- templateId: k8s-infra-template-v1 # template version string
  default: true
  supportedVersions:
    - "1.35"
    - "1.36"
    - "1.33"
    - "1.34"
  clusterAutoscaler:
    chartPath: /etc/helm/cluster-autoscaler/cluster-autoscaler-9.50.1.tgz
    releaseName: cluster-autoscaler
    namespace: kube-system
    helmValues:
      nameOverride: cluster-autoscaler
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/autoscaling/cluster-autoscaler
        tag: "v1.33.0"
      cloudProvider: aws
      extraArgs:
        expander: least-waste
        skip-nodes-with-local-storage: false
        skip-nodes-with-system-pods: false
        scale-down-utilization-threshold: 0.4
        balance-similar-node-groups: true
        feature-gates: "VolumeAttributesClass=true"
      resources:
        limits:
          cpu: 400m
          memory: 300Mi
        requests:
          cpu: 100m
          memory: 300Mi
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  kubeStateMetrics:
    chartPath: /etc/helm/kube-state-metrics/kube-state-metrics-6.1.4.tgz
    releaseName: kube-state-metrics
    namespace: monitoring
    helmValues:
      image:
        registry: 577523860935.dkr.ecr.eu-central-1.amazonaws.com
        repository: third-party/kube-state-metrics/kube-state-metrics
        tag: v2.16.0
      resources:
        limits:
          cpu: 200m
          memory: 500Mi
        requests:
          cpu: 100m
          memory: 250Mi
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
      extraArgs:
        - "--metric-labels-allowlist=nodes=[*],pods=[*]" # Add node and pod labels to metrics labels.
  nodeExporter:
    chartPath: /etc/helm/prometheus-node-exporter/prometheus-node-exporter-4.47.3.tgz
    releaseName: node-exporter
    namespace: monitoring
    helmValues:
      nameOverride: node-exporter
      image:
        registry: 577523860935.dkr.ecr.eu-central-1.amazonaws.com
        repository: third-party/prometheus/node-exporter
        tag: v1.9.1
      resources:
        limits:
          cpu: 150m
          memory: 400Mi
        requests:
          cpu: 100m
          memory: 200Mi
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  localVolumeProvisioner:
    chartPath: /etc/helm/local-path-provisioner
    releaseName: local-path-provisioner
    namespace: kube-system
    helmValues:
      nameOverride: local-path-provisioner
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/rancher/local-path-provisioner
        tag: v0.0.32
      helperImage:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/busybox
        tag: 1.34.1
      nodePathMap:
        - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
          paths:
            - /mnt/fast-disks
      storageClass:
        create: true
        name: local-ssd
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsUser: 1000
        runAsGroup: 2000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  eventExporter:
    chartPath: /etc/helm/kubernetes-event-exporter/kubernetes-event-exporter-3.6.2.tgz
    releaseName: event-exporter
    namespace: monitoring
    helmValues:
      nameOverride: event-exporter # keep the old name
      global:
        security:
          # bitnami helm chart checks if the image from their registry
          # Non-Bitnami registry image is considered insecure
          # we are using images in our registry, so must allowInsecureImages
          allowInsecureImages: true
      image:
        registry: 577523860935.dkr.ecr.eu-central-1.amazonaws.com
        repository: third-party/resmoio/kubernetes-event-exporter
        tag: "v1.7"
      resources:
        limits:
          cpu: 200m
          memory: 400Mi
        requests:
          cpu: 50m
          memory: 100Mi
      podSecurityContext:
        enabled: true
      containerSecurityContext:
        enabled: true
  kubeletVolumeStatsExporter:
    chartPath: /etc/helm/kubelet-volume-stats-exporter
    releaseName: kubelet-volume-stats-exporter
    namespace: monitoring
    helmValues:
      nameOverride: kubelet-volume-stats-exporter
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/vbeaucha/kubelet-volume-stats-exporter
        tag: v1.0.0
      config:
        metricsPort: 8081
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: tidbcloud.com/component
                    operator: NotIn
                    values:
                      - shared
  certManager:
    chartPath: /etc/helm/cert-manager/cert-manager-v1.18.2.tgz
    namespace: cert-manager
    releaseName: cert-manager
    helmValues:
      nameOverride: cert-manager
      crds:
        enabled: true
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/jetstack/cert-manager-controller
        tag: v1.18.2
      resources:
        limits:
          cpu: 500m
          memory: 1024Mi
        requests:
          cpu: 50m
          memory: 64Mi
      extraArgs:
        - "--issuer-ambient-credentials"
      featureGates: "StableCertificateRequestName=true"
      webhook:
        image:
          repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/jetstack/cert-manager-webhook
          tag: v1.18.2
        securityContext:
          fsGroup: 2000
        containerSecurityContext:
          runAsGroup: 2000
          runAsUser: 1000
          runAsNonRoot: true
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
              - NET_RAW
      cainjector:
        image:
          repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/jetstack/cert-manager-cainjector
          tag: v1.18.2
        securityContext:
          fsGroup: 2000
        containerSecurityContext:
          runAsGroup: 2000
          runAsUser: 1000
          runAsNonRoot: true
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
              - NET_RAW
      startupapicheck:
        enabled: false
      securityContext:
        fsGroup: 2000
      containerSecurityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  pcaIssuer:
    chartPath: /etc/helm/aws-privateca-issuer/aws-privateca-issuer-v1.6.0.tgz
    crdPaths:
      - /etc/helm/pca-issuer/aws-pca-issuer-crd.yaml
      - /etc/helm/pca-issuer/aws-pca-clusterissuer-crd.yaml
    namespace: cert-manager
    releaseName: aws-pca-issuer
    helmValues:
      nameOverride: aws-pca-issuer
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/k1n1h4h4/cert-manager-aws-privateca-issuer
        tag: v1.6.0
      serviceAccount:
        create: true
      resources:
        limits:
          cpu: 500m
          memory: 128Mi
        requests:
          cpu: 50m
          memory: 64Mi
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  awsLoadBalancerController:
    chartPath: /etc/helm/aws-load-balancer-controller/aws-load-balancer-controller-1.13.4.tgz
    namespace: kube-system
    releaseName: aws-load-balancer-controller
    helmValues:
      nameOverride: aws-load-balancer-controller
      enableCertManager: true
      enablePodReadinessGateInject: true
      targetgroupbindingMaxExponentialBackoffDelay: 60s
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/amazon/aws-load-balancer-controller
        tag: v2.13.4
      resources:
        limits:
          cpu: 500m
          memory: 128Mi
        requests:
          cpu: 50m
          memory: 64Mi
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  nodeLocalDNS:
    chartPath: /etc/helm/node-local-dns/node-local-dns-2.1.0.tgz
    namespace: kube-system
    releaseName: node-local-dns
    helmValues:
      nameOverride: node-local-dns
      dnsDomain: "cluster.local"
      dnsServer: "10.100.0.10"
      config:
        bindIp: true
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/dns/k8s-dns-node-cache
        tag: 1.23.1
      resources:
        requests:
          cpu: 25m
          memory: 32Mi
        limits:
          memory: 128Mi
  metricsServer:
    chartPath: /etc/helm/metrics-server/metrics-server-3.13.0.tgz
    releaseName: metrics-server
    namespace: kube-system
    helmValues:
      nameOverride: metrics-server
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/metrics-server/metrics-server
        tag: v0.8.0
      resources:
        limits:
          cpu: 200m
          memory: 500Mi
        requests:
          cpu: 100m
          memory: 250Mi
      podSecurityContext:
        fsGroup: 2000
      securityContext:
        runAsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        privileged: false
        capabilities:
          drop:
            - NET_RAW
  nodePinger:
    chartPath: /etc/helm/node-pinger
    releaseName: node-pinger
    namespace: monitoring
    helmValues:
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/third-party/tennix/node-pinger
        tag: v0.1.2
      tolerations:
      - effect: NoSchedule
        operator: Exists
  dataplaneExporter:
    chartPath: /etc/helm/dataplane-exporter
    releaseName: dataplane-exporter
    namespace: tidb-admin
    helmValues:
      image:
        repository: 577523860935.dkr.ecr.eu-central-1.amazonaws.com/tidbcloud/dataplane-exporter
        tag: v0.1.0
      service:
        type: ClusterIP
        port: 8080
      rbac:
        create: true
      containerPort: 8080
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 500m
          memory: 256Mi
      args:
        metricsPath: "/metrics"
        healthPath: "/healthz"