$schema: 'http://json-schema.org/draft-07/schema'
version: 3
additionalProperties: true
definitions:
  rawValues:
    description: "May define value overrides for a chart. WARNING: these values currently have no schema and can't be validated as such, and may break deployment. You are on your own here."
    type: object
  alerts:
    additionalProperties: false
    type: object
    properties:
      repeatInterval:
        default: 3h
        description: Waiting time before sending a notification again after it was sent successfully for an alert.
        title: Repeat Interval
        type: string
      groupInterval:
        default: 5m
        description: Waiting time before sending a notification about new alerts that are added to a group of alerts.
        title: Group Interval
        type: string
      receivers:
        description: Select notification channel(s) for receiving alerts. Use 'none' if no channel available.
        title: Notification receivers
        type: array
        items:
          enum:
            - slack
            - msteams
            # - email
            - none
          type: string
        uniqueItems: true
      slack:
        title: Slack
        description: Configure Slack endpoints for alerts.
        additionalProperties: false
        properties:
          channel:
            default: mon-apl
            description: The Slack channel for non-critical notifications.
            title: Non-critical
            type: string
          channelCrit:
            default: mon-apl-crit
            description: The Slack channel for critical notifications.
            title: Critical
            type: string
          url:
            type: string
            description: A Slack webhook URL.
            x-secret: ''
        # TODO: Enable again when form rework is done
        # required:
        #   - url
        type: object
      msteams:
        additionalProperties: false
        description: Configure Microsoft Teams endpoints for alerts.
        properties:
          highPrio:
            title: High prio web hook
            type: string
            x-secret: ''
          lowPrio:
            title: Low prio web hook
            type: string
            x-secret: ''
        # TODO: Enable again when form rework is done
        # required:
        #   - highPrio
        #   - lowPrio
        title: Microsoft Teams
        type: object
      # NOTE: keep this in case email alertReceiver gets re-enabled again
      # email:
      #   title: Email
      #   description: Configure email endpoints for alerts.
      #   additionalProperties: false
      #   properties:
      #     critical:
      #       title: Critical Events
      #       $ref: '#/email'
      #       description: One or more email addresses (comma separated) for critical events.
      #     nonCritical:
      #       title: Non-critical Events
      #       $ref: '#/email'
      #       description: One or more email addresses (comma separated) for non-critical events.
      #   # TODO: Enable again when form rework is done
      #   # required:
      #   #   - critical
      #   #   - nonCritical
      #   type: object
  annotations:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of annotations.
  autoscaling:
    additionalProperties: false
    properties:
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 1
  autoscalingEnabled:
    additionalProperties: false
    properties:
      enabled:
        default: true
        type: boolean
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 1
      targetCPUUtilizationPercentage:
        type: integer
        default: 80
      targetMemoryUtilizationPercentage:
        type: integer
        default: 80
  gatewayAutoscallingEnabled:
    additionalProperties: false
    properties:
      enabled:
        default: true
        type: boolean
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 1
      targetCPUUtilizationPercentage:
        type: integer
        default: 80
  akamai:
    definitions:
      dns:
        properties:
          host:
            title: Akamai API host
            description: Akamai Edgegrid API server
            $ref: '#/definitions/wordCharacterPattern'
          accessToken:
            title: Akamai access token
            description: Akamai Edgegrid API access token
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          clientToken:
            title: Akamai client token
            description: Akamai Edgegrid API client token
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          clientSecret:
            title: Akamai client secret
            description: Akamai Edgegrid API client secret
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
        required:
          - host
          - accessToken
          - clientToken
          - clientSecret
  aws:
    definitions:
      accessKey:
        title: AWS access key
        description: An AWS access key ID.
        $ref: '#/definitions/wordCharacterPattern'
        x-secret: ''
      secretKey:
        title: AWS secret key
        description: An AWS secret key.
        type: string
        x-secret: ''
      region:
        title: AWS region
        description: An AWS region.
        $ref: '#/definitions/wordCharacterPattern'
      role:
        description: Role may be set explicitly if no metadata can be accessed.
        example: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager
        $ref: '#/definitions/wordCharacterPattern'
  azure:
    definitions:
      clientId:
        title: Azure client id
        description: An Azure client id.
        $ref: '#/definitions/wordCharacterPattern'
      clientSecret:
        title: Azure client secret
        description: An Azure client secret.
        type: string
        x-secret: ''
      dns:
        properties:
          resourceGroup:
            $ref: '#/definitions/azure/definitions/resourceGroup'
          hostedZoneName:
            title: Hosted zone name
            description: Name of the DNS zone that should be used.
            $ref: '#/definitions/wordCharacterPattern'
          tenantId:
            $ref: '#/definitions/azure/definitions/tenantId'
          subscriptionId:
            $ref: '#/definitions/azure/definitions/subscriptionId'
          aadClientId:
            $ref: '#/definitions/azure/definitions/clientId'
          aadClientSecret:
            $ref: '#/definitions/azure/definitions/clientSecret'
            title: Client secret
            type: string
            description: Azure Application Client Secret
            x-secret: ''
        required:
          - tenantId
          - subscriptionId
          - resourceGroup
          - aadClientId
          - aadClientSecret
      environment:
        title: Azure environment
        description: An Azure environment.
        type: string
        default: AzurePublicCloud
        enum:
          - AzurePublicCloud
          - AzureChinaCloud
          - AzureUSGovernment
          - AzureGermanCloud
      tenantId:
        title: Azure tenant id
        description: An Azure tenant id.
        $ref: '#/definitions/wordCharacterPattern'
      subscriptionId:
        title: Azure subscription id
        description: An Azure subscription id.
        $ref: '#/definitions/wordCharacterPattern'
      resourceGroup:
        title: Resource group
        description: An Azure resource group.
        $ref: '#/definitions/wordCharacterPattern'
  catalog:
    additionalProperties: false
    properties:
      name:
        type: string
        description: 'A lowercase name that starts with a letter and may contain dashes.'
        pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
      repositoryUrl:
        type: string
        description: 'Git repository URL for the catalog'
        pattern: '^(https?|git|ssh)://.*'
      branch:
        type: string
        description: 'Git branch or tag to use'
      enabled:
        type: boolean
        description: 'Whether this catalog is active'
      chartsPath:
        type: string
        description: 'Path within the repository where charts are located'
        default: 'charts'
      secretName:
        type: string
        description: 'Kubernetes secret name containing git credentials (for private repos)'
        pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
    required:
      - name
      - repositoryUrl
      - branch
  cluster:
    additionalProperties: false
    properties:
      apiServer:
        description: Used to generate KUBECONFIG for download, for local access to target cluster.
        pattern: '^https:\/\/.*'
      domainSuffix:
        $ref: '#/definitions/domain'
        description: Domain suffix for the cluster. Also added to list of dns zones in the Otomi Console.
      k8sContext:
        $ref: '#/definitions/k8sContext'
        description: Optional. Must be set for development mode and must point to an existing context in KUBECONFIG.
      name:
        $ref: '#/definitions/idName'
        description: Short name that will be used in construction of cluster domain and messaging.
      owner:
        $ref: '#/definitions/idName'
        description: The name of the organization owning the cluster.
        default: otomi
      provider:
        $ref: '#/definitions/provider'
      linode:
        additionalProperties: false
        properties:
          tier:
            type: string
            description: Linode Kubernetes Engine tier (standard LKE or enterprise LKE-E)
            enum:
              - standard
              - enterprise
      defaultStorageClass:
        type: string
        description: Default storage class for platform components. Use '' for relying on the cluster's default storage class.
        default: ''
    required:
      - name
      - provider
  containerSpecNoSec:
    properties:
      image:
        $ref: '#/definitions/image'
      resources:
        $ref: '#/definitions/resources'
      env:
        $ref: '#/definitions/env'
      files:
        $ref: '#/definitions/files'
      nativeSecrets:
        $ref: '#/definitions/nativeSecrets'
        description: Reserved for internal use.
      secrets:
        $ref: '#/definitions/secrets'
      secretMounts:
        $ref: '#/definitions/secretMounts'
      command:
        type: array
        items:
          type: string
      args:
        type: array
        items:
          type: string
    required:
      - image
      - resources
  containerSpec:
    allOf:
      - $ref: '#/definitions/securityContext'
      - $ref: '#/definitions/containerSpecNoSec'
  cpuQuantity:
    description: Amount of cpu cores, or slice of cpu core in millis.
    examples:
      - '1'
      - 200m
    pattern: ^([1-9][0-9]*|([0]|[1-9]+)\\.[0-9]{1,3}|[1-9][0-9]*m)$
    type: string
  domain:
    pattern: ^([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?$
    type: string
  wildcardDomainOrIp:
    pattern: ^((\*\.)?([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)*[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?|([a-f0-9:]+:+)+[a-f0-9]+)$
    type: string
  duration:
    description: 'Prometheus duration (See: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#configuration-file)'
    pattern: '((([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?|0)'
    type: string
    default: 1d
  email:
    pattern: '^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$'
    type: string
  env:
    additionalProperties: false
    examples:
      - FOO: bar
      - bar: foo
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Environment variables
  files:
    additionalProperties: false
    description: Dictionary of absolute path > content pairs.
    patternProperties:
      '^[/].*':
        type: string
  google:
    additionalProperties: false
    definitions:
      accountJson:
        type: string
        x-secret: ''
      project:
        $ref: '#/definitions/wordCharacterPattern'
  hostPort:
    pattern: '^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]):()([1-9]|[1-5]?[0-9]{2,4}|6[1-4][0-9]{3}|65[1-4][0-9]{2}|655[1-2][0-9]|6553[1-5])$'
    type: string
  idName:
    description: A lowercase name that starts with a letter and may contain dashes.
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
    type: string
  image:
    additionalProperties: false
    properties:
      pullPolicy:
        default: IfNotPresent
        enum:
          - IfNotPresent
          - Always
        type: string
      repository:
        $ref: '#/definitions/repository'
      tag:
        default: latest
        $ref: '#/definitions/wordCharacterPattern'
    title: Container image
  imagePullPolicy:
    default: IfNotPresent
    enum:
      - IfNotPresent
      - Always
    type: string
  imageTag:
    x-default: stable
    pattern: '[\w][\w.-]{0,127}'
    type: string
    x-message: a valid container registry image tag
  imageSimple:
    properties:
      tag:
        $ref: '#/definitions/imageTag'
      pullPolicy:
        $ref: '#/definitions/imagePullPolicy'
    required:
      - tag
    type: object
    title: Container image
  ingressClassParameters:
    type: object
    properties:
      entrypoint:
        description: A public IP address that has a route to a private loadbalancer ip, allowing access to private clusters. (Provider "custom" only.)
        type: string
      network:
        title: Load balancer type
        type: string
        enum:
          - public
        default: public
      loadBalancerIP:
        title: Load balancer IP address
        description: A static IP address assigned to a load balancer
        type: string
      sourceIpAddressFiltering:
        title: Source IP address filtering
        type: string
        description: 'Whitelist source IP address ranges. The value is a comma separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1'
      annotations:
        properties:
          annotations:
            $ref: '#/definitions/annotations'
      gateway:
        type: object
        description: 'Ingress gateway deployment configuration'
        properties:
          replicas:
            type: integer
            minimum: 1
          minAvailable:
            type: integer
            minimum: 1
          resources:
            $ref: '#/definitions/resources'
          autoscaling:
            $ref: '#/definitions/gatewayAutoscallingEnabled'
  ipV4Address:
    type: string
    pattern: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
  jobs:
    description: You may pass an array of Job objects. The Kubernetes API accepts
      a Job specification, which is meant for run-to-completion apps (e.g. batch
      Jobs).
    items:
      type: object
      allOf:
        - properties:
            id:
              type: string
              readOnly: true
          type: object
        - $ref: '#/definitions/jobSpec'
        - $ref: '#/definitions/podSpec'
    type: array
  jobSpec:
    properties:
      type:
        default: Job
        enum:
          - Job
          - CronJob
        type: string
      name:
        $ref: '#/definitions/idName'
        title: Name
        description: A job name
        example: some-job
      enabled:
        default: true
        type: boolean
      runPolicy:
        default: OnSpecChange
        description: |
          If runPolicy is set to 'Always', the job controller will always be re-deployed after a successful deployment with Helm.
          If runPolicy is set to 'OnSpecChange', the job controller will only be re-deployed if one changes this specification.
        enum:
          - Always
          - OnSpecChange
        type: string
      schedule:
        default: 0 1 * * *
        description: Must give a cron-type expression if the job type is 'Cronjob'.
        type: string
      script:
        $ref: '#/definitions/script'
      shell:
        default: /bin/sh
        description: Full path to a shell binary that exists in the image.
        type: string
      ttlSecondsAfterFinished:
        default: 86400
        description: Time To Live after job is finished in seconds. Will be removed afterwards.
        minimum: 0
        title: TTL after finished
        type: integer
      init:
        type: array
        items:
          $ref: '#/definitions/containerSpec'
        nullable: true
    required:
      - name
      - script
      - type
    type: object
  k8sContext:
    description: The cluster k8s context as found in $KUBECONFIG.
    $ref: '#/definitions/wordCharacterPattern'
  labels:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of labels.
  labelsAnnotations:
    additionalProperties: false
    patternProperties:
      '^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]){1,253}\/)?([a-z0-9A-Z]+[a-z0-9A-Z-_.]+[a-z0-9A-Z]){1,63}$':
        pattern: '^((.){1,253}\/)?(.){1,63}$'
        type: string
  logLevel:
    type: string
    default: info
    enum:
      - error
      - warn
      - info
      - debug
      - trace
  memoryQuantity:
    description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
    examples:
      - 1Mi
      - 0.5M
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$'
    type: string
  nativeSecrets:
    description: List of kubernetes secret names.
    additionalProperties: false
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Kubernetes secrets
  appNetworkPolicyConfig:
    type: object
    properties:
      enabled:
        type: boolean
        default: false
        description: Enable network policies for this application with sensible defaults
  netpol:
    type: object
    properties:
      name:
        $ref: '#/definitions/idName'
        title: Network Policy name
        description: 'A unique name for the network policy'
      ruleType:
        properties:
          type:
            type: string
            enum:
              - ingress
              - egress
          ingress:
            properties:
              toLabelName:
                type: string
                title: Selector label name
                description: 'The name of the Pod selector label'
              toLabelValue:
                type: string
                title: Selector label value
                description: 'The value of the Pod selector label'
              mode:
                default: AllowOnly
                enum:
                  - AllowOnly
                  - AllowAll
              allow:
                title: Add team or team with service
                type: array
                items:
                  type: object
                  properties:
                    fromLabelName:
                      type: string
                      title: Selector label name
                      description: 'The name of the Pod selector label'
                    fromLabelValue:
                      type: string
                      title: Selector label value
                      description: 'The value of the Pod selector label'
                    fromNamespace:
                      $ref: '#/definitions/idName'
                      title: Namespace name
                      description: 'The name of the namespace'
                  required:
                    - fromNamespace
          egress:
            properties:
              domain:
                title: FQDN, Wildcard domain, or IP address
                $ref: '#/definitions/wildcardDomainOrIp'
              ports:
                properties:
                  number:
                    title: Port number
                    type: integer
                    minimum: 1
                    maximum: 65535
                  protocol:
                    title: Protocol
                    type: string
                    enum: [HTTPS, HTTP, TCP]
                    default: HTTPS
                required:
                  - number
                  - protocol
                default:
                  - number: 443
                    protocol: HTTPS
            required:
              - domain
        required:
          - type
    required:
      - name
  path:
    description: An absolute path
    type: string
    pattern: '^[/].*$'
  podSecurityContext:
    allOf:
      - $ref: '#/definitions/securityContext'
      - properties:
          fsGroup:
            description: Supplementary group ID. Volumes that support ownership management are modified to be owned and writable by this ID.
            $ref: '#/definitions/unixOwnerId'
          fsGroupChangePolicy:
            description: |
              'Defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions.
              This field has two possible values:
              - OnRootMismatch: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
              - Always: Always change permission and ownership of the volume when volume is mounted.'
            type: string
            enum:
              - Always
              - OnRootMismatch
    description: Security context for the pod.
    title: Pod security context
  podSpec:
    allOf:
      - properties:
          annotations:
            $ref: '#/definitions/annotations'
            title: Pod annotations
        type: object
      - $ref: '#/definitions/podSecurityContext'
      - $ref: '#/definitions/containerSpec'
    type: object
  portNumber:
    maximum: 32768
    minimum: 80
    type: integer
  provider:
    type: string
    description: Enter the cloud provider of the cluster.
    enum:
      - custom
      - linode
    default: linode
  registry:
    pattern: '^[a-z0-9]+(?:[._-][a-z0-9]+)*$'
    type: string
  repoUrl:
    description: Path to a remote git repo with or without protocol prefix of either https:// or file:// (https:// used if omitted)
    pattern: '^(https://|file://)?(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$'
    type: string
  repository:
    description: A container image repository.
    pattern: '^[a-z0-9]+(?:[/._-]{1,2}[a-z0-9]+)*$'
    type: string
  resource:
    additionalProperties: false
    properties:
      cpu:
        $ref: '#/definitions/cpuQuantity'
      memory:
        $ref: '#/definitions/memoryQuantity'
    required:
      - cpu
      - memory
  resources:
    additionalProperties: false
    description: Compute resources for containers.
    properties:
      limits:
        $ref: '#/definitions/resource'
        description: Requested resources (best effort).
      requests:
        $ref: '#/definitions/resource'
        description: Requested resources (guaranteed).
    required:
      - limits
      - requests
    title: Pod resources
  unixOwnerIdRange:
    type: object
    additionalProperties: false
    required: [min, max]
    properties:
      min:
        type: integer
        minimum: 0
        maximum: 65535
      max:
        type: integer
        minimum: 0
        maximum: 65535
  unixOwnerId:
    description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    type: integer
    minimum: 0
    maximum: 65535
    default: 1001
  script:
    description: May specify a non-empty string containing an executable script.
    type: string
    properties:
      id:
        readOnly: true
        type: string
      name:
        $ref: '#/definitions/idName'
    required:
      - name
      - type
  backupSchedule:
    default: 0 0 * * *
    description: Cron-type expression to schedule the backup. Defaults to once a day at 00:00.
    type: string
  secret:
    type: object
    properties:
      id:
        readOnly: true
        type: string
      clusterWide:
        description: Will create the secret in all namespaces.
        type: boolean
        default: false
      teamWide:
        description: Will create the secret in all team-* namespaces.
        type: boolean
        default: false
      name:
        $ref: '#/definitions/idName'
      namespace:
        $ref: '#/definitions/idName'
        description: A kubernetes namespace.
    required:
      - name
    oneOf:
      - title: Generic
        properties:
          type:
            default: generic
            enum:
              - generic
          entries:
            type: array
            items:
              description: A property name at vaultPath
              minItems: 1
              # a valid secret key must consist of alphanumeric characters, '-', '_' or '.' (e.g. 'key.name',  or 'KEY_NAME',  or 'key-name' )
              pattern: '^[-._a-zA-Z0-9]+$'
              type: string
            uniqueItems: true
        required:
          - type
          - entries
      - title: Docker registry
        properties:
          type:
            default: docker-registry
            enum:
              - docker-registry
            type: string
        required:
          - type
      - title: TLS
        properties:
          type:
            default: tls
            enum:
              - tls
            type: string
          crt:
            type: string
            default: 'tls.crt'
          key:
            type: string
            default: 'tls.key'
          ca:
            type: string
            default: 'ca.crt'
        required:
          - type
          - crt
          - key
  secrets:
    description: List of secret names that will have their props injected as env vars into the container.
    items:
      type: string
      pattern: '[a-zA-Z_]{1,}[a-zA-Z0-9_]*'
    nullable: true
    title: Secrets
    type: array
  secretMounts:
    description: Dictionary of absolute folder path > secret name. Will mount the contents of the secret in the container at the specified folder path.
    examples:
      - /foo: bar
    nullable: true
    patternProperties:
      '^[/].*$':
        type: string
    title: Secret mounts
    type: object
  secretTemplates:
    definitions:
      otomiAdminUsername:
        x-secret: 'otomi-admin'
  securityContext:
    additionalProperties:
      uniqueItems: true
    properties:
      runAsUser:
        $ref: '#/definitions/unixOwnerId'
      runAsNonRoot:
        description: Enforces that the container must run as non root. This implies that the UID must also be set with runAsUser.
        type: boolean
        default: true
      runAsGroup:
        description: The GID to run the entrypoint of the container process. Defaults to group specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
        $ref: '#/definitions/unixOwnerId'
  service:
    additionalProperties: false
    properties:
      trafficControl:
        title: Traffic Control
        description: Split traffic between multiple services (blue/green, canary)
        properties:
          enabled:
            type: boolean
            default: false
          weightV1:
            type: integer
            default: 90
          weightV2:
            type: integer
            default: 10
      headers:
        properties:
          response:
            properties:
              set:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
          request:
            properties:
              set:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
      ksvc:
        type: object
        properties:
          predeployed:
            description: Set this flag it the service is managed by knative service
            type: boolean
            default: false
      name:
        $ref: '#/definitions/idName'
        description: Short name. Will be used for generation of knative service name, as well as service URL.
      namespace:
        $ref: '#/definitions/idName'
        description: A kubernetes namespace. Only used by core services, so should be disallowed for non-admins.
      paths:
        items:
          description: |
            Path mapping to only route certain paths to the service. This allows micro services to operate on the same domain and port.
            When left empty all paths will go to this service.
          $ref: '#/definitions/wordCharacterPattern'
        # nullable: true
        type: array
      port:
        $ref: '#/definitions/portNumber'
        description: Points to the backing k8s service (only used when 'svc' is set).
      ingressClassName:
        description: Ingress class name
        $ref: '#/definitions/idName'
        default: platform
      svc:
        $ref: '#/definitions/idName'
        description: When given a backing k8s service is expected to be deployed with this name, which will be exposed through this team service.
      useCname:
        description: Will configure additional host(CNAME) for the service.
        type: boolean
        default: false
      cname:
        properties:
          domain:
            description: CNAME of the service.
            type: string
          tlsSecretName:
            description: Kubernetes secret name of type TLS.
            $ref: '#/definitions/idName'
      removeRequestHeaders:
        description: >-
          Strip selected headers from HTTP request.
        type: array
        items:
          type: string
    required:
      - name
  size:
    description: Disk size. Valid units are E|P|T|G|Ti|Gi.
    examples:
      - 1Gi
      - 0.5Ti
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G||Ti|Gi)?$'
    type: string
  subdomainType:
    type: string
    # A lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com')
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
  team:
    additionalProperties: false
    properties:
      settings:
        properties:
          id:
            $ref: '#/definitions/idName'
            description: Must be the same as the name.
          networkPolicy:
            ingressPrivate:
              title: Enable filtering of ingress traffic inside the cluster
              description: When set a user can define ingress from other services for a particular team service
              type: boolean
              default: true
            egressPublic:
              title: Enable filtering of egress traffic outside the cluster
              description: When set a user can define egress towards FQDNs and public IPs for a team service
              type: boolean
              default: true
          managedMonitoring:
            title: Managed monitoring
            description: Activate managed Grafana, Prometheus or Alertmanager instances
            properties:
              grafana:
                type: boolean
              alertmanager:
                type: boolean
          limitRange:
            description: 'Kubernetes limit range. As is.'
            properties:
              default:
                $ref: '#/definitions/resource'
              defaultRequest:
                $ref: '#/definitions/resource'
          oidc:
            additionalProperties: false
            properties:
              groupMapping:
                description: IDP group id to map onto this team.
                $ref: '#/definitions/wordCharacterPattern'
          resourceQuota:
            description: 'List of kubernetes resource quota. Should adhere to the "spec.hard" format as described here: https://kubernetes.io/docs/concepts/policy/resource-quotas/. Not validated as there is no schema published. Change at your own risk.'
            type: array
            items:
              type: object
              properties:
                name:
                  type: string
                value:
                  type: string
              required:
                - name
                - value
          selfService:
            $ref: '#/definitions/teamSelfService'
          alerts:
            $ref: '#/definitions/alerts'
      apps:
        additionalProperties: true
        alertmanager:
          additionalProperties: false
          properties:
            resources:
              $ref: '#/definitions/resources'
        grafana:
          additionalProperties: false
          properties:
            additionalProperties: false
            properties:
              grafana:
                $ref: '#/definitions/resources'
              sidecar:
                $ref: '#/definitions/resources'
        tekton:
          additionalProperties: false
          properties:
            resources:
              additionalProperties: false
              properties:
                dashboard:
                  $ref: '#/definitions/resources'
                buildpacksTask:
                  $ref: '#/definitions/resources'
                gitCloneTask:
                  $ref: '#/definitions/resources'
                grypeTask:
                  $ref: '#/definitions/resources'
                kanikoTask:
                  $ref: '#/definitions/resources'
      services:
        items:
          $ref: '#/definitions/service'
        type: array
      netpols:
        items:
          $ref: '#/definitions/netpol'
        type: array
      workloads:
        type: array
        items:
          $ref: '#/definitions/workload'
      policies:
        type: object
      builds:
        type: array
        items:
          $ref: '#/definitions/build'
      codeRepos:
        type: array
        items:
          $ref: '#/definitions/codeRepo'
  teamSelfService:
    title: Team Permissions
    description: Grant team permissions to modify certain configuration parameters.
    type: object
    properties:
      teamMembers:
        title: Team Members Permissions
        type: object
        properties:
          createServices:
            title: Create Services
            type: boolean
            default: false
            description: Permission to create services.
          editSecurityPolicies:
            title: Edit Security Policies
            type: boolean
            default: false
            description: Permission to edit security policies.
          useCloudShell:
            title: Use Cloud Shell
            type: boolean
            default: false
            description: Permission to use the cloud shell.
          downloadKubeconfig:
            title: Download Kubeconfig
            type: boolean
            default: false
            description: Permission to download the kubeconfig.
          downloadDockerLogin:
            title: Download Docker Login
            type: boolean
            default: false
            description: Permission to download the docker login configuration.
        required:
          - createServices
          - editSecurityPolicies
          - useCloudShell
          - downloadKubeconfig
          - downloadDockerLogin
  x-acl:
    platformAdmin: [read-any, update-any]
    teamAdmin: [read]
    teamMember: [read]
  backupRetentionPolicy:
    default: 7d
    description: Delete backups according to retention policy. In DAYS|WEEKS|MONTHS
    title: Retention policy
    type: string
  url:
    pattern: '^https?:\/\/[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)'
    type: string
  volumes:
    items:
      additionalProperties: false
      properties:
        name:
          description: Name must match mount name.
          $ref: '#/definitions/idName'
        configMap:
          properties:
            name:
              $ref: '#/definitions/idName'
    type: array
  wordCharacterPattern:
    type: string
    # At least one non whitespace character
    pattern: ^[^\s]+$
  policies:
    type: object
  build:
    type: object
    description: Define location of code to build
    properties:
      name:
        description: Name of the build
        $ref: '#/definitions/idName'
      imageName:
        description: Name of the image
        $ref: '#/definitions/idName'
      tag:
        description: Image tag
        $ref: '#/definitions/imageTag'
      trigger:
        type: boolean
        default: false
      externalRepo:
        type: boolean
        description: Select when using an external private Git repository.
        default: false
      scanSource:
        type: boolean
        default: true
        description: Select to scan source
      secretName:
        description: The name of the secret with the credentials of the external private Git repository
        $ref: '#/definitions/idName'
      mode:
        properties:
          docker:
            properties:
              repoUrl:
                description: URL of the Git repository holding the application code.
                $ref: '#/definitions/url'
              revision:
                description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
                $ref: '#/definitions/wordCharacterPattern'
                default: HEAD
              path:
                description: A relative directory path within the Git repository.
                type: string
                default: ./Dockerfile
              envVars:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
          buildpacks:
            properties:
              repoUrl:
                description: URL of the Git repository holding the application code.
                $ref: '#/definitions/url'
              revision:
                description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
                $ref: '#/definitions/wordCharacterPattern'
                default: HEAD
              path:
                description: A relative directory path within the Git repository.
                type: string
              envVars:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
    required:
      - name
  sealedsecret:
    type: object
    description: Define location of code to build
    properties:
      name:
        $ref: '#/definitions/idName'
      namespace:
        $ref: '#/definitions/idName'
      immutable:
        description: 'Immutable, if set to true, ensures that data stored in the Secret cannot be updated (only object metadata can be modified).'
        type: boolean
      type:
        description: Used to facilitate programmatic handling of secret data.
        type: string
        default: kubernetes.io/opaque
        enum:
          [
            'kubernetes.io/opaque',
            'kubernetes.io/service-account-token',
            'kubernetes.io/dockercfg',
            'kubernetes.io/dockerconfigjson',
            'kubernetes.io/basic-auth',
            'kubernetes.io/ssh-auth',
            'kubernetes.io/tls',
          ]
      encryptedData:
        type: object
      metadata:
        type: object
    required:
      - type
      - encryptedData
      - name
  workload:
    type: object
    description: Define location of the application's manifests or chart
    properties:
      name:
        $ref: '#/definitions/idName'
      url:
        description: URL to either Helm or Git repository
        $ref: '#/definitions/url'
      chartProvider:
        type: string
        title: Chart provider
        enum: ['helm', 'git']
        default: git
      path:
        description: A relative directory path within the Git repository. Absolute paths cause errors. (only valid for applications sourced from Git)
        $ref: '#/definitions/wordCharacterPattern'
      chart:
        description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo.
        $ref: '#/definitions/wordCharacterPattern'
      revision:
        description: In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version.
        $ref: '#/definitions/wordCharacterPattern'
        default: HEAD
      chartMetadata:
        title: ''
        properties:
          helmChartVersion:
            type: string
            title: Helm chart version
            default: ''
          helmChartDescription:
            type: string
            title: Helm chart description
            default: ''
      namespace:
        description: Workload namespace. Applicable only for team-admin. Default value is 'team-<team_id>'
        $ref: '#/definitions/idName'
      createNamespace:
        type: boolean
        default: false
      sidecarInject:
        type: boolean
        default: false
      imageUpdateStrategy:
        description: Automatically update the image. Only supported wit Helm charts in local Gitea repository and images stored in Harbor.
        title: Auto Image Updater
        additionalProperties: false
        properties:
          digest:
            additionalProperties: false
            properties:
              imageRepository:
                type: string
                description: The container image repository name
                $ref: '#/definitions/wordCharacterPattern'
              tag:
                $ref: '#/definitions/wordCharacterPattern'
              imageParameter:
                type: string
                default: image.name
                description: The parameter for specifying the image name
              tagParameter:
                type: string
                default: image.tag
                description: The parameter for specifying the image tag
            required:
              - tag
          semver:
            additionalProperties: false
            properties:
              imageRepository:
                type: string
                description: The container image repository name
                $ref: '#/definitions/wordCharacterPattern'
              versionConstraint:
                $ref: '#/definitions/wordCharacterPattern'
              imageParameter:
                type: string
                default: image.name
                description: The parameter for specifying the image name
              tagParameter:
                type: string
                default: image.tag
                description: The parameter for specifying the image tag
            required:
              - versionConstraint
          type:
            type: string
            enum:
              - semver
              - digest
              - disabled
            default: disabled
        required:
          - type
    required:
      - name
      - url
  codeRepo:
    type: object
    description: Define location of code repository to build
    properties:
      name:
        $ref: '#/definitions/idName'
      gitService:
        description: Git service provider
        type: string
        default: gitea
        enum:
          - gitea
          - github
          - gitlab
      repositoryUrl:
        description: URL of the Git repository holding the application code.
        $ref: '#/definitions/repoUrl'
      private:
        type: boolean
        default: false
      secret:
        description: The name of the secret with the credentials of the external private Git repository
        type: string
    required:
      - name
      - gitService
      - repositoryUrl

properties:
  alerts:
    $ref: '#/definitions/alerts'
  installation:
    type: object
    description: Top-level installation settings.
    required:
      - mode
    additionalProperties: true
    properties:
      mode:
        type: string
        description: |
          Installation execution mode.
          - `standard`: runs the normal installation workflow and follows the configuration bootstrap process.
          - `recovery`: runs recovery behavior intended to restore configuration that is stored in external git repository. It neither bootstraps nor initializes the configuration. For this mode `git` and `kms` objects are required so the operator knows how access and decrypt the data.
        enum:
          - recovery
          - standard
        default: standard
      recovery:
        type: object
        description: Recovery settings for disaster recovery scenarios. Only used when mode=recovery.
        properties:
          manifests:
            type: object
            description: >
              K8s resource List containing recovery manifests (e.g., sealed-secrets TLS key pairs)
              to apply during installation. Not stored in the values repository.
              Export from old cluster:
              kubectl get secret -n sealed-secrets -l sealedsecrets.bitnami.com/sealed-secrets-key=active -o yaml
            properties:
              apiVersion:
                type: string
              kind:
                type: string
              items:
                type: array
                items:
                  type: object
                  additionalProperties: true
              metadata:
                type: object
                additionalProperties: true
            additionalProperties: true
  azure:
    description: Azure specific configuration.
    properties:
      storageType:
        properties:
          fast:
            type: string
          standard:
            type: string
      appgw:
        properties:
          isManaged:
            default: false
            description: Indicates Azure Application Gateway Ingress Controller add-on is installed by AKS.
            type: boolean
  apps:
    additionalProperties: true
    properties:
      alertmanager:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            properties:
              alertmanger:
                $ref: '#/definitions/resources'
      argocd:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          controllerStatusProcessors:
            default: 20
            type: integer
          controllerOperationProcessors:
            default: 10
            type: integer
          applicationSet:
            replicas:
              default: 1
              type: integer
          controller:
            replicas:
              default: 1
              type: integer
          autoscaling:
            repoServer:
              $ref: '#/definitions/autoscalingEnabled'
            server:
              $ref: '#/definitions/autoscalingEnabled'
          resources:
            additionalProperties: false
            properties:
              server:
                $ref: '#/definitions/resources'
              controller:
                $ref: '#/definitions/resources'
              repo:
                $ref: '#/definitions/resources'
              redis:
                $ref: '#/definitions/resources'
              applicationSet:
                $ref: '#/definitions/resources'
              notifications:
                $ref: '#/definitions/resources'
              imageUpdater:
                $ref: '#/definitions/resources'
      cert-manager:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          networkPolicies:
            $ref: '#/definitions/appNetworkPolicyConfig'
          resources:
            certManager:
              $ref: '#/definitions/resources'
            startupapicheck:
              $ref: '#/definitions/resources'
            cainjector:
              $ref: '#/definitions/resources'
            webhook:
              $ref: '#/definitions/resources'
          byoWildcardCert:
            description: 'Bring your own trusted wildcard certificate. Only applicable for byo-wildcard-cert issuer'
            type: string
          byoWildcardCertKey:
            description: 'A certificate key corresponding to the byoWildcardCert.'
            type: string
            x-secret: ''
          externallyManagedTlsSecretName:
            description: |
              The name of a custom secret in the istio-system namespace that contains a trusted certificate and private key.
              To be used with issuer externally-managed-tls-secret.
            $ref: '#/definitions/idName'
          customRootCA:
            type: string
            description: CA that is used to create and verify self-signed certificates. Leave it empty to generate one automatically.
          customRootCAKey:
            x-secret: ''
            type: string
            description: CA private key that is used to issue certificates. Leave it empty to generate one automatically.
          email:
            $ref: '#/definitions/email'
          issuer:
            description: |
              Indicates the origin of the wildcard certificate.
              The custom-ca - cert-manager uses the customRootCA to generate wildcard certificate.
              The letsencrypt - cert-manager requests certificate from letsencrypt endpoint.
              The byo-wildcard-cert allows users to bring their own trusted wildcard certificate (cert-manager not involved)
              through the values byoWildcardCert and byoWildcardCertKey.
              The externally-managed-tls-secret is similar to byo-wildcard-cert, but assumes the certificate is already stored
              in a secret (referenced by externallyManagedTlsSecretName) and not provided through the values.
            type: string
            enum:
              - custom-ca
              - letsencrypt
              - byo-wildcard-cert
              - externally-managed-tls-secret
            default: custom-ca
          stage:
            type: string
            enum:
              - production
              - staging
            default: production
      cnpg:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
          barmanPluginResources:
            $ref: '#/definitions/resources'
          useBackupPlugin:
            type: boolean
            default: false
            description: Use CNPG plugin for platform database backups
      dex:
        additionalProperties: false
        description: Dex is an OIDC identity broker, installed by default. otomi.oidc.authenticationLayer decides whether it is actually used.
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          idp:
            additionalProperties: false
            properties:
              clientID:
                $ref: '#/definitions/wordCharacterPattern'
                default: otomi
                description: The OAuth2 client identifier platform applications will use against Dex.
          replicas:
            type: integer
            default: 2
            description: Number of Dex replicas. More than one requires all replicas to share the same storage backend.
          resources:
            $ref: '#/definitions/resources'
          networkPolicies:
            $ref: '#/definitions/appNetworkPolicyConfig'
      external-dns:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          logLevel:
            type: string
            default: 'info'
          resources:
            $ref: '#/definitions/resources'
      external-secrets:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            properties:
              operator:
                $ref: '#/definitions/resources'
      gitea:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
          adminUsername:
            type: string
            default: otomi-admin
          databaseMaxConnections:
            type: number
            description: Maximum amount of total connections of the application to the database server
          databaseMaxIdleConnections:
            type: number
            description: Maximum amount of idle connections of the application to the database server
          resources:
            additionalProperties: false
            properties:
              gitea:
                $ref: '#/definitions/resources'
              init:
                $ref: '#/definitions/resources'
          networkPolicies:
            $ref: '#/definitions/appNetworkPolicyConfig'
      grafana:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            grafana:
              $ref: '#/definitions/resources'
            sidecar:
              $ref: '#/definitions/resources'
      harbor:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          privateLibrary:
            type: boolean
            default: true
            description: Will mark the main project named "library" as private.
          oidcAutoOnboard:
            type: boolean
          oidcUserClaim:
            type: string
          databaseMaxConnections:
            type: number
            description: Maximum amount of total connections of the application to the database server
          databaseMaxIdleConnections:
            type: number
            description: Maximum amount of idle connections of the application to the database server
          resources:
            additionalProperties: false
            properties:
              core:
                $ref: '#/definitions/resources'
              jobservice:
                $ref: '#/definitions/resources'
              portal:
                $ref: '#/definitions/resources'
              redis:
                $ref: '#/definitions/resources'
              registry:
                $ref: '#/definitions/resources'
              registryController:
                $ref: '#/definitions/resources'
              trivy:
                $ref: '#/definitions/resources'
              nginx:
                $ref: '#/definitions/resources'
      istio:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          autoscaling:
            properties:
              egressgateway:
                $ref: '#/definitions/autoscaling'
              ingressgateway:
                $ref: '#/definitions/autoscaling'
              pilot:
                $ref: '#/definitions/autoscaling'
          egressGateway:
            properties:
              enabled:
                default: false
                type: boolean
          global:
            additionalProperties: false
            properties:
              logging:
                properties:
                  level:
                    type: string
          extensionProviders:
            description: 'See: https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig'
            type: array
            items:
              type: object
          image:
            $ref: '#/definitions/imageSimple'
          ambient:
            description: Enable Istio ambient mesh
            type: boolean
          resources:
            properties:
              egressgateway:
                $ref: '#/definitions/resources'
              ingressgateway:
                $ref: '#/definitions/resources'
              ingressgateway-private:
                $ref: '#/definitions/resources'
              pilot:
                $ref: '#/definitions/resources'
              proxy:
                $ref: '#/definitions/resources'
              operator:
                $ref: '#/definitions/resources'
      keycloak:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
            description: Whether Keycloak is deployed. Independent of otomi.oidc.authenticationLayer — enabling Keycloak does not select it as the issuer.
          idp:
            additionalProperties: false
            properties:
              alias:
                type: string
                default: otomi-idp
              clientID:
                $ref: '#/definitions/wordCharacterPattern'
                default: otomi
          adminUsername:
            type: string
            default: otomi-admin
          theme:
            type: string
            default: otomi
          image:
            properties:
              keycloak:
                $ref: '#/definitions/imageSimple'
              postgresql:
                $ref: '#/definitions/imageSimple'
          databaseMaxConnections:
            type: number
            description: Maximum amount of total connections of the application to the database server
          databaseMinConnections:
            type: number
            description: Minimum amount of connections of the application to the database server
          databaseInitialConnections:
            type: number
            description: Initial amount of connections of the application to the database server on startup
          resources:
            additionalProperties: false
            properties:
              keycloak:
                $ref: '#/definitions/resources'
              operator:
                $ref: '#/definitions/resources'
      kserve:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              controller:
                $ref: '#/definitions/resources'
              rbacProxy:
                $ref: '#/definitions/resources'
              inferenceService:
                $ref: '#/definitions/resources'
      kyverno:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
          mode:
            type: string
            enum: ['DevTest', 'Prod']
            default: DevTest
          resources:
            additionalProperties: false
            properties:
              admissionController:
                $ref: '#/definitions/resources'
              cleanupController:
                $ref: '#/definitions/resources'
              backgroundController:
                $ref: '#/definitions/resources'
              reportsController:
                $ref: '#/definitions/resources'
      policy-reporter:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
      knative:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          resources:
            queueSidecar:
              $ref: '#/definitions/resources'
            controller:
              $ref: '#/definitions/resources'
            activator:
              $ref: '#/definitions/resources'
            webhook:
              $ref: '#/definitions/resources'
            autoscaler:
              $ref: '#/definitions/resources'
            autoscalerHpa:
              $ref: '#/definitions/resources'
            operator:
              $ref: '#/definitions/resources'
            operatorWebhook:
              $ref: '#/definitions/resources'
          serving:
            type: object
            properties:
              replicas:
                default: 1
                type: integer
                minimum: 1
              gateway:
                type: object
                description: 'Knative local gateway deployment configuration'
                properties:
                  replicas:
                    type: integer
                    minimum: 1
                  minAvailable:
                    type: integer
                    minimum: 1
                  resources:
                    $ref: '#/definitions/resources'
                  autoscaling:
                    $ref: '#/definitions/gatewayAutoscallingEnabled'
      kubeflow-pipelines:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            default: false
            type: boolean
          persistence:
            properties:
              mysql:
                properties:
                  size:
                    default: 20Gi
                    $ref: '#/definitions/size'
          resources:
            additionalProperties: false
            properties:
              cacheDeployer:
                $ref: '#/definitions/resources'
              cacheServer:
                $ref: '#/definitions/resources'
              metadataEnvoy:
                $ref: '#/definitions/resources'
              metadataGrpc:
                $ref: '#/definitions/resources'
              metadataWriter:
                $ref: '#/definitions/resources'
              mlPipeline:
                $ref: '#/definitions/resources'
              mlPipelinePersistenceagent:
                $ref: '#/definitions/resources'
              mlPipelineScheduledworkflow:
                $ref: '#/definitions/resources'
              mlPipelineUi:
                $ref: '#/definitions/resources'
              mlPipelineViewer:
                $ref: '#/definitions/resources'
              mlPipelineVisualizationserver:
                $ref: '#/definitions/resources'
              mysql:
                $ref: '#/definitions/resources'
              workflowController:
                $ref: '#/definitions/resources'
      linode-cfw:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
      sealed-secrets:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            properties:
              operator:
                $ref: '#/definitions/resources'
      tekton:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            additionalProperties: false
            properties:
              dashboard:
                $ref: '#/definitions/resources'
              pipelinesController:
                $ref: '#/definitions/resources'
              pipelinesRemoteresolver:
                $ref: '#/definitions/resources'
              pipelinesEvents:
                $ref: '#/definitions/resources'
              pipelinesWebhook:
                $ref: '#/definitions/resources'
              triggersInterceptors:
                $ref: '#/definitions/resources'
              triggersController:
                $ref: '#/definitions/resources'
              triggersWebhook:
                $ref: '#/definitions/resources'
      loki:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            additionalProperties: false
            properties:
              compactor:
                $ref: '#/definitions/resources'
              ingester:
                $ref: '#/definitions/resources'
              gateway:
                $ref: '#/definitions/resources'
              querier:
                $ref: '#/definitions/resources'
              distributor:
                $ref: '#/definitions/resources'
              queryFrontend:
                $ref: '#/definitions/resources'
              reverseProxy:
                $ref: '#/definitions/resources'
              queryScheduler:
                $ref: '#/definitions/resources'
              indexGateway:
                $ref: '#/definitions/resources'
              singleBinary:
                $ref: '#/definitions/resources'
          autoscaling:
            properties:
              ingester:
                $ref: '#/definitions/autoscalingEnabled'
              gateway:
                $ref: '#/definitions/autoscalingEnabled'
              querier:
                $ref: '#/definitions/autoscalingEnabled'
              distributor:
                $ref: '#/definitions/autoscalingEnabled'
              queryFrontend:
                $ref: '#/definitions/autoscalingEnabled'
              queryScheduler:
                $ref: '#/definitions/autoscalingEnabled'
          persistentVolumeSize:
            $ref: '#/definitions/size'
          v13SchemaStartDate:
            description: Automatically set to a date in the future in case of an upgrade
            title: Schema v13 start date
            type: string
          networkPolicies:
            $ref: '#/definitions/appNetworkPolicyConfig'
      metrics-server:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          apiServer:
            additionalProperties: false
            properties:
              create:
                type: boolean
                default: true
          extraArgs:
            type: array
          resources:
            $ref: '#/definitions/resources'
      oauth2-proxy:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
      oauth2-proxy-redis:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              master:
                $ref: '#/definitions/resources'
              sentinel:
                $ref: '#/definitions/resources'
          replicas:
            type: integer
          persistentVolumeSize:
            $ref: '#/definitions/size'
        type: object
      otomi-api:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          editorInactivityTimeout:
            type: integer
            default: 10
          kubeconfigExpirationSeconds:
            type: integer
          resources:
            additionalProperties: false
            properties:
              api:
                $ref: '#/definitions/resources'
              tools:
                $ref: '#/definitions/resources'
          networkPolicies:
            $ref: '#/definitions/appNetworkPolicyConfig'
      otomi-console:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - properties:
                  registry:
                    required:
                      - username
                      - password
        type: object
      apl-harbor-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-gitea-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-keycloak-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      git-server:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
          htpasswd:
            type: string
            x-secret: ''
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
          createHttpRoute:
            type: boolean
      prometheus:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          disabledRules:
            type: array
            items:
              type: string
          remoteWrite:
            properties:
              enabled:
                type: boolean
                default: false
              insecureSkipVerify:
                type: boolean
                default: false
              rwConfig:
                properties:
                  target:
                    type: string
                  basicAuth:
                    properties:
                      enabled:
                        type: boolean
                        default: false
                      username:
                        type: string
                      password:
                        $ref: '#/definitions/wordCharacterPattern'
                        x-secret: ''
                  customConfig:
                    description: Custom remote write config. Will be appended to the remoteWrite list.
                    type: string
          replicas:
            type: integer
            default: 1
          scrapeInterval:
            type: string
            default: 60s
          retention:
            $ref: '#/definitions/duration'
          retentionSize:
            description: 'The maximum number of bytes of storage blocks to retain. The oldest data will be removed first. Defaults to 0 or disabled. Units supported: B, KB, MB, GB, TB, PB, EB'
            default: 4GB
            pattern: '^([0-9]+\.)?[0-9]+(B|KB|MB|GB|TB|PB|EB)?$'
          storageSize:
            $ref: '#/definitions/size'
            default: 5Gi
          image:
            properties:
              prometheus:
                $ref: '#/definitions/imageSimple'
              kube-state-metrics:
                $ref: '#/definitions/imageSimple'
              node-exporter:
                $ref: '#/definitions/imageSimple'
          resources:
            properties:
              prometheusOperator:
                $ref: '#/definitions/resources'
              prometheus:
                $ref: '#/definitions/resources'
              kube-state-metrics:
                $ref: '#/definitions/resources'
              node-exporter:
                $ref: '#/definitions/resources'
              prometheusConfigReloader:
                $ref: '#/definitions/resources'
      promtail:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            $ref: '#/definitions/resources'
      rabbitmq:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            properties:
              clusterOperator:
                description: Controller which is used to create RabbitMQ-clusters
                $ref: '#/definitions/resources'
              msgTopologyOperator:
                description: Controller which is used to create RabbitMQ queues and policies
                $ref: '#/definitions/resources'
      trivy:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          operator:
            properties:
              replicaCount:
                description: Number of Operator replicas.
                type: integer
                default: 1
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
              trivy:
                $ref: '#/definitions/resources'
      otel:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          operator:
            properties:
              replicaCount:
                description: Number of replicas.
                type: integer
                default: 1
          resources:
            additionalProperties: false
            properties:
              logsCollector:
                $ref: '#/definitions/resources'
              manager:
                $ref: '#/definitions/resources'
  catalogs:
    type: object
    additionalProperties:
      $ref: '#/definitions/catalog'
  cluster:
    $ref: '#/definitions/cluster'
  dns:
    additionalProperties: false
    properties:
      zones:
        description: Extra dns zones that the cluster can administer. Team services can use this to publish their URLs on.
        items:
          $ref: '#/definitions/domain'
        type: array
      domainFilters:
        description: Limit possible target zones by domain suffixes.
        items:
          type: string
        type: array
      zoneIdFilters:
        description: Limit possible target zones by zone id.
        items:
          type: string
        type: array
      policy:
        description: Modify how DNS records are synchronized between sources and providers.
        type: string
        enum:
          - upsert-only
          - sync
      provider:
        description: The DNS provider managing the domains.
        oneOf:
          - title: Akamai EdgeDNS
            additionalProperties: false
            properties:
              akamai:
                $ref: '#/definitions/akamai/definitions/dns'
            required:
              - akamai
          - title: AWS
            description: Uses credentials when either a pair of id+key or a secret name is provided. Assumes node role otherwise.
            additionalProperties: false
            properties:
              aws:
                properties:
                  credentials:
                    properties:
                      secretKey:
                        $ref: '#/definitions/aws/definitions/secretKey'
                      accessKey:
                        $ref: '#/definitions/aws/definitions/accessKey'
                    required: [secretKey, accessKey]
                  region:
                    $ref: '#/definitions/aws/definitions/region'
                  role:
                    $ref: '#/definitions/aws/definitions/role'
                required: [region]
                oneOf:
                  - required: [credentials]
                  - required: [role]
                  - not:
                      anyOf:
                        - required: [credentials]
                        - required: [role]
            required:
              - aws
          - title: Azure
            additionalProperties: false
            properties:
              azure:
                $ref: '#/definitions/azure/definitions/dns'
            required:
              - azure
          - title: Azure Private
            additionalProperties: false
            properties:
              azure-private-dns:
                $ref: '#/definitions/azure/definitions/dns'
            required:
              - azure-private-dns
          - title: Google
            additionalProperties: false
            properties:
              google:
                properties:
                  serviceAccountKey:
                    $ref: '#/definitions/google/definitions/accountJson'
                    description: A service account key in json format for managing a DNS zone.
                  project:
                    $ref: '#/definitions/google/definitions/project'
                required: [project, serviceAccountKey]
            required:
              - google
          - title: Digital Ocean
            additionalProperties: false
            properties:
              digitalocean:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                required:
                  - apiToken
            required:
              - digitalocean
          - title: Linode
            additionalProperties: false
            properties:
              linode:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                required:
                  - apiToken
            required:
              - linode
          - title: CloudFlare
            additionalProperties: false
            properties:
              cloudflare:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                  apiSecret:
                    type: string
                    x-secret: ''
                    description: Required when Email is set.
                  email:
                    $ref: '#/definitions/email'
                    description: Required when Email is set.
                  proxied:
                    type: boolean
                    x-default: true
                oneOf:
                  - required: [apiToken]
                  - required: [apiSecret, email]
                  - not:
                      anyOf:
                        - required: [apiToken]
                        - required: [apiSecret]
                        - required: [email]
            required:
              - cloudflare
          - title: Other
            additionalProperties: false
            properties:
              other:
                description: This option requires configuration for both external-dns as well as cert-manager. No schema validation is available so provide correct data.
                type: object
                properties:
                  name:
                    type: string
                    description: Name of the provider.
                  external-dns:
                    title: YAML for external-dns.
                    type: object
                    description: 'The provider config as provided here: https://github.com/linode/apl-core/blob/main/charts/external-dns/values.yaml'
                  cert-manager:
                    title: YAML for cert-manager.
                    type: object
                    description: 'The dns01 config as provided here: https://cert-manager.io/docs/configuration/acme/dns01/'
                required:
                  - name
                  - external-dns
                  - cert-manager
            required:
              - other
      entrypoint:
        $ref: '#/definitions/ipV4Address'
        description: Optional. A public IP address that will override (loadbalancer) ip used for registering hosts. This allows for access to private clusters.
  files:
    type: object
    description: 'Custom values for the workload chart.'
    patternProperties:
      '^/|(/[\w-]+)+$':
        type: string
        pattern: ^[^\s]+$
  oidc:
    additionalProperties: false
    description: 'Holds many parts used in different locations. Please see keycloak, grafana, istio and oauth-proxy as those are all consuming (parts of) these settings.'
    properties:
      issuer:
        $ref: '#/definitions/url'
      clientID:
        $ref: '#/definitions/wordCharacterPattern'
        x-secret: ''
      clientSecret:
        type: string
        x-secret: ''
      platformAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      allTeamsAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      teamAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      usernameClaimMapper:
        $ref: '#/definitions/wordCharacterPattern'
        description: Claim name from identity provider used by Keycloak to create the username. Best to not change this from the default.
        default: '${CLAIM.upn}'
      subClaimMapper:
        type: string
        description: Claim name passed by Keycloak as a unique user identifier. Best to not change this from the default.
        default: sub
    required:
      - clientID
      - issuer
  otomi:
    additionalProperties: false
    properties:
      isPreInstalled:
        type: boolean
        description: Defines if APL is installed and managed by Linode
        default: false
      oidc:
        additionalProperties: false
        properties:
          authenticationLayer:
            type: string
            enum:
              - dex
              - keycloak
            default: keycloak
            description: Which app every consumer authenticates against.
      aiEnabled:
        type: boolean
        description: Defines if APL enables AI/ML components
        default: false
      globalPullSecret:
        title: Global pullsecret
        description: Will be connected to each "default" service account in all otomi app namespaces.
          Handy for authenticating with DockerHub to avoid rate limiting.
          Also useful when pulling all otomi images from a private repo. (One would need to override all the images in the config first.)
        additionalProperties: false
        properties:
          username:
            $ref: '#/definitions/wordCharacterPattern'
          password:
            type: string
            x-secret: ''
          email:
            $ref: '#/definitions/email'
            default: not@us.ed
          server:
            $ref: '#/definitions/wordCharacterPattern'
            default: docker.io
        required:
          - username
          - password
      git:
        type: object
        title: Git Configuration
        description: |
          Git configuration for APL values repository.
        additionalProperties: true
        properties:
          repoUrl:
            type: string
            description: |
              The base URL of the Git repository (without credentials). Auto-derived for internal Gitea.
            pattern: '^https?://.+'
            x-secret: ''
          username:
            type: string
            description: |
              Username for authenticating with the Git repository.
              Defaults to 'otomi-admin' for internal Gitea.
            x-secret: ''
          password:
            type: string
            description: Password or token for authenticating with the Git repository
            x-secret: ''
          email:
            type: string
            description: |
              Email address to use for Git commits.
              Defaults to 'pipeline@cluster.local' for internal Gitea.
            x-secret: ''
          branch:
            type: string
            description: The branch to use in the Git repository
            x-secret: ''
      hasExternalDNS:
        description: Set this to true when an external dns zone is available to manage dns records. (Expects required `dns:` fields to be set.)
        default: false
        type: boolean
      hasExternalIDP:
        default: false
        description: Set this to true when bringing your own external IDP such as Azure AD. (Expects required `oidc:` fields to be set.)
        type: boolean
      isMultitenant:
        default: true
        description: Whether to separate team metrics and logs. Disabling this lets everybody be admin and see everything.
        type: boolean
      nodeSelector:
        $ref: '#/definitions/labelsAnnotations'
        description: 'One or more "label: value" pairs that must exist on one or more nodes, which will force all otomi platform workloads to be scheduled there.'
      version:
        default: latest
        description: 'Best pin this to a valid release version found in the repo.'
        pattern: '(v[0-9]+.[0-9]+.[0-9]+|[a-zA-Z]+[a-zA-Z0-9-])'
      useORCS:
        type: boolean
        description: Defines if the OCI Registry Cache Service (ORCS) is used to cache images from the public registry.
  ingress:
    properties:
      platformClass:
        type: object
        allOf:
          - properties:
              className:
                type: string
                enum: [platform]
          - $ref: '#/definitions/ingressClassParameters'
      classes:
        type: array
        items:
          allOf:
            - type: object
              properties:
                className:
                  type: string
            - $ref: '#/definitions/ingressClassParameters'
          required:
            - className
  smtp:
    additionalProperties: false
    properties:
      auth_identity:
        type: string
      auth_password:
        type: string
        x-secret: ''
      auth_secret:
        type: string
        x-secret: ''
      auth_username:
        type: string
      from:
        $ref: '#/definitions/email'
        description: The "from" address. Defaults to alerts@$clusterDomain.
      hello:
        type: string
      smarthost:
        $ref: '#/definitions/hostPort'
        description: 'The smtp host:port combination.'
    required:
      - smarthost
  platformBackups:
    type: object
    properties:
      database:
        type: object
        title: Database backups
        properties:
          harbor:
            title: Harbor
            properties:
              enabled:
                type: boolean
                default: false
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
              pathSuffix:
                type: string
                pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
                default: harbor
          gitea:
            title: Gitea
            properties:
              enabled:
                type: boolean
                default: false
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
              pathSuffix:
                type: string
                pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
                default: gitea
          keycloak:
            title: Keycloak
            properties:
              enabled:
                type: boolean
                default: false
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
              pathSuffix:
                type: string
                pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
                default: keycloak
      gitea:
        type: object
        title: Gitea
        description: Enable application-level backup of Gitea repositories and database
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          resources:
            $ref: '#/definitions/resources'
          retentionPolicy:
            $ref: '#/definitions/backupRetentionPolicy'
          schedule:
            $ref: '#/definitions/backupSchedule'
  obj:
    properties:
      showWizard:
        type: boolean
        default: true
        description: Show the Object Storage wizard.
      provider:
        properties:
          linode:
            properties:
              region:
                description: The region of the bucket
                $ref: '#/definitions/wordCharacterPattern'
              accessKeyId:
                type: string
                description: The ID of the access key
                $ref: '#/definitions/wordCharacterPattern'
              secretAccessKey:
                type: string
                description: The secret of the access key
                $ref: '#/definitions/wordCharacterPattern'
                x-secret: ''
              buckets:
                properties:
                  loki:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: loki
                  cnpg:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: cnpg
                  harbor:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: harbor
                  gitea:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: gitea
                  kubeflow-pipelines:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: kubeflow-pipelines
            required:
              - region
              - accessKeyId
              - secretAccessKey
          type:
            type: string
            enum:
              - linode
              - disabled
            default: disabled
  databases:
    properties:
      keycloak:
        title: Keycloak
        properties:
          size:
            type: string
          storageClass:
            type: string
          walStorageSize:
            type: string
          resources:
            $ref: '#/definitions/resources'
          backupSidecarResources:
            $ref: '#/definitions/resources'
          postgresqlParameters:
            type: object
            additionalProperties:
              type: string
            default: {}
          replicas:
            type: integer
            default: 2
          recovery:
            type: object
            additionalProperties: true
            default: {}
          externalClusters:
            type: array
            items:
              type: object
              additionalProperties: true
            default: []
      harbor:
        title: Harbor
        properties:
          size:
            type: string
          storageClass:
            type: string
          walStorageSize:
            type: string
          resources:
            $ref: '#/definitions/resources'
          backupSidecarResources:
            $ref: '#/definitions/resources'
          postgresqlParameters:
            type: object
            additionalProperties:
              type: string
            default: {}
          replicas:
            type: integer
            default: 2
          recovery:
            type: object
            additionalProperties: true
            default: {}
          externalClusters:
            type: array
            items:
              type: object
              additionalProperties: true
            default: []
      gitea:
        title: gitea
        properties:
          size:
            type: string
          storageClass:
            type: string
          walStorageSize:
            type: string
          resources:
            $ref: '#/definitions/resources'
          backupSidecarResources:
            $ref: '#/definitions/resources'
          postgresqlParameters:
            type: object
            additionalProperties:
              type: string
            default: {}
          replicas:
            type: integer
            default: 2
          recovery:
            type: object
            additionalProperties: true
            default: {}
          externalClusters:
            type: array
            items:
              type: object
              additionalProperties: true
            default: []
  teamConfig:
    additionalProperties: false
    patternProperties:
      '^[a-z0-9]([-a-z0-9]*[a-z0-9])+$':
        $ref: '#/definitions/team'
  versions:
    properties:
      specVersion:
        type: integer
        description: DO NOT CHANGE! Holds the values-schema version. For more details, see `otomi migrate`.
  license:
    type: string
    describe: License in form of JWT
    x-secret: ''
  status:
    type: object
    properties:
      otomi:
        properties:
          deployingTag:
            type: string
          deployingVersion:
            type: string
          status:
            type: string
            enum: [deploying, deployed]
          version:
            type: string
      helm:
        type: object
required:
  - cluster