values-schema.yaml

$schema: 'http://json-schema.org/draft-07/schema'
version: 3
additionalProperties: true
definitions:
  rawValues:
    description: "May define value overrides for a chart. WARNING: these values currently have no schema and can't be validated as such, and may break deployment. You are on your own here."
    type: object
  alerts:
    additionalProperties: false
    properties:
      email:
        additionalProperties: false
        properties:
          critical:
            $ref: '#/definitions/email'
            description: One or more email addresses (comma separated) for critical events.
            x-secret: ''
          nonCritical:
            $ref: '#/definitions/email'
            description: One or more email addresses (comma separated) for non-critical events.
            x-secret: ''
      groupInterval:
        default: 5m
        description: How long to wait before sending a notification about new alerts that are added to a group of alerts for which an initial notification has already been sent. (Usually ~5m or more.)
        $ref: '#/definitions/duration'
      msteams:
        additionalProperties: false
        properties:
          highPrio:
            description: The high prio web hook.
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          lowPrio:
            description: The low prio web hook.
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
      receivers:
        description: Notification receivers.
        items:
          enum:
            - slack
            - msteams
            - opsgenie
            - email
            - none
          type: string
        type: array
        uniqueItems: true
      repeatInterval:
        default: 3h
        description: How long to wait before sending a notification again if it has already been sent successfully for an alert. (Usually ~3h or more).
        $ref: '#/definitions/duration'
      slack:
        additionalProperties: false
        properties:
          channel:
            default: mon-otomi
            description: The Slack channel for non-critical notifications.
            $ref: '#/definitions/wordCharacterPattern'
          channelCrit:
            default: mon-otomi-crit
            description: The Slack channel for critical notifications.
            $ref: '#/definitions/wordCharacterPattern'
          url:
            $ref: '#/definitions/url'
            description: A Slack webhook URL.
            x-secret: ''
      opsgenie:
        additionalProperties: false
        properties:
          apiKey:
            description: The api key to use for authn
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          url:
            $ref: '#/definitions/url'
            description: A Slack webhook URL.
            x-secret: ''
          responders:
            type: array
            items:
              allOf:
                - properties:
                    type:
                      type: string
                      enum:
                        - team
                        - user
                        - escalation
                        - schedule
                - oneOf:
                    - title: ID
                      required: [id]
                      properties:
                        id:
                          $ref: '#/definitions/wordCharacterPattern'
                    - title: Name
                      required: [name]
                      properties:
                        name:
                          $ref: '#/definitions/idName'
                    - title: Username
                      required: [username]
                      properties:
                        username:
                          $ref: '#/definitions/wordCharacterPattern'
              required: [type]

  annotations:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of annotations.
  autoscaling:
    additionalProperties: false
    properties:
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 1
  autoscalingEnabled:
    additionalProperties: false
    properties:
      enabled:
        default: true
        type: boolean
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 1
      targetCPUUtilizationPercentage:
        type: integer
        default: 80
      targetMemoryUtilizationPercentage:
        type: integer
        default: 80
  akamai:
    definitions:
      dns:
        properties:
          host:
            title: Akamai API host
            description: Akamai Edgegrid API server
            $ref: '#/definitions/wordCharacterPattern'
          accessToken:
            title: Akamai access token
            description: Akamai Edgegrid API access token
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          clientToken:
            title: Akamai client token
            description: Akamai Edgegrid API client token
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          clientSecret:
            title: Akamai client secret
            description: Akamai Edgegrid API client secret
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
        required:
          - host
          - accessToken
          - clientToken
          - clientSecret
  aws:
    definitions:
      accessKey:
        title: AWS access key
        description: An AWS access key ID.
        $ref: '#/definitions/wordCharacterPattern'
        x-secret: ''
      secretKey:
        title: AWS secret key
        description: An AWS secret key.
        type: string
        x-secret: ''
      region:
        title: AWS region
        description: An AWS region.
        $ref: '#/definitions/wordCharacterPattern'
      role:
        description: Role may be set explicitly if no metadata can be accessed.
        example: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager
        $ref: '#/definitions/wordCharacterPattern'
  azure:
    definitions:
      clientId:
        title: Azure client id
        description: An Azure client id.
        $ref: '#/definitions/wordCharacterPattern'
      clientSecret:
        title: Azure client secret
        description: An Azure client secret.
        type: string
        x-secret: ''
      dns:
        properties:
          resourceGroup:
            $ref: '#/definitions/azure/definitions/resourceGroup'
          hostedZoneName:
            title: Hosted zone name
            description: Name of the DNS zone that should be used.
            $ref: '#/definitions/wordCharacterPattern'
          tenantId:
            $ref: '#/definitions/azure/definitions/tenantId'
          subscriptionId:
            $ref: '#/definitions/azure/definitions/subscriptionId'
          aadClientId:
            $ref: '#/definitions/azure/definitions/clientId'
          aadClientSecret:
            $ref: '#/definitions/azure/definitions/clientSecret'
            title: Client secret
            type: string
            description: Azure Application Client Secret
            x-secret: ''
        required:
          - tenantId
          - subscriptionId
          - resourceGroup
          - aadClientId
          - aadClientSecret
      environment:
        title: Azure environment
        description: An Azure environment.
        type: string
        default: AzurePublicCloud
        enum:
          - AzurePublicCloud
          - AzureChinaCloud
          - AzureUSGovernment
          - AzureGermanCloud
      tenantId:
        title: Azure tenant id
        description: An Azure tenant id.
        $ref: '#/definitions/wordCharacterPattern'
      subscriptionId:
        title: Azure subscription id
        description: An Azure subscription id.
        $ref: '#/definitions/wordCharacterPattern'
      resourceGroup:
        title: Resource group
        description: An Azure resource group.
        $ref: '#/definitions/wordCharacterPattern'
  cluster:
    additionalProperties: false
    properties:
      apiServer:
        description: Used to generate KUBECONFIG for download, for local access to target cluster.
        pattern: '^https:\/\/.*'
      domainSuffix:
        $ref: '#/definitions/domain'
        description: Domain suffix for the cluster. Also added to list of dns zones in the Otomi Console.
      k8sContext:
        $ref: '#/definitions/k8sContext'
        description: Optional. Must be set for development mode and must point to an existing context in KUBECONFIG.
      name:
        $ref: '#/definitions/idName'
        description: Short name that will be used in construction of cluster domain and messaging.
      owner:
        $ref: '#/definitions/idName'
        description: The name of the organization owning the cluster.
        default: otomi
      provider:
        $ref: '#/definitions/provider'
    required:
      - name
      - provider
  containerSpecNoSec:
    properties:
      image:
        $ref: '#/definitions/image'
      resources:
        $ref: '#/definitions/resources'
      env:
        $ref: '#/definitions/env'
      files:
        $ref: '#/definitions/files'
      nativeSecrets:
        $ref: '#/definitions/nativeSecrets'
        description: Reserved for internal use.
      secrets:
        $ref: '#/definitions/secrets'
      secretMounts:
        $ref: '#/definitions/secretMounts'
      command:
        type: array
        items:
          type: string
      args:
        type: array
        items:
          type: string
    required:
      - image
      - resources
  containerSpec:
    allOf:
      - $ref: '#/definitions/securityContext'
      - $ref: '#/definitions/containerSpecNoSec'
  cpuQuantity:
    description: Amount of cpu cores, or slice of cpu core in millis.
    examples:
      - '1'
      - 200m
    pattern: ^([1-9][0-9]*|([0]|[1-9]+)\\.[0-9]{1,3}|[1-9][0-9]*m)$
    type: string
  backup:
    type: object
    description: PV backups
    properties:
      name:
        $ref: '#/definitions/idName'
      ttl:
        $ref: '#/definitions/backupTtl'
      schedule:
        $ref: '#/definitions/backupSchedule'
      snapshotVolumes:
        type: boolean
        default: false
      labelSelector:
        $ref: '#/definitions/labels'
        description: Individual objects must match this label selector to be included in the backup.
  domain:
    pattern: ^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))|([a-f0-9:]+:+)+[a-f0-9]+$
    type: string
  droneGit:
    properties:
      clientID:
        $ref: '#/definitions/wordCharacterPattern'
      clientSecretValue:
        type: string
        x-secret: ''
  duration:
    description: 'Prometheus duration (See: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#configuration-file)'
    pattern: '((([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?|0)'
    type: string
    default: 1d
  email:
    pattern: '^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$'
    type: string
  env:
    additionalProperties: false
    examples:
      - FOO: bar
      - bar: foo
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Environment variables
  files:
    additionalProperties: false
    description: Dictionary of absolute path > content pairs.
    patternProperties:
      '^[/].*':
        type: string
  google:
    additionalProperties: false
    definitions:
      accountJson:
        type: string
        x-secret: ''
      project:
        $ref: '#/definitions/wordCharacterPattern'
  hostPort:
    pattern: '^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]):()([1-9]|[1-5]?[0-9]{2,4}|6[1-4][0-9]{3}|65[1-4][0-9]{2}|655[1-2][0-9]|6553[1-5])$'
    type: string
  idName:
    description: A lowercase name that starts with a letter and may contain dashes.
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])$'
    type: string
  image:
    additionalProperties: false
    properties:
      pullPolicy:
        default: IfNotPresent
        enum:
          - IfNotPresent
          - Always
        type: string
      repository:
        $ref: '#/definitions/repository'
      tag:
        default: latest
        $ref: '#/definitions/wordCharacterPattern'
    title: Container image
  imagePullPolicy:
    default: IfNotPresent
    enum:
      - IfNotPresent
      - Always
    type: string
  imageTag:
    x-default: stable
    pattern: '[\w][\w.-]{0,127}'
    type: string
    x-message: a valid container registry image tag
  imageSimple:
    properties:
      tag:
        $ref: '#/definitions/imageTag'
      pullPolicy:
        $ref: '#/definitions/imagePullPolicy'
    required:
      - tag
    type: object
    title: Container image
  ingressNginx:
    additionalProperties: false
    properties:
      _rawValues:
        $ref: '#/definitions/rawValues'
      tracing:
        description: Configure Nginx for tracing. Requires Otel Collector to be enabled.
        propterties:
          enabled:
            default: false
            type: boolean
          samplingRatio:
            type: string
            default: '0.01'
      autoscaling:
        additionalProperties: false
        properties:
          enabled:
            default: true
            type: boolean
          maxReplicas:
            type: integer
            default: 10
          minReplicas:
            type: integer
            default: 1
          targetCPUUtilizationPercentage:
            type: integer
            default: 80
          targetMemoryUtilizationPercentage:
            type: integer
            default: 80
      maxBodySize:
        type: string
        default: 1024m
      maxBodySizeBytes:
        type: integer
        minimum: 0
        default: 1073741824
        description: Needed for modsecurity. Should correspond to maxBodySize, but expressed in bytes.
      modsecurity:
        title: MOD Security
        description: Enables MOD Security functionality.
        properties:
          block:
            description: Makes nginx block requests that are marked as violating the modsec rules.
            type: boolean
            default: false
          enabled:
            type: boolean
            default: false
          owasp:
            description: Turns on the default OWASP rule set for modsec. See
            type: boolean
            default: true
        type: object
      image:
        properties:
          tag:
            $ref: '#/definitions/imageTag'
            x-default: v1.0.5
          pullPolicy:
            $ref: '#/definitions/imagePullPolicy'
      resources:
        controller:
          $ref: '#/definitions/resources'
        opentelemetry:
          $ref: '#/definitions/resources'
        defaultBackend:
          $ref: '#/definitions/resources'
      service:
        properties:
          annotations:
            $ref: '#/definitions/annotations'
  ingressClassParameters:
    type: object
    properties:
      entrypoint:
        description: A public IP address that has a route to a private loadbalancer ip, allowing access to private clusters. (Provider "custom" only.)
        type: string
      network:
        title: Load balancer type
        type: string
        enum:
          - public
        default: public
      loadBalancerIP:
        title: Load balancer IP address
        description: A static IP address assigned to a load balancer
        type: string
      sourceIpAddressFiltering:
        title: Source IP address filtering
        type: string
        description: 'Whitelist source IP address ranges. The value is a comma separated list of CIDRs, e.g. 10.0.0.0/24,172.10.0.1'
      annotations:
        properties:
          annotations:
            $ref: '#/definitions/annotations'
  ipV4Address:
    type: string
    pattern: ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$
  jobs:
    description: You may pass an array of Job objects. The Kubernetes API accepts
      a Job specification, which is meant for run-to-completion apps (e.g. batch
      Jobs).
    items:
      type: object
      allOf:
        - properties:
            id:
              type: string
              readOnly: true
          type: object
        - $ref: '#/definitions/jobSpec'
        - $ref: '#/definitions/podSpec'
    type: array
  jobSpec:
    properties:
      type:
        default: Job
        enum:
          - Job
          - CronJob
        type: string
      name:
        $ref: '#/definitions/idName'
        title: Name
        description: A job name
        example: some-job
      enabled:
        default: true
        type: boolean
      runPolicy:
        default: OnSpecChange
        description: |
          If runPolicy is set to 'Always', the job controller will always be re-deployed after a successful deployment with Helm.
          If runPolicy is set to 'OnSpecChange', the job controller will only be re-deployed if one changes this specification.
        enum:
          - Always
          - OnSpecChange
        type: string
      schedule:
        default: 0 1 * * *
        description: Must give a cron-type expression if the job type is 'Cronjob'.
        type: string
      script:
        $ref: '#/definitions/script'
      shell:
        default: /bin/sh
        description: Full path to a shell binary that exists in the image.
        type: string
      ttlSecondsAfterFinished:
        default: 86400
        description: Time To Live after job is finished in seconds. Will be removed afterwards.
        minimum: 0
        title: TTL after finished
        type: integer
      init:
        type: array
        items:
          $ref: '#/definitions/containerSpec'
        nullable: true
    required:
      - name
      - script
      - type
    type: object
  k8sContext:
    description: The cluster k8s context as found in $KUBECONFIG.
    $ref: '#/definitions/wordCharacterPattern'
  labels:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of labels.
  labelsAnnotations:
    additionalProperties: false
    patternProperties:
      '^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]){1,253}\/)?([a-z0-9A-Z]+[a-z0-9A-Z-_.]+[a-z0-9A-Z]){1,63}$':
        pattern: '^((.){1,253}\/)?(.){1,63}$'
        type: string
  logLevel:
    type: string
    default: info
    enum:
      - error
      - warn
      - info
      - debug
      - trace
  memoryQuantity:
    description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
    examples:
      - 1Mi
      - 0.5M
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$'
    type: string
  nativeSecrets:
    description: List of kubernetes secret names.
    additionalProperties: false
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Kubernetes secrets
  netpol:
    type: object
    properties:
      name:
        $ref: '#/definitions/idName'
        title: Network Policy name
        description: 'A unique name for the network policy'
      ruleType:
        properties:
          type:
            type: string
            enum:
              - ingress
              - egress
          ingress:
            properties:
              toLabelName:
                type: string
                title: Selector label name
                description: 'The name of the Pod selector label'
              toLabelValue:
                type: string
                title: Selector label value
                description: 'The value of the Pod selector label'
              mode:
                default: AllowOnly
                enum:
                  - AllowOnly
                  - AllowAll
              allow:
                title: Add team or team with service
                type: array
                items:
                  type: object
                  properties:
                    fromLabelName:
                      type: string
                      title: Selector label name
                      description: 'The name of the Pod selector label'
                    fromLabelValue:
                      type: string
                      title: Selector label value
                      description: 'The value of the Pod selector label'
                    fromNamespace:
                      $ref: '#/definitions/idName'
                      title: Namespace name
                      description: 'The name of the namespace'
                  required:
                    - fromNamespace
          egress:
            properties:
              domain:
                title: FQDN or IP address
                $ref: '#/definitions/domain'
              ports:
                properties:
                  number:
                    title: Port number
                    type: integer
                    minimum: 1
                    maximum: 65535
                  protocol:
                    title: Protocol
                    type: string
                    enum: [HTTPS, HTTP, TCP]
                    default: HTTPS
                required:
                  - number
                  - protocol
                default:
                  - number: 443
                    protocol: HTTPS
            required:
              - domain
        required:
          - type
    required:
      - name
  path:
    description: An absolute path
    type: string
    pattern: '^[/].*$'
  podSecurityContext:
    allOf:
      - $ref: '#/definitions/securityContext'
      - properties:
          fsGroup:
            description: Supplementary group ID. Volumes that support ownership management are modified to be owned and writable by this ID.
            $ref: '#/definitions/unixOwnerId'
          fsGroupChangePolicy:
            description: |
              'Defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions.
              This field has two possible values:
              - OnRootMismatch: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
              - Always: Always change permission and ownership of the volume when volume is mounted.'
            type: string
            enum:
              - Always
              - OnRootMismatch
    description: Security context for the pod.
    title: Pod security context
  podSpec:
    allOf:
      - properties:
          annotations:
            $ref: '#/definitions/annotations'
            title: Pod annotations
        type: object
      - $ref: '#/definitions/podSecurityContext'
      - $ref: '#/definitions/containerSpec'
    type: object
  portNumber:
    maximum: 32768
    minimum: 80
    type: integer
  provider:
    type: string
    description: Enter the cloud provider of the cluster.
    enum:
      - custom
      - linode
    default: linode
  registry:
    pattern: '^[a-z0-9]+(?:[._-][a-z0-9]+)*$'
    type: string
  repoUrl:
    description: Path to a remote git repo with or without protocol prefix of either https:// or file:// (https:// used if omitted)
    pattern: '^(https://|file://)?(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$'
    type: string
  repository:
    description: A container image repository.
    pattern: '^[a-z0-9]+(?:[/._-]{1,2}[a-z0-9]+)*$'
    type: string
  resource:
    additionalProperties: false
    properties:
      cpu:
        $ref: '#/definitions/cpuQuantity'
      memory:
        $ref: '#/definitions/memoryQuantity'
    required:
      - cpu
      - memory
  resources:
    additionalProperties: false
    description: Compute resources for containers.
    properties:
      limits:
        $ref: '#/definitions/resource'
        description: Requested resources (best effort).
      requests:
        $ref: '#/definitions/resource'
        description: Requested resources (guaranteed).
    required:
      - limits
      - requests
    title: Pod resources
  unixOwnerIdRange:
    type: object
    additionalProperties: false
    required: [min, max]
    properties:
      min:
        type: integer
        minimum: 0
        maximum: 65535
      max:
        type: integer
        minimum: 0
        maximum: 65535
  unixOwnerId:
    description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    type: integer
    minimum: 0
    maximum: 65535
    default: 1001
  script:
    description: May specify a non-empty string containing an executable script.
    type: string
    properties:
      id:
        readOnly: true
        type: string
      name:
        $ref: '#/definitions/idName'
    required:
      - name
      - type
  backupSchedule:
    default: 0 0 * * *
    description: Cron-type expression to schedule the backup. Defaults to once a day at 00:00.
    type: string
  secret:
    type: object
    properties:
      id:
        readOnly: true
        type: string
      clusterWide:
        description: Will create the secret in all namespaces.
        type: boolean
        default: false
      teamWide:
        description: Will create the secret in all team-* namespaces.
        type: boolean
        default: false
      name:
        $ref: '#/definitions/idName'
      namespace:
        $ref: '#/definitions/idName'
        description: A kubernetes namespace.
    required:
      - name
    oneOf:
      - title: Generic
        properties:
          type:
            default: generic
            enum:
              - generic
          entries:
            type: array
            items:
              description: A property name at vaultPath
              minItems: 1
              # a valid secret key must consist of alphanumeric characters, '-', '_' or '.' (e.g. 'key.name',  or 'KEY_NAME',  or 'key-name' )
              pattern: '^[-._a-zA-Z0-9]+$'
              type: string
            uniqueItems: true
        required:
          - type
          - entries
      - title: Docker registry
        properties:
          type:
            default: docker-registry
            enum:
              - docker-registry
            type: string
        required:
          - type
      - title: TLS
        properties:
          type:
            default: tls
            enum:
              - tls
            type: string
          crt:
            type: string
            default: 'tls.crt'
          key:
            type: string
            default: 'tls.key'
          ca:
            type: string
            default: 'ca.crt'
        required:
          - type
          - crt
          - key
  secrets:
    description: List of secret names that will have their props injected as env vars into the container.
    items:
      type: string
      pattern: '[a-zA-Z_]{1,}[a-zA-Z0-9_]*'
    nullable: true
    title: Secrets
    type: array
  secretMounts:
    description: Dictionary of absolute folder path > secret name. Will mount the contents of the secret in the container at the specified folder path.
    examples:
      - /foo: bar
    nullable: true
    patternProperties:
      '^[/].*$':
        type: string
    title: Secret mounts
    type: object
  secretTemplates:
    definitions:
      otomiAdminUsername:
        x-secret: 'admin'
  securityContext:
    additionalProperties:
      uniqueItems: true
    properties:
      runAsUser:
        $ref: '#/definitions/unixOwnerId'
      runAsNonRoot:
        description: Enforces that the container must run as non root. This implies that the UID must also be set with runAsUser.
        type: boolean
        default: true
      runAsGroup:
        description: The GID to run the entrypoint of the container process. Defaults to group specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
        $ref: '#/definitions/unixOwnerId'
  service:
    additionalProperties: false
    properties:
      authz:
        additionalProperties: false
        description: Identifies a workload to authorize.
        properties:
          forwardOriginalToken:
            default: false
            description: If true istio will forward the bearer token instead of removing it from the headers.
            type: boolean
          workload:
            $ref: '#/definitions/labelsAnnotations'
      trafficControl:
        title: Traffic Control
        description: Split traffic between multiple services (blue/green, canary)
        properties:
          enabled:
            type: boolean
            default: false
          weightV1:
            type: integer
            default: 90
          weightV2:
            type: integer
            default: 10
      certName:
        description: The name of a TLS secret known to exist in the team namespace.
        example: www-example-com
        type: string
      domain:
        description: A custom service domain name (max 64 bytes).
        maxLength: 64
        $ref: '#/definitions/wordCharacterPattern'
      forwardPath:
        default: false
        description: Whether to forward the path into the service, or 'terminate' it.
        type: boolean
      hasCert:
        description: Select when a certificate exists and should not be generated.
        type: boolean
      headers:
        properties:
          response:
            properties:
              set:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
          request:
            properties:
              set:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
      hide:
        description: Used by otomi console to determine wether to render it on screen or not. Only used by core services.
        type: boolean
      host:
        description: Reference to another core service name. Used by otomi console to show a variation of a core service with a different path (i.e. Loki). Only used by core services.
        $ref: '#/definitions/wordCharacterPattern'
      id:
        description: Unique identifier created by and used in API. Optional.
        type: string
      auth:
        description: Available only for core apps.
        type: boolean
      isShared:
        description: When true the service will get it's own domain by prefixing the app name to the cluster domain. Mostly used by core apps.
        type: boolean
      ksvc:
        type: object
        properties:
          predeployed:
            description: Set this flag it the service is managed by knative service
            type: boolean
            default: false
      logo:
        description: Used by otomi-console as an override mechanism to display another logo.
        properties:
          name:
            type: string
        required:
          - name
      name:
        $ref: '#/definitions/idName'
        description: Short name. Will be used for generation of knative service name, as well as service URL.
      namespace:
        $ref: '#/definitions/idName'
        description: A kubernetes namespace. Only used by core services, so should be disallowed for non-admins.
      ownHost:
        default: true
        description: When true the service will get it's own domain by prefixing the app name to the team domain. Mostly set to true. This will probably be removed soon.
        type: boolean
      path:
        description: Used by otomi-console to render a path for the app. Only used by core services.
        $ref: '#/definitions/wordCharacterPattern'
      paths:
        items:
          description: |
            Path mapping to only route certain paths to the service. This allows micro services to operate on the same domain and port.
            When left empty all paths will go to this service.
          $ref: '#/definitions/wordCharacterPattern'
        # nullable: true
        type: array
      port:
        $ref: '#/definitions/portNumber'
        description: Points to the backing k8s service (only used when 'svc' is set).
      ingressClassName:
        description: Ingress class name
        $ref: '#/definitions/idName'
        default: platform
      svc:
        $ref: '#/definitions/idName'
        description: When given a backing k8s service is expected to be deployed with this name, which will be exposed through this team service.
      tlsPass:
        description: Will pass the request to the backing service without TLS termination.
        type: boolean
        default: false
      useCname:
        description: Will configure additional host(CNAME) for the service.
        type: boolean
        default: false
      cname:
        properties:
          domain:
            description: CNAME of the service.
            type: string
          tlsSecretName:
            description: Kubernetes secret name of type TLS (not required if the tlsPass flag is set to true).
            $ref: '#/definitions/idName'
      type:
        nullable: true
        default: public
        description: Will determine the ingress routing.
        enum:
          - public
          - cluster
        type: string
      removeRequestHeaders:
        description: >-
          Strip selected headers from HTTP request.
        type: array
        items:
          type: string
    required:
      - name
      - type
  size:
    description: Disk size. Valid units are E|P|T|G|Ti|Gi.
    examples:
      - 1Gi
      - 0.5Ti
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G||Ti|Gi)?$'
    type: string
  subdomainType:
    type: string
    # A lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com')
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
  team:
    additionalProperties: false
    properties:
      alerts:
        $ref: '#/definitions/alerts'
      apps:
        additionalProperties: true
        alertmanager:
          additionalProperties: false
          properties:
            resources:
              $ref: '#/definitions/resources'
        grafana:
          additionalProperties: false
          properties:
            additionalProperties: false
            properties:
              grafana:
                $ref: '#/definitions/resources'
              sidecar:
                $ref: '#/definitions/resources'
        tekton:
          additionalProperties: false
          properties:
            resources:
              additionalProperties: false
              properties:
                dashboard:
                  $ref: '#/definitions/resources'
                buildpacksTask:
                  $ref: '#/definitions/resources'
                gitCloneTask:
                  $ref: '#/definitions/resources'
                grypeTask:
                  $ref: '#/definitions/resources'
                kanikoTask:
                  $ref: '#/definitions/resources'
      backups:
        type: array
        items:
          $ref: '#/definitions/backup'
      secrets:
        items:
          $ref: '#/definitions/secret'
        type: array
      id:
        $ref: '#/definitions/idName'
        description: Must be the same as the name.
      limitRange:
        description: 'Kubernetes limit range. As is.'
        properties:
          default:
            $ref: '#/definitions/resource'
          defaultRequest:
            $ref: '#/definitions/resource'
      oidc:
        additionalProperties: false
        properties:
          groupMapping:
            description: IDP group id to map onto this team.
            $ref: '#/definitions/wordCharacterPattern'
      password:
        description: Will be used to separate team resources.
        type: string
        x-secret: ''
      resourceQuota:
        description: 'List of kubernetes resource quota. Should adhere to the "spec.hard" format as described here: https://kubernetes.io/docs/concepts/policy/resource-quotas/. Not validated as there is no schema published. Change at your own risk.'
        type: object
      selfService:
        $ref: '#/definitions/teamSelfService'
      services:
        items:
          $ref: '#/definitions/service'
        type: array
      netpols:
        items:
          $ref: '#/definitions/netpol'
        type: array
      managedMonitoring:
        title: Managed monitoring
        description: Activate managed Grafana, Prometheus or Alertmanager instances
        properties:
          grafana:
            type: boolean
          alertmanager:
            type: boolean
      networkPolicy:
        ingressPrivate:
          title: Enable filtering of ingress traffic inside the cluster
          description: When set a user can define ingress from other services for a particular team service
          type: boolean
          default: true
        egressPublic:
          title: Enable filtering of egress traffic outside the cluster
          description: When set a user can define egress towards FQDNs and public IPs for a team service
          type: boolean
          default: true
      workloads:
        type: array
        items:
          $ref: '#/definitions/workload'
      projects:
        type: array
        items:
          $ref: '#/definitions/project'
      policies:
        type: object
      builds:
        type: array
        items:
          $ref: '#/definitions/build'
  teamSelfService:
    title: Team permissions
    description: Grant team permissions to modify certain configuration parameters.
    type: object
    properties:
      service:
        title: Service
        type: array
        items:
          type: string
          enum: [ingress]
        uniqueItems: true
      team:
        title: Team settings
        type: array
        items:
          type: string
          enum: [oidc, managedMonitoring, alerts, resourceQuota, networkPolicy]
        uniqueItems: true
      apps:
        title: Apps
        type: array
        items:
          type: string
          enum: [argocd, gitea]
        uniqueItems: true
      access:
        title: Access
        type: array
        items:
          type: string
          enum: [shell, downloadKubeConfig, downloadDockerConfig, downloadCertificateAuthority]
        uniqueItems: true
  backupTtl:
    default: 168h
    description: Expiration of the backup. Defaults to 7 days.
    title: TTL after finished
    type: string
  backupRetentionPolicy:
    default: 7d
    description: Delete backups according to retention policy. In DAYS|WEEKS|MONTHS
    title: Retention policy
    type: string
  url:
    pattern: '^https?:\/\/[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/=]*)'
    type: string
  volumes:
    items:
      additionalProperties: false
      properties:
        name:
          description: Name must match mount name.
          $ref: '#/definitions/idName'
        configMap:
          properties:
            name:
              $ref: '#/definitions/idName'
    type: array
  wordCharacterPattern:
    type: string
    # At least one non whitespace character
    pattern: ^[^\s]+$
  project:
    type: object
    description: A single project can represent application's build, workload and service.
    properties:
      name:
        description: Name of the project
        $ref: '#/definitions/idName'
    required:
      - name
  policies:
    type: object
  build:
    type: object
    description: Define location of code to build
    properties:
      name:
        description: Name of the image
        $ref: '#/definitions/idName'
      tag:
        description: Image tag
        $ref: '#/definitions/imageTag'
      trigger:
        type: boolean
        default: false
      externalRepo:
        type: boolean
        description: Select when using an external private Git repository.
        default: false
      scanSource:
        type: boolean
        default: true
        description: Select to scan source
      secretName:
        description: The name of the secret with the credentials of the external private Git repository
        $ref: '#/definitions/idName'
      mode:
        properties:
          docker:
            properties:
              repoUrl:
                description: URL of the Git repository holding the application code.
                $ref: '#/definitions/url'
              revision:
                description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
                $ref: '#/definitions/wordCharacterPattern'
                default: HEAD
              path:
                description: A relative directory path within the Git repository.
                type: string
                default: ./Dockerfile
              envVars:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
          buildpacks:
            properties:
              repoUrl:
                description: URL of the Git repository holding the application code.
                $ref: '#/definitions/url'
              revision:
                description: This may be a commit sha, branch name, or tag. If omitted, will equal to HEAD.
                $ref: '#/definitions/wordCharacterPattern'
                default: HEAD
              path:
                description: A relative directory path within the Git repository.
                type: string
              envVars:
                type: array
                items:
                  type: object
                  properties:
                    name:
                      type: string
                    value:
                      type: string
                  required:
                    - name
                    - value
    required:
      - name
  sealedsecret:
    type: object
    description: Define location of code to build
    properties:
      name:
        $ref: '#/definitions/idName'
      namespace:
        $ref: '#/definitions/idName'
      immutable:
        description: 'Immutable, if set to true, ensures that data stored in the Secret cannot be updated (only object metadata can be modified).'
        type: boolean
      type:
        description: Used to facilitate programmatic handling of secret data.
        type: string
        default: kubernetes.io/opaque
        enum:
          [
            'kubernetes.io/opaque',
            'kubernetes.io/service-account-token',
            'kubernetes.io/dockercfg',
            'kubernetes.io/dockerconfigjson',
            'kubernetes.io/basic-auth',
            'kubernetes.io/ssh-auth',
            'kubernetes.io/tls',
          ]
      encryptedData:
        type: object
      metadata:
        type: object
    required:
      - type
      - encryptedData
      - name
  workload:
    type: object
    description: Define location of the application's manifests or chart
    properties:
      name:
        $ref: '#/definitions/idName'
      url:
        description: URL to either Helm or Git repository
        $ref: '#/definitions/url'
      chartProvider:
        type: string
        title: Chart provider
        enum: ['helm', 'git']
        default: git
      path:
        description: A relative directory path within the Git repository. Absolute paths cause errors. (only valid for applications sourced from Git)
        $ref: '#/definitions/wordCharacterPattern'
      chart:
        description: Chart is a Helm chart name, and must be specified for applications sourced from a Helm repo.
        $ref: '#/definitions/wordCharacterPattern'
      revision:
        description: In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. In case of Helm, this is a semver tag for the Chart's version.
        $ref: '#/definitions/wordCharacterPattern'
        default: HEAD
      chartMetadata:
        title: ''
        properties:
          helmChartVersion:
            type: string
            title: Helm chart version
            default: ''
          helmChartDescription:
            type: string
            title: Helm chart description
            default: ''
      namespace:
        description: Workload namespace. Applicable only for team-admin. Default value is 'team-<team_id>'
        $ref: '#/definitions/idName'
      imageUpdateStrategy:
        description: Automatically update the image. Only supported wit Helm charts in local Gitea repository and images stored in Harbor.
        title: Auto Image Updater
        additionalProperties: false
        properties:
          digest:
            additionalProperties: false
            properties:
              imageRepository:
                type: string
                description: The container image repository name
                $ref: '#/definitions/wordCharacterPattern'
              tag:
                $ref: '#/definitions/wordCharacterPattern'
              imageParameter:
                type: string
                default: image.name
                description: The parameter for specifying the image name
              tagParameter:
                type: string
                default: image.tag
                description: The parameter for specifying the image tag
            required:
              - tag
          semver:
            additionalProperties: false
            properties:
              imageRepository:
                type: string
                description: The container image repository name
                $ref: '#/definitions/wordCharacterPattern'
              versionConstraint:
                $ref: '#/definitions/wordCharacterPattern'
              imageParameter:
                type: string
                default: image.name
                description: The parameter for specifying the image name
              tagParameter:
                type: string
                default: image.tag
                description: The parameter for specifying the image tag
            required:
              - versionConstraint
          type:
            type: string
            enum:
              - semver
              - digest
              - disabled
            default: disabled
        required:
          - type
    required:
      - name
      - url
  user:
    type: object
    description: A user in keycloak, who can be a platform admin, a team admin, or a team member.
    properties:
      email:
        $ref: '#/definitions/email'
        x-secret: ''
      firstName:
        type: string
        x-secret: ''
      lastName:
        type: string
        x-secret: ''
      isPlatformAdmin:
        type: boolean
        x-secret: ''
      isTeamAdmin:
        type: boolean
        x-secret: ''
      teams:
        type: array
        items:
          type: string
          x-secret: ''
      initialPassword:
        type: string
        x-secret: ''
    required:
      - email
      - firstName
      - lastName

properties:
  alerts:
    $ref: '#/definitions/alerts'
  azure:
    description: Azure specific configuration.
    properties:
      storageType:
        properties:
          fast:
            type: string
          standard:
            type: string
      appgw:
        properties:
          isManaged:
            default: false
            description: Indicates Azure Application Gateway Ingress Controller add-on is installed by AKS.
            type: boolean
  apps:
    additionalProperties: true
    properties:
      alertmanager:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            properties:
              alertmanger:
                $ref: '#/definitions/resources'
      argocd:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          controllerStatusProcessors:
            default: 20
            type: integer
          controllerOperationProcessors:
            default: 10
            type: integer
          applicationSet:
            replicas:
              default: 1
              type: integer
          controller:
            replicas:
              default: 1
              type: integer
          autoscaling:
            repoServer:
              $ref: '#/definitions/autoscalingEnabled'
            server:
              $ref: '#/definitions/autoscalingEnabled'
          resources:
            additionalProperties: false
            properties:
              server:
                $ref: '#/definitions/resources'
              controller:
                $ref: '#/definitions/resources'
              repo:
                $ref: '#/definitions/resources'
              redis:
                $ref: '#/definitions/resources'
              applicationSet:
                $ref: '#/definitions/resources'
              notifications:
                $ref: '#/definitions/resources'
              imageUpdater:
                $ref: '#/definitions/resources'
      cert-manager:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            certManager:
              $ref: '#/definitions/resources'
            startupapicheck:
              $ref: '#/definitions/resources'
            cainjector:
              $ref: '#/definitions/resources'
            webhook:
              $ref: '#/definitions/resources'
          byoWildcardCert:
            description: 'Bring your own trusted wildcard certificate. Only applicable for byo-wildcard-cert issuer'
            type: string
          byoWildcardCertKey:
            description: 'A certificate key corresponding to the byoWildcardCert.'
            type: string
            x-secret: ''
          externallyManagedTlsSecretName:
            description: |
              The name of a custom secret in the istio-system namespace that contains a trusted certificate and private key.
              To be used with issuer externally-managed-tls-secret.
            $ref: '#/definitions/idName'
          customRootCA:
            x-secret: ''
            type: string
            description: CA that is used to create and verify self-signed certificates. Leave it empty to generate one automatically.
          customRootCAKey:
            x-secret: ''
            type: string
            description: CA private key that is used to issue certificates. Leave it empty to generate one automatically.
          email:
            $ref: '#/definitions/email'
          issuer:
            description: |
              Indicates the origin of the wildcard certificate. 
              The custom-ca - cert-manager uses the customRootCA to generate wildcard certificate.
              The letsencrypt - cert-manager requests certificate from letsencrypt endpoint.
              The byo-wildcard-cert allows users to bring their own trusted wildcard certificate (cert-manager not involved)
              through the values byoWildcardCert and byoWildcardCertKey.
              The externally-managed-tls-secret is similar to byo-wildcard-cert, but assumes the certificate is already stored
              in a secret (referenced by externallyManagedTlsSecretName) and not provided through the values.
            type: string
            enum:
              - custom-ca
              - letsencrypt
              - byo-wildcard-cert
              - externally-managed-tls-secret
            default: custom-ca
          stage:
            type: string
            enum:
              - production
              - staging
            default: production
      cnpg:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
      drone:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          adminIsMachine:
            type: boolean
            default: false
          adminUser:
            $ref: '#/definitions/wordCharacterPattern'
          adminToken:
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
          debug:
            type: boolean
            default: false
          githubAdmins:
            additionalProperties: false
            properties:
              org:
                $ref: '#/definitions/wordCharacterPattern'
              team:
                $ref: '#/definitions/wordCharacterPattern'
              token:
                $ref: '#/definitions/wordCharacterPattern'
          orgsFilter:
            $ref: '#/definitions/wordCharacterPattern'
          owner:
            $ref: '#/definitions/wordCharacterPattern'
          repo:
            $ref: '#/definitions/idName'
          repoFilter:
            $ref: '#/definitions/wordCharacterPattern'
          image:
            additionalProperties: false
            properties:
              agent:
                $ref: '#/definitions/imageSimple'
              server:
                $ref: '#/definitions/imageSimple'
          resources:
            additionalProperties: false
            properties:
              runner:
                properties:
                  requests:
                    properties:
                      cpu:
                        description: Requested compute resources for all the containers started by the runner (guaranteed), expressed in millicores.
                        type: integer
                        default: 1000
                      memory:
                        $ref: '#/definitions/memoryQuantity'
                        description: Requested memory resources for all the containers started by the runner (guaranteed).
                        default: 1Gi
              agent:
                $ref: '#/definitions/resources'
              server:
                $ref: '#/definitions/resources'
          sharedSecret:
            description: A secret used by drone-admit-members plugin. https://docs.drone.io/runner/kubernetes/configuration/reference/drone-secret-plugin-token/
            type: string
            x-secret: '{{ randAlphaNum 32 }}'
          sourceControl:
            additionalProperties: false
            properties:
              bitbucketCloud:
                $ref: '#/definitions/droneGit'
              bitbucketServer:
                properties:
                  consumerKey:
                    default: consumerKey
                    type: string
                    x-secret: ''
                  passwordKey:
                    default: password
                    type: string
                    x-secret: ''
                  privateKey:
                    default: privateKey
                    type: string
                    x-secret: ''
                  server:
                    type: string
                  username:
                    type: string
                    x-secret: ''
              gitea:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        type: string
              github:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        default: 'https://github.com'
                        type: string
              gitlab:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        type: string
              gogs:
                properties:
                  server:
                    type: string
              password:
                type: string
              provider:
                default: github
                enum:
                  - github
                  - gitlab
                  - gitea
                  - gogs
                  - bitbucketCloud
                  - bitbucketServer
                type: string
              secret:
                type: string
              username:
                type: string
          trace:
            default: false
            type: boolean
      external-dns:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          logLevel:
            type: string
            default: 'info'
          resources:
            $ref: '#/definitions/resources'
      falco:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          driver:
            type: string
            default: ebpf
            enum:
              - module
              - ebpf
              - modern-bpf
          resources:
            additionalProperties: false
            properties:
              falco:
                $ref: '#/definitions/resources'
              falcoCtlInstall:
                $ref: '#/definitions/resources'
              falcoCtlFollow:
                $ref: '#/definitions/resources'
              falcoDriverLoader:
                $ref: '#/definitions/resources'
              falcoExporter:
                $ref: '#/definitions/resources'
      gitea:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          adminPassword:
            type: string
            x-secret: '{{ randAlphaNum 20 }}'
          postgresqlPassword:
            type: string
            description: This password was generated and cannot be changed without manual intervention.
            x-secret: '{{ randAlphaNum 20 }}'
            readOnly: true
          image:
            additionalProperties: false
            properties:
              gitea:
                $ref: '#/definitions/imageSimple'
              postgresql:
                $ref: '#/definitions/imageSimple'
              memcached:
                $ref: '#/definitions/imageSimple'
          resources:
            additionalProperties: false
            properties:
              gitea:
                $ref: '#/definitions/resources'
              init:
                $ref: '#/definitions/resources'
              postgresql:
                $ref: '#/definitions/resources'
              memcached:
                $ref: '#/definitions/resources'
              memcachedMetrics:
                $ref: '#/definitions/resources'
      grafana:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          adminPassword:
            type: string
            x-secret: ''
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            grafana:
              $ref: '#/definitions/resources'
            sidecar:
              $ref: '#/definitions/resources'
      harbor:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          privateLibrary:
            type: boolean
            default: true
            description: Will mark the main project named "library" as private.
          adminPassword:
            type: string
            x-secret: ''
          oidcAutoOnboard:
            type: boolean
          oidcUserClaim:
            type: string
          core:
            properties:
              secret:
                type: string
                x-secret: '{{ randAlphaNum 16 }}'
              xsrfKey:
                type: string
                x-secret: '{{ randAlphaNum 32 }}'
          jobservice:
            properties:
              secret:
                type: string
                x-secret: '{{ randAlphaNum 16 }}'
          registry:
            properties:
              secret:
                type: string
                x-secret: '{{ randAlpha 16 }}'
              credentials:
                properties:
                  htpasswd:
                    type: string
                    x-secret: ''
                  username:
                    type: string
                    $ref: '#/definitions/secretTemplates/definitions/otomiAdminUsername'
                  password:
                    type: string
                    x-secret: '{{ randAlphaNum 32 }}'
            required:
              - secret
              - credentials
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            additionalProperties: false
            properties:
              chartmuseum:
                $ref: '#/definitions/resources'
              core:
                $ref: '#/definitions/resources'
              jobservice:
                $ref: '#/definitions/resources'
              portal:
                $ref: '#/definitions/resources'
              redis:
                $ref: '#/definitions/resources'
              registry:
                $ref: '#/definitions/resources'
              registryController:
                $ref: '#/definitions/resources'
              trivy:
                $ref: '#/definitions/resources'
              nginx:
                $ref: '#/definitions/resources'
          secretKey:
            type: string
            x-secret: '{{ randAlpha 16 }}'
      httpbin:
        description: The famous httpbin application.
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
      ingress-nginx-platform:
        $ref: '#/definitions/ingressNginx'
      istio:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          tracing:
            description: Configure Istio for tracing. Requires Otel Collector to be enabled.
            propterties:
              enabled:
                default: false
                type: boolean
              samplingRatio:
                type: string
                default: '0.01'
          autoscaling:
            properties:
              egressgateway:
                $ref: '#/definitions/autoscaling'
              ingressgateway:
                $ref: '#/definitions/autoscaling'
              pilot:
                $ref: '#/definitions/autoscaling'
          egressGateway:
            properties:
              enabled:
                default: false
                type: boolean
          global:
            additionalProperties: false
            properties:
              logging:
                properties:
                  level:
                    type: string
          extensionProviders:
            description: 'See: https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig'
            type: array
            items:
              type: object
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            properties:
              egressgateway:
                $ref: '#/definitions/resources'
              ingressgateway:
                $ref: '#/definitions/resources'
              ingressgateway-private:
                $ref: '#/definitions/resources'
              pilot:
                $ref: '#/definitions/resources'
              proxy:
                $ref: '#/definitions/resources'
              operator:
                $ref: '#/definitions/resources'
      jaeger:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          resources:
            operator:
              $ref: '#/definitions/resources'
            jaeger:
              $ref: '#/definitions/resources'
          _rawValues:
            $ref: '#/definitions/rawValues'
      keycloak:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          idp:
            additionalProperties: false
            properties:
              alias:
                type: string
                default: otomi-idp
              clientID:
                $ref: '#/definitions/wordCharacterPattern'
                default: otomi
              clientSecret:
                type: string
                x-secret: '{{ randAlphaNum 32 }}'
          adminPassword:
            type: string
            x-secret: ''
          adminUsername:
            type: string
          theme:
            type: string
            default: otomi
          image:
            properties:
              keycloak:
                $ref: '#/definitions/imageSimple'
              postgresql:
                $ref: '#/definitions/imageSimple'
          resources:
            additionalProperties: false
            properties:
              keycloak:
                $ref: '#/definitions/resources'
              operator:
                $ref: '#/definitions/resources'
      kyverno:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
          mode:
            type: string
            enum: ['DevTest', 'Prod']
            default: DevTest
          resources:
            additionalProperties: false
            properties:
              admissionController:
                $ref: '#/definitions/resources'
              cleanupController:
                $ref: '#/definitions/resources'
              backgroundController:
                $ref: '#/definitions/resources'
              reportsController:
                $ref: '#/definitions/resources'

      kiali:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
              pod:
                $ref: '#/definitions/resources'
      knative:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          resources:
            queueSidecar:
              $ref: '#/definitions/resources'
            controller:
              $ref: '#/definitions/resources'
            activator:
              $ref: '#/definitions/resources'
            webhook:
              $ref: '#/definitions/resources'
            autoscaler:
              $ref: '#/definitions/resources'
            autoscalerHpa:
              $ref: '#/definitions/resources'
            operator:
              $ref: '#/definitions/resources'
            operatorWebhook:
              $ref: '#/definitions/resources'
          serving:
            type: object
            properties:
              replicas:
                default: 1
                type: integer
                minimum: 1
      kured:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            default: false
            type: boolean
          resources:
            additionalProperties: false
            properties:
              kuredDaemonSet:
                $ref: '#/definitions/resources'
      sealed-secrets:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            properties:
              operator:
                $ref: '#/definitions/resources'
      thanos:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          query:
            properties:
              replicaCount:
                description: Number of Thanos Query replicas.
                type: integer
                default: 1
          compactor:
            description: Resolution and Retention flags.
            properties:
              retentionResolutionRaw:
                type: string
                default: 30d
              retentionResolution5m:
                type: string
                default: 30d
              retentionResolution1h:
                type: string
                default: 10y
          resources:
            additionalProperties: false
            properties:
              query:
                $ref: '#/definitions/resources'
              storegateway:
                $ref: '#/definitions/resources'
              compactor:
                $ref: '#/definitions/resources'
          persistence:
            properties:
              storegateway:
                properties:
                  size:
                    $ref: '#/definitions/size'
                    default: 10Gi
              compactor:
                properties:
                  size:
                    $ref: '#/definitions/size'
                    default: 10Gi
      tekton:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              dashboard:
                $ref: '#/definitions/resources'
              pipelinesController:
                $ref: '#/definitions/resources'
              pipelinesRemoteresolver:
                $ref: '#/definitions/resources'
              pipelinesEvents:
                $ref: '#/definitions/resources'
              pipelinesWebhook:
                $ref: '#/definitions/resources'
              triggersInterceptors:
                $ref: '#/definitions/resources'
              triggersController:
                $ref: '#/definitions/resources'
              triggersWebhook:
                $ref: '#/definitions/resources'
      loki:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            additionalProperties: false
            properties:
              compactor:
                $ref: '#/definitions/resources'
              ingester:
                $ref: '#/definitions/resources'
              gateway:
                $ref: '#/definitions/resources'
              querier:
                $ref: '#/definitions/resources'
              distributor:
                $ref: '#/definitions/resources'
              queryFrontend:
                $ref: '#/definitions/resources'
              reverseProxy:
                $ref: '#/definitions/resources'
          autoscaling:
            properties:
              ingester:
                $ref: '#/definitions/autoscalingEnabled'
              gateway:
                $ref: '#/definitions/autoscalingEnabled'
              querier:
                $ref: '#/definitions/autoscalingEnabled'
              distributor:
                $ref: '#/definitions/autoscalingEnabled'
              queryFrontend:
                $ref: '#/definitions/autoscalingEnabled'
          adminPassword:
            type: string
            x-secret: '{{ randAlphaNum 20 }}'
          persistence:
            properties:
              querier:
                properties:
                  size:
                    default: 20Gi
                    $ref: '#/definitions/size'
              ingester:
                properties:
                  size:
                    default: 20Gi
                    $ref: '#/definitions/size'
          retention:
            additionalProperties: false
            properties:
              duration:
                default: 24h
                type: string
              period:
                default: 24h
                description: Should be a multiple of 24h. See https://grafana.com/docs/loki/latest/operations/storage/boltdb-shipper/.
                type: string
            required:
              - duration
          v11StartDate:
            description: Set this to a date just after deployment in case of an upgrade. (Otomi started at v9 with filesystem.)
            title: Schema v11 start date
            type: string
        required:
          - adminPassword
      metrics-server:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          apiServer:
            additionalProperties: false
            properties:
              create:
                type: boolean
                default: true
          extraArgs:
            type: array
          resources:
            $ref: '#/definitions/resources'
      minio:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            $ref: '#/definitions/resources'
          provisioning:
            additionalProperties: false
            properties:
              enabled:
                type: boolean
                default: true
          persistence:
            properties:
              enabled:
                type: boolean
                default: true
              size:
                $ref: '#/definitions/size'
                default: 20Gi
      oauth2-proxy:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          config:
            properties:
              cookieSecret:
                description: Cookie secret must be 32 byte base64 encoded string.
                pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
                type: string
                x-secret: '{{ randAlphaNum 32 | b64enc }}'
          resources:
            $ref: '#/definitions/resources'
      oauth2-proxy-redis:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          architecture:
            type: string
            enum:
              - standalone
              - replication
            default: standalone
          password:
            type: string
            x-secret: '{{ randAlpha 24 }}'
          resources:
            additionalProperties: false
            properties:
              master:
                $ref: '#/definitions/resources'
              replica:
                $ref: '#/definitions/resources'
              sentinel:
                $ref: '#/definitions/resources'
              metrics:
                $ref: '#/definitions/resources'
          persistence:
            properties:
              master:
                properties:
                  size:
                    default: 1Gi
                    $ref: '#/definitions/size'
              replica:
                properties:
                  size:
                    default: 1Gi
                    $ref: '#/definitions/size'
              sentinet:
                properties:
                  size:
                    default: 1Gi
                    $ref: '#/definitions/size'
        type: object
      otomi-api:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          editorInactivityTimeout:
            type: integer
            default: 10
          git:
            additionalProperties: false
            properties:
              branch:
                type: string
              email:
                $ref: '#/definitions/email'
              password:
                type: string
                x-secret: ''
              repoUrl:
                $ref: '#/definitions/repoUrl'
              user:
                type: string
          resources:
            additionalProperties: false
            properties:
              api:
                $ref: '#/definitions/resources'
              tools:
                $ref: '#/definitions/resources'
      otomi-console:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            $ref: '#/definitions/resources'
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - properties:
                  registry:
                    required:
                      - username
                      - password
        type: object
      otomi-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-harbor-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-gitea-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
      apl-keycloak-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'

      oltp:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
      prometheus:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          disabledRules:
            type: array
            items:
              type: string
          remoteWrite:
            properties:
              enabled:
                type: boolean
                default: false
              insecureSkipVerify:
                type: boolean
                default: false
              rwConfig:
                properties:
                  target:
                    type: string
                  basicAuth:
                    properties:
                      enabled:
                        type: boolean
                        default: false
                      username:
                        type: string
                      password:
                        $ref: '#/definitions/wordCharacterPattern'
                        x-secret: ''
                  customConfig:
                    description: Custom remote write config. Will be appended to the remoteWrite list.
                    type: string
          replicas:
            type: integer
            default: 1
          scrapeInterval:
            type: string
            default: 60s
          retention:
            $ref: '#/definitions/duration'
          retentionSize:
            description: 'The maximum number of bytes of storage blocks to retain. The oldest data will be removed first. Defaults to 0 or disabled. Units supported: B, KB, MB, GB, TB, PB, EB'
            default: 4GB
            pattern: '^([0-9]+\.)?[0-9]+(B|KB|MB|GB|TB|PB|EB)?$'
          storageSize:
            $ref: '#/definitions/size'
            default: 5Gi
          image:
            properties:
              prometheus:
                $ref: '#/definitions/imageSimple'
              kube-state-metrics:
                $ref: '#/definitions/imageSimple'
              node-exporter:
                $ref: '#/definitions/imageSimple'
          resources:
            properties:
              prometheusOperator:
                $ref: '#/definitions/resources'
              prometheus:
                $ref: '#/definitions/resources'
              kube-state-metrics:
                $ref: '#/definitions/resources'
              node-exporter:
                $ref: '#/definitions/resources'
              thanosSidecar:
                $ref: '#/definitions/resources'
              prometheusConfigReloader:
                $ref: '#/definitions/resources'
      promtail:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            $ref: '#/definitions/resources'
      rabbitmq:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            properties:
              clusterOperator:
                description: Controller which is used to create RabbitMQ-clusters
                $ref: '#/definitions/resources'
              msgTopologyOperator:
                description: Controller which is used to create RabbitMQ queues and policies
                $ref: '#/definitions/resources'
      tempo:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          resources:
            additionalProperties: false
            properties:
              compactor:
                $ref: '#/definitions/resources'
              ingester:
                $ref: '#/definitions/resources'
              querier:
                $ref: '#/definitions/resources'
              distributor:
                $ref: '#/definitions/resources'
              queryFrontend:
                $ref: '#/definitions/resources'
              memcached:
                $ref: '#/definitions/resources'
              metricsGenerator:
                $ref: '#/definitions/resources'
          autoscaling:
            properties:
              ingester:
                $ref: '#/definitions/autoscalingEnabled'
              querier:
                $ref: '#/definitions/autoscalingEnabled'
              distributor:
                $ref: '#/definitions/autoscalingEnabled'
              queryFrontend:
                $ref: '#/definitions/autoscalingEnabled'
          persistence:
            properties:
              ingester:
                properties:
                  size:
                    default: 10Gi
                    $ref: '#/definitions/size'
      trivy:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          operator:
            properties:
              replicaCount:
                description: Number of Operator replicas.
                type: integer
                default: 1
          resources:
            additionalProperties: false
            properties:
              operator:
                $ref: '#/definitions/resources'
              trivy:
                $ref: '#/definitions/resources'
      otel:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          collector:
            properties:
              mode:
                title: Collector mode
                description: Mode to run collector in.
                type: string
                default: deployment
                enum:
                  - deployment
                  - daemonset
                  - statefulset
              autoscaler:
                properties:
                  maxReplicas:
                    type: integer
                    default: 5
                  minReplicas:
                    type: integer
                    default: 2
                  targetCPUUtilizationPercentage:
                    type: integer
                    default: 80
                  targetMemoryUtilizationPercentage:
                    type: integer
                    default: 80
              attributes:
                type: array
                title: Kubernetes Attributes
                $ref: '#/definitions/labelsAnnotations'
                description: 'Attributes to extract metadata from pods'
          operator:
            properties:
              replicaCount:
                description: Number of replicas.
                type: integer
                default: 1
          resources:
            additionalProperties: false
            properties:
              collector:
                $ref: '#/definitions/resources'
              manager:
                $ref: '#/definitions/resources'
              kubeRBACProxy:
                $ref: '#/definitions/resources'
      velero:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
          restic:
            enabled:
              type: boolean
              default: false
          logLevel:
            description: Set log-level for the Velero pod.
            default: info
            enum:
              - debug
              - info
              - warning
              - error
              - fatal
              - panic
          resources:
            $ref: '#/definitions/resources'
    patternProperties:
      '^ingress-nginx-[a-z0-9]([-a-z0-9]*[a-z0-9])+$':
        $ref: '#/definitions/ingressNginx'
  cluster:
    $ref: '#/definitions/cluster'
  dns:
    additionalProperties: false
    properties:
      zones:
        description: Extra dns zones that the cluster can administer. Team services can use this to publish their URLs on.
        items:
          $ref: '#/definitions/domain'
        type: array
      domainFilters:
        description: Limit possible target zones by domain suffixes.
        items:
          type: string
        type: array
      zoneIdFilters:
        description: Limit possible target zones by zone id.
        items:
          type: string
        type: array
      policy:
        description: Modify how DNS records are synchronized between sources and providers.
        type: string
        enum:
          - upsert-only
          - sync
      provider:
        description: The DNS provider managing the domains.
        oneOf:
          - title: Akamai EdgeDNS
            additionalProperties: false
            properties:
              akamai:
                $ref: '#/definitions/akamai/definitions/dns'
            required:
              - akamai
          - title: AWS
            description: Uses credentials when either a pair of id+key or a secret name is provided. Assumes node role otherwise.
            additionalProperties: false
            properties:
              aws:
                properties:
                  credentials:
                    properties:
                      secretKey:
                        $ref: '#/definitions/aws/definitions/secretKey'
                      accessKey:
                        $ref: '#/definitions/aws/definitions/accessKey'
                    required: [secretKey, accessKey]
                  region:
                    $ref: '#/definitions/aws/definitions/region'
                  role:
                    $ref: '#/definitions/aws/definitions/role'
                required: [region]
                oneOf:
                  - required: [credentials]
                  - required: [role]
                  - not:
                      anyOf:
                        - required: [credentials]
                        - required: [role]
            required:
              - aws
          - title: Azure
            additionalProperties: false
            properties:
              azure:
                $ref: '#/definitions/azure/definitions/dns'
            required:
              - azure
          - title: Azure Private
            additionalProperties: false
            properties:
              azure-private-dns:
                $ref: '#/definitions/azure/definitions/dns'
            required:
              - azure-private-dns
          - title: Google
            additionalProperties: false
            properties:
              google:
                properties:
                  serviceAccountKey:
                    $ref: '#/definitions/google/definitions/accountJson'
                    description: A service account key in json format for managing a DNS zone.
                  project:
                    $ref: '#/definitions/google/definitions/project'
                required: [project, serviceAccountKey]
            required:
              - google
          - title: Digital Ocean
            additionalProperties: false
            properties:
              digitalocean:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                required:
                  - apiToken
            required:
              - digitalocean
          - title: Linode
            additionalProperties: false
            properties:
              linode:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                required:
                  - apiToken
            required:
              - linode
          - title: CloudFlare
            additionalProperties: false
            properties:
              cloudflare:
                properties:
                  apiToken:
                    type: string
                    x-secret: ''
                  apiSecret:
                    type: string
                    x-secret: ''
                    description: Required when Email is set.
                  email:
                    $ref: '#/definitions/email'
                    description: Required when Email is set.
                  proxied:
                    type: boolean
                    x-default: true
                oneOf:
                  - required: [apiToken]
                  - required: [apiSecret, email]
                  - not:
                      anyOf:
                        - required: [apiToken]
                        - required: [apiSecret]
                        - required: [email]
            required:
              - cloudflare
          - title: Other
            additionalProperties: false
            properties:
              other:
                description: This option requires configuration for both external-dns as well as cert-manager. No schema validation is available so provide correct data.
                type: object
                properties:
                  name:
                    type: string
                    description: Name of the provider.
                  external-dns:
                    title: YAML for external-dns.
                    type: object
                    description: 'The provider config as provided here: https://github.com/linode/apl-core/blob/main/charts/external-dns/values.yaml'
                  cert-manager:
                    title: YAML for cert-manager.
                    type: object
                    description: 'The dns01 config as provided here: https://cert-manager.io/docs/configuration/acme/dns01/'
                required:
                  - name
                  - external-dns
                  - cert-manager
            required:
              - other
      entrypoint:
        $ref: '#/definitions/ipV4Address'
        description: Optional. A public IP address that will override (loadbalancer) ip used for registering hosts. This allows for access to private clusters.
  files:
    type: object
    description: 'Custom values for the workload chart.'
    patternProperties:
      '^/|(/[\w-]+)+$':
        type: string
        pattern: ^[^\s]+$
  kms:
    additionalProperties: false
    properties:
      sops:
        oneOf:
          - properties:
              provider:
                type: string
                const: age
              age:
                properties:
                  publicKey:
                    type: string
                  privateKey:
                    type: string
                    x-secret: ''
            required:
              - provider
          - properties:
              provider:
                type: string
                const: aws
              aws:
                properties:
                  keys:
                    description: Comma separated list of one or two ARNs to keys as defined in AWS KMS. One if used for both enc+dec. Two if one for enc, other for dec. (You can specify a role by appending it to the ARN of the key with a + sign.)
                    title: AWS KMS keys
                    type: string
                  accessKey:
                    $ref: '#/definitions/aws/definitions/accessKey'
                  secretKey:
                    $ref: '#/definitions/aws/definitions/secretKey'
                  region:
                    $ref: '#/definitions/aws/definitions/region'
                required:
                  - accessKey
                  - keys
                  - secretKey
            required:
              - aws
          - properties:
              provider:
                type: string
                const: azure
              azure:
                properties:
                  keys:
                    description: Comma separated list of one or two paths to keys as defined in Azure Keyvault. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: Azure Keyvault keys
                    type: string
                  clientId:
                    $ref: '#/definitions/azure/definitions/clientId'
                  clientSecret:
                    $ref: '#/definitions/azure/definitions/clientSecret'
                  tenantId:
                    $ref: '#/definitions/azure/definitions/tenantId'
                required:
                  - clientId
                  - clientSecret
                  - keys
            required:
              - azure
          - properties:
              provider:
                type: string
                const: google
              google:
                properties:
                  keys:
                    description: Comma separated list of one or two paths to keys as defined in GCP KMS. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: GCP KMS keys
                    type: string
                  accountJson:
                    $ref: '#/definitions/google/definitions/accountJson'
                  project:
                    $ref: '#/definitions/google/definitions/project'
                required:
                  - keys
                  - accountJson
                  - project
            required:
              - google
  oidc:
    additionalProperties: false
    description: 'Holds many parts used in different locations. Please see keycloak, grafana, istio and oauth-proxy as those are all consuming (parts of) these settings.'
    properties:
      issuer:
        $ref: '#/definitions/url'
      clientID:
        $ref: '#/definitions/wordCharacterPattern'
      clientSecret:
        type: string
        x-secret: ''
      platformAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      allTeamsAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      teamAdminGroupID:
        $ref: '#/definitions/wordCharacterPattern'
      usernameClaimMapper:
        $ref: '#/definitions/wordCharacterPattern'
        description: Claim name from identity provider used by Keycloak to create the username. Best to not change this from the default.
        default: '${CLAIM.upn}'
      subClaimMapper:
        type: string
        description: Claim name passed by Keycloak as a unique user identifier. Best to not change this from the default.
        default: sub
    required:
      - clientID
      - clientSecret
      - issuer
  otomi:
    additionalProperties: false
    properties:
      adminPassword:
        type: string
        x-secret: '{{ randAlphaNum 20 }}'
      isPreInstalled:
        type: boolean
        description: Defines if APL is installed and managed by Linode
        default: false
      globalPullSecret:
        title: Global pullsecret
        description: Will be connected to each "default" service account in all otomi app namespaces.
          Handy for authenticating with DockerHub to avoid rate limiting.
          Also useful when pulling all otomi images from a private repo. (One would need to override all the images in the config first.)
        additionalProperties: false
        properties:
          username:
            $ref: '#/definitions/wordCharacterPattern'
          password:
            type: string
            x-secret: ''
          email:
            $ref: '#/definitions/email'
            default: not@us.ed
          server:
            $ref: '#/definitions/wordCharacterPattern'
            default: docker.io
        required:
          - username
          - password
      hasExternalDNS:
        description: Set this to true when an external dns zone is available to manage dns records. (Expects required `dns:` fields to be set.)
        default: false
        type: boolean
      hasExternalIDP:
        default: false
        description: Set this to true when bringing your own external IDP such as Azure AD. (Expects required `oidc:` fields to be set.)
        type: boolean
      isMultitenant:
        default: true
        description: Whether to separate team metrics and logs. Disabling this lets everybody be admin and see everything.
        type: boolean
      nodeSelector:
        $ref: '#/definitions/labelsAnnotations'
        description: 'One or more "label: value" pairs that must exist on one or more nodes, which will force all otomi platform workloads to be scheduled there.'
      version:
        default: latest
        description: 'Best pin this to a valid release version found in the repo.'
        pattern: '(v[0-9]+.[0-9]+.[0-9]+|[a-zA-Z]+[a-zA-Z0-9-])'
  ingress:
    properties:
      platformClass:
        type: object
        allOf:
          - properties:
              className:
                type: string
                enum: [platform]
          - $ref: '#/definitions/ingressClassParameters'
      classes:
        type: array
        items:
          allOf:
            - type: object
              properties:
                className:
                  type: string
            - $ref: '#/definitions/ingressClassParameters'
          required:
            - className
  smtp:
    additionalProperties: false
    properties:
      auth_identity:
        type: string
      auth_password:
        type: string
        x-secret: ''
      auth_secret:
        type: string
        x-secret: ''
      auth_username:
        type: string
      from:
        $ref: '#/definitions/email'
        description: The "from" address. Defaults to alerts@$clusterDomain.
      hello:
        type: string
      smarthost:
        $ref: '#/definitions/hostPort'
        description: 'The smtp host:port combination.'
    required:
      - smarthost
  platformBackups:
    type: object
    properties:
      database:
        type: object
        title: Database backups
        properties:
          harbor:
            title: Harbor
            properties:
              enabled:
                type: boolean
                default: false
              resources:
                $ref: '#/definitions/resources'
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
          gitea:
            title: Gitea
            properties:
              enabled:
                type: boolean
                default: false
              resources:
                $ref: '#/definitions/resources'
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
          keycloak:
            title: Keycloak
            properties:
              enabled:
                type: boolean
                default: false
              resources:
                $ref: '#/definitions/resources'
              retentionPolicy:
                $ref: '#/definitions/backupRetentionPolicy'
              schedule:
                $ref: '#/definitions/backupSchedule'
      persistentVolumes:
        type: object
        description: Create backups of persistent volumes
        additionalProperties: false
        properties:
          linodeApiToken:
            type: string
            description: Linode API Token
            $ref: '#/definitions/wordCharacterPattern'
            x-secret: ''
      gitea:
        type: object
        title: Gitea
        description: Enable application-level backup of Gitea repositories and database
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: false
          resources:
            $ref: '#/definitions/resources'
          retentionPolicy:
            $ref: '#/definitions/backupRetentionPolicy'
          schedule:
            $ref: '#/definitions/backupSchedule'

  obj:
    properties:
      showWizard:
        type: boolean
        default: true
        description: Show the Object Storage wizard.
      provider:
        properties:
          linode:
            properties:
              region:
                description: The region of the bucket
                $ref: '#/definitions/wordCharacterPattern'
              accessKeyId:
                type: string
                description: The ID of the access key
                $ref: '#/definitions/wordCharacterPattern'
              secretAccessKey:
                type: string
                description: The secret of the access key
                $ref: '#/definitions/wordCharacterPattern'
                x-secret: ''
              buckets:
                properties:
                  loki:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: loki
                  cnpg:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: cnpg
                  velero:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: velero
                  harbor:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: harbor
                  thanos:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: tempo
                  tempo:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: tempo
                  gitea:
                    type: string
                    $ref: '#/definitions/wordCharacterPattern'
                    default: gitea
            required:
              - region
              - accessKeyId
              - secretAccessKey
          type:
            type: string
            enum:
              - minioLocal
              - linode
              - disabled
            default: disabled
  databases:
    properties:
      keycloak:
        title: Keycloak
        properties:
          size:
            type: string
          resources:
            $ref: '#/definitions/resources'
          replicas:
            type: integer
            default: 2
          imported:
            type: boolean
            default: false
      harbor:
        title: Harbor
        properties:
          size:
            type: string
          resources:
            $ref: '#/definitions/resources'
          replicas:
            type: integer
            default: 2
      gitea:
        title: gitea
        properties:
          useOtomiDB:
            type: boolean
            default: false
          size:
            type: string
          resources:
            $ref: '#/definitions/resources'
          replicas:
            type: integer
            default: 2
          imported:
            type: boolean
            default: false
  teamConfig:
    additionalProperties: false
    patternProperties:
      '^[a-z0-9]([-a-z0-9]*[a-z0-9])+$':
        $ref: '#/definitions/team'
    properties:
      admin:
        properties:
          password:
            type: string
            x-secret: '{{ randAlpha 16 }}'
  version:
    type: integer
    description: DO NOT CHANGE! Holds the values-schema version. For more details, see `otomi migrate`.
  license:
    type: string
    describe: License in form of JWT
    x-secret: ''
  status:
    type: object
    properties:
      otomi:
        properties:
          deployingTag:
            type: string
          deployingVersion:
            type: string
          status:
            type: string
            enum: [deploying, deployed]
          version:
            type: string
      helm:
        type: object
  users:
    type: array
    items:
      $ref: '#/definitions/user'
required:
  - cluster