values.yaml

# REQUIRED: the domain that the deployment will be visible to the user.
# system_domain: example.com

# List of stacks to install; the first one will be used as the default.
# A stack is a prebuilt root file system that supports a specific
# operating system with a corresponding set of buildpacks.
install_stacks: [sle15, cflinuxfs3]

# Set or override job properties. The first level of the map is the instance group name. The second
# level of the map is the job name. E.g.:
#  properties:
#    adapter:
#      adapter:
#        scalablesyslog:
#          adapter:
#            logs:
#              addr: kubecf-log-api:8082
#
properties: {}

# Override credentials to not be auto-generated.  The credentials can either be
# specified as a nested mapping, or with a dot-separated key.  For example:
#  credentials:
#    cf_admin_password: changeme
#    credhub_tls.ca: credhub-real-ca
#    credhub_tls:
#      certificate: the-cert
credentials: {}

# Override variable values to not be auto-generated.  The variables are a simple
# mapping with keys/values.  Note that the `system_domain` domain is handled
# differently and must be set via the top-level key (which is required).
# For example:
#  variables:
#    key: value
variables: {}

kube:
  # The storage class to be used for the instance groups that need it (e.g. bits, database and
  # singleton-blobstore). If it's not set, the default storage class will be used.
  storage_class: ~
  # The psp key contains the configuration related to Pod Security Policies. By default, a PSP will
  # be generated with the necessary permissions for running KubeCF. To pass an existing PSP and
  # prevent KubeCF from creating a new one, set the kube.psp.default with the PSP name.
  psp:
    default: ~

# Set to true to enable support for multiple availability zones.
multi_az: false

# Set to true to enable high availability mode, where pods are replicated in
# order to prevent downtime when a node is temporarily unavailable.
high_availability: false

# Instance sizing takes precedence over the high_availability property. I.e. setting the
# instance count for an instance group greater than 1 will make it highly available.
#
# It is also possible to specify custom affinity rules for each instance group. If no rule
# is provided, then each group as anti-affinity to itself, to try to spread the pods between
# different nodes. In addition diego-cell and router also have anti-affinity to each other.
#
# The default rules look like this:
#
# sizing:
#   sample_group:
#     affinity:
#       podAntiAffinity:
#         preferredDuringSchedulingIgnoredDuringExecution:
#         - weight: 100
#           podAffinityTerm:
#             labelSelector:
#               matchExpressions:
#               - key: quarks.cloudfoundry.org/quarks-statefulset-name
#                 operator: In
#                 values:
#                 - sample_group
#             topologyKey: kubernetes.io/hostname
#
# Any affinity rules specified here will *overwrite* the default rule and not merge with it.

sizing:
  adapter:
    instances: ~
  api:
    instances: ~
  apps_dns:
    instances: ~
  asactors:
    instances: ~
  asapi:
    instances: ~
  asmetrics:
    instances: ~
  asnozzle:
    instances: ~
  auctioneer:
    instances: ~
  bits:
    instances: ~
  cc_worker:
    instances: ~
  credhub:
    instances: ~
  database:
    instances: ~
    persistence:
      size: 20Gi
  diego_api:
    instances: ~
  diego_cell:
    ephemeral_disk:
      # Size of the ephemeral disk used to store applications in MB
      size: 40960
      # IMPORTANT! Only set this if you understand the consequences of using a PVC as ephemeral
      # storage for diego cells. The storage class should be high performance, and not based on NFS.
      # Do not set this value in production environments unless you've tested your storage class with
      # diego cells and have found no problems.
      # The name of the storage class used for the ephemeral disk PVC.
      storage_class: ~
    instances: ~
  doppler:
    instances: ~
  eirini:
    instances: ~
  log_api:
    instances: ~
  nats:
    instances: ~
  router:
    instances: ~
  routing_api:
    instances: ~
  scheduler:
    instances: ~
  uaa:
    instances: ~
  tcp_router:
    instances: ~

#  External endpoints are created for the instance groups only if features.ingress.enabled is false.
services:
  router:
    annotations: {}
    type: LoadBalancer
    externalIPs: []
    clusterIP: ~
    loadBalancerIP: ~
  ssh-proxy:
    annotations: {}
    type: LoadBalancer
    externalIPs: []
    clusterIP: ~
    loadBalancerIP: ~
  tcp-router:
    annotations: {}
    type: LoadBalancer
    externalIPs: []
    clusterIP: ~
    loadBalancerIP: ~
    port_range:
      start: 20000
      end: 20008

# CPU and memory resources can be configured via the `resources` tree when features.cpu_limits.enabled
# or features.memory_limits.enabled are set respectively. Each setting covers both limit and request
# settings for their resource type.
#
# The helm chart includes default memory limits for all processes, and some explicit requests. When no
# request size is specified, a default is calculated as a percentage of the limit, but at least some
# minimum threshold, but never more than the limit itself. See the features.memory_limits setting to
# finetune this algorithm.
#
# All values are integers; cpu values are in millicpus (m) and memory is in megabytes (Mi).
#
# More information about the `resources` structure can be found in the config/resources.yaml file
# inside this helm chart.

resources:
  diego-cell:
    garden:
      garden: {memory: {limit: 524288, request: 16}}

settings:
  router:
    # tls sets up the public TLS for the router. The tls keys:
    #   crt: the certificate in the PEM format. Required.
    #   key: the private key in the PEM format. Required.
    tls: {}
    # crt: |
    #   -----BEGIN CERTIFICATE-----
    #   ...
    #   -----END CERTIFICATE-----
    # key: |
    #   -----BEGIN PRIVATE KEY-----
    #   ...
    #   -----END PRIVATE KEY-----


features:
  # Set default memory limits and requests for all containers
  memory_limits:
    enabled: true
    # The memory request size default is calculated as a percentage of the limit.
    # The default is always at least a minimum value, but never larger than the limit itself.
    default_request_minimum: 32
    default_request_in_percent: 25
  eirini:
    enabled: false
  # To support multi-clusters, deploy diego-cell separately please set control_plane is false  and cell_segment is true
  multiple_cluster_mode:
    control_plane:
      enabled: false
    cell_segment:
      enabled: false
    # To support multi-clusters, services for diego-cell deployed separately
    control_plane_workers:
      uaa:
        name: uaa
        addresses:
        - ip: ~
      diego_api:
        name: diego-api
        addresses:
        - ip: ~
      api:
        name: api
        addresses:
        - ip: ~
      singleton_blobstore:
        name: singleton-blobstore
        addresses:
        - ip: ~
    # To support multi-clusters, provider link secrets for diego-cell deployed separately
    provider_link_service:
      nats:
        secret_name: minion-link-nats
        service_name: minion-service-nats
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of nats, for example:
        # link: |
        #   ---
        #   nats.user: "nats"
        #   nats.password: "xxxxxx"
        #   nats.hostname: "nats"
        #   nats.port: 4222
        link: ~
      nats_tls:
        secret_name: minion-link-nats-tls
        service_name: minion-service-nats-tls
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of nats_tls, for example:
        # link: |
        #   ---
        #   nats.user: "nats"
        #   nats.password: "xxxxxx"
        #   nats.hostname: "nats"
        #   nats.port: 4223
        #   nats.external.tls.ca: ""
        link: ~
      routing_api:
        secret_name: minion-link-routing-api
        service_name: minion-service-routing-api
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of routing-api, for example:
        # link: |
        #   routing_api.clients: ~
        #   routing_api.system_domain: "xxx.xxx.xxx"
        #   routing_api.port: 3000
        #   routing_api.mtls_port: 3001
        #   routing_api.mtls_ca: |
        #     -----BEGIN CERTIFICATE-----
        #     xxxxxx
        #     -----END CERTIFICATE-----
        #   ......
        link: ~
      doppler:
        secret_name: minion-link-doppler
        service_name: minion-service-doppler
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of doppler, for example:
        # link: |
        #   doppler.grpc_port: 8082
        link: ~
      loggregator:
        secret_name: minion-link-loggregator
        service_name: minion-service-loggregator
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of loggregator, for example:
        # link: |
        #   loggregator.tls.ca_cert: |
        #     -----BEGIN CERTIFICATE-----
        #     xxxxxx
        #     -----END CERTIFICATE-----
        #   ......
        link: ~
      cloud_controller:
        secret_name: minion-link-cloud-controller
        service_name: minion-service-cloud-controller
        addresses:
        - ip: ~
        # To support multi-clusters, fill the provider link secrets context of cloud-controller, for example:
        # link: |
        #   system_domain: "{{ .Values.system_domain }}"
        #   app_domains: []
        link: ~
      cloud_controller_container_networking_info:
        secret_name: minion-link-cloud-controller-container-networking-info
        service_name: minion-service-cloud-controller-container-networking-info
        addresses:
        - ip: ~
        # link: |
        #   cc.internal_route_vip_range: "127.128.0.0/9"
        link: ~
      cf_network:
        secret_name: minion-link-cf-network
        service_name: minion-service-cf-network
        addresses:
        - ip: ~
        # link: |
        #   network: "10.255.0.0/16"
        #   subnet_prefix_length: 24
        link: ~
  ingress:
    enabled: false
    tls:
      # TLS certificate for the ingress controller.  This should be a wildcard certificate for the
      # system domain (*.example.com, where api.example.com is the API endpoint).  It should also
      # include the full certificate chain (that is, include the intermediate certificates).
      crt: ~
      # TLS certificate private key for the ingress controller, matching features.ingress.tls.crt.
      key: ~
    annotations: {}
    labels: {}
  autoscaler:
    # Enable the application autoscaler.  The autoscaler service must be manually registered; see
    # https://github.com/cloudfoundry/app-autoscaler-release#register-service for details.
    enabled: false
    mysql:
      enabled: false
  credhub:
    # Enable credhub; this is only used as a service broker for applications, and is not used for
    # authentication with the Cloud Foundry deployment.
    enabled: true
  routing_api:
    # Enable the routing API.  Disabling this will also disable TCP routing, which is used for TCP
    # port forwarding.
    enabled: true
  embedded_database:
    # Enable the embedded database.  If this is disabled, then features.external_database should be
    # configured to use an external database.
    enabled: true
    # Number of seconds to wait for the database to be ready, per iteration of the waiter loop
    connect_timeout: 3
  blobstore:
    # Possible values for provider: singleton and s3.
    provider: singleton
    s3:
      aws_region: ~
      blobstore_access_key_id: ~
      blobstore_secret_access_key: ~
      blobstore_admin_users_password: ~
      # The following values are used as S3 bucket names.
      app_package_directory_key: ~
      buildpack_directory_key: ~
      droplet_directory_key: ~
      resource_directory_key: ~

  # Configuration for the external database; see also features.embedded_database.  Please refer to
  # https://kubecf.suse.dev/docs/getting-started/kubernetes-deploy/#external-database for details.
  external_database:
    enabled: false
    require_ssl: false
    ca_cert: ~
    # The external database type; it can be either 'mysql' or 'postgres'.
    type: ~
    host: ~
    port: ~
    # Number of seconds to wait for the database to be ready, per iteration of the waiter loop
    connect_timeout: 3
    # If seed is set to true, we will initialize the database using the provided
    # root password (see `.variables.pxc-root-password`); in that case it is not
    # necessary to provide the configuration for the individual databases.
    seed: false
    databases:
      uaa:
        name: uaa
        password: ~
        username: ~
      cc:
        name: cloud_controller
        password: ~
        username: ~
      bbs:
        name: diego
        password: ~
        username: ~
      routing_api:
        name: routing-api
        password: ~
        username: ~
      policy_server:
        name: network_policy
        password: ~
        username: ~
      silk_controller:
        name: network_connectivity
        password: ~
        username: ~
      locket:
        name: locket
        password: ~
        username: ~
      credhub:
        name: credhub
        password: ~
        username: ~

# Enable or disable instance groups for the different test suites.
# Only smoke tests should be run in production environments.
testing:
  # __ATTENTION__: The brain tests do things with the cluster which
  # required them to have `cluster-admin` permissions (i.e. root).
  # Enabling them is thus potentially insecure. They should only be
  # activated for isolated testing.
  brain_tests:
    enabled: false
    # Delete the testing pod after completion (default: false)
    delete_pod: false
  cf_acceptance_tests:
    enabled: false
    # Delete the testing pod after completion (default: false)
    delete_pod: false
  smoke_tests:
    enabled: true
    # Delete the testing pod after completion (default: false)
    delete_pod: false
  sync_integration_tests:
    enabled: false
    # Delete the testing pod after completion (default: false)
    delete_pod: false

ccdb:
  encryption:
    # Configure CCDB key rotation.  Please see
    # https://kubecf.suse.dev/docs/tasks/secrets/#rotating-the-ccdb-encryption-keys for details.
    rotation:
      # Key labels must be <= 240 characters long.
      key_labels:
      - encryption_key_0
      current_key_label: encryption_key_0

operations:
  # A list of configmap names that should be applied to the BOSH manifest.
  custom: []
  # Inlined operations that get into generated ConfigMaps. E.g. adding a password variable:
  # operations:
  #   inline:
  #   - type: replace
  #     path: /variables/-
  #     value:
  #       name: my_password
  #       type: password
  inline: []

eirinix:
  persi-broker:
    # Service plans for Eirini persistant storage support
    service-plans:
    - id: default
      name: "default"
      description: "Existing default storage class"
      kube_storage_class: ~
      free: true
      default_size: "1Gi"
    description: Eirini persistence broker
    long_description: Eirini persistence broker to provide Kubernete storage classes
    provider_display_name: Eirini broker
    documentation_url: https://github.com/SUSE/eirini-persi-broker
    support_url: https://github.com/SUSE/eirini-persi-broker/issues
    display_name: Eirini broker
    icon_image: Eirini broker
    secrets:
      auth-password: ~ # Password is randomly generated if not given