# Default values for kube-apiserver.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 3

issuer: ca-issuer

# Kubernetes Cluster Domain
clusterDomain: cluster.local

cert:
  duration: 87600h # 10yrs
  renewBefore: 720h # 30d
  extralDnsNames: [] # extra "dnsNames" for kube-apiserver cert
  extralIpAddresses: [] # extra "ipAddresses" for kube-apiserver cert

images:
  # images of kube-apiserver and kube-controller-manager are distroless (ref: https://github.com/GoogleContainerTools/distroless),
  # then we can't use shell in their containers,
  # so we need another init container to generate some dynamic files with shell supported.
  init:
    registry: docker.io
    repository: busybox
    tag: 1.33.1
    pullPolicy: IfNotPresent
  apiServer:
    registry: k8s.gcr.io
    tag: v1.21.1
    pullPolicy: IfNotPresent

etcd:
  endpoints: https://etcd:2379
  secretNames:
    ca: etcd-ca
    client: etcd-client

apiServer:
  # the URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT),
  # like "https://accounts.google.com"
  oidcIssuerURL: ""
  # the client ID for the OpenID Connect client, must be set if "oidcIssuerURL" is set,
  # something like "***.apps.googleusercontent.com"
  oidcClientID: ""
  # created this secret manually if needed later
  oidcCaSecretName: ""

# values for livenessProbe and readinessProbe.
probe:
  # This token can be generated with "tr -dc A-Za-z0-9 </dev/urandom | head -c 32"
  # NOTE: we can't use dynamic environment variables for livenessProbe/readinessProbe (ref: https://github.com/kubernetes/kubernetes/issues/40846)
  # so we need to pass the token in from this Helm chart.
  # this token will be bound to "system:unauthenticated" group, so no need to worry about the leak of it.
  token: ""
  user: probe
  uid: 10001

resources:
  kubeApiserver: {}
  kubeControllerManager: {}
  kube-controller-manager: {}