# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

secretManifests:
- apiVersion: v1
  kind: Secret
  metadata:
    name: (( configValues.secretname ))
    namespace: (( configValues.namespace ))
  type: Opaque
  data:
    kubeconfig: (( base64( asyaml( configValues.kubeconfigs.seed ) ) ))
- apiVersion: v1
  kind: Secret
  metadata:
    name: (( configValues.secretname "-backup" ))
    namespace: (( configValues.namespace ))
  type: Opaque
  data:
    <<: (( sum[configValues.config.credentials|{}|s,k,v|->s { k = base64(v) }] ))
- apiVersion: v1
  kind: Secret
  name: (( &temporary ( "bootstrap" ) ))
  metadata:
    name: (( "bootstrap-token-" configValues.bootstrapToken.id ))
    namespace: kube-system
  type: bootstrap.kubernetes.io/token
  stringData:
    description: "A bootstrap token used by Gardenlet."
    token-id: (( configValues.bootstrapToken.id ))
    token-secret: (( configValues.bootstrapToken.secret ))
    usage-bootstrap-authentication: "true"
    usage-bootstrap-signing: "true"

seedSpec:
  <<: (( &temporary ))
  provider:
    type: (( configValues.config.type ))
    region: (( configValues.config.region ))
  blockCIDRs: (( configValues.iaas.blockCIDRs ))
  backup:
    provider: (( configValues.config.type ))
    region: (( configValues.config.region ))
    secretRef:
      name: (( configValues.secretname "-backup" ))
      namespace: (( configValues.namespace ))
  dns:
    ingressDomain: (( configValues.seed.ingressdomain ))
  secretRef:
    name: (( configValues.secretname ))
    namespace: (( configValues.namespace ))
  networks: # Seed and Shoot networks must be disjunct
    nodes: (( configValues.seed.networks.nodes ))
    pods: (( configValues.seed.networks.pods ))
    services: (( configValues.seed.networks.services ))
    shootDefaults: (( configValues.seed.shootDefaultNetworks || { "pods" = "100.96.0.0/11", "services" = "100.64.0.0/13" } ))
  taints: (( configValues.config.mode == "soil" ? [{ "key" = "seed.gardener.cloud/invisible" }] :~~ ))

gardenletBootstrapKubeconfig:
  apiVersion: v1
  kind: Config
  current-context: gardenlet-bootstrap@default
  clusters:
  - cluster:
      certificate-authority-data: (( base64( .imports.kube_apiserver.export.kube_apiserver_ca.cert ) ))
      server: (( .imports.kube_apiserver.export.apiserver_url ))
    name: default
  contexts:
  - context:
      cluster: default
      user: gardenlet-bootstrap
    name: gardenlet-bootstrap@default
  users:
  - name: gardenlet-bootstrap
    user:
      token: (( configValues.bootstrapToken.id "." configValues.bootstrapToken.secret ))

gardenletSpec:
  global:
    gardenlet:
      enabled: true
      replicaCount: 1
      serviceAccountName: gardenlet
      image:
        repository: (( .landscape.versions.gardener.gardenlet.image_repo ))
        tag: (( .landscape.versions.gardener.gardenlet.image_tag ))
      resources:
        <<: (( .landscape.versions.gardener.gardenlet.resources || ~ ))
      imageVectorOverwrite: (( .landscape.versions.gardener.gardenlet.imageVectorOverwrite || ~ ))
      additionalVolumes: []
      additionalVolumeMounts: []
      env: []
      vpa: false
      config:
        gardenClientConnection:
          acceptContentTypes: application/json
          contentType: application/json
          qps: 100
          burst: 130
          gardenClusterAddress: (( .imports.kube_apiserver.export.apiserver_url ))
          gardenClusterCACert: (( base64( .imports.kube_apiserver.export.kube_apiserver_ca.cert ) ))
          bootstrapKubeconfig:
            name: gardenlet-kubeconfig-bootstrap
            namespace: garden
            kubeconfig: (( asyaml( gardenletBootstrapKubeconfig ) ))
          kubeconfigSecret:
            name: gardenlet-kubeconfig
            namespace: garden
        seedClientConnection:
          acceptContentTypes: application/json
          contentType: application/json
          qps: 25
          burst: 50
        shootClientConnection:
          acceptContentTypes: application/json
          contentType: application/json
          qps: 25
          burst: 50
        controllers:
          backupBucket:
            concurrentSyncs: 20
          backupEntry:
            concurrentSyncs: 20
            deletionGracePeriodHours: 0
          seed:
            concurrentSyncs: 5
            syncPeriod: 1m
            heartBeatPeriod: 20s
            reserveExcessCapacity: true
          shoot:
            concurrentSyncs: 20
            syncPeriod: 1h
            retryDuration: 24h
            respectSyncPeriodOverwrite: false
            reconcileInMaintenanceOnly: false
          shootCare:
            concurrentSyncs: 5
            syncPeriod: 30s
            conditionThresholds:
            - type: APIServerAvailable
              duration: 1m
            - type: ControlPlaneHealthy
              duration: 1m
            - type: SystemComponentsHealthy
              duration: 1m
            - type: EveryNodeReady
              duration: 5m
        leaderElection:
          leaderElect: true
          leaseDuration: 15s
          renewDeadline: 10s
          retryPeriod: 2s
          resourceLock: configmaps
        logLevel: info
        kubernetesLogLevel: 0
        featureGates:
          Logging: false
        seedConfig:
          metadata:
            name: (( configValues.name ))
          spec: (( seedSpec ))
        overrideHelmValues:
          # seed level
          <<: (( configValues.config.overrideHelmValues || ~ ))
    # Deployment related configuration
    deployment:
      virtualGarden:
        enabled: true

pluginSpecs:
  deploySecrets:
    kubeconfig: (( configValues.kubeconfigs.virtual ))
    manifests: (( secretManifests ))
  namespace:
    <<: (( configValues.isBaseCluster ? ~~ :~ ))
    kubeconfig: (( configValues.kubeconfigs.seed ))
    manifests:
      - apiVersion: v1
        kind: Namespace
        metadata:
          labels:
          name: (( landscape.namespace ))
  gardenlet:
    kubeconfig: (( configValues.kubeconfigs.seed ))
    files:
      - (( "renderedPluginSpecs[" id "].gardenlet/rendered_charts.yaml" ))
    source: "git/repo/charts/gardener/gardenlet/charts/runtime"
    name: gardenlet
    namespace: garden
    values: (( gardenletSpec ))
  seedReady:
    kubeconfig: (( configValues.kubeconfigs.virtual ))
    seed: (( configValues.name ))
  deleteSeed:
    kubeconfig: (( configValues.kubeconfigs.virtual ))
    step: delete
    type: seed
    name: (( configValues.name ))
  deleteBootstrapToken:
    # delete duplicate bootstrap tokens that are created during re-deployment
    kubeconfig: (( configValues.kubeconfigs.virtual ))
    step: deploy
    type: secret
    namespace: kube-system
    name: (( secretManifests.bootstrap.metadata.name ))