# imagePullSecrets is a special helm field which, when specified, creates a secret
# containing the pull secret which is used to pull all images deployed by this helm chart and the resulting operator.
# this field is a map where the key is the desired secret name and the value is the contents of the imagePullSecret.
#
# Example: --set-file imagePullSecrets.gcr=./pull-secret.json
imagePullSecrets: {}

# Configures general installation parameters for Calico. Schema is based
# on the operator.tigera.io/Installation API documented
# here: https://docs.tigera.io/calico/latest/reference/installation/api#installationspec
installation:
  enabled: true
  # Uncomment to enable prometheus metrics reporting for node and typha.
  # nodeMetricsPort: 9090
  # typhaMetricsPort: 9091
  # Path to the kubelet volume plugin directory used by the Calico CSI driver.
  # Set to "None" to disable the CSI driver. If unset, defaults to /var/lib/kubelet (CSI enabled).
  kubeletVolumePluginPath: "None"

  # --- General Image Settings ---
  # registry: <custom-registry>
  # imagePath: <optional-path>
  # imagePrefix: <optional-prefix>

  # imagePullSecrets are configured on all images deployed by the tigera-operator.
  # secrets specified here must exist in the tigera-operator namespace; they won't be created by the operator or helm.
  # imagePullSecrets are a slice of LocalObjectReferences, which is the same format they appear as on deployments.
  #
  # Example: --set installation.imagePullSecrets[0].name=my-existing-secret
  imagePullSecrets: []

  # Valid options: EKS, GKE, AKS, RKE2, OpenShift, DockerEnterprise, TKG, Kind.
  # If empty the operator will attempt to automatically determine the current provider.
  kubernetesProvider: ""

  # cni:
  #   # "Calico" (default), "AmazonVPC", "GKE", "AzureVNET", "HostLocal"
  #   type: "Calico"
  #   ipam:
  #     # "Calico" (default), "HostLocal", "AmazonVPC", "AzureVNET"
  #     type: "Calico"

  # calicoNetwork:
  #   # "Enabled" (default) or "Disabled"
  #   bgp: "Enabled"
  #
  #   # One of: Iptables, BPF, VPP, Nftables
  #   linuxDataplane: "Iptables"
  #
  #   # Enable HostPorts (default: Enabled)
  #   hostPorts: "Enabled"
  #
  #   # Default: auto-detected based on node interface (typically around 1450)
  #   mtu: 1450
  #
  #   ipPools:
  #     - cidr: "192.168.0.0/16"
  #       encapsulation: "IPIP" # IPIP, VXLAN, IPIPCrossSubnet, VXLANCrossSubnet, None
  #       natOutgoing: "Enabled"
  #       nodeSelector: "all()"
  #       blockSize: 26

  # Number of replicas for Typha/Control Plane (default: 2)
  controlPlaneReplicas: 2

  controlPlaneNodeSelector: {}

  controlPlaneTolerations: []

  # Run Calico in non-privileged mode (Rootless)
  nonPrivileged: "Disabled"

  # Enable FIPS compliance mode (Requires FIPS compliant cluster/images)
  # Only supported for Variant=Calico.
  # fipsMode: "Disabled"

  # Configure log severity (Info, Debug, Warning, Error, Fatal)
  # logging:
  #   cni:
  #     logSeverity: Info
  #     logFileMaxSize: 100Mi
  #     logFileMaxAgeDays: 30 # Days
  #     logFileMaxCount: 10

# apiServer configures the Calico API server, needed for interacting with
# the projectcalico.org/v3 suite of APIs.
apiServer:
  enabled: true

# goldmane configures the Calico Goldmane flow aggregator.
goldmane:
  enabled: true

# whisker configures the Calico Whisker observability UI.
whisker:
  enabled: true

defaultFelixConfiguration:
  enabled: false

certs:
  node:
    key:
    cert:
    commonName:
  typha:
    key:
    cert:
    commonName:
    caBundle:

# Whether or not the tigera/operator should manange CustomResourceDefinitions
# needed to run itself and Calico. If disabled, you must manage these resources out-of-band.
manageCRDs: true

# Resource requests and limits for the tigera/operator pod.
resources: {}

# Common labels for all resources created by this chart
additionalLabels: {}

# Tolerations for the tigera/operator pod.
tolerations:
  - effect: NoExecute
    operator: Exists
  - effect: NoSchedule
    operator: Exists

# NodeSelector for the tigera/operator pod.
nodeSelector:
  kubernetes.io/os: linux

# Affinity for the tigera/operator pod.
affinity: {}

# PriorityClassName for the tigera/operator pod.
priorityClassName: ""

# Custom annotations for the tigera/operator pod.
podAnnotations: {}

# Custom labels for the tigera/operator pod.
podLabels: {}

# DNS policy for the tigera/operator pod. Set "None" with a dnsConfig listing cluster and node
# resolvers where cluster DNS is not reachable at install time, such as EKS with kube-proxy disabled.
dnsPolicy: ""

# Custom DNS configuration for the tigera/operator pod. calico-node inherits this and dnsPolicy
# when set.
dnsConfig: {}
# Image and registry configuration for the tigera/operator pod.
tigeraOperator:
  image: tigera/operator
  version: v1.42.6
  registry: quay.io
calicoctl:
  image: quay.io/calico/ctl
  tag: v3.32.2

# Optionally configure the host and port used to access the Kubernetes API server.
kubernetesServiceEndpoint:
  host: ""
  port: "6443"