core.yaml

# NOTE: This file is merged with other values in ./helmfile.d/snippets/env.gotmpl
k8s:
  namespaces:
    - name: argocd
      app: argocd
      disableIstioInjection: true
    - name: cert-manager
      disableIstioInjection: true
    - name: cnpg-system
      app: cnpg
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: default
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: drone
    - name: drone-pipelines
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: external-dns
      disableIstioInjection: true
    - name: falco
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: harbor
      app: harbor
    - name: apl-harbor-operator
      disableIstioInjection: true
    - name: gitea
    - name: apl-gitea-operator
      disableIstioInjection: true
    - name: grafana
      app: grafana
    - name: istio-system
      disableIstioInjection: true
    - name: istio-operator
      istio-operator-managed: Reconcile
      istio-injection: disabled
    - name: httpbin
      app: httpbin
    - name: ingress
      # disabling istio sidecar as it does not preserve client ip (yet)
      # TODO: enable once it does
      disableIstioInjection: true
    - name: jaeger
      app: jaeger
    - name: jaeger-operator
      app: jaeger
      disableIstioInjection: true
    - name: keycloak
    - name: apl-keycloak-operator
      disableIstioInjection: true
    - name: kiali
      app: kiali
    - name: kiali-operator
      app: kiali
      disableIstioInjection: true
    - name: knative-serving
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: knative-operator
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kured
      app: kured
      disableIstioInjection: true
    - name: kyverno
      app: kyverno
      disableIstioInjection: true
    - name: thanos
      app: thanos
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: tekton-pipelines
      app: tekton
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: tekton-triggers
      app: tekton
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: otel
      app: otel
      disableIstioInjection: true
    - name: tempo
      app: tempo
      disableIstioInjection: true
    - name: maintenance
      disableIstioInjection: true
    - name: minio
      app: minio
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: monitoring
      disableIstioInjection: true
    - name: otomi
    - name: otomi-operator
      disableIstioInjection: true
    - name: rabbitmq
      app: rabbitmq
      disableIstioInjection: true
    - name: redis
      app: prometheus
      disableIstioInjection: true
    - name: team-admin
    - name: trivy-operator
      app: trivy
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: sealed-secrets
      app: sealed-secrets
    - name: velero
      app: velero
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: otomi-pipelines
      app: tekton
      disableIstioInjection: true
      disablePolicyChecks: true

adminApps:
  - name: alertmanager
    tags: [alerting, observability]
    deps: [prometheus]
    ownHost: true
    ingress:
      - svc: po-alertmanager
        namespace: monitoring
        # namespace: alertmanager
        port: 9093
        type: public
        auth: true
  - name: argocd
    tags: [cicd, gitops]
    isShared: true
    ownHost: true
    ingress:
      - svc: argocd-server
        namespace: argocd
        type: public
        auth: true
  - name: cert-manager
    tags: [ingress, security, tls]
  - name: cnpg
    tags: [database]
  - name: drone
    tags: [cicd, deployment, pipeline]
    isShared: true
    ownHost: true
    ingress:
      - svc: drone
        namespace: drone
        type: public
        auth: true
        removeRequestHeaders:
          - authorization
      - svc: drone
        namespace: drone
        type: public
        paths: [/hook, /api/user, /api/repo]
        forwardPath: true
        removeRequestHeaders:
          - authorization
  - name: tty
    tags: [tty]
    isShared: true
    ownHost: true
    ingress:
      - svc: tty
        # virtual service is not going to be used.
        namespace: ingress
        type: public
        auth: true
  - name: external-dns
    tags: [ingress, security, tls]
  - name: falco
    tags: [security]
    deps: [prometheus, grafana]
  - name: gitea
    tags: [git]
    isShared: true
    ownHost: true
    path: /user/oauth2/otomi-idp
    ingress:
      - namespace: gitea
        svc: gitea-http
        port: 3000
        type: public
  - name: grafana
    tags: [tracing, telemetry, observability]
    deps: [prometheus]
    path: /dashboards
    ownHost: true
    ingress:
      - svc: po-grafana
        namespace: grafana
        removeRequestHeaders:
          - authorization
        type: public
        auth: true
  - name: harbor
    tags: [security]
    isShared: true
    ownHost: true
    ingress:
      - svc: harbor-portal
        namespace: harbor
        type: public
        auth: true
      - svc: harbor-core
        namespace: harbor
        paths: [/api/, /c/]
        forwardPath: true
        type: public
        auth: true
      - svc: harbor-core
        namespace: harbor
        paths: [/chartrepo/, /service/, /v1/, /v2/]
        forwardPath: true
        type: public
        hasOwnIngress: true
  - name: hello
    hide: true
    tags: [demo]
  - name: httpbin
    tags: [dev, testing, debugging]
    isShared: true
    ownHost: true
    ingress:
      - namespace: httpbin
        svc: httpbin
        type: public
        auth: true
  - name: ingress-nginx
    tags: [ingress, auth]
  - name: istio
    tags: [ingress, egress, routing, security, tls, observability, policies]
  - name: jaeger
    tags: [ingress, telemetry, observability]
    deps: [istio]
    ingress:
      - svc: jaeger-operator-jaeger-query
        port: 16686
        forwardPath: true
        namespace: jaeger
        type: public
        auth: true
  - name: keycloak
    tags: [auth, sso]
    # isShared: true
    ownHost: true
    ingress:
      - namespace: keycloak
        svc: keycloak-service
        type: public
        port: 8080
  - name: kiali
    tags: [tracing, telemetry, observability]
    deps: [istio, prometheus]
    ingress:
      - svc: kiali
        forwardPath: true
        removeRequestHeaders:
          - authorization
        port: 20001
        namespace: kiali
        type: public
        auth: true
  - name: knative
    tags: [serverless, functions]
    deps: [istio]
  - name: kured
    tags: [security]
  - name: tekton
    tags: [buildpacks, ci, pipelines]
    ownHost: true
    path: /#/namespaces/otomi-pipelines/pipelineruns
    ingress:
      - svc: tekton-dashboard
        namespace: tekton-pipelines
        port: 9097
        type: public
        auth: true
        removeRequestHeaders:
          - authorization
  - name: thanos
    tags: [metrics, observability]
    ownHost: true
    ingress:
      - svc: thanos-query
        port: 9090
        namespace: thanos
        type: public
        auth: true
  - name: loki
    tags: [logging, telemetry, observability]
    deps: [grafana, prometheus]
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A"%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: minio
    tags: [storage, backup]
    ownHost: true
    ingress:
      - svc: minio
        port: 9001
        namespace: minio
        type: public
        auth: true
        removeRequestHeaders:
          - authorization
  - name: console
    hide: true
    isShared: true
    ownHost: true
    ingress:
      - svc: otomi-api
        namespace: otomi
        paths: [/api/]
        type: public
        auth: true
      - svc: otomi-console
        namespace: otomi
        type: public
        auth: true
  - name: api # Used by any client that do not support cookies
    hide: true
    isShared: true
    ownHost: true
    ingress:
      - svc: otomi-api
        namespace: otomi
        type: public
        # RequestAuthentication and AuthorizationPolicy ensure Authorization header validation
        auth: false

  - name: prometheus
    tags: [metrics, observability]
    ownHost: true
    ingress:
      - svc: po-prometheus
        port: 9090
        namespace: monitoring
        # namespace: prometheus
        type: public
        auth: true
  - name: sealed-secrets
    tags: [secrets, security, observability]
    ownHost: true
  - name: tempo
    tags: [tracing]
    deps: [prometheus, grafana]
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"tempo","queries":%5B%7B"refId":"A","datasource":%7B"type":"tempo","uid":"tempo"%7D,"queryType":"clear","limit":20%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: otel
    tags: [tracing]
  - name: trivy
    tags: [security]
    deps: [prometheus, grafana]
  - name: velero
    tags: [backup]
  - name: kyverno
    tags: [security]
  - name: rabbitmq
    tags: [messaging]

teamApps:
  - name: alertmanager
    ownHost: true
    path: /#/alerts?silenced=false&inhibited=false&active=true&filter=%7Bnamespace%3D"team-#TEAM#"%7D
    ingress:
      - svc: po-alertmanager
        hasPrefix: true
        port: 9093
        type: public
        auth: true
  - name: grafana
    ownHost: true
    path: /dashboards
    ingress:
      - svc: po-grafana
        hasPrefix: true
        forwardPath: true
        removeRequestHeaders:
          - authorization
        type: public
        auth: true
  - name: loki
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: tekton
    ownHost: true
    ingress:
      - svc: tekton-dashboard
        hasPrefix: true
        port: 9097
        type: public
        auth: true
        removeRequestHeaders:
          - authorization