# Complete Chef 360 Platform Configuration
global:
  # Set to true to use a custom StorageClass instead of the default gp2 on managed Kubernetes clusters.
  managedCluster: true

  # ----------------------------------------------------------------------------
  # Container registry configuration - Update with your ECR or private registry details
  # ----------------------------------------------------------------------------
  ecr:
    ECR_URI: "proxy.chef360.chef.io/proxy/chef-360/448877188565.dkr.ecr.us-east-2.amazonaws.com/beta-development"
  docker:
    DOCKER_BITNAMI_URI: "proxy.chef360.chef.io/proxy/chef-360/448877188565.dkr.ecr.us-east-2.amazonaws.com/beta-development"

  # ---------------------------------------------------------------------------
  # Cluster topology and placement
  # ---------------------------------------------------------------------------
  # Options: hyperconverged-ha, hyperconverged-nonha, tiered-ha, hyperscaled-ha
  # Type: string | Default: hyperconverged-ha
  topology: hyperconverged-nonha
  # haMode is derived automatically from topology: true for all HA topologies, false for hyperconverged-nonha (default: true).
  # haMode: ""

  # ---------------------------------------------------------------------------
  # External storage and search backends
  # ---------------------------------------------------------------------------
  # Default storage class for EKS. Override if using a different storage class.
  storageClass: <STORAGE_CLASS>
  external:
    s3_config:
      enabled: false
      endpoint:
      access_key:
      secret_key:
      region:
    opensearch_config:
      enabled: false
      hostname:
      port: 443
      username:
      password:
      protocol: https
      sslVerify: true
      rootCA:

  # ---------------------------------------------------------------------------
  # Log storage configuration
  # ---------------------------------------------------------------------------
  log_storage:
    enable_general_logs: true
    enable_audit_logs: true
    s3:
      logging_buckets:
        general_logs:
        audit_logs:
        auto_create:
    minio:
      retention:
        general_logs:
        audit_logs:

  # ---------------------------------------------------------------------------
  # Primary tenant and SMTP integration
  # ---------------------------------------------------------------------------
  tenants:
    - tenant:
      # Public DNS of your cluster endpoint or load balancer.
      fqdn: <FQDN>:31000
      # Unique identifier for the tenant, used in URLs and configs.
      slug: <TENANT_SLUG>
      # Display name for the tenant.
      name: <ORGANIZATION_NAME>
      # Set to true if using HTTPS.
      is_https: false
      enabled: true
      # Set to true to skip TLS verification. Not recommended for production.
      insecure: true
      notification_integration_name: Default-SMTP
      notification_integration_username: <SMTP_USERNAME>
      notification_integration_password: <SMTP_PASSWORD>
      notification_integration_senderemail: <SENDER_EMAIL>
      notification_integration_rootca:
      notification_integration_auth_type: none
      notification_integration_ssl_enable: false
      notification_integration_skip_validation: false
      notification_integration_smtp_host: mailpit
      notification_integration_smtp_port: 1025
      notification_integration_retry_enable: true
      notification_integration_no_of_retries: 2
      tenant_admin_email: <ADMIN_EMAIL>
      tenant_admin_first_name: <FIRST_NAME>
      tenant_admin_last_name: <LAST_NAME>
      ou_name: <ORGANIZATION_NAME>
      ou_description: ""
      create_default_skill_assembly: true
      license_base64: "<CHEF_360_PLATFORM_LICENSE>"

  log_level: info
  chef_habitat:
    # Set to true to enable on-premises Chef Habitat installation.
    enabled: false
  # dsm-configuration:
  #   dsm-erchef:
  #     OPSCODE_ERCHEF_S3_BUCKET: bookshelf

chef-platform:
  # ---------------------------------------------------------------------------
  # TLS certificates (common cert-manager integration)
  # ---------------------------------------------------------------------------
  # Set these values if nginx-reverse-proxy.isSecure and tenants[*].is_https are both true
  # and you want to use system-generated certs. Ignore if using custom certs or if isSecure is false.
  common-cert-manager:
    openSSL:
      commonName:
    isSecure:
    userCrt:
    userKey:
    userCrtSource:
    # Root CA certificate (optional, required only for private CA for TLS)
    # userRootCa: "<USER_ROOT_CA>"
    altNames:

  # ---------------------------------------------------------------------------
  # Gateway and API configuration
  # ---------------------------------------------------------------------------
  chef-services:
    courier-server:
      state:
        bodyLimit:
    node-management-server:
      agent_node_checkin_interval_min:
      agent_node_checkin_interval_max:
    platform-services:
      internal-api-gateway:
        install_admin_token:
        cache_config:
          enabled:
        public_key_for_signer:
        private_key_for_signer:
        public_key_expires_at:
      mailpit:
        service:
          http:
            nodePort:
          smtp:
            nodePort:
      nginx-reverse-proxy:
        directAccessEnabled:
        directAccessPort:
        isSecure:
        bodyLimit:
        service:
          nodePort:
      public-api-gateway:
        is_onprem: true

  # ---------------------------------------------------------------------------
  # Metrics Server configuration
  # ---------------------------------------------------------------------------
  metrics-server:
    # Set to true to install Metrics Server for HPA support.
    enabled: true

kots:
  configuration:
    eula:
      # Set to true to accept the EULA. Required for installation to proceed.
      accepted: true

preflightConfig:
  # Set to true to enforce strict preflight checks. Set to false to allow installation to proceed with warnings.
  strict: true
