- templateId: k8s-infra-template-v1 # template version string
  default: true
  supportedVersions:
    - "1.34"
    - "1.34.3-aliyun.1"
    - "1.34.1-aliyun.1"
    - "1.36.2-aliyun.1"
  kubeStateMetrics:
    chartPath: /etc/helm/kube-state-metrics/kube-state-metrics-6.1.4.tgz
    releaseName: kube-state-metrics
    namespace: monitoring
    helmValues:
      image:
        registry: registry.k8s.io
        repository: kube-state-metrics/kube-state-metrics
        tag: v2.16.0
      resources:
        limits:
          cpu: 200m
          memory: 500Mi
        requests:
          cpu: 100m
          memory: 250Mi
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
      extraArgs:
        - "--metric-labels-allowlist=nodes=[*],pods=[*]" # Add node and pod labels to metrics labels.
  nodeLocalDNS:
    chartPath: /etc/helm/node-local-dns/node-local-dns-2.1.0.tgz
    namespace: kube-system
    releaseName: node-local-dns
    helmValues:
      nameOverride: node-local-dns
      dnsDomain: "cluster.local"
      dnsServer: "10.100.0.10"
      config:
        bindIp: true
      image:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/dns/k8s-dns-node-cache
        tag: 1.26.5
      resources:
        requests:
          cpu: 25m
          memory: 32Mi
        limits:
          memory: 128Mi
  nodeExporter:
    chartPath: /etc/helm/prometheus-node-exporter/prometheus-node-exporter-4.47.3.tgz
    releaseName: node-exporter
    namespace: monitoring
    helmValues:
      nameOverride: node-exporter
      image:
        registry: quay.io
        repository: prometheus/node-exporter
        tag: v1.11.1
      resources:
        limits:
          cpu: 150m
          memory: 400Mi
        requests:
          cpu: 10m
          memory: 200Mi
  eventExporter:
    chartPath: /etc/helm/kubernetes-event-exporter/kubernetes-event-exporter-3.6.2.tgz
    releaseName: event-exporter
    namespace: monitoring
    helmValues:
      nameOverride: event-exporter # keep the old name
      global:
        security:
          # bitnami helm chart checks if the image from their registry
          # Non-Bitnami registry image is considered insecure
          # we are using images in our registry, so must allowInsecureImages
          allowInsecureImages: true
      image:
        registry: ghcr.io
        repository: resmoio/kubernetes-event-exporter
        tag: "v1.7"
      resources:
        limits:
          cpu: 200m
          memory: 400Mi
        requests:
          cpu: 50m
          memory: 100Mi
  certManager:
    chartPath: /etc/helm/cert-manager/cert-manager-v1.18.2.tgz
    namespace: cert-manager
    releaseName: cert-manager
    helmValues:
      nameOverride: cert-manager
      crds:
        enabled: true
      image:
        repository: quay.io/jetstack/cert-manager-controller
        tag: v1.18.2
      resources:
        limits:
          cpu: 500m
          memory: 1024Mi
        requests:
          cpu: 50m
          memory: 64Mi
      extraArgs:
        - "--issuer-ambient-credentials"
      featureGates: "StableCertificateRequestName=true"
      webhook:
        image:
          repository: quay.io/jetstack/cert-manager-webhook
          tag: v1.18.2
        securityContext:
          fsGroup: 2000
        containerSecurityContext:
          runAsGroup: 2000
          runAsUser: 1000
          runAsNonRoot: true
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
              - NET_RAW
      cainjector:
        image:
          repository: quay.io/jetstack/cert-manager-cainjector
          tag: v1.18.2
        securityContext:
          fsGroup: 2000
        containerSecurityContext:
          runAsGroup: 2000
          runAsUser: 1000
          runAsNonRoot: true
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
              - NET_RAW
      startupapicheck:
        enabled: false
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  pcaIssuer:
    chartPath: /etc/helm/aws-privateca-issuer/aws-privateca-issuer-v1.7.0.tgz
    namespace: cert-manager
    releaseName: aws-pca-issuer
    helmValues:
      nameOverride: aws-pca-issuer
      image:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
        tag: v1.7.0
      env:
        AWS_REGION: us-east-1
        AWS_ROLE_ARN: ""
        AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token
      serviceAccount:
        create: true
        name: aws-pca-issuer
      resources:
        limits:
          cpu: 500m
          memory: 128Mi
        requests:
          cpu: 50m
          memory: 64Mi
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  localVolumeProvisioner:
    chartPath: /etc/helm/local-path-provisioner
    releaseName: local-path-provisioner
    namespace: kube-system
    helmValues:
      nameOverride: local-path-provisioner
      image:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/rancher/local-path-provisioner
        tag: v0.0.32
      helperImage:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/busybox
        tag: 1.34.1
      nodePathMap:
        - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
          paths:
            - /mnt/fast-disks
      storageClass:
        create: true
        name: local-ssd
      configmap:
        helperPod:
          tolerations:
            - key: "has-local-disk"
              operator: "Equal"
              value: "true"
              effect: "NoSchedule"
            - key: "dedicated"
              operator: "Equal"
              value: "worker"
              effect: "NoSchedule"
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  goldpinger:
    chartPath: /etc/helm/goldpinger
    releaseName: goldpinger
    namespace: monitoring
    helmValues:
      image:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/bloomberg/goldpinger
        tag: 3.10.3
      tolerations:
      - effect: NoSchedule
        operator: Exists
  nodePinger:
    chartPath: /etc/helm/node-pinger
    releaseName: node-pinger
    namespace: monitoring
    helmValues:
      image:
        repository: tidbcloud-dev-registry.ap-southeast-1.cr.aliyuncs.com/third-party/tennix/node-pinger
        tag: v0.1.2
      tolerations:
      - effect: NoSchedule
        operator: Exists