# Copyright 2019 Copyright (c) 2019 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
imports: (( &temporary ))
landscape: (( &temporary ))
utilities: (( &temporary ))
env: (( &temporary ))

settings:
  seedCandidateDeterminationStrategy: (( .landscape.gardener.seedCandidateDeterminationStrategy || "SameRegion" ))
  dns_credentials: (( sum[landscape.dns.credentials|{}|c,k,v|-> c {k=base64(v)}] ))

spec:
  <<: (( &temporary ))
  apiserver:
    name: "gardener-apiserver"
    commonName: (( name ".garden.svc.cluster.local" ))
    validity: 87600
    usage:
      - ServerAuth
      - Signature
      - KeyEncipherment
    hosts: (( utilities.svcHosts(name, landscape.namespace) ))
  controllermanager:
    name: "gardener-controller-manager"
    commonName: (( name ".garden.svc.cluster.local" ))
    validity: 87600
    usage:
      - ServerAuth
      - Signature
      - KeyEncipherment
    hosts: (( utilities.svcHosts(name, landscape.namespace) ))

state:
  <<: (( &state(merge none) ))
  gardener_ca: (( utilities.certs.selfSignedCA("ca-gardener", false) ))
  gardener_apiserver: (( utilities.certs.keyCertForCA(spec.apiserver, gardener_ca, false) ))
  gardener_controller_manager: (( utilities.certs.keyCertForCA(spec.controllermanager, gardener_ca, false) ))

plugins:
  - pinned:
    - helm:
      - gardener
      - template
    - kubectl:
      - kubectl_apply
  - kubectl:
    - garden_secret

kubectl_apply:
  kubeconfig: (( imports.kube_apiserver.export.kubeconfig ))
  files:
    - "gardener/rendered_charts.yaml"

garden_secret:
  kubeconfig: (( imports.kube_apiserver.export.kubeconfig ))
  manifests:
    - apiVersion: v1
      kind: Secret
      metadata:
        name: garden-secret-runtime
        namespace: (( .landscape.namespace ))
        labels:
            runtime: garden
        annotations:
          clusterName: (( .landscape.name ))
      type: Opaque
      data:
        kubeconfig: (( base64( read( .env.ROOTDIR "/" .landscape.clusters[0].kubeconfig, "text" ) ) ))

gardener_version: (( &temporary ( .landscape.versions.gardener ) ))

gardener:
  kubeconfig: (( landscape.clusters.[0].kubeconfig ))
  source: "git/repo/charts/gardener/controlplane/charts/application"
  name: "gardener"
  namespace: "garden"
  values:
    global:
      apiserver:
        kubeconfig: dummy
        caBundle: (( .state.gardener_ca.value.cert ))
        enabled: true
        etcd:
          servers: (( join(",",.imports.etcd.exports.endpoints.main) ))
          useSidecar: false
          caBundle: (( .imports.etcd.exports.cacert ))
          tls:
            crt: (( .imports.etcd.exports.cert ))
            key: (( .imports.etcd.exports.key ))
        featureGates: {}
        groupPriorityMinimum: 10000
        image:
          pullPolicy: (( defined( tag ) -and tag != "latest" ? "IfNotPresent" :"Always" ))
          repository: (( .gardener_version.apiserver.image_repo ))
          tag: (( .gardener_version.apiserver.image_tag || ~~ ))
        insecureSkipTLSVerify: false
        replicaCount: 3
        resources:
          <<: (( .gardener_version.apiserver.resources || ~ ))
        serviceAccountName: gardener-apiserver
        tls:
          crt: (( .state.gardener_apiserver.value.cert ))
          key: (( .state.gardener_apiserver.value.key ))
        versionPriority: 20
      controller:
        kubeconfig: dummy
        additionalVolumeMounts: []
        additionalVolumes: []
        alerting: []
        config:
          clientConnection:
            acceptContentTypes: application/json
            burst: 130
            contentType: application/json
            qps: 100
          controllers:
            backupInfrastructure:
              concurrentSyncs: 20
              syncPeriod: 24h
            seed:
              concurrentSyncs: 5
              reserveExcessCapacity: false
              syncPeriod: 1m
            shoot:
              concurrentSyncs: 20
              retryDuration: 24h
              syncPeriod: 1h
            shootCare:
              concurrentSyncs: 5
              conditionThresholds:
                apiServerAvailable: 1m
                controlPlaneHealthy: 1m
                everyNodeReady: 5m
                systemComponentsHealthy: 1m
              syncPeriod: 30s
            shootMaintenance:
              concurrentSyncs: 5
            shootQuota:
              concurrentSyncs: 5
              syncPeriod: 60m
          featureGates: {}
          leaderElection:
            leaderElect: true
            leaseDuration: 15s
            renewDeadline: 10s
            resourceLock: configmaps
            retryPeriod: 2s
          logLevel: info
          server:
            http:
              bindAddress: 0.0.0.0
              port: 2718
            https:
              bindAddress: 0.0.0.0
              port: 2719
              tls:
                caBundle: (( .state.gardener_ca.value.cert ))
                crt: (( .state.gardener_controller_manager.value.cert ))
                key: (( .state.gardener_controller_manager.value.key ))
        enabled: true
        image:
          pullPolicy: (( defined( tag ) -and tag != "latest" ? "IfNotPresent" :"Always" ))
          repository: (( .gardener_version.controller_manager.image_repo ))
          tag: (( .gardener_version.controller_manager.image_tag || ~~ ))
        replicaCount: 1
        resources:
          <<: (( .gardener_version.controller_manager.resources || ~ ))
        serviceAccountName: gardener-controller-manager
      scheduler:
        image:
          pullPolicy: (( defined( tag ) -and tag != "latest" ? "IfNotPresent" :"Always" ))
          repository: (( .gardener_version.scheduler.image_repo ))
          tag: (( .gardener_version.scheduler.image_tag || ~~ ))
        serviceAccountName: gardener-scheduler
        resources:
          <<: (( .gardener_version.scheduler.resources || ~ ))
        config:
          schedulers:
            shoot:
              retrySyncPeriod: 15s
              concurrentSyncs: 5
              candidateDeterminationStrategy: (( .settings.seedCandidateDeterminationStrategy ))
        # kubeconfig: is only needed for the runtime chart and will be added in export step
      defaultDomains:
        - credentials: (( .settings.dns_credentials ))
          domain: (( "shoot." .landscape.domain ))
          provider: (( .landscape.dns.type ))
      internalDomain:
        credentials: (( .settings.dns_credentials ))
        domain: (( "internal." .landscape.domain ))
        provider: (( .landscape.dns.type ))
      deployment:
        virtualGarden:
          clusterIP: (( min_ip(.landscape.clusters.[0].networks.services) + 20 ))
          enabled: true