# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

dependency_versions: (( &temporary( read( __ctx.DIR "/dependency-versions.yaml", "yaml" ) ) ))
meta: (( ~~ ))
landscape:
  name: (( error("landscape name required") ))
  domain:
  ingressSourceRanges:
  namespace: garden
  cluster:
    kubeconfig: ./kubeconfig
    networks: ~
  clusters: (( valid(landscape.cluster.networks) ? [ landscape.cluster ] :error("no cluster networks definition found") ))
  components: []
  versions:
    kube-apiserver:
      <<: (( merge ))
      image_repo: registry.k8s.io/hyperkube
      image_tag: v1.15.10
      resources:
        requests:
          cpu: 500m
          memory: 512Mi
        limits:
          cpu: 2000m
          memory: 1024Mi
    etcd:
      etcd:
        <<: (( merge ))
        image_repo: gcr.io/pingcap-public/coreos/etcd
        image_tag: "v3.3.13"
        resources:
          requests:
            cpu: 1000m
            memory: 4Gi
          limits:
            cpu: 4000m
            memory: 12Gi
      backup_restore:
        <<: (( merge ))
        image_repo: eu.gcr.io/gardener-project/gardener/etcdbrctl
        image_tag: "v0.9.0"
        resources:
          # we can over-commit br resources since when br is restoring it consumes much more but the main etcd
          # container is idle (thus the sidecar can safely over-claim)
          requests:
            cpu: 200m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 6Gi
    gardener:
      <<: (( merge ))
      repo: "https://github.com/pingcap/gardener.git"
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.gardener.core.version ))
      apiserver:
        <<: (( merge ))
        image_repo: "gcr.io/pingcap-public/gardener/apiserver"
        image_tag: (( valid( tag ) ? tag :~~ ))
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
          limits:
            cpu: 500m
            memory: 2048Mi
      controller_manager:
        <<: (( merge ))
        image_repo: "gcr.io/pingcap-public/gardener/controller-manager"
        image_tag: (( valid( tag ) ? tag :~~ ))
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 512Mi
      scheduler:
        <<: (( merge ))
        image_repo: "gcr.io/pingcap-public/gardener/scheduler"
        image_tag: (( valid( tag ) ? tag :~~ ))
        resources:
          requests:
            cpu: 200m
            memory: 400Mi
          limits:
            cpu: 200m
            memory: 400Mi
      gardenlet:
        <<: (( merge ))
        image_repo: "gcr.io/pingcap-public/gardener/gardenlet"
        image_tag: (( valid( tag ) ? tag :~~ ))
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 1024Mi
        imageVectorOverwrite: |
          images:
          # Gardener components
          - name: gardenlet
            sourceRepository: github.com/gardener/gardener
            repository: gcr.io/pingcap-public/gardener/gardenlet
          - name: gardener-seed-admission-controller
            sourceRepository: github.com/gardener/gardener
            repository: gcr.io/pingcap-public/gardener/seed-admission-controller
          # Seed bootstrap
          - name: pause-container
            sourceRepository: github.com/kubernetes/kubernetes/blob/master/build/pause/Dockerfile
            repository: registry.k8s.io/pause
            tag: "3.1"
          - name: etcd-druid
            sourceRepository: github.com/tidbcloud/etcd-druid
            repository: gcr.io/pingcap-public/gardener/etcd-druid
            tag: "v0.2.3"
          - name: gardener-resource-manager
            sourceRepository: github.com/tidbcloud/gardener-resource-manager
            repository: gcr.io/pingcap-public/gardener/gardener-resource-manager
            tag: "v0.12.0-pingcap.1"
          - name: dependency-watchdog
            sourceRepository: github.com/gardener/dependency-watchdog
            repository: eu.gcr.io/gardener-project/gardener/dependency-watchdog
            tag: "0.4.0"
          # Seed controlplane
          - name: hyperkube # used for kubectl + kubelet binaries on the worker nodes
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/hyperkube
          - name: kube-apiserver
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/hyperkube
            targetVersion: "< 1.17"
          - name: kube-apiserver
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/kube-apiserver
            targetVersion: ">= 1.17"
          - name: kube-controller-manager
            sourceRepository: github.com/kubernetes/kubernetes
            repository: gcr.io/pingcap-public/k8s/hyperkube
            tag: "v1.16.17"
            targetVersion: "< 1.17"
          - name: kube-controller-manager
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/kube-controller-manager
            targetVersion: ">= 1.17"
          - name: kube-scheduler
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/hyperkube
            targetVersion: "< 1.17"
          - name: kube-scheduler
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/kube-scheduler
            targetVersion: ">= 1.17"
          - name: kube-proxy
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/hyperkube
            targetVersion: "< 1.17"
          - name: kube-proxy
            sourceRepository: github.com/kubernetes/kubernetes
            repository: registry.k8s.io/kube-proxy
            targetVersion: ">= 1.17"
          - name: cluster-autoscaler
            sourceRepository: github.com/gardener/autoscaler
            repository: eu.gcr.io/gardener-project/gardener/autoscaler/cluster-autoscaler
            tag: "0.9.0"
          - name: vpn-seed
            sourceRepository: github.com/gardener/vpn
            repository: eu.gcr.io/gardener-project/gardener/vpn-seed
            tag: "0.19.0"
          # Monitoring
          - name: alertmanager
            sourceRepository: github.com/prometheus/alertmanager
            repository: gcr.io/pingcap-public/prometheus/alertmanager
            tag: v0.18.0
          - name: prometheus
            sourceRepository: github.com/prometheus/prometheus
            repository: gcr.io/pingcap-public/prometheus/prometheus
            tag: v2.25.2
          - name: configmap-reloader
            sourceRepository: github.com/jimmidyson/configmap-reload
            repository: gcr.io/pingcap-public/coreos/configmap-reload
            tag: v0.0.1
          - name: kube-state-metrics
            sourceRepository: github.com/kubernetes/kube-state-metrics
            repository: gcr.io/pingcap-public/coreos/kube-state-metrics
            tag: v1.9.5
          - name: node-exporter
            sourceRepository: github.com/prometheus/node_exporter
            repository: gcr.io/pingcap-public/prometheus/node-exporter
            tag: v0.18.1
          - name: grafana
            sourceRepository: github.com/grafana/grafana
            repository: grafana/grafana
            tag: "6.3.2"
          - name: blackbox-exporter
            sourceRepository: github.com/prometheus/blackbox_exporter
            repository: gcr.io/pingcap-public/prometheus/blackbox-exporter
            tag: v0.14.0
          - name: metrics-server
            sourceRepository: github.com/kubernetes-incubator/metrics-server
            repository: registry.k8s.io/metrics-server-amd64
            tag: v0.3.6
            targetVersion: ">= 1.11"
          - name: metrics-server
            sourceRepository: github.com/kubernetes-incubator/metrics-server
            repository: registry.k8s.io/metrics-server-amd64
            tag: v0.3.1
            targetVersion: 1.10.x
          # Shoot core addons
          - name: vpn-shoot
            sourceRepository: github.com/gardener/vpn
            repository: eu.gcr.io/gardener-project/gardener/vpn-shoot
            tag: "0.19.0"
          - name: coredns
            sourceRepository: github.com/coredns/coredns
            repository: gcr.io/pingcap-public/coredns
            tag: "1.8.3"
          - name: node-problem-detector
            sourceRepository: github.com/kubernetes/node-problem-detector
            repository: gcr.io/pingcap-public/node-problem-detector
            tag: "v0.8.10-multiarch"
          # Miscellaenous
          - name: busybox
            sourceRepository: github.com/mirror/busybox
            repository: busybox
            tag: "1.29.2"
          - name: alpine
            repository: alpine
            tag: "3.10.3"
          - name: alpine-iptables
            sourceRepository: github.com/DockToFuture/alpine-iptables
            repository: eu.gcr.io/gardener-project/alpine-iptables
            tag: "3.10.3"
          # VPA
          - name: vpa-admission-controller
            sourceRepository: github.com/kubernetes/autoscaler
            repository: us.gcr.io/k8s-artifacts-prod/autoscaling/vpa-admission-controller
            tag: "0.9.2"
          - name: vpa-recommender
            sourceRepository: github.com/kubernetes/autoscaler
            repository: us.gcr.io/k8s-artifacts-prod/autoscaling/vpa-recommender
            tag: "0.9.2"
          - name: vpa-updater
            sourceRepository: github.com/kubernetes/autoscaler
            repository: us.gcr.io/k8s-artifacts-prod/autoscaling/vpa-updater
            tag: "0.9.2"
          - name: vpa-exporter
            sourceRepository: github.com/gardener/vpa-exporter
            repository: eu.gcr.io/gardener-project/gardener/vpa-exporter
            tag: "0.1.5"
      extensions:
        dns-external:
          <<: (( merge ))
          tag: (( valid( dns-external.branch ) -or valid( dns-external.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.dns-external.version ))
          image_tag: (( valid( dns-external.tag ) ? dns-external.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/dns-controller-manager
          repo: (( .dependency_versions.versions.gardener.extensions.dns-external.repo ))
          chart_path: charts/external-dns-management
          resources:
            requests:
              cpu: 150m
              memory: 512Mi
            limits:
              cpu: 300m
              memory: 512Mi
          createCRDs: false
          configuration:
            kubeconfigDisableDeployCrds: true
        os-ubuntu:
          <<: (( merge ))
          tag: (( valid( os-ubuntu.branch ) -or valid( os-ubuntu.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.os-ubuntu.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-ubuntu.repo ))
          chart_path: charts/gardener-extension-os-ubuntu
          image_tag: (( valid( os-ubuntu.tag ) ? os-ubuntu.tag :~~ ))
          image_repo: (( ~~ ))
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
        provider-aws:
          <<: (( merge ))
          tag: (( valid( provider-aws.branch ) -or valid( provider-aws.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-aws.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-aws.repo ))
          chart_path: charts/gardener-extension-provider-aws
          image_tag: (( valid( provider-aws.tag ) ? provider-aws.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/provider-aws
          resources:
            limits:
              cpu: 1000m
              memory: 1024Mi
            requests:
              cpu: 250m
              memory: 1024Mi
            vpa:
              enabled: false
          overrideHelmValues:
            <<: (( merge ))
            kind: HelmValues
            cloud-controller-manager:
              <<: (( merge ))
              resources:
                requests:
                  cpu: 100m
                  memory: 2Gi
                limits:
                  cpu: 800m
                  memory: 3Gi
            machine-controller-manager:
              <<: (( merge ))
              resources:
                requests:
                  cpu: 150m
                  memory: 200Mi
                limits:
                  cpu: 1000m
                  memory: 300Mi
            csi-driver-controller:
              <<: (( merge ))
              resources:
                driver:
                  requests:
                    cpu: 20m
                    memory: 50Mi
                  limits:
                    cpu: 500m
                    memory: 800Mi
                provisioner:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                attacher:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                snapshotter:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                resizer:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
          imageVectorOverwrite: |
            images:
            - name: terraformer
              sourceRepository: github.com/gardener/terraformer
              repository: eu.gcr.io/gardener-project/gardener/terraformer
              tag: "v1.5.0"
            - name: cloud-controller-manager
              sourceRepository: github.com/tidbcloud/kubernetes
              repository: gcr.io/pingcap-public/k8s/hyperkube
              tag: "v1.16.17"
              targetVersion: "< 1.17"
            - name: cloud-controller-manager
              sourceRepository: github.com/gardener/cloud-provider-aws
              repository: eu.gcr.io/gardener-project/kubernetes/cloud-provider-aws
              tag: "v1.17.4"
              targetVersion: "1.17.x"
            - name: cloud-controller-manager
              sourceRepository: github.com/gardener/cloud-provider-aws
              repository: gcr.io/pingcap-public/kubernetes/cloud-provider-aws
              tag: "v1.18.0"
              targetVersion: ">= 1.18"
            - name: machine-controller-manager
              sourceRepository: github.com/pingcap/machine-controller-manager
              repository: gcr.io/pingcap-public/gardener/machine-controller-manager
              tag: "v0.29.0-dev.11"
            - name: aws-lb-readvertiser
              sourceRepository: github.com/gardener/aws-lb-readvertiser
              repository: eu.gcr.io/gardener-project/gardener/aws-lb-readvertiser
              tag: "0.6.0"
            - name: csi-driver
              sourceRepository: github.com/kubernetes-sigs/aws-ebs-csi-driver
              repository: gcr.io/pingcap-public/k8scsi/aws-ebs-csi-driver
              tag: "v0.9.1-amazonlinux"
            - name: csi-provisioner
              sourceRepository: github.com/kubernetes-csi/external-provisioner
              repository: gcr.io/pingcap-public/k8scsi/csi-provisioner
              tag: "v2.0.2"
            - name: csi-attacher
              sourceRepository: github.com/kubernetes-csi/external-attacher
              repository: gcr.io/pingcap-public/k8scsi/csi-attacher
              tag: "v3.0.0"
            - name: csi-snapshotter
              sourceRepository: github.com/kubernetes-csi/external-snapshotter
              repository: gcr.io/pingcap-public/k8scsi/csi-snapshotter
              tag: "v3.0.3"
            - name: csi-resizer
              sourceRepository: github.com/kubernetes-csi/external-resizer
              repository: gcr.io/pingcap-public/k8scsi/csi-resizer
              tag: "v1.0.0"
            - name: csi-snapshot-controller
              sourceRepository: github.com/kubernetes-csi/external-snapshotter
              repository: gcr.io/pingcap-public/k8scsi/snapshot-controller
              tag: "v3.0.3"
            - name: csi-node-driver-registrar
              sourceRepository: github.com/kubernetes-csi/node-driver-registrar
              repository: gcr.io/pingcap-public/k8scsi/csi-node-driver-registrar
              tag: "v2.0.1"
            - name: csi-liveness-probe
              sourceRepository: github.com/kubernetes-csi/livenessprobe
              repository: gcr.io/pingcap-public/k8scsi/livenessprobe
              tag: "v2.1.0"
        provider-gcp:
          <<: (( merge ))
          tag: (( valid( provider-gcp.branch ) -or valid( provider-gcp.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-gcp.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.provider-gcp.repo ))
          chart_path: charts/gardener-extension-provider-gcp
          image_tag: (( valid( provider-gcp.tag ) ? provider-gcp.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/provider-gcp
          resources:
            limits:
              memory: 1Gi
          overrideHelmValues:
            <<: (( merge ))
            kind: HelmValues
            cloud-controller-manager:
              resources:
                requests:
                  cpu: 25m
                  memory: 50Mi
                limits:
                  cpu: 100m
                  memory: 75Mi
            machine-controller-manager:
              resources:
                requests:
                  cpu: 150m
                  memory: 200Mi
                limits:
                  cpu: 1000m
                  memory: 300Mi
            csi-driver-controller:
              <<: (( merge ))
              resources:
                driver:
                  requests:
                    cpu: 20m
                    memory: 50Mi
                  limits:
                    cpu: 500m
                    memory: 800Mi
                provisioner:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                attacher:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                snapshotter:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
                resizer:
                  requests:
                    cpu: 10m
                    memory: 32Mi
                  limits:
                    cpu: 300m
                    memory: 500Mi
          imageVectorOverwrite: |
            images:
            - name: terraformer
              sourceRepository: github.com/gardener/terraformer
              repository: eu.gcr.io/gardener-project/gardener/terraformer
              tag: "v1.0.0"
            - name: cloud-controller-manager
              sourceRepository: github.com/tidbcloud/kubernetes
              repository: gcr.io/pingcap-public/k8s/hyperkube
              tag: "v1.16.17"
              targetVersion: "< 1.17"
            - name: cloud-controller-manager
              sourceRepository: github.com/gardener/cloud-provider-gcp
              repository: eu.gcr.io/gardener-project/kubernetes/cloud-provider-gcp
              tag: "v1.17.4"
              targetVersion: ">= 1.17"
            - name: machine-controller-manager
              sourceRepository: github.com/pingcap/machine-controller-manager
              repository: gcr.io/pingcap-public/gardener/machine-controller-manager
              tag: "v0.29.0-dev.11"
            - name: csi-driver
              sourceRepository: github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver
              repository: gcr.io/gke-release/gcp-compute-persistent-disk-csi-driver
              tag: "v0.7.0-gke.0"
            - name: csi-provisioner
              sourceRepository: github.com/kubernetes-csi/external-provisioner
              repository: gcr.io/pingcap-public/k8scsi/csi-provisioner
              tag: "v1.6.0"
            - name: csi-attacher
              sourceRepository: github.com/kubernetes-csi/external-attacher
              repository: gcr.io/pingcap-public/k8scsi/csi-attacher
              tag: "v2.2.0"
            - name: csi-snapshotter
              sourceRepository: github.com/kubernetes-csi/external-snapshotter
              repository: gcr.io/pingcap-public/k8scsi/csi-snapshotter
              tag: "v2.1.1"
            - name: csi-resizer
              sourceRepository: github.com/kubernetes-csi/external-resizer
              repository: gcr.io/pingcap-public/k8scsi/csi-resizer
              tag: "v0.5.0"
            - name: csi-snapshot-controller
              sourceRepository: github.com/kubernetes-csi/external-snapshotter
              repository: gcr.io/pingcap-public/k8scsi/snapshot-controller
              tag: "v2.1.1"
            - name: csi-node-driver-registrar
              sourceRepository: github.com/kubernetes-csi/node-driver-registrar
              repository: gcr.io/pingcap-public/k8scsi/csi-node-driver-registrar
              tag: "v2.0.1"
            - name: csi-liveness-probe
              sourceRepository: github.com/kubernetes-csi/livenessprobe
              repository: gcr.io/pingcap-public/k8scsi/livenessprobe
              tag: "v2.1.0"
#        provider-azure:
#          <<: (( merge ))
#          tag: (( valid( provider-azure.branch ) -or valid( provider-azure.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-azure.version ))
#          repo: (( .dependency_versions.versions.gardener.extensions.provider-azure.repo ))
#          chart_path: charts/gardener-extension-provider-azure
#          image_tag: (( valid( provider-azure.tag ) ? provider-azure.tag :~~ ))
#          image_repo: (( ~~ ))
#        provider-openstack:
#          <<: (( merge ))
#          tag: (( valid( provider-openstack.branch ) -or valid( provider-openstack.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.provider-openstack.version ))
#          repo: (( .dependency_versions.versions.gardener.extensions.provider-openstack.repo ))
#          chart_path: charts/gardener-extension-provider-openstack
#          image_tag: (( valid( provider-openstack.tag ) ? provider-openstack.tag :~~ ))
#          image_repo: (( ~~ ))
        networking-calico:
          <<: (( merge ))
          tag: (( valid( networking-calico.branch ) -or valid( networking-calico.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.networking-calico.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.networking-calico.repo ))
          chart_path: charts/gardener-extension-networking-calico
          image_tag: (( valid( networking-calico.tag ) ? networking-calico.tag :~~ ))
          image_repo: (( ~~ ))
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
          imageVectorOverwrite: |
            images:
            - name: calico-node
              sourceRepository: github.com/projectcalico/calico
              repository: gcr.io/pingcap-public/calico/node
              tag: v3.13.1
            - name: calico-cni
              sourceRepository: github.com/projectcalico/cni-plugin
              repository: gcr.io/pingcap-public/calico/cni
              tag: v3.13.1
            - name: calico-typha
              sourceRepository: github.com/projectcalico/typha
              repository: gcr.io/pingcap-public/calico/typha
              tag: v3.13.1
            - name: calico-kube-controllers
              sourceRepository: github.com/projectcalico/kube-controllers
              repository: gcr.io/pingcap-public/calico/kube-controllers
              tag: v3.13.1
            - name: calico-podtodaemon-flex
              sourceRepository: github.com/projectcalico/pod2daemon
              repository: gcr.io/pingcap-public/calico/pod2daemon-flexvol
              tag: v3.13.1
            - name: calico-cpa
              sourceRepository: github.com/kubernetes-incubator/cluster-proportional-autoscaler
              repository: registry.k8s.io/cluster-proportional-autoscaler-amd64
              tag: 1.7.1
            - name: calico-cpva
              sourceRepository: github.com/kubernetes-incubator/cluster-proportional-vertical-autoscaler
              repository: registry.k8s.io/cpvpa-amd64
              tag: v0.8.2
#        shoot-cert-service:
#          <<: (( merge ))
#          tag: (( valid( shoot-cert-service.branch ) -or valid( shoot-cert-service.commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.shoot-cert-service.version ))
#          repo: (( .dependency_versions.versions.gardener.extensions.shoot-cert-service.repo ))
#          chart_path: charts/gardener-extension-shoot-cert-service
#          image_tag: (( valid( shoot-cert-service.tag ) ? shoot-cert-service.tag :~~ ))
#          image_repo: (( ~~ ))
        os-centos:
          <<: (( merge ))
          tag: (( .dependency_versions.versions.gardener.extensions.os-centos.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-centos.repo ))
          chart_path: charts/gardener-extension-os-centos
          image_tag: (( valid( os-centos.tag ) ? os-centos.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/os-centos
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
        os-centos-tidb:
          <<: (( merge ))
          tag: (( .dependency_versions.versions.gardener.extensions.os-centos-tidb.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-centos-tidb.repo ))
          chart_path: charts/gardener-extension-os-centos-tidb
          image_tag: (( valid( os-centos-tidb.tag ) ? os-centos-tidb.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/os-centos-tidb
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
        os-centos-v20210420:
          <<: (( merge ))
          tag: (( .dependency_versions.versions.gardener.extensions.os-centos-v20210420.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-centos-v20210420.repo ))
          chart_path: charts/gardener-extension-os-centos
          image_tag: (( valid( os-centos-v20210420.tag ) ? os-centos-v20210420.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/os-centos
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
        os-centos-tidb-v20210420:
          <<: (( merge ))
          tag: (( .dependency_versions.versions.gardener.extensions.os-centos-tidb-v20210420.version ))
          repo: (( .dependency_versions.versions.gardener.extensions.os-centos-tidb-v20210420.repo ))
          chart_path: charts/gardener-extension-os-centos-tidb
          image_tag: (( valid( os-centos-tidb-v20210420.tag ) ? os-centos-tidb-v20210420.tag :~~ ))
          image_repo: gcr.io/pingcap-public/gardener/extensions/os-centos-tidb
          resources:
            limits:
              cpu: 400m
              memory: 1024Mi
            requests:
              cpu: 100m
              memory: 512Mi
    terminal-controller-manager:
      <<: (( merge ))
      repo: https://github.com/gardener/terminal-controller-manager.git
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: eu.gcr.io/gardener-project/gardener/terminal-controller-manager
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :"v0.8.0" ))
    dns-controller:
      <<: (( merge ))
      tag: (( valid( branch ) -or valid( commit ) ? ~~ :.dependency_versions.versions.gardener.extensions.dns-external.version ))
      image_tag: (( valid( tag ) ? tag :~~ ))
      image_repo: gcr.io/pingcap-public/gardener/dns-controller-manager
      repo: "https://github.com/tidbcloud/external-dns-management.git"
      configuration:
        kubeconfigDisableDeployCrds: true
    cert-manager:
      controller:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :helm_tag )) # only used for CRDs
        repo: "https://github.com/jetstack/cert-manager.git"
        helm_repo: "https://charts.jetstack.io"
        helm_tag: "v1.8.1"
      cert-dns-bridge:
        <<: (( merge ))
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"2.1.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
        repo: "https://github.com/gardener/certificate-dns-bridge.git"
    monitoring:
      prometheus:
        image_repo: gcr.io/pingcap-public/prometheus/prometheus
        image_tag: v2.25.2
        resources:
          limits:
            cpu: 1000m
            memory: 1024Mi
          requests:
            cpu: 1000m
            memory: 1024Mi
      blackbox-exporter:
        image_repo: gcr.io/pingcap-public/prometheus/blackbox-exporter
        image_tag: v0.14.0
      configmap-reload:
        image_repo: gcr.io/pingcap-public/coreos/configmap-reload
        image_tag: v0.0.1
      grafana:
        image_repo: grafana/grafana
        image_tag: "6.3.2"
      gardener-metrics-exporter:
        <<: (( merge ))
        repo: https://github.com/gardener/gardener-metrics-exporter.git
        tag: (( valid( branch ) -or valid( commit ) ? ~~ :"0.9.0" ))
        image_tag: (( valid( tag ) ? tag :~~ ))
        image_repo: (( ~~ ))
  iaas: (( merge none // map[ select[stub()|e|-> ( ! defined( e.mode ) ) -or ( e.mode != "inactive" ) ] |idx,v|-> v { "mode" = v.mode || "seed" } ] ))
  iaas_shooted_seeds: (( merge none // sum[landscape.iaas|[]|s,e|-> ( e.mode == "seed" -or e.mode == "soil" ) -and valid( e.seeds ) ? s map[e.seeds|x|-> x {"seed" = e.name}] :s] ))
  etcd:
    <<: (( merge ))
    backup:
      <<: (( merge ))
      type: (( .backup_type_mapping[iaas[0].type] ))
      region: (( iaas[0].region ))
      credentials: (( iaas[0].credentials ))
  dashboard: (( ~~ ))
  gardener: (( ~~ ))
  monitoring:
    active: false
    username: admin
    password: (( ~~ ))
    hash: (( ~~ ))
  cert-manager:
    <<: (( merge ))
    server: (( merge none // valid( stub() ) ? ( type( stub() ) == "map" ? stub() :{ "url" = stub() } ) :{"url" = "self-signed"} ))
  dns:
    <<: (( merge ))
    type: (( .dns_type_mapping[iaas[0].type] ))
    credentials: (( iaas[0].credentials ))

dns_type_mapping:
  <<: (( &temporary ))
  gcp: google-clouddns
  aws: aws-route53
  azure: azure-dns
  openstack: openstack-designate

backup_type_mapping:
  <<: (( &temporary ))
  gcp: gcs
  aws: s3
  azure: abs
  openstack: swift


######################
##### VALIDATION #####
######################

validation:
  <<: (( &temporary ))

  ### AUXILIARY FUNCTIONS ###
  return_true: (( |x|-> true )) # dummy validator that never fails
  instantiate_validator: (( |values,validator|-> *validator )) # instantiates a validator with given values
  email_regex: "[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*@[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+$" # a simple email regex
  flatten: (( |l|-> sum[l|[]|s,e|-> s e.[*]] )) # flattens a list of lists to a list of elements
  length_validator: (( |x,l|-> [length( x ) <= l, x, "exceeded maximum allowed length (" l "):" " " x] )) # returns true if the length of x is equals or lesser than l

  ### VALIDATOR DEFINITIONS ###
  types:
    iaas:
      gcp:
        credentials:
          - mapfield
          - serviceaccount.json
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        networks:
          - ["mapfield", "workers", ["cidr"]]
      aws:
        credentials:
          - and
          - ["mapfield", "accessKeyID"]
          - ["mapfield", "secretAccessKey"]
        config:
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        networks:
          - ["mapfield", "internal", ["cidr"]]
          - ["mapfield", "public", ["cidr"]]
          - ["mapfield", "vpc", ["or", ["mapfield", "id"], ["mapfield", "cidr", ["cidr"]]]]
      azure:
        credentials:
          - and
          - ["mapfield", "clientID"]
          - ["mapfield", "clientSecret"]
          - ["mapfield", "subscriptionID"]
          - ["mapfield", "tenantID"]
        config:
          - ["mapfield", "region"]
        networks:
          - ["mapfield", "workers", ["cidr"]]
          - ["mapfield", "vnet", ["or", ["mapfield", "name"], ["mapfield", "cidr", ["cidr"]]]]
      openstack:
        credentials:
          - and
          - ["mapfield", "domainName"]
          - ["mapfield", "tenantName"]
          - ["mapfield", "username"]
          - ["mapfield", "password"]
          - ["mapfield", "authURL"]
        config:
          - - mapfield
            - floatingPools
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineImages
            - - list
              - - and
                - ["mapfield", "name"]
                - - mapfield
                  - versions
                  - - list
                    - ["mapfield", "version"]
          - - mapfield
            - loadBalancerProviders
            - - list
              - ["mapfield", "name"]
          - - mapfield
            - machineTypes
            - - list
              - - and
                - ["mapfield", "name"]
                - ["mapfield", "cpu"]
                - ["mapfield", "gpu"]
                - ["mapfield", "memory"]
                - ["mapfield", "usable"]
                - - optionalfield
                  - storage
                  - - and
                    - ["mapfield", "class"]
                    - ["mapfield", "type"]
                    - ["mapfield", "size"]
          - ["optionalfield", "dhcpDomain", "dnsdomain"]
          - ["optionalfield", "keystoneURL", "dnsdomain"]
          - ["optionalfield", "useOctavia", ["type", "bool"]]
          - ["optionalfield", "dnsServers", ["list", ["ip"]]]
          - - or
            - - mapfield
              - cloudprofile
            - - mapfield
              - extensionConfig
              - - mapfield
                - machineImages
                - - list
                  - - and
                    - ["mapfield", "name"]
                    - - mapfield
                      - versions
                      - - list
                        - - and
                          - ["mapfield", "image"]
                          - ["mapfield", "version"]
          - ["mapfield", "region"]
          - ["mapfield", "zones", ["list"]]
        networks:
          - ["mapfield", "workers", ["cidr"]]
    etcd_backup:
      gcs:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      s3:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      abs:
        credentials: (( iaas.azure.credentials ))
        config: ["mapfield", "resourceGroup"]
      swift:
        credentials: (( iaas.openstack.credentials ))
        config: (( return_true ))
    dns:
      google-clouddns:
        credentials: (( iaas.gcp.credentials ))
        config: (( return_true ))
      aws-route53:
        credentials: (( iaas.aws.credentials ))
        config: (( return_true ))
      azure-dns:
        credentials: (( iaas.azure.credentials ))
        config: (( return_true ))
      openstack-designate:
        credentials:
          - <<: (( iaas.openstack.credentials ))
          - ["mapfield", "region"]
        config: (( return_true ))
      cloudflare-dns:
        credentials:
          - mapfield
          - apiToken
        config: (( return_true ))
  iaas_entry_validators:
    basic:
      - <<: (( &template ))
      - and
      - ["mapfield", "name"]
      - ["mapfield", "type", ["valueset", (( keys( types.iaas ) ))]]
      - ["mapfield", "mode", ["valueset", ["seed", "profile", "cloudprofile", "soil"]]]
      - - optionalfield
        - shootDefaultNetworks
        - - and
          - ["mapfield", "pods", ["cidr"]]
          - ["mapfield", "services", ["cidr"]]
      - - optionalfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - <<: (( types.iaas[values.type].config ))
    initial_seed:
      - <<: (( &template ))
      - and
      - ["mapfield", "mode", ["valueset", ["seed", "soil"]]]
      - - mapfield
        - credentials
        - (( types.iaas[values.type].credentials ))
    seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - mapfield
        - cluster
        - - and
          - ["mapfield", "kubeconfig"]
          - - mapfield
            - networks
            - (( validation.networks ))
    cloudprofile: (( &template( return_true ) ))
    shooted_seed:
      - <<: (( &template ))
      - and
      - - mapfield
        - name
        - - (( validation.length_validator ))
          - 10
      - - mapfield
        - mode
        - ["valueset", ["seed", "soil"]]
      - - mapfield
        - credentials
        - (( types.iaas[values.type].credentials ))
      - - mapfield
        - cluster
        - - mapfield
          - networks
          - (( validation.networks types.iaas[values.type].networks ))
  dashboard_validator:
    - and
    - - optionalfield
      - cname
      - - and
        - - mapfield
          - domain
          - - dnsdomain
        - - optionalfield
          - dns
          - - and
            - - mapfield
              - type
              - - valueset
                - (( keys( validation.types.dns ) ))
            - - mapfield
              - credentials
              - (( types.dns[landscape.dashboard.cname.dns.type].credentials || [] ))
    - - optionalfield
      - terminals
      - - and
        - - mapfield
          - active
          - - type
            - bool
        - - optionalfield
          - cert
          - - and
            - - optionalfield
              - email
              - - match
                - (( validation.email_regex ))
            - - optionalfield
              - server
            - - optionalfield
              - privateKey
              - privatekey
  dashboard_no_seed_strategy_validator: (( |db|-> [! defined( db.frontendConfig.seedCandidateDeterminationStrategy ), "valid", "the 'frontendConfig.seedCandidateDeterminationStrategy' value for the dashboard is derived from the Gardener config and cannot be set here - set 'landscape.gardener.seedCandidateDeterminationStrategy' instead"] ))
  dashboard_terminals_validator: (( |db,cm|-> [! (( db.terminals.active || false ) -and ( cm.server.url == "self-signed" -or cm.server.url == "staging" )), "valid", "the 'dashboard terminals' feature requires trusted certificates, please configure the cert-manager accordingly"] ))
  gardener_validator:
    - and
    - - optionalfield
      - seedCandidateDeterminationStrategy
      - ["valueset", ["SameRegion", "MinimalDistance"]]
    - - optionalfield
      - network-policies
      - - mapfield
        - active
        - ["type", "bool"]
  networks:
    - and
    - ["mapfield", "nodes", "cidr"]
    - ["mapfield", "pods", "cidr"]
    - ["mapfield", "services", "cidr"]
  cert-manager_validators:
    basic:
      - and
      - - optionalfield
        - email
        - - match
          - (( validation.email_regex ))
      - - mapfield
        - server
        - - and
          - - mapfield
            - url
            - - or
              - ["valueset", ["self-signed", "staging", "live"]]
              - dnsdomain
          - - optionalfield
            - ca
            - ["and", [(( cert-manager_validators.selfsigned )), (( landscape.cert-manager.server.url ))], [(( cert-manager_validators.acme )), (( landscape.cert-manager.server.url ))]]
      - - optionalfield
        - privateKey
        - privatekey
    selfsigned: (( |ca,url|-> [url == "self-signed" ? valid( ca.crt ) -and valid( ca.key ) :true, "valid", "if 'landscape.cert-manager.server.url' is set to 'self-signed', you should either specify a CA with key ('server.ca.crt' and 'server.ca.key' set), or no CA at all ('server.ca' node not present)"] ))
    acme: (( |ca,url|-> [url != "self-signed" ? valid( ca.crt ) -and ( ! defined( ca.key ) ) :true, "if 'landscape.cert-manager.server.url' is not set to 'self-signed', you should either specify a CA without key ('server.ca.crt' set, no 'server.ca.key'), or the 'server.ca' node should not be present at all"] ))
    email: (( |ca|-> [valid( ca.email ), "either 'landscape.cert-manager.email' needs to be set"] ))

  ### VALIDATIONS ###
  # structure resembles structure of landscape where possible
  ##### landscape.name
  name: (( validate( landscape.name, "dnslabel" ) ))
  ##### landscape.domain
  domain: (( validate( landscape.domain, "dnsdomain" ) ))
  ##### landscape.cluster.networks
  cluster:
    networks: (( validate( landscape.clusters[0].networks, validation.networks ) ))
  ##### landscape.iaas
  iaas:
    basic: (( map[landscape.iaas|entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic) )] ))
    initial_seed: (( validate( landscape.iaas[0], validation.instantiate_validator(landscape.iaas[0], iaas_entry_validators.initial_seed) ) ))
    seed_soil: (( map[select[landscape.iaas.[1..]|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.seed) )] ))
    cloudprofile: (( map[select[landscape.iaas.[1..]|elem|-> elem.mode == "profile" -or elem.mode == "cloudprofile"]|id,entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.cloudprofile) )] ))
    shooted_seed: (( map[validation.flatten( select[select[landscape.iaas|elem|-> elem.mode == "seed" -or elem.mode == "soil"]|elem|-> valid( elem.seeds )].[*].seeds ) |entry|-> validate( entry, validation.instantiate_validator(entry, iaas_entry_validators.basic), validation.instantiate_validator(entry, iaas_entry_validators.shooted_seed) )] ))
  ##### landscape.etcd
  etcd:
    backup:
      type: (( validate( landscape.etcd.backup, ["mapfield", "type", ["valueset", keys( types.etcd_backup )]] ) ))
      region: (( validate( landscape.etcd.backup, ["mapfield", "region"] ) ))
      provider_config: (( validate( landscape.etcd.backup, types.etcd_backup[landscape.etcd.backup.type].config ) ))
      credentials: (( validate( landscape.etcd.backup, ["mapfield", "credentials", types.etcd_backup[landscape.etcd.backup.type].credentials] ) ))
  ##### landscape.dns
  dns:
    type: (( validate( landscape.dns, ["mapfield", "type", ["valueset", keys( types.dns )]] ) ))
    hostedZoneIDs: (( validate( landscape.dns, ["optionalfield", "hostedZoneIDs", ["map", ["valueset", ["include", "exclude"]], "list"]] ) ))
    provider_config: (( validate( landscape.dns, types.dns[landscape.dns.type].config ) ))
    credentials: (( validate( landscape.dns, ["mapfield", "credentials", types.dns[landscape.dns.type].credentials] ) ))
  ##### landscape.gardener
  gardener: (( defined( landscape.gardener ) ? validate( landscape.gardener, validation.gardener_validator ) :~~ ))
  ##### landscape.dashboard
  dashboard: (( defined( landscape.dashboard ) ? validate( landscape.dashboard, validation.dashboard_validator, validation.dashboard_no_seed_strategy_validator, [validation.dashboard_terminals_validator, landscape.cert-manager] ) :~~ ))
  ##### landscape.certmanager
  cert-manager: (( validate( landscape.cert-manager, validation.cert-manager_validators.basic, [validation.cert-manager_validators.email] ) ))