---
# +docs:section=CRDs

crds:
  # This option decides if the CRDs should be installed
  # as part of the Helm installation.
  enabled: true

  # This option makes it so that the "helm.sh/resource-policy": keep
  # annotation is added to the CRD. This will prevent Helm from uninstalling
  # the CRD when the Helm release is uninstalled.
  # WARNING: when the CRDs are removed, all cert-manager custom resources
  # (Certificates, Issuers, ...) will be removed too by the garbage collector.
  keep: true

# +docs:section=Trust Manager

# The number of replicas of trust-manager to run.
#
# For example:
#  Use integer to set a fixed number of replicas
#   replicaCount: 2
#
#  Use null, if you want to omit the replicas field and use the Kubernetes default value.
#   replicaCount: null
#
#  Use a string if you want to insert a variable for post-processing of the rendered template.
#   replicaCount: ${REPLICAS_OVERRIDE:=3}
#
# +docs:type=number,string,null
replicaCount: 2

nameOverride: ""

# The namespace to install trust-manager into.
# If not set, the namespace of the release is used.
# This is helpful when installing trust-manager as a chart dependency (sub chart).
namespace: ""

# For Private docker registries, authentication is needed. Registry secrets are applied to the service account.
imagePullSecrets: []

image:
  # Target image registry. This value is prepended to the target image repository, if set.
  # For example:
  #   registry: quay.io
  #   repository: jetstack/trust-manager
  # +docs:property
  # registry: quay.io

  # Target image repository.
  repository: quay.io/jetstack/trust-manager

  # Override the image tag to deploy by setting this variable.
  # If no value is set, the chart's appVersion is used.
  # +docs:property
  # tag: vX.Y.Z

  # Target image digest. Override any tag, if set.
  # For example:
  #   digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  # +docs:property
  # digest: sha256:...

  # Kubernetes imagePullPolicy on Deployment.
  pullPolicy: IfNotPresent

defaultPackage:
  # Whether to load the default trust package during pod initialization, and include it in main container args. This container enables the 'useDefaultCAs' source on Bundles.
  enabled: true
  # Kubernetes pod resource limits for default package init container.
  #
  # For example:
  resources:
    limits:
      cpu: 50m
      memory: 96Mi
    requests:
      cpu: 10m
      memory: 48Mi

defaultPackageImage:
  # Target image registry. This value is prepended to the target image repository, if set.
  # For example:
  #   registry: quay.io
  #   repository: jetstack/cert-manager-package-debian
  # +docs:property
  # registry: quay.io

  # The repository for the default package image. This image enables the 'useDefaultCAs' source on Bundles.
  repository: quay.io/jetstack/cert-manager-package-debian

  # Override the image tag of the default package image.
  # If no value is set, the chart's appVersion is used.
  # +docs:property
  tag: "20210119.0"

  # Target image digest. Override any tag, if set.
  # For example:
  #   digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  # +docs:property
  # digest: sha256:...

  # imagePullPolicy for the default package image.
  pullPolicy: IfNotPresent

secretTargets:
  # If set to true, enable writing trust bundles to Kubernetes Secrets as a target.
  # trust-manager can only write to secrets which are explicitly allowed via either authorizedSecrets or authorizedSecretsAll.
  # Note that enabling secret targets will grant trust-manager read access to all secrets in the cluster.
  enabled: true
  # If set to true, grant read/write permission to all secrets across the cluster. Use with caution!
  # If set, ignores the authorizedSecrets list.
  authorizedSecretsAll: true
  # A list of secret names which trust-manager will be permitted to read and write across all namespaces.
  # These are the only allowable Secrets that can be used as targets. If the list is empty (and authorizedSecretsAll is false),
  # trust-manager can't write to secrets and can only read secrets in the trust namespace for use as sources.
  authorizedSecrets: []

# Kubernetes pod resource limits for trust.
#
# For example:
resources:
  limits:
    cpu: 50m
    memory: 96Mi
  requests:
    cpu: 10m
    memory: 48Mi

# Configure the priority class of the pod. For more information, see [PriorityClass](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass).
priorityClassName: ""

# Configure the nodeSelector; defaults to any Linux node (trust-manager doesn't support Windows nodes)
# +docs:property
nodeSelector:
  kubernetes.io/os: linux

# Kubernetes Affinity. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
# For example:
#   affinity:
#     nodeAffinity:
#      requiredDuringSchedulingIgnoredDuringExecution:
#        nodeSelectorTerms:
#        - matchExpressions:
#          - key: foo.bar.com/role
#            operator: In
#            values:
#            - master
affinity: {}

# List of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
# For example:
#   tolerations:
#   - key: foo.bar.com/role
#     operator: Equal
#     value: master
#     effect: NoSchedule
tolerations: []

# List of Kubernetes TopologySpreadConstraints. For more information, see [TopologySpreadConstraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
# For example:
topologySpreadConstraints:
  - maxSkew: 2
    topologyKey: topology.kubernetes.io/zone
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: trust-manager

filterExpiredCertificates:
  # Whether to filter expired certificates from the trust bundle.
  enabled: false

app:
  # The format of trust-manager logging. Accepted values are text or json.
  logFormat: text

  # The verbosity of trust-manager logging. This takes a value from 1-5, with the higher value being more verbose.
  logLevel: 1

  leaderElection:
    # The duration that non-leader candidates will wait to force acquire leadership.
    # The default should be sufficient in a healthy cluster but can be slightly increased to prevent trust-manager from restart-looping when the API server is overloaded.
    leaseDuration: 15s

    # The interval between attempts by the acting leader to renew a leadership slot before it stops leading.
    # This MUST be less than or equal to the lease duration.
    # The default should be sufficient in a healthy cluster but can be slightly increased to prevent trust-manager from restart-looping when the API server is overloaded.
    renewDeadline: 10s

  readinessProbe:
    # The container port on which to expose the trust-manager HTTP readiness probe using the default network interface.
    port: 6060
    # The path on which to expose the trust-manager HTTP readiness probe using the default network interface.
    path: "/readyz"

  trust:
    # The namespace used as the trust source. Note that the namespace _must_ exist
    # before installing trust-manager.
    namespace: cert-manager

  securityContext:
    # If false, disables the default seccomp profile, which might be required to run on certain platforms.
    seccompProfileEnabled: true

  # Pod labels to add to trust-manager pods.
  podLabels: {}

  # Pod annotations to add to trust-manager pods.
  podAnnotations: {}

  # +docs:section=Webhook

  webhook:
    # Host that the webhook listens on.
    host: 0.0.0.0
    # Port that the webhook listens on.
    port: 6443
    # Timeout of webhook HTTP request.
    timeoutSeconds: 5

    service:
      # The type of Kubernetes Service used by the Webhook.
      type: ClusterIP

      # Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
      ipFamilyPolicy: ""
      # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
      ipFamilies: []

      # The nodePort set on the Service used by the webhook.
      # +docs:property
      # nodePort: 8080

    tls:
      helmCert:
        # Whether to issue a webhook cert using Helm, which removes the need to install cert-manager.
        # Helm-issued certificates can be challenging to rotate and maintain, and the issued cert will have a duration of 10 years and be modified when trust-manager is updated.
        # It's safer and easier to rely on cert-manager for issuing the webhook cert - avoid using Helm-generated certs in production.
        enabled: false

      approverPolicy:
        # Whether to create an approver-policy CertificateRequestPolicy allowing auto-approval of the trust-manager webhook certificate. If you have approver-policy installed, you almost certainly want to enable this.
        enabled: false

        # The namespace in which cert-manager was installed. Only used if `app.webhook.tls.approverPolicy.enabled` is true.
        certManagerNamespace: "cert-manager"

        # The name of cert-manager's Service Account. Only used if `app.webhook.tls.approverPolicy.enabled` is true.
        certManagerServiceAccount: "cert-manager"
    # This value specifies if the app should be started in hostNetwork mode. It is required for use in some managed Kubernetes clusters (such as AWS EKS) with custom CNI.
    hostNetwork: false

  # +docs:section=Metrics

  metrics:
    # The port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'.
    port: 9402
    # The service to expose metrics endpoint.
    service:
      # Create a Service resource to expose the metrics endpoint.
      enabled: true
      # The Service type to expose metrics.
      type: ClusterIP
      # Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
      ipFamilyPolicy: ""
      # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
      ipFamilies: []
      # The ServiceMonitor resource for this Service.
      servicemonitor:
        # Create a Prometheus ServiceMonitor for trust-manager.
        enabled: true
        # Sets the value of the "prometheus" label on the ServiceMonitor.
        # This is used so that separate Prometheus instances can select different ServiceMonitors using labels.
        prometheusInstance: default
        # The interval to scrape the metrics.
        interval: 10s
        # The timeout for a metrics scrape.
        scrapeTimeout: 5s
        # Additional labels to add to the ServiceMonitor.
        labels: {}

podDisruptionBudget:
  # Enable or disable the PodDisruptionBudget resource.
  #
  # This prevents downtime during voluntary disruptions such as during a Node upgrade.
  # For example, the PodDisruptionBudget will block `kubectl drain`
  # if it is used on the Node where the only remaining trust-manager
  # Pod is currently running.
  enabled: true

  # This configures the minimum available pods for disruptions. It can either be set to
  # an integer (e.g. 1) or a percentage value (e.g. 25%).
  # It cannot be used if `maxUnavailable` is set.
  # +docs:type=unknown
  # +docs:property
  # minAvailable: 1

  # This configures the maximum unavailable pods for disruptions. It can either be set to
  # an integer (e.g. 1) or a percentage value (e.g. 25%).
  # it cannot be used if `minAvailable` is set.
  # +docs:type=unknown
  # +docs:property
  # maxUnavailable: 1

# Labels to apply to all resources
commonLabels: {}