apiVersion: core.gardener.cloud/v1beta1
kind: Shoot
metadata:
  name: (( values.values.name ))
  namespace: (( values.values.namespace ))
spec:
  purpose: production # 'infrastructure' is only possible for shoots in the 'garden' namespace
  secretBindingName: (( values.values.secretbinding ))
  cloudProfileName: (( values.values.cloudprofile ))
  seedName: (( values.values.seed ))
  region: (( values.values.config.region ))
  provider:
    type: (( values.values.type ))
    infrastructureConfig: (( values.values.iaas.infrastructureConfig ))
    controlPlaneConfig: (( values.values.iaas.controlPlaneConfig ))
    workers: (( templates.instantiateWorkerSpecs( templates.ensureNotEmptyList( rawWorkersConfig ), values.values ) ))
    rawWorkersConfig: (( &temporary ( values.values.config.shootMachines || {} ) ))
  kubernetes:
    version: (( values.values.k8sVersion ))
    allowPrivilegedContainers: true # 'true' means that all authenticated users can use the "gardener.privileged" PodSecurityPolicy, allowing full unrestricted access to Pod features.
    kubeAPIServer:
      enableBasicAuthentication: true
    kubeControllerManager:
      horizontalPodAutoscaler:
        downscaleStabilization: 24h0m0s
        tolerance: 0.2
      nodeCIDRMaskSize: 24
  dns:
    domain: (( values.values.domain ))
    providers:
      - type: (( landscape.dns.type ))
        secretName: (( values.values.domain_secret ))
  networking:
    type: calico
    pods: (( values.values.config.cluster.networks.pods || ~~ ))
    nodes: (( values.values.config.cluster.networks.nodes || ~~ ))
    services: (( values.values.config.cluster.networks.services || ~~ ))
  maintenance:
    timeWindow:
      begin: 220000+0100
      end: 230000+0100
    autoUpdate:
      kubernetesVersion: false
      machineImageVersion: true
  hibernation:
    enabled: false
  addons:
    nginxIngress:
      enabled: true
    kubernetesDashboard:
      enabled: false

templates:
  <<: (( &temporary ))
  ensureNotEmptyList: (( lambda |x|-> templates.ensureNotEmpty( templates.ensureList( x ) ) ))
  ensureList: (( lambda |x|-> type( x ) == "list" ? x :[x] ))
  ensureNotEmpty: (( lambda |x|-> length( x ) == 0 ? [{}] :x ))
  instantiateWorkerSpecs: (( lambda |x,cvalues|-> sum[x|[]|s,i,elem|-> s [ *templates.worker ]] ))
  worker:
    <<: (( &template ))
    name: (( elem.name || i > 0 ? "worker" i :"cpu-worker" ))
    minimum: (( elem.minimum || 1 ))
    maximum: (( elem.maximum || 50 ))
    maxSurge: (( elem.maxSurge || "50%" ))
    maxUnavailable: (( elem.maxUnavailable || 0 ))
    providerConfig: (( elem.providerConfig || ~~ ))
    labels: (( elem.labels || ~~ ))
    annotations: (( elem.annotations || ~~ ))
    taints: (( elem.taints || ~~ ))
    kubernetes: (( elem.kubernetes || ~~ ))
    machine:
      type: (( elem.machine.type || cvalues.iaas.defaultMachineType ))
      image:
        name: (( elem.machine.image.name || cvalues.defaultMachineImage ))
        version: (( elem.machine.image.version || cvalues.type == "openstack" ? cvalues.config.machineImages[0].versions[0].version :~~ ))
    volume:
      <<: (( cvalues.type == "openstack" ? ~~ :~ ))
      type: (( cvalues.type != "openstack" ? elem.volume.type || cvalues.iaas.defaultVolumeType :~~ ))
      size: (( cvalues.type != "openstack" ? elem.volume.size || cvalues.iaas.defaultVolumeSize || "50Gi" :~~ ))
    caBundle: (( elem.caBundle || ~~ ))
    zones: (( elem.zones || [ cvalues.config.zones[0] ] || ~~ ))