager issuer to use
      issuerRef: "{{ .Values.certManager.selfSignedIssuer.name }}"

  globalAuthConfig:
    # globalAuthConfig.providers -- object containing a list of global default auth providers.  These providers will be available to every app and can not be disabled.
    "providers":
      {
        "dummy-provider":
          {
            "type": "tokenWebhook",
            "webhookUrl": "http://ditto-bp-dummy-auth-webhook/validate_token",
          },
        "__playgroundProvider":
          {
            "type": "anonymous",
            "sessionLength": 630000,
            "sharedToken": "test",
            "permission":
              {
                "read": { "everything": true, "queriesByCollection": {} },
                "write": { "everything": true, "queriesByCollection": {} },
              },
          },
      }

  certManager:
    enabled: true
    selfSignedIssuer:
      create: true
      name: selfsigned-issuer

  networkPolicies:
    enabled: false

  # -- the configuration of the statefulset for the http api server
  apiServer:
    enabled: true
    replicaCount: 1
    env: {}
    additionalEnv: {}
    additionalLabels: {}
    resources: {}
    networkPolicies:
      enabled: false

######################################
# Service Token Validator
#####################################
# Default values for service-token-validator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
service-token-validator:
  enabled: false

######################################
# Cert Manager
# More Information see https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
######################################

# Default values for cert-manager.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
cert-manager:
  enabled: true

  replicaCount: 2
  namespace: kube-system

  strategy:
    {}
    # type: RollingUpdate
    # rollingUpdate:
    #   maxSurge: 0
    #   maxUnavailable: 1

  # Comma separated list of feature gates that should be enabled on the
  # controller pod.
  featureGates: ""

  serviceAccount:
    # Specifies whether a service account should be created
    create: true
    # The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    # name: ""
    # Optional additional annotations to add to the controller's ServiceAccount
    # annotations: {}
    # Automount API credentials for a Service Account.
    automountServiceAccountToken: true

  # Optional additional arguments
  extraArgs:
    # Use this flag to set a namespace that cert-manager will use to store
    # supporting resources required for each ClusterIssuer (default is kube-system)
    # - --cluster-resource-namespace=kube-system
    # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
    - --enable-certificate-owner-ref=true
    # Use this flag to enabled or disable arbitrary controllers, for example, disable the CertificiateRequests approver
    # - --controllers=*,-certificaterequests-approver

  extraEnv: []
  # - name: SOME_VAR
  #   value: 'some value'

  resources:
    requests:
      cpu: 10m
      memory: 32Mi

  # Pod Security Context
  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
  securityContext:
    runAsNonRoot: true
  # legacy securityContext parameter format: if enabled is set to true, only fsGroup and runAsUser are supported
  # securityContext:
  #   enabled: false
  #   fsGroup: 1001
  #   runAsUser: 1001
  # to support additional securityContext parameters, omit the `enabled` parameter and simply specify the parameters
  # you want to set, e.g.
  # securityContext:
  #   fsGroup: 1000
  #   runAsUser: 1000
  #   runAsNonRoot: true

  # Container Security Context to be set on the controller component container
  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
  containerSecurityContext:
    {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true

  volumes: []

  volumeMounts: []

  # Optional additional annotations to add to the controller Deployment
  # deploymentAnnotations: {}

  # Optional additional annotations to add to the controller Pods
  # podAnnotations: {}

  podLabels:
    app.ditto.live/tier: "master"
    app.ditto.live/exposed: "false"
    app.ditto.live/runtime: "golang"
    app.ditto.live/repo: "cloud-infra"

  # Optional additional labels to add to the controller Service
  # serviceLabels: {}

  # Optional DNS settings, useful if you have a public and private DNS zone for
  # the same domain on Route 53. What follows is an example of ensuring
  # cert-manager can access an ingress or DNS TXT records at all times.
  # NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
  # the cluster to work.
  # podDnsPolicy: "None"
  # podDnsConfig:
  #   nameservers:
  #     - "1.1.1.1"
  #     - "8.8.8.8"

  # Ensure the pods are deployed to nodes with the matching laebls
  # nodeSelector:
  #   app.ditto.live/tier: "infrastructure"

  ingressShim:
    {}
    # defaultIssuerName: ""
    # defaultIssuerKind: ""
    # defaultIssuerGroup: ""

  prometheus:
    enabled: false

######################################
# Dummy Auth Webhook
#####################################
dummy-auth-webhook:
  enabled: true

  image:
    name: quay.io/ditto-external/big-peer-auth-webhook:1.39.2
    pullPolicy: IfNotPresent

######################################
# Big Peer Authorization Middleware
#####################################
bpam:
  enabled: false

######################################
# Strimzi Kafka Operator
#####################################
strimzi-kafka-operator:
  enabled: true
  replicas: 1
  # Installs Cluster Roles, Service Accounts etc.
  createGlobalResources: true
  watchAnyNamespace: true
  tolerations: []
  affinity: {}
  # nodeSelector:
  #   app.ditto.live/tier: infrastructure
  labels:
    app.ditto.live/service-group: "kafka"
    app.ditto.live/exposed: "false"
    app.ditto.live/repo: "ditto-umbrella-chart"
    app.ditto.live/tier: "infrastructure"
  # zookeeper:
  #   replicas: 1
  # resources:
  #   limits:
  #     memory: 1Gi
  #     cpu: 1
  #   requests:
  #     memory: 1Gi
  #     cpu: 1