# Helm values for OpenChoreo Observability Plane in k3d single-cluster setup
# Observer configuration
observer:
  openSearchSecretName: opensearch-admin-credentials
  secretName: observer-secret
  # OpenChoreo 1.2.0+ requires a real (non-.invalid) control plane API URL.
  # Used for AUTHZ_SERVICE_URL and UID_RESOLVER_OPENCHOREO_API_URL; resolves
  # via coredns-custom (*.openchoreo.localhost -> host.k3d.internal) to the
  # openchoreo-api HTTPRoute.
  controlPlaneApiUrl: "http://api.openchoreo.localhost:8080"
  # OpenChoreo 1.2.0+ validates OBSERVER_BASE_URL is not a placeholder domain.
  extraEnvs:
    - name: OBSERVER_BASE_URL
      value: "http://observer.openchoreo.localhost:11080"
    - name: AUTHZ_TIMEOUT
      value: "30s"
  http:
    hostnames:
      - observer.openchoreo.localhost

# OIDC security configuration (Thunder integration)
security:
  oidc:
    # Thunder JWKS endpoint for token validation
    jwksUrl: "http://amp-thunder-extension-service.amp-thunder.svc.cluster.local:8090/oauth2/jwks"
    tokenUrl: "http://amp-thunder-extension-service.amp-thunder.svc.cluster.local:8090/oauth2/token"
    authServerBaseUrl: "http://thunder.amp.localhost:8080"

gateway:
  httpPort: 11080
  httpsPort: 11085
  tls:
    enabled: false
  # Fluent Bit reaches OpenSearch through this listener (SNI-routed by the
  # opensearch TLSRoute in values/opensearch-tls-route.yaml), not directly.
  tlsPassthrough:
    enabled: true
    hostname: "opensearch.observability.openchoreo.localhost"
    port: 11443
networkPolicy:
  unrestrictedIngressAppNames:
    - gateway-default
    - opentelemetry-collector
    - wso2-amp-observability-extension