# Default values for opentelemetry-operator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Top level field indicating an override for the namespace
namespaceOverride: ""

replicaCount: 1

## The number of old history to retain to allow rollback.
##
revisionHistoryLimit: 10

## Minimum number of seconds for which a newly created pod should be ready
## without any of its container crashing, for it to be considered available.
##
minReadySeconds: 0

## Provide a name in place of opentelemetry-operator (includes the chart's release name).
##
nameOverride: ""

## Fully override the name (excludes the chart's release name).
##
fullnameOverride: ""

## Reference one or more secrets to be used when pulling images from authenticated repositories.
imagePullSecrets: []

## Kubernetes cluster domain suffix
clusterDomain: cluster.local

# Common labels to add to all otel-operator resources. Evaluated as a template.
additionalLabels: {}

## Pod Disruption Budget configuration
##
pdb:
  ## Enable/disable a Pod Disruption Budget creation
  ##
  create: false
  ## Minimum number/percentage of pods that should remain scheduled
  ##
  minAvailable: 1
  ## Maximum number/percentage of pods that may be made unavailable
  ##
  maxUnavailable: ""

## Provide OpenTelemetry Operator manager container image and resources.
##
manager:
  image:
    repository: ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator
    tag: ""
    imagePullPolicy: IfNotPresent
  collectorImage:
    repository: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s
    tag: 0.162.0
  opampBridgeImage:
    repository: ""
    tag: ""
  targetAllocatorImage:
    repository: ghcr.io/open-telemetry/opentelemetry-operator/target-allocator
    tag: 0.162.0
  autoInstrumentationImage:
    java:
      repository: ""
      tag: ""
    nodejs:
      repository: ""
      tag: ""
    python:
      repository: ""
      tag: ""
    dotnet:
      repository: ""
      tag: ""
    apacheHttpd:
      repository: ""
      tag: ""
    nginx:
      repository: ""
      tag: ""
    # To enable Go instrumentation, manager.autoInstrumentation.go.enabled must be set to true
    go:
      repository: ""
      tag: ""
    php:
      repository: ""
      tag: ""
    ruby:
      repository: ""
      tag: ""

  # The Go, PHP and Ruby instrumentation support in the operator is disabled by default.
  autoInstrumentation:
    go:
      enabled: false
    php:
      enabled: false
    ruby:
      enabled: false

  # If ignoreMissingCollectorCRDs is set to true, the manager will not raise errors
  # if the collector CRDs are not present.
  ignoreMissingCollectorCRDs: false
  # OpenTelemetry Operator manager configuration.
  # When set, this value is rendered as a ConfigMap and mounted into the
  # manager container. The chart also passes the mounted file path to the
  # manager with --config-file.
  # The operator applies file configuration before CLI flags, so chart-rendered
  # CLI flags take precedence over the same fields set here.
  # The chart always sets the manager metrics address, metrics security, and
  # health probe address with CLI flags. It also sets leader election, pprof,
  # and webhook port flags when those chart values are enabled.
  # See https://github.com/open-telemetry/opentelemetry-operator/blob/main/internal/config/config.go
  # for the list of supported configuration fields.
  config: {}
  # The featureGatesMap will enable or disable specific feature gates in the operator as well as deploy any prerequisites for the feature gate.
  # A full list of valid identifiers can be found here: https://github.com/open-telemetry/opentelemetry-operator/blob/main/pkg/featuregate/featuregate.go
  featureGatesMap: {}
  # operator.clusterobservability: false
  # operator.targetallocator.fallbackstrategy: false
  # operand.networkpolicy: false
  # operator.networkpolicy: false
  ports:
    metricsPort: 8443
    webhookPort: 9443
    healthzPort: 8081
  # Expose optionally a port for pprof profiling
  #  pprofPort: 6060
  ## Metrics server configuration
  ## The operator uses controller-runtime built-in auth for the metrics server
  metrics:
    # Enable authentication and authorization for the metrics server
    # Corresponds to --metrics-secure flag in the operator
    secure: true

    # TLS configuration (optional, self-signed certs generated if not provided)
    # Corresponds to --metrics-tls-cert-file and --metrics-tls-key-file flags
    tls:
      # Path to TLS certificate file (optional)
      certFile: ""
      # Path to TLS private key file (optional)
      keyFile: ""
  resources: {}
  # resources:
  #   limits:
  #     cpu: 100m
  #     memory: 128Mi
  #     ephemeral-storage: 50Mi
  #   requests:
  #     cpu: 100m
  #     memory: 64Mi
  #     ephemeral-storage: 50Mi

  ## Adds additional environment variables. This property will be deprecated. Please use extraEnvs instead.
  ## e.g ENV_VAR: env_value
  env:
    ENABLE_WEBHOOKS: "true"

  # Extra definitions of environment variables.
  extraEnvs: []
  # - name: GOMEMLIMIT
  #   valueFrom:
  #     resourceFieldRef:
  #       containerName: manager
  #       resource: limits.memory

  # -- Create the manager ServiceAccount
  serviceAccount:
    create: true
    annotations: {}
    ## Override the default name of the serviceaccount (the name of your installation)
    name: ""

  ## Enable ServiceMonitor for Prometheus metrics scrape
  serviceMonitor:
    enabled: false
    # additional labels on the ServiceMonitor
    extraLabels: {}
    # add annotations on the ServiceMonitor
    annotations: {}
    metricsEndpoints:
      - port: metrics
        scheme: https
        bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
        tlsConfig:
          insecureSkipVerify: true
    # Used to set relabeling and metricRelabeling configs on the ServiceMonitor
    # https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config
    relabelings: []
    metricRelabelings: []

  # Adds additional annotations to the manager Deployment
  deploymentAnnotations: {}
  # Adds additional annotations to the manager Service
  serviceAnnotations: {}

  podAnnotations: {}
  podLabels: {}

  prometheusRule:
    enabled: false
    groups: []
    # Create default rules for monitoring the manager
    defaultRules:
      enabled: false
      ## Additional labels for PrometheusRule alerts
      additionalRuleLabels: {}
      ## Additional annotations for PrometheusRule alerts
      additionalRuleAnnotations: {}
      ## Alerts are considered firing once they have been returned for this long.
      duration: 5m
    # additional labels on the PrometheusRule object
    extraLabels: {}
    # add annotations on the PrometheusRule object
    annotations: {}
    # change the default runbook urls.
    # the alert name will get appended at the end of the url as an anchor.
    runbookUrl: ""

  # Whether the operator should create RBAC permissions for collectors. See README.md for more information.
  createRbacPermissions: false
  ## List of additional cli arguments to configure the manager
  ## for example: --labels, etc.
  extraArgs: []

  ## List of additional volumes to mount into the manager pod, e.g. a Secret holding a TLS certificate and key
  extraVolumes: []

  ## List of additional volume mounts for the manager container.
  ## manager.metrics.tls.certFile and keyFile must point to files inside a mounted path.
  extraVolumeMounts: []

  ## Enable leader election mechanism for protecting against split brain if multiple operator pods/replicas are started.
  ## See more at https://docs.openshift.com/container-platform/4.10/operators/operator_sdk/osdk-leader-election.html
  leaderElection:
    enabled: true

  # Enable vertical pod autoscaler support for the manager
  verticalPodAutoscaler:
    enabled: false

    # Recommender responsible for generating recommendation for the object.
    # List should be empty (then the default recommender will generate the recommendation)
    # or contain exactly one recommender.
    # recommenders:
    # - name: custom-recommender-performance

    # List of resources that the vertical pod autoscaler can control. Defaults to cpu, memory and ephemeral-storage.
    controlledResources: []

    # Define the max allowed resources for the pod
    maxAllowed: {}
    # cpu: 200m
    # memory: 100Mi
    # ephemeral-storage: 50Mi
    # Define the min allowed resources for the pod
    minAllowed: {}
    # cpu: 200m
    # memory: 100Mi
    # ephemeral-storage: 50Mi

    updatePolicy:
      # Specifies whether recommended updates are applied when a Pod is started and whether recommended updates
      # are applied during the life of a Pod. Possible values are "Off", "Initial", "Recreate", and "Auto".
      updateMode: Auto
      # Minimal number of replicas which need to be alive for Updater to attempt pod eviction.
      # Only positive values are allowed. The default is 2.
      minReplicas: 2
  # Enable manager pod automatically rolling
  rolling: false

  ## Container specific securityContext
  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault

## Admission webhooks make sure only requests with correctly formatted rules will get into the Operator.
## They also enable the sidecar injection for OpenTelemetryCollector and Instrumentation CR's
admissionWebhooks:
  create: true
  servicePort: 443
  failurePolicy: Fail
  secretName: ""

  ## Defines the sidecar injection logic in Pods.
  ## - Ignore, the injection is fail-open. The pod will be created, but the sidecar won't be injected.
  ## - Fail, the injection is fail-close. If the webhook pod is not ready, pods cannot be created.
  pods:
    failurePolicy: Ignore
    namespaceSelector: {}
    objectSelector: {}

  ## Selectors for Instrumentation webhooks.
  ## Empty maps use the common selectors from admissionWebhooks.namespaceSelector and admissionWebhooks.objectSelector.
  instrumentation:
    namespaceSelector: {}
    objectSelector: {}

  ## Selectors for OpenTelemetryCollector webhooks.
  ## Empty maps use the common selectors from admissionWebhooks.namespaceSelector and admissionWebhooks.objectSelector.
  opentelemetryCollector:
    namespaceSelector: {}
    objectSelector: {}

  ## Adds a prefix to the mutating webhook name.
  ## This can be used to order this mutating webhook with all your cluster's mutating webhooks.
  namePrefix: ""

  ## Customize webhook timeout duration
  timeoutSeconds: 10

  ## Common selectors for all admission webhooks (Pods, Instrumentation, and OpenTelemetryCollector).
  ## Per-webhook selectors are merged with these values, with specific values taking precedence on conflicts.
  namespaceSelector: {}
  objectSelector: {}

  ## https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-operator/README.md#tls-certificate-requirement
  ## TLS Certificate Option 1: Use certManager to generate self-signed certificate.
  ## certManager must be enabled. If enabled, always takes precedence over options 2 and 3.
  certManager:
    enabled: true
    ## Provide the issuer kind and name to do the cert auth job.
    ## By default, OpenTelemetry Operator will use self-signer issuer.
    issuerRef: {}
    # kind:
    # name:
    ## Annotations for the cert and issuer if cert-manager is enabled.
    certificateAnnotations: {}
    issuerAnnotations: {}
    # duration must be specified by a Go time.Duration (ending in s, m or h)
    duration: ""
    # renewBefore must be specified by a Go time.Duration (ending in s, m or h)
    # Take care when setting the renewBefore field to be very close to the duration
    # as this can lead to a renewal loop, where the Certificate is always in the renewal period.
    renewBefore: ""

  ## TLS Certificate Option 2: Use Helm to automatically generate self-signed certificate.
  ## certManager must be disabled and autoGenerateCert must be enabled.
  ## If true and certManager.enabled is false, Helm will automatically create a self-signed cert and secret for you.
  autoGenerateCert:
    enabled: true
    # If set to true, new webhook key/certificate is generated on helm upgrade.
    recreate: true
    # Cert period time in days. The default is 365 days.
    certPeriodDays: 365

  ## TLS Certificate Option 3: Use your own self-signed certificate.
  ## certManager and autoGenerateCert must be disabled and certFile, keyFile, and caFile must be set.
  ## The chart reads the contents of the file paths with the helm .Files.Get function.
  ## Refer to this doc https://helm.sh/docs/chart_template_guide/accessing_files/ to understand
  ## limitations of file paths accessible to the chart.
  ## Path to your own PEM-encoded certificate.
  certFile: ""
  ## Path to your own PEM-encoded private key.
  keyFile: ""
  ## Path to the CA cert.
  caFile: ""

  # Adds additional annotations to the admissionWebhook Service
  serviceAnnotations: {}

  ## Secret annotations
  secretAnnotations:
    "helm.sh/hook": "pre-install,pre-upgrade"
    "helm.sh/hook-delete-policy": "before-hook-creation"
  ## Secret labels
  secretLabels: {}

## Install CRDS with the right webhook settings
## These are installed as templates, so they will clash with existing OpenTelemetry Operator CRDs in your cluster that are not already managed by the helm chart.
## See https://github.com/open-telemetry/opentelemetry-helm-charts/blob/main/charts/opentelemetry-operator/UPGRADING.md#0560-to-0570 for more details.
crds:
  create: true
  # Annotations to add to all CRDs managed by this chart.
  # For example, "example.com/managed-by: opentelemetry-operator-chart".
  annotations: {}

## Create the provided Roles and RoleBindings
##
role:
  create: true

## Create the provided ClusterRoles and ClusterRoleBindings
##
clusterRole:
  create: true

affinity: {}
tolerations: []
nodeSelector:
  kubernetes.io/os: linux
topologySpreadConstraints: []
hostNetwork: false

# Whether to use user namespace or not
# Kubernetes version 1.30 for feature beta (1.33 for GA) or higher is required with support from OS and OCI runtime
# ref: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
# hostUsers: false

# Allows for pod scheduler prioritisation
priorityClassName: ""

## SecurityContext holds pod-level security attributes and common container settings.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext:
  runAsGroup: 65532
  runAsNonRoot: true
  runAsUser: 65532
  fsGroup: 65532

# Determines how the operator pod mounts the service account token and also
# sets the corresponding field in the associated service account object.
# - When set to `true` (default), the service account token is automatically
#   mounted to the pod, and the service account object will have the
#   `automountServiceAccountToken` field set to `true`.
# - When set to `false`, automounting of the service account token is disabled,
#   and the token is manually mounted using a volume and volumeMounts in
#   the pod spec by the chart. This also updates the `automountServiceAccountToken`
#   field in the service account object to `false`.
automountServiceAccountToken: true

testFramework:
  certManager:
    env:
      - name: CERT_MANAGER_CLUSTERIP
        value: "cert-manager-webhook.cert-manager"
      - name: CERT_MANAGER_PORT
        value: "443"
  image:
    repository: busybox
    tag: latest
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  resources: {}
  # resources:
  #   limits:
  #     cpu: 100m
  #     memory: 128Mi
  #   requests:
  #     cpu: 10m
  #     memory: 64Mi

## Extra manifests to deploy as an array
## Supports tpl syntax for templating
extraObjects: []
  # - apiVersion: v1
  #   kind: ConfigMap
  #   metadata:
  #     name: '{{ include "opentelemetry-operator.fullname" . }}-extra'
  #   data:
  #     key: value