# Copyright © 2017 Amdocs, Bell Canada
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
 
#################################################################
# Global configuration overrides.
#
# These overrides will affect all helm charts (ie. applications)
# that are listed below and are 'enabled'.
#################################################################
global:
  # Change to an unused port prefix range to prevent port conflicts
  # with other instances running within the same k8s cluster
  nodePortPrefix: 302
  nodePortPrefixExt: 304
  masterPassword: userUSER
  addTestingComponents: &testing true
  centralizedLoggingEnabled: &centralizedLogging false
  flavor: unlimited

  # Global ingress configuration
  ingress:
      # generally enable ingress for ONAP components
    enabled: true
    # enable all component's Ingress interfaces
    enable_all: true
    # All http requests via ingress will be redirected
    
    # Provider: ingress, istio, gw-api
    provider: gw-api
    
    # Ingress class (only for provider "ingress"): e.g. nginx, traefik
    ingressClass:
    # Ingress Selector (only for provider "istio") to match with the

    # ingress pod label "istio=ingress"
    ingressSelector: ingress
    # optional: common used Gateway (for Istio, GW-API) and listener names
    commonGateway:
      name: ""
      httpListener: ""
      httpsListener: ""

    # default Ingress base URL and preAddr- and postAddr settings
    # Ingress URLs result:
    # <preaddr><component.ingress.service.baseaddr><postaddr>.<baseurl>
    virtualhost:
      # Default Ingress base URL
      # can be overwritten in component by setting ingress.baseurlOverride
      baseurl: "simpledemo.onap.org"
      # prefix for baseaddr
      # can be overwritten in component by setting ingress.preaddrOverride
      preaddr: ""
      # postfix for baseaddr
      # can be overwritten in component by setting ingress.postaddrOverride
      postaddr: ""
        

    # All http (port 80) requests via ingress will be redirected
    # to port 443 on Ingress controller
    # only valid for Istio Gateway (ServiceMesh enabled)
    config:
      ssl: "redirect"
    # you can set an own Secret containing a certificate
    # only valid for Istio Gateway (ServiceMesh enabled)
    #  tls:
    #    secret: 'my-ingress-cert'

    # optional: Namespace of the Istio IngressGateway or Gateway-API
    # only valid for Istio Gateway (ServiceMesh enabled)
    namespace: istio-ingress

  # image pull policy
  pullPolicy: IfNotPresent
 
  cassandra:
    # flag to enable the DB creation via k8ssandra-operator
    useOperator: true
    # if useOperator set to "true", set "enableServiceAccount to "false"
    # as the SA is created by the Operator
    enableServiceAccount: false

  # override default mount path root directory
  # referenced by persistent volumes and log files
  persistence:
    mountPath: /dockerdata-nfs
    enableDefaultStorageclass: false
    parameters: {}
    storageclassProvisioner: kubernetes.io/no-provisioner
    volumeReclaimPolicy: Retain
 
  # Global flag to enable the creation of default roles instead of using
  # common roles-wrapper
  createDefaultRoles: false

  # override default resource limit flavor for all charts
  #flavor: unlimited 
  
  # flag to enable debugging - application support required
  debugEnabled: false

  # default password complexity
  # available options: phrase, name, pin, basic, short, medium, long, maximum security
  # More datails: https://www.masterpasswordapp.com/masterpassword-algorithm.pdf
  passwordStrength: long

  # ONAP Repository
  # Four different repositories are used
  # You can change individually these repositories to ones that will serve the
  # right images. If credentials are needed for one of them, see below.
  repository: nexus3.onap.org:10001
  dockerHubRepository: &dockerHubRepository docker.io
  elasticRepository: &elasticRepository docker.elastic.co
  quayRepository: quay.io
  googleK8sRepository: k8s.gcr.io
  githubContainerRegistry: ghcr.io
  
  #readinessRepository: oomk8s # readiness check - temporary repo until images migrated to nexus3

  #/!\ DEPRECATED /!\
  # Legacy repositories which will be removed at the end of migration.
  # Please don't use
  loggingRepository: *elasticRepository
  busyboxRepository: *dockerHubRepository

  # common global images
  # Busybox for simple shell manipulation
  busyboxImage: busybox:1.34.1

  # curl image
  curlImage: curlimages/curl:7.80.0

  # env substitution image
  envsubstImage: dibi/envsubst:1

  # generate htpasswd files image
  # there's only latest image for htpasswd
  htpasswdImage: xmartlabs/htpasswd:latest

  # kubenretes client image
  kubectlImage: bitnami/kubectl:1.22.4

  # logging agent
  loggingImage: beats/filebeat:5.5.0

  # mariadb client image
  mariadbImage: bitnami/mariadb:10.5.8

  # nginx server image
  nginxImage: bitnami/nginx:1.21.4

  # postgreSQL client and server image
  postgresImage: crunchydata/crunchy-postgres:centos8-13.2-4.6.1

  # readiness check image
  readinessImage: onap/oom/readiness:5.0.1

  # default java image
  jreImage: onap/integration-java11:10.0.0

  # default clusterName
  # {{ template "common.fullname" . }}.{{ template "common.namespace" . }}.svc.{{ .Values.global.clusterName }}
  clusterName: cluster.local

  # Default credentials
  # they're optional. If the target repository doesn't need them, comment them
  repositoryCred:
    user: docker
    password: docker
  dockerHubCred:
    user: scantrell7
    password: where-onap-at-now

  # Global Service Mesh configuration
  # POC Mode, don't use it in production
  serviceMesh:
    enabled: true
    tls: true
    # be aware that linkerd is not well tested
    engine: "istio" # valid value: istio or linkerd

  # Global Istio Authorization Policy configuration
  authorizationPolicies:
    enabled: false
  
  # metrics part
  # If enabled, exporters (for prometheus) will be deployed
  # if custom resources set to yes, CRD from prometheus operartor will be
  # created
  # Not all components have it enabled.
  #
  metrics:
    enabled: true
    custom_resources: false

  # Disabling AAF
  # POC Mode, only for use in development environment
  # Keep it enabled in production
  aafEnabled: false
  aafAgentImage: onap/aaf/aaf_agent:2.1.20

  # Disabling MSB
  # POC Mode, only for use in development environment
  msbEnabled: true
  #  tlsEnabled: false

  # default values for certificates
  certificate:
    default:
      renewBefore: 720h #30 days
      duration:    8760h #365 days
      subject:
        organization: "Linux-Foundation"
        country: "US"
        locality: "San-Francisco"
        province: "California"
        organizationalUnit: "ONAP"
      issuer:
        group: certmanager.onap.org
        kind: CMPv2Issuer
        name: cmpv2-issuer-onap

  # Enabling CMPv2
  cmpv2Enabled: false
  platform:
    certificates:
      clientSecretName: oom-cert-service-client-tls-secret
      keystoreKeyRef: keystore.jks
      truststoreKeyRef: truststore.jks
      keystorePasswordSecretName: oom-cert-service-certificates-password
      keystorePasswordSecretKey: password
      truststorePasswordSecretName: oom-cert-service-certificates-password
      truststorePasswordSecretKey: password

  # Indicates offline deployment build
  # Set to true if you are rendering helm charts for offline deployment
  # Otherwise keep it disabled
  offlineDeploymentBuild: false

  # TLS
  # Set to false if you want to disable TLS for NodePorts. Be aware that this
  # will loosen your security.
  # if set this element will force or not tls even if serviceMesh.tls is set.
  tlsEnabled: true

  # Logging
  # Currently, centralized logging is not in best shape so it's disabled by
  # default
centralizedLoggingEnabled: &centralizedLogging false

  # Example of specific for the components where you want to disable TLS only for
  # it:
  # if set this element will force or not tls even if global.serviceMesh.tls and
  # global.tlsEnabled is set otherwise.
  # robot:
  #   tlsOverride: false

  # Global storage configuration
  #    Set to "-" for default, or with the name of the storage class
  #    Please note that if you use AAF, CDS, SDC, Netbox or Robot, you need a
  #    storageclass with RWX capabilities (or set specific configuration for these
  #    components).
  # persistence:
  #   storageClass: "-"

#k8ssandra operator settings to control pod antiAffinity isettins for Cassandra.  Pod AntiAffinity by default is set to hard pod AntiAffinity meaning that one one pod is allowed per workder node.  This is designed for HA clusters where for redundancy the pods are spread accruss multiple worker nodes.  This does not however work in a single VM test environment and these settings need to be modified to make ONAP single VM deployments possible.  Also, the helm deploy script uses the raw charts and values files, and does not pass down these overrides.  There are two options, manipulate the charts and values with these overrides, or once the cass0b template has the softPodAntiAffinity variable defined, and linked to a value, run helm install onap-cassandra prior to deploying with the helm deploy onap command which will skip over Cassandra since it will already be installed.
k8ssandraOperator:
    #Set the value of softPodAntiAffinity to true to disable hard pod antiAffinity such as in single VM deployments.
    softPodAntiAffinity: true
    reaper:
      #Set to true to enable deployment of reeaper.
      enabled: true
    stargate:
      #Set this value to "true" to enable deployment of Stargate
      enabled: true
      #Set this value to "preferredDuringSchedulingIgnoredDuringExecution" ton enable multiple pods on a single worker node such as in single VM test environments.  Use "requiedDuringSchedulingIgnoredDuringExecution" to prevent multiple pods on a singel worker node sucha s in HA clusters.
      affinity: preferredDuringSchedulingIgnoredDuringExecution

#settings to fix error with capitalized HTTPS-443 in the name of the listener for https.
ingress:
   spec:
      gatewayClassName: istio
      listeners:
      - name: http-80
        port: 80
        protocol: HTTP
        hostname: reaper-dc1.simpledemo.onap.org
        allowedRoutes:
          namespaces:
            from: All
      - name: https-443
        port: 443
        protocol: HTTPS
        hostname: reaper-dc1.simpledemo.onap.org
        tls:
          CertificateRefs:
          - kind: Secret
            group: ""
            name: "ingress-tls-secret"
          ode: Terminate



# Example of specific for the components which requires RWX:
# cds:
#   cds-blueprints-processor:
#     persistence:
#       storageClassOverride: "My_RWX_Storage_Class"
# sdc:
#   sdc-onboarding-be:
#     persistence:
#       storageClassOverride: "My_RWX_Storage_Class"
 
#################################################################
# Enable/disable and configure helm charts (ie. applications)
# to customize the ONAP deployment.
#################################################################
aaf:
  enabled: false
  aaf-sms:
    cps:
      # you must always set the same values as value set in cps.enabled
      enabled: true
  aaf-service:
    readiness:
      initialDelaySeconds: 150
aai:
  enabled: true
  flavorOverride: unlimited
  global:
    flavorOverride: unlimited
    cassandra:
      replicas: 3
  aai-cassandra:
    flavorOverride: unlimited
    replicaCount: 3
  aai-babel:
    flavorOverride: unlimited
  aai-data-router:
    flavorOverride: unlimited
  aai-elasticsearch:
    flavorOverride: unlimited
  aai-graphadmin:
    flavorOverride: unlimited
  aai-modelloader:
    flavorOverride: unlimited
  aai-resources:
    flavorOverride: unlimited
  aai-schema-service:
    flavorOverride: unlimited
  aai-search-data:
    flavorOverride: unlimited
  aai-sparky-be:
    flavorOverride: unlimited
    readiness:
      initialDelaySeconds: 150
      periodSeconds: 20
      timeoutSeconds: 10
    liveness:
      timeoutSeconds: 10
  aai-traversal:
    flavorOverride: unlimited 
appc:
  enabled: false
cassandra:
  enabled: true
cds:
  enabled: true
cps:
  enabled: true
clamp:
  enabled: true
cli:
  enabled: true
consul:
  enabled: true
contrib:
  enabled: *testing
cmpv2issuer:
  updateEndpoint: v1/certificate-update
dcaegen2:
  enabled: true
dcaegen2-services:
  enabled: true
  dcae-datafile-collector:
    enabled: true
  dcae-datalake-admin-ui:
    enabled: true
  dcae-datalake-des:
    enabled: true
  dcae-datalake-feeder:
    enabled: true
  dcae-heartbeat:
    enabled: true
  dcae-hv-ves-collector:
    enabled: true
  dcae-kpi-ms:
    enabled: true
  dcae-ms-healthcheck:
    enabled: true
  dcae-pm-mapper:
    enabled: true
  dcae-pmsh:
    enabled: true
  dcae-prh:
    enabled: true
  dcae-restconf-collector:
    enabled: true
  dcae-slice-analysis-ms:
    enabled: true
  dcae-snmptrap-collector:
    enabled: true
  dcae-son-handler:
    enabled: true
  dcae-tcagen2:
    enabled: true
  dcae-ves-collector:
    enabled: true
    applicationConfig:
      auth.method: "noAuth"
  dcae-ves-mapper:
    enabled: true
  dcae-ves-openapi-manager:
    enabled: true
holmes:
  enabled: true
dmaap:
  enabled: true
  message-router:
    enabled: true
  dmaap-bc:
    enabled: true
  dmaap-dr-prov:
    enabled: true
  dmaap-dr-node:
    enabled: true
esr:
  enabled: true
log:
  enabled: true
  log-logstash:
    replicaCount: 1
oof:
  enabled: true
mariadb-galera:
  enabled: true
  affinity:
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
        - topologyKey: kubernetes.io/hostname
msb:
  enabled: true
multicloud:
  enabled: true
nbi:
  enabled: false
  config:
    cloudOwner: k8scloudowner4
    k8sCloudRegionId: k8sregionfour
    k8sCloudOwner: k8scloudowner4
    ecompInstanceId: OOM
    openStackRegion: k8sregionfour
    openStackVNFTenantId: aaaa
    tenantId: aaaa
    tenant-id: aaaa
platform:
  enabled: true
  cmpv2-cert-service:
    enabled: false
  keycloak-init:
    enabled: true
policy:
  enabled: true
postgres:
  enabled: true
portal:
  enabled: false
portal-ng:
  enabled: true
robot:
  enabled: false
  flavor: small
  appcUsername: "appc@appc.onap.org"
  appcPassword: "TBD"
  openStackKeyStoneUrl: "http://10.0.0.154:5000"
  openStackKeystoneAPIVersion: "v3"
  openStackPublicNetId: "8e95b54c-4f66-4e43-9548-60cec257e4fb"
  openStackTenantId: "745c263129954aa2b03a786ec77b543e"
  openStackUserName: "admin"
  openStackUserDomain: "default"
  openStackProjectName: "admin"
  ubuntu14Image: "ubuntu-14-04-cloud-amd64"
  ubuntu16Image: "ubuntu-16-04-cloud-amd64"
  openStackPrivateNetCidr: "10.10.10.10/24"
  openStackPrivateNetId: "OAM_NETWORK"
  openStackPrivateSubnetId: "OAN_SUBNET"
  openStackSecurityGroup: "default"
  openStackOamNetworkCidrPrefix: "10.10"
  dcaeCollectorIp: "10.0.0.46"
  vnfPubKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJa9Txm9Hfs3hP2w3WejseBVZug8RWMzDp9onWJZzo8I9W37yUcYD8a47/7V6XqBOqbNQ0FlwabxP+aZ2tlAjxh5+XwPk6m4d2+kxHbecxCC7M64LN+MG5i5g5Z6BXB08Eg2UvdF1OUiHYISI+6StJYjuPQTLdeUl+Se9Hdjz6QGRyanGRnK5w7oFK/g32ptHuJIvred03RyPI3wACkpTSQ+ixKV3BroJ17uuX62MBdho5eeIms9YpBom6iiVjPk04EFxKeDo9BmI7JO6HIgGoyvSWiSqpgSZchAcxSssnlO8K/wCCaE/CJYqLkswza6/vYJulEvW+az4e1ukgpPAx"
  demoArtifactsVersion: "1.4.0"
  demoArtifactsRepoUrl: "https://nexus.onap.org/content/repositories/releases"
  scriptVersion: "1.4.0"
  nfsIpAddress: "192.168.122.166"
  config:
    openStackEncryptedPasswordHere: "815fd971e0c5341a3d84e5a5c98ecbc6b744165a88b2441deed3f9a8a67b5c60"
    openStackSoEncryptedPassword: "6E2B64C411EC258F02DD5BD4B0F8BD2D25154EAC85E19F233C21A90CC7C1D86FABF957659908E9E0CFCD158407EAADCBB06009B49F"
sdc:
  enabled: true
  config:
    environment:
      vnfRepoPort: 8703
  sdc-be:
    config:
      javaOptions: "-Xmx1g -Xms512m"
    liveness:
      periodSeconds: 300
      timeoutSeconds: 180
    readiness:
      periodSeconds: 300
      timeoutSeconds: 240
  sdc-fe:
    resources:
      small:
        limits:
          cpu: 1
          memory: 2Gi
        requests:
          cpu: 100m
          memory: 500Mi
sdnc:
  enabled: true
  replicaCount: 1
  mysql:
    replicaCount: 1
so:
  enabled: true
  replicaCount: 1
  config:
    # message router configuration
    dmaapTopic: "AUTO"
    # openstack configuration
    openStackUserName: "admin"
    openStackRegion: "RegionOne"
    openStackKeyStoneUrl: "http://10.0.0.154:5000/v3"
    openStackServiceTenantName: "admin"
    openStackEncryptedPasswordHere: "6E2B64C411EC258F02DD5BD4B0F8BD2D25154EAC85E19F233C21A90CC7C1D86FABF957659908E9E0CFCD158407EAADCBB06009B49F"
  so-catalog-db-adapter:
    config:
      openStackUserName: "admin"
      openStackKeyStoneUrl: "http://10.0.0.154:5000/v3"
      openStackEncryptedPasswordHere: "6E2B64C411EC258F02DD5BD4B0F8BD2D25154EAC85E19F233C21A90CC7C1D86FABF957659908E9E0CFCD158407EAADCBB06009B49F"
      openStackKeystoneVersion: "KEYSTONE_V3"
strimzi:
  enabled: true
  affinity:
    podAntiAffinity:
      enabled: false
  strimzi-kafka-bridge:
    enabled: true
uui:
  enabled: true
vfc:
  enabled: false
vid:
  enabled: true
vnfsdk:
  enabled: false

cert-wrapper:
  enabled: true
repository-wrapper:
  enabled: true
roles-wrapper:
  enabled: true
modeling:
  enabled: true
a1policymanagement:
  enabled: true

# DCAE Analytic Services
dcae-son-handler:
  enabled: true
  applicationConfig:
    sonhandler.configDb.service: http://10.0.0.46:8086
