## nginx configuration
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
##
controller:
  name: controller
  enableAnnotationValidations: false
  image:
    ## Keep false as default for now!
    chroot: false
    registry: o11yprod.azurecr.io
    image: ingress-nginx/controller
    ## for backwards compatibility consider setting the full image url via the repository value below
    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
    ## repository:
    tag: "v1.12.5-0e51fd5e4"
    digest: ""
    digestChroot: sha256:5bee417e81f5478b166e35b66b62824275fba150cb737adf665ba05c61ff4632
    pullPolicy: IfNotPresent
    runAsNonRoot: true
    # -- This value must not be changed using the official image.
    # uid=101(www-data) gid=82(www-data) groups=82(www-data)
    runAsUser: 101
    # -- This value must not be changed using the official image.
    # uid=101(www-data) gid=82(www-data) groups=82(www-data)
    runAsGroup: 82
    allowPrivilegeEscalation: false
    seccompProfile:
      type: RuntimeDefault
    readOnlyRootFilesystem: false
  # -- Configures the controller container name
  containerName: controller
  # -- Configures the ports that the nginx-controller listens on
  containerPort:
    http: 80
    https: 443

  # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
  config:
    lua-shared-dicts: 'configuration_data: 100, o11y_route_data: 100'
    error-log-level: info
    annotations-risk-level: Critical
    main-snippet: |
      env AUTH_SERVICE_URL;
      env CACHE_EXPIRE_TIME;
      env ERROR_CACHE_EXPIRE_TIME;

  # -- This configuration defines if Ingress Controller should allow users to set
  # their own *-snippet annotations, otherwise this is forbidden / dropped
  # when users add those annotations.
  # Global snippets in ConfigMap are still respected
  allowSnippetAnnotations: true

  # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
  electionID: nginx-read-leader
  # -- This section refers to the creation of the IngressClass resource.
  # IngressClasses are immutable and cannot be changed after creation.
  # We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required.
  ingressClassResource:
    # -- Name of the IngressClass
    name: nginx-read
    # -- Create the IngressClass or not
    enabled: true
    # -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation.
    # Ingress creation gets rejected if there are multiple default IngressClasses.
    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class
    default: false
    # -- Annotations to be added to the IngressClass resource.
    annotations: {}
    # -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value.
    # This value is also being set as the `--controller-class` argument of this Ingress Controller.
    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
    controllerValue: k8s.io/ingress-nginx-read
    # -- Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name.
    # Useful for development environments with only one Ingress Controller but production-like Ingress resources.
    # `default` gets enabled on the original IngressClass only.
    aliases: []
    # aliases:
    # - nginx-alias-1
    # - nginx-alias-2
    # -- A link to a custom resource containing additional configuration for the controller.
    # This is optional if the controller consuming this IngressClass does not require additional parameters.
    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
    parameters: {}

  # -- For backwards compatibility with ingress.class annotation, use ingressClass.
  # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
  ingressClass: nginx-read

  # -- Additional command line arguments to pass to Ingress-Nginx Controller
  # E.g. to specify the default SSL certificate you can use
  extraArgs:
    metrics-per-host: false

  # -- Additional environment variables to set
  extraEnvs:
    - name: AUTH_SERVICE_URL
      value: "http://regionalservice.observability.svc.cluster.local:8081"
    - name: CACHE_EXPIRE_TIME
      value: "3600"
    - name: ERROR_CACHE_EXPIRE_TIME
      value: "120"

  # -- Affinity and anti-affinity rules for server scheduling to nodes
  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
  ##
  affinity:
    # # An example of preferred pod anti-affinity, weight is in the range 1-100
    podAntiAffinity:
      preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
            - key: app.kubernetes.io/name
              operator: In
              values:
              - '{{ include "ingress-nginx.name" . }}'
            - key: app.kubernetes.io/instance
              operator: In
              values:
              - '{{ .Release.Name }}'
            - key: app.kubernetes.io/component
              operator: In
              values:
              - controller
          topologyKey: kubernetes.io/hostname
  nodeSelector:
    kubernetes.io/os: linux
    node_type: worker
  replicaCount: 2
  ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
  ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
  ## Ideally, there should be no limits.
  ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
  resources:
    limits:
      cpu: 500m
      memory: 1Gi
    requests:
      cpu: 100m
      memory: 256Mi
  # Mutually exclusive with keda autoscaling
  autoscaling:
    enabled: true
    annotations: {}
    minReplicas: 2
    maxReplicas: 4
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 90
    behavior:
      scaleDown:
        stabilizationWindowSeconds: 300
        # scale down at the rate of 1 pod per 5 minutes.
        policies:
        - type: Pods
          value: 1
          periodSeconds: 300
      scaleUp:
        stabilizationWindowSeconds: 60

  service:
    # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.
    enabled: true
    external:
      # -- Enable the external controller service or not. Useful for internal-only deployments.
      enabled: true
    # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.
    annotations: {}
    # -- Labels to be added to both controller services.
    labels: {}
    # -- Type of the external controller service.
    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
    type: ClusterIP
  metrics:
    port: 10254
    portName: metrics
    # if this port is changed, change healthz-port: in extraArgs: accordingly
    enabled: true
    serviceMonitor:
      enabled: true
      additionalLabels: {}
      ## The label to use to retrieve the job name from.
      ## jobLabel: "app.kubernetes.io/name"
      namespace: ""
      namespaceSelector: {}
      ## Default: scrape .Release.Namespace only
      ## To scrape all, use the following:
      ## namespaceSelector:
      ##   any: true
      scrapeInterval: 30s
      # honorLabels: true
      targetLabels: []
      relabelings: []
      metricRelabelings: []