values.yaml

# Default values for hyperfleet-api
# This is a YAML-formatted file.

replicaCount: 1

image:
  registry: CHANGE_ME  # Set to your actual container registry (e.g. quay.io)
  repository: CHANGE_ME # e.g. openshift-hyperfleet/hyperfleet-api
  pullPolicy: Always
  tag: ""  # Required — no default. Set via --set image.tag=<version>

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

# ============================================================
# Container Ports
# ============================================================
# These ports must match the application configuration
ports:
  api: 8000      # Must match config.server.port
  health: 8080   # Must match config.health.port
  metrics: 9090  # Must match config.metrics.port

# ============================================================
# Application Configuration
# ============================================================
# All application settings are configurable via this section.
# These values generate the ConfigMap used by the application.
# ============================================================
config:
  # Use existing ConfigMap instead of generating one
  # If set, all config.* values below are ignored
  existingConfigMap: ""

  # Server configuration
  server:
    hostname: ""
    host: "0.0.0.0"
    port: 8000

    timeouts:
      read: 5s
      write: 30s

    tls:
      enabled: false
      cert_file: ""
      key_file: ""

    jwt:
      enabled: true

    authz:
      enabled: false

    jwk:
      cert_file: ""
      cert_url: "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/certs"

    acl:
      file: ""

  # Database configuration
  database:
    dialect: postgres

    # Connection settings
    # Note: username/password MUST be provided via Secret (not ConfigMap)
    # See database.external.secretName or database.postgresql.enabled for credentials
    host: ""  # Auto-set for built-in DB, or specify external host
    port: 5432
    name: hyperfleet

    # Application behavior settings
    debug: false

    ssl:
      mode: disable
      root_cert_file: ""

    pool:
      max_connections: 50
      max_idle_connections: 10
      conn_max_lifetime: 5m
      conn_max_idle_time: 1m
      request_timeout: 30s
      conn_retry_attempts: 10
      conn_retry_interval: 3s

  # Logging configuration
  logging:
    level: info
    format: json
    output: stdout

    # OpenTelemetry tracing (HyperFleet standard)
    # Configuration via standard environment variables.
    # See: https://github.com/openshift-hyperfleet/architecture/blob/main/hyperfleet/standards/tracing.md#configuration
    otel:
      enabled: true

    masking:
      enabled: true
      headers:
        - Authorization
        - X-API-Key
        - Cookie
        - X-Auth-Token
        - X-Forwarded-Authorization
      fields:
        - password
        - secret
        - token
        - api_key
        - access_token
        - refresh_token
        - client_secret

  # Metrics configuration
  metrics:
    host: 0.0.0.0  # Must be 0.0.0.0 in Kubernetes for Service to access
    port: 9090

    tls:
      enabled: false

    label_metrics_inclusion_duration: 168h

  # Health check configuration
  health:
    host: 0.0.0.0  # Must be 0.0.0.0 in Kubernetes for liveness/readiness probes
    port: 8080

    tls:
      enabled: false

    shutdown_timeout: 20s
    db_ping_timeout: 2s

  # Adapters required for resources to reach "Ready" state
  # Production deployments should specify adapters
  adapters:
    required:
      cluster: []  # Example: [validation, dns, pullsecret, hypershift]
      nodepool: []  # Example: [validation, hypershift]

# ============================================================
# Kubernetes Resources
# ============================================================
serviceAccount:
  create: true
  annotations: {}
  name: ""

podAnnotations: {}
podLabels: {}

podSecurityContext:
  fsGroup: 65532
  runAsNonRoot: true
  runAsUser: 65532

securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
  seccompProfile:
    type: RuntimeDefault

service:
  type: ClusterIP
  # Service ports are set to match container ports (ports.api, ports.health, ports.metrics)

resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80
  targetMemoryUtilizationPercentage: 80

# Pod Disruption Budget configuration
podDisruptionBudget:
  enabled: false
  minAvailable: 1
  # Maximum number of pods that can be unavailable during disruption
  # maxUnavailable: 1

# ============================================================
# Infrastructure Configuration
# ============================================================
# These settings control Kubernetes infrastructure components
# (PostgreSQL pod, secrets, pgbouncer sidecar)
# ============================================================

# Database infrastructure
database:
  # For PRODUCTION: Use external database (GCP Cloud SQL, etc.)
  # Set external.enabled=true and provide connection details
  #
  # For DEVELOPMENT: Use built-in PostgreSQL pod
  # Set postgresql.enabled=true (default)

  # External database configuration (production)
  external:
    enabled: false
    # Name of existing secret with db.host, db.port, db.name, db.user, db.password keys
    secretName: ""

  # PgBouncer connection pooler sidecar (opt-in for production)
  # Runs as a sidecar container, proxying connections to PostgreSQL
  pgbouncer:
    enabled: false
    image: public.ecr.aws/bitnami/pgbouncer:1.25.1
    port: 6432
    poolMode: transaction
    defaultPoolSize: 50
    maxClientConn: 100
    minPoolSize: 5
    serverIdleTimeout: 600
    serverLifetime: 3600
    resources:
      limits:
        cpu: 200m
        memory: 128Mi
      requests:
        cpu: 50m
        memory: 64Mi

  # Built-in PostgreSQL for development/testing
  postgresql:
    enabled: true
    image: docker.io/library/postgres:14.2
    database: hyperfleet
    user: hyperfleet
    password: hyperfleet-dev-password
    port: 5432
    resources:
      limits:
        cpu: 500m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi
    persistence:
      enabled: false
      size: 1Gi
      storageClass: ""

# ServiceMonitor for Prometheus Operator
serviceMonitor:
  enabled: false
  interval: 30s
  scrapeTimeout: 10s
  labels: {}
  namespace: ""

# ============================================================
# Advanced Overrides (Escape Hatch)
# ============================================================
# Additional environment variables to override ConfigMap values.
# Use sparingly - prefer modifying config.* values above.
# See docs/deployment.md#environment-variables for examples.
extraEnv: []

# Volume mounts for additional configs
extraVolumeMounts: []

# Additional volumes
extraVolumes: []