# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Default values for dynamo-operator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Whether to apply CRDs via an init container on the operator Deployment.
# Uses server-side apply with the bundled /crd-apply binary.
# Set to false if CRDs are managed externally (e.g., via GitOps or a separate pipeline).
upgradeCRD: true

# Environment variables to pass to operator Deployment.
env: []

# -- DEPRECATED: Namespace-restricted mode is deprecated and will be removed in a future release. Use cluster-wide mode (the default) instead. Do not enable this for new deployments.
namespaceRestriction:
  # -- DEPRECATED: Do not enable for new deployments. Namespace-restricted mode is deprecated.
  enabled: false
  # -- DEPRECATED: Only used in namespace-restricted mode, which is deprecated.
  targetNamespace: ""
  # -- DEPRECATED: Only used in namespace-restricted mode, which is deprecated.
  lease:
    # -- DEPRECATED: Lease duration for namespace-restricted mode, which is deprecated.
    duration: 30s
    # -- DEPRECATED: Lease renew interval for namespace-restricted mode, which is deprecated.
    renewInterval: 10s
# -- DEPRECATED: GPU discovery for namespace-scoped operators is deprecated along with namespace-restricted mode.
gpuDiscovery:
  # -- DEPRECATED: Only relevant when namespaceRestriction is enabled, which is deprecated.
  enabled: true
controllerManager:
  tolerations: []
  affinity: {}

  # Leader election configuration
  leaderElection:
    # Leader election ID for cluster-wide coordination
    # WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain
    # Different IDs would allow multiple leaders simultaneously
    id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)

    # Namespace for leader election leases (only used in cluster-wide mode)
    # If empty, defaults to kube-system for cluster-wide coordination
    # All cluster-wide operators should use the SAME namespace for proper leader election
    namespace: ""

  manager:
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: nvcr.io/nvidia/ai-dynamo/kubernetes-operator
      # tag is optional - if not set, will use Chart.AppVersion
      tag: ""
    resources:
      limits:
        cpu: 1024m
        memory: 2Gi
      requests:
        cpu: 512m
        memory: 1Gi
  replicas: 1
  serviceAccount:
    annotations: {}

dynamo:
  components:
    serviceAccount:
      annotations: {}

  groveTerminationDelay: 15m

  dockerRegistry:
    server: ''
    # set to true if you want to use the kubernetes secret for the registry credentials
    # if false, no secret will be created and used. Allows to use cloud provider mechanisms for authentication (e.g. Workload Identity for GKE, ...)
    useKubernetesSecret: false
    username: '$oauthtoken'
    password: ""
    existingSecretName: ''
    secure: true

  metrics:
    prometheusEndpoint: ""
    podMonitors:
      # -- Whether to create PodMonitor resources for Prometheus scraping of dynamo components.
      # null=auto-detect (creates PodMonitors if prometheus-operator CRDs exist in cluster),
      # true=always create (use for helm template / GitOps workflows),
      # false=never create
      enabled: null

  mpiRun:
    secretName: "mpi-run-ssh-secret"


#imagePullSecrets: []
kubernetesClusterDomain: cluster.local

metricsService:
  # -- Whether to create the operator metrics Service and ServiceMonitor.
  # null=auto-detect (Service always created; ServiceMonitor created if prometheus-operator CRDs exist),
  # true=always create both (use for helm template / GitOps workflows),
  # false=never create either
  enabled: null
  ports:
  - name: metrics
    port: 8080
    protocol: TCP
    targetPort: metrics
  type: ClusterIP

natsAddr: ""
etcdAddr: ""

nats:
  # Whether the NATS is enabled
  enabled: true

modelExpressURL: ""

# Checkpoint configuration for fast pod restore
# NOTE: The checkpoint infrastructure (PVC + DaemonSet) must be installed separately
# using the snapshot Helm chart in each namespace where checkpointing is needed.
checkpoint:
  # Enable checkpoint/restore functionality
  enabled: false

  # Path written by worker when model is loaded and ready for checkpointing
  # Must match the path expected by checkpoint-enabled runtime images
  readyForCheckpointFilePath: "/tmp/ready-for-checkpoint"

# Webhook configuration
webhook:
  # Certificate configuration
  certificateSecret:
    # Name of the Kubernetes Secret holding webhook TLS certificates.
    # In auto mode, the operator creates and manages this secret at runtime.
    # In cert-manager mode, cert-manager provisions it.
    # In external mode, you must create and populate it yourself.
    name: webhook-server-cert

    # Set to true if you're managing the certificate secret externally
    # (e.g., provisioned by an admin or another pipeline).
    # When true, the operator operates in manual cert mode and expects
    # the secret to exist with tls.crt, tls.key, and ca.crt.
    external: false

  # CA bundle for webhook (base64 encoded)
  # Only used when certificateSecret.external=true and cert-manager is not enabled.
  caBundle: ""

  # Webhook failure policy
  # Fail: Reject requests if webhook is unavailable (recommended for production)
  # Ignore: Allow requests if webhook is unavailable
  failurePolicy: Fail

  # Timeout for webhook calls (in seconds)
  timeoutSeconds: 10

  # Namespace selector for webhooks
  # Use this to exclude certain namespaces from validation
  #
  # For CLUSTER-WIDE operators: Exclude namespaces with namespace-restricted operators
  # namespaceSelector:
  #   matchExpressions:
  #   - key: dynamo-operator
  #     operator: NotIn
  #     values: ["namespace-restricted"]
  #
  # For NAMESPACE-RESTRICTED operators: Leave empty (auto-configured)
  namespaceSelector: {}

  # cert-manager integration (optional, alternative to built-in cert-controller)
  # When enabled, the operator runs in manual cert mode and relies on
  # cert-manager to provision and rotate the webhook TLS secret.
  certManager:
    # Enable cert-manager for certificate management
    # Requires cert-manager to be installed in the cluster
    enabled: false

    # Certificate configuration for cert-manager
    certificate:
      # Certificate duration (e.g., "8760h" for 1 year)
      duration: "8760h"

      # Time before expiration to renew certificate (e.g., "360h" for 15 days)
      renewBefore: "360h"

      # Root CA configuration
      rootCA:
        # Duration for root CA certificate (e.g., "87600h" for 10 years)
        duration: "87600h"

        # Time before expiration to renew root CA (e.g., "720h" for 30 days)
        renewBefore: "720h"
