clusterBackup:
  enabled: false

  image:
    name: public.ecr.aws/zero-downtime/kubezero-admin
    # tag: v1.22.8

  # -- s3:https://s3.amazonaws.com/${CFN[ConfigBucket]}/k8s/${CLUSTERNAME}/clusterBackup
  repository: ""
  # -- /etc/cloudbender/clusterBackup.passphrase
  password: ""

  extraEnv: []

forseti:
  enabled: false

  image:
    name: public.ecr.aws/zero-downtime/forseti
    tag: v0.1.2

  aws:
    region: ""
    # -- "arn:aws:iam::${AWS::AccountId}:role/${AWS::Region}.${ClusterName}.kubezeroForseti"
    iamRoleArn: ""

sealed-secrets:
  enabled: false

  # ensure kubeseal default values match
  fullnameOverride: sealed-secrets-controller

  # Disable auto keyrotation for now
  keyrenewperiod: 0

  resources:
    requests:
      cpu: 10m
      memory: 24Mi
    limits:
      memory: 128Mi

  metrics:
    serviceMonitor:
      enabled: false

  nodeSelector:
    node-role.kubernetes.io/control-plane: ""
  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule

aws-node-termination-handler:
  enabled: false

  fullnameOverride: "aws-node-termination-handler"

  # -- "aws-node-termination-handler/${ClusterName}"
  managedTag: "aws-node-termination-handler/managed"

  useProviderId: true
  enableSqsTerminationDraining: true
  # otherwise pds fails trying to reach IMDS
  enableSpotInterruptionDraining: false
  enableProbesServer: true
  deleteLocalData: true
  ignoreDaemonSets: true
  taintNode: true
  emitKubernetesEvents: true

  # -- https://sqs.${AWS::Region}.amazonaws.com/${AWS::AccountId}/${ClusterName}_Nth
  queueURL: ""

  metadataTries: 0
  extraEnv:
  # -- "arn:aws:iam::${AWS::AccountId}:role/${AWS::Region}.${ClusterName}.awsNth"
  - name: AWS_ROLE_ARN
    value: ""
  - name: AWS_WEB_IDENTITY_TOKEN_FILE
    value: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token"
  - name: AWS_STS_REGIONAL_ENDPOINTS
    value: "regional"

  enablePrometheusServer: false
  podMonitor:
    create: false

  jsonLogging: true
  logFormatVersion: 2

  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
  nodeSelector:
    node-role.kubernetes.io/control-plane: ""

  rbac:
    pspEnabled: false

fuseDevicePlugin:
  enabled: false

awsNeuron:
  enabled: false

  image:
    name: public.ecr.aws/neuron/neuron-device-plugin
    tag: 1.9.3.0

nvidia-device-plugin:
  enabled: false
  tolerations:
  - key: nvidia.com/gpu
    operator: Exists
    effect: NoSchedule
  - key: kubezero-workergroup
    effect: NoSchedule
    operator: Exists

  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: "node.kubernetes.io/instance-type"
                operator: In
                values:
                  - g5.xlarge
                  - g5.2xlarge
                  - g5.4xlarge
                  - g5.8xlarge
                  - g5.12xlarge
                  - g5.16xlarge
                  - g5.24xlarge
                  - g5.48xlarge

cluster-autoscaler:
  enabled: false

  autoDiscovery:
    clusterName: ""
  awsRegion: "us-west-2"

  serviceMonitor:
    enabled: false
    interval: 30s

  prometheusRule:
    enabled: false
    interval: "30"

  # Disable pdb for now
  podDisruptionBudget: false

  extraArgs:
    scan-interval: 30s
    skip-nodes-with-local-storage: false

  #securityContext:
  #  runAsNonRoot: true

  nodeSelector:
    node-role.kubernetes.io/control-plane: ""
  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule

  # On AWS enable Projected Service Accounts to assume IAM role
  #extraEnv:
  # AWS_ROLE_ARN: <IamArn>
  # AWS_WEB_IDENTITY_TOKEN_FILE: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token" 
  # AWS_STS_REGIONAL_ENDPOINTS: "regional"

  #extraVolumes:
  #- name: aws-token
  #  projected:
  #    sources:
  #    - serviceAccountToken:
  #        path: token
  #        expirationSeconds: 86400
  #        audience: "sts.amazonaws.com"

  #extraVolumeMounts:
  #- name: aws-token
  #  mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
  #  readOnly: true

external-dns:
  enabled: false

  interval: 3m
  triggerLoopOnEvent: true

  tolerations:
  - key: node-role.kubernetes.io/master
    effect: NoSchedule
  - key: node-role.kubernetes.io/control-plane
    effect: NoSchedule
  nodeSelector:
    node-role.kubernetes.io/control-plane: ""

  #logLevel: debug
  sources:
    - service
  #- istio-gateway

  provider: inmemory