# Copyright 2017 The Openstack-Helm Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

images:
  tags:
    dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1
    ks_user: docker.io/openstackhelm/heat:ocata
    results_publisher: docker.io/openstackhelm/heat:ocata
    sonobuoy_api: gcr.io/heptio-images/sonobuoy:v0.11.4
    systemd_logs: gcr.io/heptio-images/sonobuoy-plugin-systemd-logs:v0.1
  pull_policy: "IfNotPresent"
  local_registry:
    active: false
    exclude: []

labels:
  api:
    node_selector_key: openstack-control-plane
    node_selector_value: enabled
  job:
    node_selector_key: openstack-control-plane
    node_selector_value: enabled

dependencies:
  dynamic: {}
  static:
    sonobuoy:
      jobs:
      - sonobuoy-ks-user

pod:
  resources:
    enabled: false
    jobs:
      ks_user:
        requests:
          memory: "128Mi"
          cpu: "100m"
        limits:
          memory: "128Mi"
          cpu: "2000m"

secrets:
  identity:
    admin: sonobuoy-keystone-admin
    sonobuoy: sonobuoy-keystone-user

endpoints:
  cluster_domain_suffix: cluster.local
  identity:
    name: keystone
    auth:
      admin:
        region_name: RegionOne
        username: admin
        password: password
        project_name: admin
        user_domain_name: default
        project_domain_name: default
      sonobuoy:
        role: admin
        region_name: RegionOne
        username: sonobuoy
        password: password
        project_name: sonobuoy
        user_domain_name: sonobuoy
        project_domain_name: sonobuoy
    hosts:
      default: keystone
      internal: keystone-api
    host_fqdn_override:
      default: null
    path:
      default: /v3
    scheme:
      default: http
    port:
      api:
        default: 80
        internal: 5000

manifests:
  configmap_bin: true
  configmap_plugins: true
  job_ks_user: true
  pod_api: true
  secret_etc: true
  secret_keystone: true

conf:
  publish_results: true
  swift:
    container_name: sonobuoy
    # delete objects after 1 month (60 * 60 * 24 * 30 seconds)
    delete_objects_after_seconds: "2592000"
    object_name_prefix: ""
  sonobuoy:
    Description: "sonobuoy run for scanner.heptio.com"
    Version: v0.11.4
    ResultsDir: /tmp/resultshost
    Resources:
      - Nodes
      - ServerVersion
    Filters:
      Namespaces: ""
      LabelSelector: ""
    Server:
      bindaddress: 0.0.0.0
      bindport: 8080
      advertiseaddress: ""
      timeoutseconds: 8000
    Plugins:
      - name: systemd-logs
    Limits:
      PodLogs:
        SizeLimitBytes: 10000
    # NOTE: the WorkerImage should not be defined and is set in sonobuoy-etc
    WorkerImage: null
    ImagePullPolicy: IfNotPresent
  plugins:
    - name: systemd_logs.yaml
      data: |
        sonobuoy-config:
          driver: DaemonSet
          plugin-name: systemd-logs
          result-type: systemd_logs
        spec:
          name: sonobuoy-systemd-logs-config
          env:
          - name: CHROOT_DIR
            value: /node
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: RESULTS_DIR
            value: /tmp/results
          image: {{ .Values.images.tags.systemd_logs }}
          imagePullPolicy: Always
          command:
          - sh
          - -c
          - /get_systemd_logs.sh && sleep 3600
          securityContext:
            privileged: true
          volumeMounts:
          - mountPath: /tmp/results
            name: results
            readOnly: false
          - mountPath: /node
            name: root
            readOnly: false