repositories:
  - name: bitnami
    url:  https://charts.bitnami.com/bitnami

helmDefaults:
  cleanupOnFail: true
  wait: true
  force: true
  createNamespace: true

releases:
  - name: postgres
    namespace: '{{ requiredEnv "E2E_NS" }}'
    createNamespace: true
    labels:
      e2e-run: '{{ requiredEnv "E2E_RUN_ID" }}'
      e2e-ctx: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
    chart: bitnami/postgresql
    hooks:
      - events: ["presync"]
        showlogs: true
        command: kubectl
        args:
          - create
          - namespace
          - '{{ requiredEnv "E2E_NS" }}'
      - events: ["presync"]
        showlogs: true
        command: kubectl
        args:
          - create
          - configmap
          - postgres-init
          - '--namespace={{ requiredEnv "E2E_NS" }}'
          - '--from-file=00_init_schema.sql={{ requiredEnv "E2E_SRC_ROOT" }}/internal/storage/db/postgres/schema.sql'
      - events: ["postuninstall"]
        showlogs: true
        command: kubectl
        args:
          - delete
          - configmap
          - postgres-init
          - '--namespace={{ requiredEnv "E2E_NS" }}'
      - events: ["postuninstall"]
        showlogs: true
        command: kubectl
        args:
          - delete
          - namespace
          - '{{ requiredEnv "E2E_NS" }}'
    values:
      - nameOverride: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
      - image:
          repository: bitnamilegacy/postgresql
      - auth:
          postgresPassword: passw0rd
      - primary:
          initdb:
            scriptsConfigMap: postgres-init
          persistence:
            enabled: false

  - name: cerbos
    namespace: '{{ requiredEnv "E2E_NS" }}'
    needs: ["postgres"]
    createNamespace: true
    labels:
      e2e-run: '{{ requiredEnv "E2E_RUN_ID" }}'
      e2e-ctx: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
    chart: '{{ requiredEnv "E2E_SRC_ROOT" }}/deploy/charts/cerbos'
    hooks:
      - events: ["presync"]
        showlogs: true
        command: kubectl
        args:
          - create
          - secret
          - tls
          - 'cerbos-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          - '--cert={{ requiredEnv "E2E_SRC_ROOT" }}/internal/test/testdata/server/tls.crt'
          - '--key={{ requiredEnv "E2E_SRC_ROOT" }}/internal/test/testdata/server/tls.key'
          - '--namespace={{ requiredEnv "E2E_NS" }}'
      - events: ["postuninstall"]
        showlogs: true
        command: kubectl
        args:
          - delete
          - secret
          - 'cerbos-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          - '--namespace={{ requiredEnv "E2E_NS" }}'
    values:
      - nameOverride: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
      - image:
          repository: '{{ env "E2E_CERBOS_IMG_REPO" | default "ghcr.io/cerbos/cerbos" }}'
          tag: '{{ env "E2E_CERBOS_IMG_TAG" | default "dev" }}'
      - volumes:
        - name: cerbos-auditlog
          emptyDir: {}
      - volumeMounts:
        - name: cerbos-auditlog
          mountPath: /audit
      - cerbos:
          tlsSecretName: 'cerbos-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          logLevel: DEBUG
          config:
            server:
              playgroundEnabled: true
              requestLimits:
                maxActionsPerResource: 5
                maxResourcesPerRequest: 5
              adminAPI:
                enabled: true
                adminCredentials:
                  username: cerbos
                  passwordHash: JDJ5JDEwJC5BYjQyY2RJNG5QR2NWMmJPdnNtQU93c09RYVA0eFFGdHBrbmFEeXh1NnlIVTE1cHJNY05PCgo=
            auxData:
              jwt:
                disableVerification: true
            schema:
              enforcement: reject
            audit:
              enabled: true
              accessLogsEnabled: true
              decisionLogsEnabled: true
              backend: local
              local:
                storagePath: /audit/cerbos
            compile:
              # Because we're `helmfile apply`ing, our Cerbos instance persists between the two runs so we need to ensure
              # the compilation cache is empty to ensure the second test calls out to the db
              cacheDuration: 1ms
            storage:
              driver: "overlay"
              overlay:
                baseDriver: "postgres"
                fallbackDriver: "git"
                fallbackErrorThreshold: {{ requiredEnv "E2E_FALLBACK_ERR_THRESHOLD" }}
              postgres:
                url: {{ requiredEnv "E2E_DATABASE_URL" }}
              git:
                protocol: https
                url: https://github.com/cerbos/cerbos.git
                branch: main
                subDir: internal/test/testdata/store
                checkoutDir: /data
                updatePollInterval: 60s
            telemetry:
              disabled: true

  - name: cerbos-admin
    namespace: '{{ requiredEnv "E2E_NS" }}'
    needs: ["postgres"]
    createNamespace: true
    labels:
      e2e-run: '{{ requiredEnv "E2E_RUN_ID" }}'
      e2e-ctx: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
    chart: '{{ requiredEnv "E2E_SRC_ROOT" }}/deploy/charts/cerbos'
    hooks:
      - events: ["presync"]
        showlogs: true
        command: kubectl
        args:
          - create
          - secret
          - tls
          - 'cerbos-admin-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          - '--cert={{ requiredEnv "E2E_SRC_ROOT" }}/internal/test/testdata/server/tls.crt'
          - '--key={{ requiredEnv "E2E_SRC_ROOT" }}/internal/test/testdata/server/tls.key'
          - '--namespace={{ requiredEnv "E2E_NS" }}'
      - events: ["postuninstall"]
        showlogs: true
        command: kubectl
        args:
          - delete
          - secret
          - 'cerbos-admin-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          - '--namespace={{ requiredEnv "E2E_NS" }}'
    values:
      - nameOverride: '{{ requiredEnv "E2E_CONTEXT_ID" }}'
      - image:
          repository: '{{ env "E2E_CERBOS_IMG_REPO" | default "ghcr.io/cerbos/cerbos" }}'
          tag: '{{ env "E2E_CERBOS_IMG_TAG" | default "dev" }}'
      - cerbos:
          tlsSecretName: 'cerbos-admin-certs-{{ requiredEnv "E2E_CONTEXT_ID" }}'
          logLevel: DEBUG
          config:
            server:
              adminAPI:
                enabled: true
                adminCredentials:
                  username: cerbos
                  passwordHash: JDJ5JDEwJC5BYjQyY2RJNG5QR2NWMmJPdnNtQU93c09RYVA0eFFGdHBrbmFEeXh1NnlIVTE1cHJNY05PCgo=
            auxData:
              jwt:
                disableVerification: true
            schema:
              enforcement: reject
            audit:
              enabled: false
            storage:
              driver: "postgres"
              postgres:
                url: {{ requiredEnv "E2E_DATABASE_URL" }}
            telemetry:
              disabled: true