# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Default values for dynamo-operator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Whether to apply CRDs via an init container on the operator Deployment.
# Uses server-side apply with the bundled /crd-apply binary.
# Set to false if CRDs are managed externally (e.g., via GitOps or a separate pipeline).
upgradeCRD: true

# Namespace restriction configuration for the operator
# If enabled: true and targetNamespace is empty, the operator will be restricted to the release namespace
# If enabled: true and targetNamespace is set, the operator will be restricted to the specified namespace
# If enabled: false, the operator will run with cluster-wide permissions
namespaceRestriction:
  # Whether to restrict the operator to a single namespace
  enabled: false
  # The target namespace to restrict to. If empty, defaults to the release namespace
  targetNamespace: ""
  # Namespace scope marker lease configuration (used to prevent conflicts when running both cluster-wide and namespace-restricted operators)
  lease:
    # Duration before the namespace scope marker lease expires if not renewed (namespace-restricted mode only). When a namespace-restricted operator is running, it creates a lease in its namespace. The cluster-wide operator detects this lease and excludes that namespace from processing. If the namespace operator stops renewing the lease (e.g., crashes), the lease expires and the cluster-wide operator automatically resumes processing that namespace.
    duration: 30s
    # Interval for renewing the namespace scope marker lease (namespace-restricted mode only). The namespace-restricted operator renews its lease at this interval to signal it's still running.
    renewInterval: 10s
# -- GPU discovery configuration (only applies when namespaceRestriction.enabled=true)
gpuDiscovery:
  # -- Whether to provision a ClusterRole for the namespace-scoped operator to read GPU node labels.
  # When true (default), Helm creates a ClusterRole/ClusterRoleBinding granting node read access.
  # Set to false if your installer lacks ClusterRole creation permissions; you must then provide
  # hardware config manually in each DynamoGraphDeploymentRequest.
  enabled: true
controllerManager:
  tolerations: []
  affinity: {}

  # Leader election configuration
  leaderElection:
    # Leader election ID for cluster-wide coordination
    # WARNING: All cluster-wide operators must use the SAME ID to prevent split-brain
    # Different IDs would allow multiple leaders simultaneously
    id: ""  # If empty, defaults to: dynamo.nvidia.com (shared across all cluster-wide operators)

    # Namespace for leader election leases (only used in cluster-wide mode)
    # If empty, defaults to kube-system for cluster-wide coordination
    # All cluster-wide operators should use the SAME namespace for proper leader election
    namespace: ""

  manager:
    containerSecurityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    image:
      repository: nvcr.io/nvidia/ai-dynamo/kubernetes-operator
      # tag is optional - if not set, will use Chart.AppVersion
      tag: ""
    resources:
      limits:
        cpu: 1024m
        memory: 2Gi
      requests:
        cpu: 512m
        memory: 1Gi
  replicas: 1
  serviceAccount:
    annotations: {}

dynamo:
  components:
    serviceAccount:
      annotations: {}

  groveTerminationDelay: 15m

  dockerRegistry:
    server: ''
    # set to true if you want to use the kubernetes secret for the registry credentials
    # if false, no secret will be created and used. Allows to use cloud provider mechanisms for authentication (e.g. Workload Identity for GKE, ...)
    useKubernetesSecret: false
    username: '$oauthtoken'
    password: ""
    existingSecretName: ''
    secure: true

  metrics:
    prometheusEndpoint: ""
    podMonitors:
      # -- Whether to create PodMonitor resources for Prometheus scraping of dynamo components.
      # null=auto-detect (creates PodMonitors if prometheus-operator CRDs exist in cluster),
      # true=always create (use for helm template / GitOps workflows),
      # false=never create
      enabled: null

  mpiRun:
    secretName: "mpi-run-ssh-secret"


#imagePullSecrets: []
kubernetesClusterDomain: cluster.local

metricsService:
  # -- Whether to create the operator metrics Service and ServiceMonitor.
  # null=auto-detect (Service always created; ServiceMonitor created if prometheus-operator CRDs exist),
  # true=always create both (use for helm template / GitOps workflows),
  # false=never create either
  enabled: null
  ports:
  - name: metrics
    port: 8080
    protocol: TCP
    targetPort: metrics
  type: ClusterIP

natsAddr: ""
etcdAddr: ""

nats:
  # Whether the NATS is enabled
  enabled: true

modelExpressURL: ""

# Checkpoint configuration for fast pod restore
# NOTE: The checkpoint infrastructure (PVC + DaemonSet) must be installed separately
# using the snapshot Helm chart in each namespace where checkpointing is needed.
checkpoint:
  # Enable checkpoint/restore functionality
  enabled: false

  # Path written by worker when model is loaded and ready for checkpointing
  # Must match the path expected by checkpoint-enabled runtime images
  readyForCheckpointFilePath: "/tmp/ready-for-checkpoint"

  # Storage configuration
  # These settings tell the operator where to find checkpoint storage
  # Must match the configuration in the snapshot chart
  storage:
    # Storage backend type: pvc, s3, or oci
    type: pvc

    # PVC configuration (used when type=pvc)
    pvc:
      # Name of the PVC created by the snapshot chart
      # Must match the PVC name in the snapshot chart
      pvcName: "snapshot-pvc"
      # Base path within the PVC for storing checkpoints
      basePath: "/checkpoints"

    # S3 configuration (used when type=s3)
    s3:
      # S3 URI in format: s3://[endpoint/]bucket/prefix
      # Examples:
      #   - s3://my-bucket/checkpoints (AWS S3)
      #   - s3://minio.example.com/my-bucket/checkpoints (MinIO/custom endpoint)
      uri: ""
      # Reference to a secret containing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_REGION
      # If not provided, uses IRSA/Workload Identity for authentication
      credentialsSecretRef: ""

    # OCI registry configuration (used when type=oci)
    oci:
      # OCI URI in format: oci://registry/repository
      # Examples:
      #   - oci://myregistry.io/checkpoints
      #   - oci://ghcr.io/myorg/checkpoints
      uri: ""
      # Reference to a docker config secret for registry authentication
      credentialsSecretRef: ""

# Webhook configuration
webhook:
  # Certificate configuration
  certificateSecret:
    # Name of the Kubernetes Secret holding webhook TLS certificates.
    # In auto mode, the operator creates and manages this secret at runtime.
    # In cert-manager mode, cert-manager provisions it.
    # In external mode, you must create and populate it yourself.
    name: webhook-server-cert

    # Set to true if you're managing the certificate secret externally
    # (e.g., provisioned by an admin or another pipeline).
    # When true, the operator operates in manual cert mode and expects
    # the secret to exist with tls.crt, tls.key, and ca.crt.
    external: false

  # CA bundle for webhook (base64 encoded)
  # Only used when certificateSecret.external=true and cert-manager is not enabled.
  caBundle: ""

  # Webhook failure policy
  # Fail: Reject requests if webhook is unavailable (recommended for production)
  # Ignore: Allow requests if webhook is unavailable
  failurePolicy: Fail

  # Timeout for webhook calls (in seconds)
  timeoutSeconds: 10

  # Namespace selector for webhooks
  # Use this to exclude certain namespaces from validation
  #
  # For CLUSTER-WIDE operators: Exclude namespaces with namespace-restricted operators
  # namespaceSelector:
  #   matchExpressions:
  #   - key: dynamo-operator
  #     operator: NotIn
  #     values: ["namespace-restricted"]
  #
  # For NAMESPACE-RESTRICTED operators: Leave empty (auto-configured)
  namespaceSelector: {}

  # cert-manager integration (optional, alternative to built-in cert-controller)
  # When enabled, the operator runs in manual cert mode and relies on
  # cert-manager to provision and rotate the webhook TLS secret.
  certManager:
    # Enable cert-manager for certificate management
    # Requires cert-manager to be installed in the cluster
    enabled: false

    # Certificate configuration for cert-manager
    certificate:
      # Certificate duration (e.g., "8760h" for 1 year)
      duration: "8760h"

      # Time before expiration to renew certificate (e.g., "360h" for 15 days)
      renewBefore: "360h"

      # Root CA configuration
      rootCA:
        # Duration for root CA certificate (e.g., "87600h" for 10 years)
        duration: "87600h"

        # Time before expiration to renew root CA (e.g., "720h" for 30 days)
        renewBefore: "720h"
