# SPDX-FileCopyrightText: Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Default values for dynamo-operator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Namespace restriction configuration for the operator
# If enabled: true and targetNamespace is empty, the operator will be restricted to the release namespace
# If enabled: true and targetNamespace is set, the operator will be restricted to the specified namespace
# If enabled: false, the operator will run with cluster-wide permissions
namespaceRestriction:
  # Whether to restrict the operator to a single namespace
  enabled: false
  # The target namespace to restrict to. If empty, defaults to the release namespace
  targetNamespace: ""
controllerManager:
  tolerations: []

  # Leader election configuration
  leaderElection:
    # Leader election ID for cluster-wide coordination
    # WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain
    # Different IDs would allow multiple leaders simultaneously
    id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)

    # Namespace for leader election leases (only used in cluster-wide mode)
    # If empty, defaults to kube-system for cluster-wide coordination
    # All cluster-wide operators should use the SAME namespace for proper leader election
    namespace: ""

  kubeRbacProxy:
    args:
    - --secure-listen-address=0.0.0.0:8443
    - --upstream=http://127.0.0.1:8080/
    - --logtostderr=true
    - --v=0
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: gcr.io/kubebuilder/kube-rbac-proxy
      tag: v0.15.0
    resources:
      limits:
        cpu: 500m
        memory: 128Mi
      requests:
        cpu: 5m
        memory: 64Mi
  manager:
    args:
    - --health-probe-bind-address=:8081
    - --metrics-bind-address=127.0.0.1:8080
    - --leader-elect
    - --leader-election-id=dynamo.nko.nvidia.com
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: nvcr.io/nvidia/ai-dynamo/kubernetes-operator
      # tag is optional - if not set, will use Chart.AppVersion
      tag: ""
    resources:
      limits:
        cpu: 1024m
        memory: 2Gi
      requests:
        cpu: 512m
        memory: 1Gi
  replicas: 1
  serviceAccount:
    annotations: {}

dynamo:
  components:
    serviceAccount:
      annotations: {}

  groveTerminationDelay: 15m

  internalImages:
    debugger: python:3.12-slim

  enableRestrictedSecurityContext: false

  dockerRegistry:
    server: ''
    # set to true if you want to use the kubernetes secret for the registry credentials
    # if false, no secret will be created and used. Allows to use cloud provider mechanisms for authentication (e.g. Workload Identity for GKE, ...)
    useKubernetesSecret: false
    username: '$oauthtoken'
    password: ""
    existingSecretName: ''
    secure: true

  metrics:
    prometheusEndpoint: ""

  mpiRun:
    secretName: "mpi-run-ssh-secret"
    sshKeygen:
      enabled: true

  # DynamoGraphDeploymentRequest (DGDR) configuration
  dgdr:
    # Container image to use for profiling jobs (both online and offline/AIC)
    # REQUIRED: Must be set to create DynamoGraphDeploymentRequests
    # For development: Build and push the profiler image from the ai-dynamo repository
    # Public image will be available in release 0.6.1
    # Example: "nvcr.io/nvidia/ai-dynamo/vllm-runtime:0.6.1"
    profilerImage: ""


#imagePullSecrets: []
kubernetesClusterDomain: cluster.local
metricsService:
  ports:
  - name: https
    port: 8443
    protocol: TCP
    targetPort: https
  type: ClusterIP

natsAddr: ""
etcdAddr: ""
modelExpressURL: ""

