defaults.yml

parameters:
  appuio_cloud:
    =_metadata: {}
    namespace: appuio-cloud
    namespaceLabels:
      # Ensure the default network policies are not created in the
      # namespace, as we need to allow access to the validating webhook
      # from various agreggated API servers.
      network-policies.syn.tools/no-defaults: 'true'
      network-policies.syn.tools/purge-defaults: 'true'
    namespaceAnnotations: {}

    monitoring:
      enabled: true

    images:
      agent:
        registry: ghcr.io
        repository: appuio/appuio-cloud-agent
        tag: v0.10.0

    secrets: {}

    # Disables Kyverno policies deployed.
    # possible values: [usage-profiles]
    agent_feature_set: []

    agent:
      replicas: 3
      # Customize agent deployment resource requests & limits
      resources:
        limits:
          memory: 1Gi
      extraArgs: []
      extraEnv: {}
      resourceRatio:
        memoryPerCore: 4Gi
      webhook:
        tls:
          certSecretName: webhook-service-tls
          caCertificate: ""
          certificate: ""
          key: "?{vaultkv:${cluster:tenant}/${cluster:name}/${_instance}/webhook-key}"
        namespaceSelector:
          matchExpressions:
            - key: appuio.io/organization
              operator: Exists
      config:
        QuotaOverrideNamespace: ${appuio_cloud:namespace}
        MemoryPerCoreLimit: ${appuio_cloud:agent:resourceRatio:memoryPerCore}
        OrganizationLabel: appuio.io/organization
        UserDefaultOrganizationAnnotation: appuio.io/default-organization

        _subjects: ${appuio_cloud:bypassNamespaceRestrictions:subjects}
        PrivilegedClusterRoles: ${appuio_cloud:bypassNamespaceRestrictions:clusterRoles}

        DefaultNodeSelector: {}
        DefaultNamespaceNodeSelectorAnnotation: appuio.io/default-node-selector

        DefaultOrganizationClusterRoles:
          admin: admin
          namespace-owner: namespace-owner
          monitoring-edit: monitoring-edit
          alert-routing-edit: alert-routing-edit
          monitoring-edit-probe: monitoring-edit-probe

    clusterRoles:
      namespace-owner:
        rules:
          - apiGroups: ['']
            resources: [namespaces]
            verbs:
              - get
              - watch
              - edit
              - patch
              - delete
      appuio:metrics-reader:
        rules:
          - apiGroups: ['']
            resources: [pods]
            verbs:
              - get
      monitoring-edit-probe:
        rules:
          - apiGroups: ['monitoring.coreos.com']
            resources:
              - probes
            verbs:
              - '*'

    bypassNamespaceRestrictions:
      # Roles are not supported for the APPUiO Cloud Agent. Should be left empty.
      roles: {}
      # In APPUiO Cloud Agent ClusterRoles are only ever matched if they are bound through a ClusterRoleBinding,
      # this is different from the behavior of Kyverno.
      # This is done to prevent a user from wrongly configuring a low-privileged ClusterRole which users
      # can then bind to themselves to bypass the restrictions.
      clusterRoles:
        cluster-admin: cluster-admin
        cluster-image-registry-operator: cluster-image-registry-operator
        cluster-node-tuning-operator: cluster-node-tuning-operator
        kyverno:generatecontroller: kyverno:generatecontroller
        kyverno:policycontroller: kyverno:policycontroller
        multus-admission-controller-webhook: multus-admission-controller-webhook
        openshift-dns-operator: openshift-dns-operator
        openshift-ingress-operator: openshift-ingress-operator
        syn-admin: syn-admin
        syn-argocd-application-controller: syn-argocd-application-controller
        syn-argocd-server: syn-argocd-server
        system:controller:generic-garbage-collector: system:controller:generic-garbage-collector
        system:controller:operator-lifecycle-manager: system:controller:operator-lifecycle-manager
        system:master: system:master
        system:openshift:controller:namespace-security-allocation-controller: system:openshift:controller:namespace-security-allocation-controller
        system:openshift:controller:podsecurity-admission-label-syncer-controller: system:openshift:controller:podsecurity-admission-label-syncer-controller
      subjects:
        syn-resource-locker-ingress:
          kind: ServiceAccount
          name: namespace-default-d6a0af6dd07e8a3-manager
          namespace: syn-resource-locker
        syn-resource-locker-monitoring:
          kind: ServiceAccount
          name: namespace-openshift-monitoring-c4273dc15ddfdf7-manager
          namespace: syn-resource-locker
        syn-resource-locker-console:
          kind: ServiceAccount
          name: namespace-openshift-config-2c8343f13594d63-manager
          namespace: syn-resource-locker
        openshift-operator-lifecycle-manager:
          kind: ServiceAccount
          name: olm-operator-serviceaccount
          namespace: openshift-operator-lifecycle-manager
        openshift-logging-operator:
          kind: ServiceAccount
          name: cluster-logging-operator
          namespace: openshift-logging

    reservedNamespaces:
      kubernetes: ["default", "kube-*"]
      openshift: openshift-*
      projectsyn: syn-*
      appuio: appuio-*
      cilium: cilium*

    allowedNamespaceLabels:
      kubernetesGenerated:
        - kubernetes.io/metadata.name
      appuioUserDefined: custom.appuio.io/*
      appuioOrg: appuio.io/organization
      # As defined in component-networkpolicy: https://github.com/projectsyn/component-networkpolicy/blob/master/class/defaults.yml
      netPolNoDefaults: network-policies.syn.tools/no-defaults
      netPolPurgeDefaults: network-policies.syn.tools/purge-defaults

    allowedNamespaceAnnotations:
      kubernetesGenerated:
        - kubectl.kubernetes.io/last-applied-configuration
      appuioUserDefined: custom.appuio.io/*
      runOnceActiveDeadlineSecondsOverride: ${appuio_cloud:runOnceActiveDeadlineSeconds:overrideAnnotationKey}
      # If using mutate, Kyverno appends an annotation to debug the mutate patches.
      # The annotation is appended in the context of the original requestor.
      # Thus we have to whitelist the annotation or the later validation rejects the request.
      # This should be safe because:
      # - The annotation is only for debugging and not referenced elsewhere.
      # - The mutating policies are validated with a validation rule too.
      kyvernoMutateLabel: policies.kyverno.io/last-applied-patches
      defaultNamespaceNodeSelectorAnnotation: ${appuio_cloud:agent:config:DefaultNamespaceNodeSelectorAnnotation}

    maxNamespaceQuota: 25
    namespaceQuotaOverrides: {}

    generatedResourceQuota:
      # See https://kb.vshn.ch/appuio-cloud/references/quality-requirements/performance/resource-quota.html
      organization-objects:
        synchronize: true
        spec:
          hard:
            count/configmaps: "150"
            count/jobs.batch: "150"
            count/secrets: "150"
            count/services: "20"
            count/services.loadbalancers: "0"
            count/services.nodeports: "0"
            count/replicationcontrollers: "100"
            openshift.io/imagestreams: "20"
            openshift.io/imagestreamtags: "50"

            requests.storage: 1000Gi
            persistentvolumeclaims: "10"
            localblock-storage.storageclass.storage.k8s.io/persistentvolumeclaims: "0"
            requests.ephemeral-storage: "250Mi"
            limits.ephemeral-storage: "500Mi"

            # Limit the total amount of Rook-Ceph backed storage which can be
            # requested per namespace
            cephfs-fspool-cluster.storageclass.storage.k8s.io/requests.storage: 25Gi
            rbd-storagepool-cluster.storageclass.storage.k8s.io/requests.storage: 25Gi

      organization-compute:
        synchronize: true
        spec:
          hard:
            requests.cpu: 4
            requests.memory: 4Gi
            limits.cpu: 8
            limits.memory: 20Gi
            pods: "45"
          scopes:
            - NotTerminating

      organization-compute-terminating:
        synchronize: true
        spec:
          hard:
            limits.cpu: 4000m
            limits.memory: 4Gi
            pods: "5"
            requests.cpu: 500m
            requests.memory: 2Gi
          scopes:
            - Terminating

    generatedLimitRange:
      name: organization
      synchronize: true
      limits:
        "Container":
          min:
            cpu: "10m"
            memory: "4Mi"
            ephemeral-storage: "100Ki"
          default:
            cpu: "600m"
            memory: "768Mi"
          defaultRequest:
            cpu: "10m"
            memory: "100Mi"

    disallowDockerBuildStrategy: true

    projectTemplate:
      enabled: true
      objects:
        project:
          apiVersion: project.openshift.io/v1
          kind: Project
          metadata:
            annotations:
              openshift.io/description: '\${PROJECT_DESCRIPTION}'
              openshift.io/display-name: '\${PROJECT_DISPLAYNAME}'
              openshift.io/requester: '\${PROJECT_REQUESTING_USER}'
            name: '\${PROJECT_NAME}'

        adminRoleBinding:
          apiVersion: rbac.authorization.k8s.io/v1
          kind: RoleBinding
          metadata:
            labels:
              appuio.io/uninitialized: "true"
            creationTimestamp: null
            name: admin
            namespace: '\${PROJECT_NAME}'
          roleRef:
            apiGroup: rbac.authorization.k8s.io
            kind: ClusterRole
            name: admin
          subjects:
            - apiGroup: rbac.authorization.k8s.io
              kind: User
              name: '\${PROJECT_ADMIN_USER}'
      parameters:
        PROJECT_NAME: {}
        PROJECT_DISPLAYNAME: {}
        PROJECT_DESCRIPTION: {}
        PROJECT_ADMIN_USER: {}
        PROJECT_REQUESTING_USER: {}

    runOnceActiveDeadlineSeconds:
      defaultActiveDeadlineSeconds: 1800
      overrideAnnotationKey: appuio.io/active-deadline-seconds-override
      podMatchExpressions: {}