credentials:
  user: sre-admin
  ask_sudo_password: false
  private_key_file: /home/sre-admin/.ssh/id_rsa

hosts:
  - hostname: vbox-prod-k8s-master-01
    ip: "10.250.50.22"
    roles: [control_plane, etcd]

    # # Optional creds for each host
    # user: user
    # password: nF5S8nuKi87Dh42Jnjik

  - hostname: vbox-prod-k8s-slave-01
    ip: "10.250.50.23"
    roles: [node]

  - hostname: vbox-prod-k8s-slave-02
    ip: "10.250.50.21"
    roles: [node]

orchestrator:
  version: v1.29.0
  cluster_name: k8s-cluster.local
  # bin_dir: /usr/local/bin
  # sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
  loadbalancer_apiserver_port: 6443
  dns:
    servers:
      - 8.8.8.8
      - 8.8.4.4
    disable_host_nameservers: false
  # cloud_provider: ""  # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
  # external_cloud_provider: ""  # 'openstack', 'vsphere' and 'hcloud'

  container_engine:
    type: containerd # docker, crio and containerd
    install: true

  ping_access_ip: true
  auto_renew_certificates: true
  event_ttl: "1h0m0s"
  pod_security_policy_enabled: true

  network:
    plugin: calico # cilium, calico, kube-ovn, weave or flannel
    # service_addresses: 10.233.0.0/18
    # pods_subnet: 10.233.64.0/18

modules:
  admin_password: changeit

  ## Add additional helm repositories before installation
  # additional_repositories:
  #   - name: argo-helm
  #     url: "https://argoproj.github.io/argo-helm"

  observability:
    enabled: true

    logging:
      enabled: true

      loki:
        persistence:
          storage_size: 10Gi
          retention: 168h

      events:
        enabled: true
        cron:
          schedule: "*/2 * * * *"

    tracing:
      enabled: true

      tempo:
        retention: 24h
        listen_port: 3100

        persistence:
          storage_size: 10Gi

        tempo_query:
          listen_port: 16686

    monitoring:
      enabled: true

      prometheus:
        scrape_interval: 15s
        persistence:
          storage_size: 3Gi
          retention: 7d

      alert_manager:
        enabled: true
        # additionalMessageTemplates: {}

        route:
          receiver: kvazaric_notifications
          group_wait: 1s
          repeat_interval: 180m

          routes:
            - receiver: "kvazaric_notifications"
              group_by: ["alertname"]
              group_wait: 1s
              repeat_interval: 8737h
              matchers:
                - fireOnce=true
        receivers:
          - name: kvazaric_notifications
            telegram_configs:
              - send_resolved: true
                api_url: https://api.telegram.org
                bot_token: bot_token
                chat_id: chat_id # int
                parse_mode: HTML
                message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
                http_config:
                  follow_redirects: true
                  enable_http2: false

      blackbox:
        enabled: true
        additional_modules: |

      kube_state:
        enabled: true

      node:
        enabled: true

    visualization:
      enabled: true

      grafana:
        enabled: true
        expose:
          type: ingress # ingress or NodePort
          domain: grafana.disk.lt.t1.cloud
          node_port_http: 30007

          tls:
            enabled: true

        persistence:
          storage_size: 2Gi

  cicd:
    enabled: true

    argo_cd:
      expose:
        type: ingress # ingress or NodePort
        domain: argocd.disk.lt.t1.cloud

        node_port_http: 30005
        node_port_https: 30006

        tls:
          enabled: true

      repositories:
        {}
        # harbor-helm:
        #   enableOCI: "true"
        #   type: helm
        #   name: helm-mountbit
        #   url: harbor.disk.t1.cloud/mountbit-helm
        #   username: username
        #   password: password
      rbac:
        additional_policies: |
          p, developer, applications, *, */*, allow

          p, developer, applications, *, */*logging*, deny
          p, developer, repositories, get, *, allow
          p, developer, projects, get, *, allow

          p, developer, logs, get, *, allow

          p, guest, applications, get, */*, allow
          p, guest, projects, get, *, allow

      ha:
        enabled: false
        autoscaling: false

    rollouts:
      enabled: true
      ha:
        enabled: true
      expose:
        type: "NodePort" # now only NodePort supported
        node_port: 30010

    updates_operator:
      enabled: true

  secrets_storage:
    enabled: true
    key_shares: 5
    key_threshold: 3

    # specify unseal keys to auto-unseal after updates or restarts
    unseal_keys:
      - "abc"
      - "abc"
      - "abc"
    expose:
      type: ingress # ingress or NodePort
      domain: vault.disk.lt.t1.cloud
      node_port: 30004

      tls:
        enabled: true

    # requires secrets_store_csi_driver in additional modules
    csi_integration:
      enabled: true
    agent:
      image: hashicorp/vault
      tag: 1.16.0
    server:
      image: "hashicorp/vault"
      tag: 1.16.0
      persistence:
        size: 10Gi

  registry:
    enabled: true
    expose:
      type: ingress # ingress or nodePort
      # if expose_type is "ingress"
      domain: harbor.disk.lt.t1.cloud

      # if expose_type is "NodePort"
      node_port_http: 30002
      node_port_https: 30003
    tls:
      enabled: true

    persistence:
      registry_size: 10Gi
      jobservice_size: 1Gi
      database_size: 2Gi
      redis_size: 1Gi
      trivy_size: 5Gi

    enabled_scanner: true

  additional:
    cert_manager:
      enabled: true
      ha_enabled: false
      dns_servers:
        - "1.1.1.1"
        - "8.8.8.8"
      account_email: reversstorm@gmail.com

    ingress:
      type: nginx # nginx
      enabled: true
      ingress_class_name: nginx
      host_network: true

    # load_balancer:
    #   type: metallb
    #   install: true

    # docker_secrets:
    #   repositories:
    #     - name: registry
    #       repository: registry.example.com
    #       username: admin
    #       password: admin
    #       namespaces:
    #         - default

    storage:
      local_path_provisioner:
        storage_class_name: local-path
        reclaim_policy: Delete

      longhorn:
        enabled: true

      secrets_store_csi_driver:
        enabled: true

      ## TODO: ceph