credentials:
  user: sre-admin
  ask_sudo_password: false
  private_key_file: /home/sre-admin/.ssh/id_rsa

hosts:
  - hostname: vbox-prod-k8s-master-01
    ip: "10.250.50.22"
    roles: [control_plane, etcd]

    # # Optional creds for each host
    # user: user
    # password: nF5S8nuKi87Dh42Jnjik

  - hostname: vbox-prod-k8s-slave-01
    ip: "10.250.50.23"
    roles: [node]

  - hostname: vbox-prod-k8s-slave-02
    ip: "10.250.50.21"
    roles: [node]

default_registry: ""

orchestrator:
  version: v1.29.0
  cluster_name: k8s-cluster.local
  # bin_dir: /usr/local/bin
  # sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
  loadbalancer_apiserver_port: 6443
  dns:
    servers:
      - 8.8.8.8
      - 8.8.4.4
    disable_host_nameservers: false
  # cloud_provider: ""  # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
  # external_cloud_provider: ""  # 'openstack', 'vsphere' and 'hcloud'

  container_engine:
    type: containerd # docker, crio and containerd
    install: true

  ping_access_ip: true
  auto_renew_certificates: true
  event_ttl: "1h0m0s"
  pod_security_policy_enabled: true

  network:
    plugin: calico # cilium, calico, kube-ovn, weave or flannel
    # service_addresses: 10.233.0.0/18
    # pods_subnet: 10.233.64.0/18

modules:
  admin_password: changeit

  # additional_repositories:
  #   - name: argo-helm
  #     url: "https://argoproj.github.io/argo-helm"

  observability:
    enabled: true

    logging:
      enabled: true

      loki:
        persistence:
          storage_size: 10Gi
          retention: 168h

      events:
        enabled: true
        cron:
          schedule: "*/2 * * * *"

    tracing:
      enabled: true

      tempo:
        retention: 24h
        listen_port: 3100

        persistence:
          storage_size: 10Gi

        tempo_query:
          listen_port: 16686

    monitoring:
      enabled: true

      prometheus:
        scrape_interval: 15s
        persistence:
          storage_size: 3Gi
          retention: 7d

      alert_manager:
        enabled: false

        # route:
        #   receiver: kvazaric_notifications
        #   group_wait: 1s
        #   repeat_interval: 180m

        #   routes:
        #     - receiver: "kvazaric_notifications"
        #       group_by: ["alertname"]
        #       group_wait: 1s
        #       repeat_interval: 8737h
        #       matchers:
        #         - fireOnce=true
        # receivers:
        #   - name: kvazaric_notifications
        #     telegram_configs:
        #       - send_resolved: true
        #         api_url: https://api.telegram.org
        #         bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I
        #         chat_id: -968770779
        #         parse_mode: HTML
        #         message: '{{ template "telegram-message" . }}'
        #         http_config:
        #           follow_redirects: true
        #           enable_http2: false
      blackbox:
        enabled: true
        additional_modules: |

      kube_state:
        enabled: true

      node:
        enabled: true

    visualization:
      enabled: true

      grafana:
        enabled: true
        expose:
          type: ingress

          domain: grafana.disk.lt.t1.cloud

          tls:
            enabled: true

        persistence:
          storage_size: 2Gi

  cicd:
    enabled: true

    argo_cd:
      expose:
        type: ingress
        domain: argocd.disk.lt.t1.cloud

        tls:
          enabled: true

      repositories:
        {}
        # harbor-helm:
        #   enableOCI: "true"
        #   type: helm
        #   name: helm-mountbit
        #   url: harbor.disk.t1.cloud/mountbit-helm
        #   username: username
        #   password: password
      rbac:
        additional_policies: |
          p, developer, applications, *, */*, allow

          p, developer, applications, *, */*logging*, deny
          p, developer, repositories, get, *, allow
          p, developer, projects, get, *, allow

          p, developer, logs, get, *, allow

          p, guest, applications, get, */*, allow
          p, guest, projects, get, *, allow

      ha:
        enabled: false
        autoscaling: false

    rollouts:
      enabled: true

    updates_operator:
      enabled: true

  secrets_storage:
    enabled: true
    expose:
      type: ingress # NodePort
      domain: vault.disk.lt.t1.cloud
      node_port: 30004

      tls:
        enabled: true

    # requires secrets_store_csi_driver in additional modules
    csi_integration:
      enabled: true
      image: hashicorp/vault-csi-provider
      version: 1.4.1
    agent:
      image: hashicorp/vault
      version: 1.15.6
    injector:
      image: hashicorp/vault-k8s
      version: 1.3.1
    server:
      image: "hashicorp/vault"
      version: 1.15.6
      persistence:
        size: 10Gi

  registry:
    enabled: true
    expose:
      type: ingress # ingress or NodePort
      # if expose_type is "ingress"
      domain: harbor.disk.lt.t1.cloud

      # if expose_type is "NodePort"
      node_port_http: 30002
      node_port_https: 30003
    tls:
      enabled: true

    persistence:
      registry_size: 10Gi
      jobservice_size: 1Gi
      database_size: 2Gi
      redis_size: 1Gi
      trivy_size: 5Gi

    defaultProjects:
      - name: harbor-helm
        public: false
    enabled_scanner: true

  additional:
    cert_manager:
      install: true
      dns_servers:
        - "1.1.1.1"
        - "8.8.8.8"
      account_email: reversstorm@gmail.com

    ingress:
      type: nginx # nginx
      install: true
      insecure_port: 80
      secure_port: 443
      ingress_class_name: nginx
      host_network: true

    # load_balancer:
    #   type: metallb
    #   install: true

    storage:
      local_path_provisioner:
        storage_class_name: local-path
        reclaim_policy: Delete

      longhorn:
        enabled: true

      secrets_store_csi_driver:
        enabled: true

      ## TODO: ceph