# _helpers.tpl
{{- /*
name defines a template for the name of the chartmuseum chart.

The prevailing wisdom is that names should only contain a-z, 0-9 plus dot (.) and dash (-), and should
not exceed 63 characters.

Parameters:

- .Values.nameOverride: Replaces the computed name with this given name
- .Values.namePrefix: Prefix
- .Values.global.namePrefix: Global prefix
- .Values.nameSuffix: Suffix
- .Values.global.nameSuffix: Global suffix

The applied order is: "global prefix + prefix + name + suffix + global suffix"

Usage: 'name: "{{- template "chartmuseum.name" . -}}"'
*/ -}}
{{- define "chartmuseum.name"}}
{{- $global := default (dict) .Values.global -}}
{{- $base := default .Chart.Name .Values.nameOverride -}}
{{- $gpre := default "" $global.namePrefix -}}
{{- $pre := default "" .Values.namePrefix -}}
{{- $suf := default "" .Values.nameSuffix -}}
{{- $gsuf := default "" $global.nameSuffix -}}
{{- $name := print $gpre $pre $base $suf $gsuf -}}
{{- $name | lower | trunc 54 | trimSuffix "-" -}}
{{- end -}}

{{- /*
fullname defines a suitably unique name for a resource by combining
the release name and the chartmuseum chart name.

The prevailing wisdom is that names should only contain a-z, 0-9 plus dot (.) and dash (-), and should
not exceed 63 characters.

Parameters:

- .Values.fullnameOverride: Replaces the computed name with this given name
- .Values.fullnamePrefix: Prefix
- .Values.global.fullnamePrefix: Global prefix
- .Values.fullnameSuffix: Suffix
- .Values.global.fullnameSuffix: Global suffix

The applied order is: "global prefix + prefix + name + suffix + global suffix"

Usage: 'name: "{{- template "chartmuseum.fullname" . -}}"'
*/ -}}
{{- define "chartmuseum.fullname"}}
{{- $global := default (dict) .Values.global -}}
{{- $base := default (printf "%s-%s" .Release.Name .Chart.Name) .Values.fullnameOverride -}}
{{- $gpre := default "" $global.fullnamePrefix -}}
{{- $pre := default "" .Values.fullnamePrefix -}}
{{- $suf := default "" .Values.fullnameSuffix -}}
{{- $gsuf := default "" $global.fullnameSuffix -}}
{{- $name := print $gpre $pre $base $suf $gsuf -}}
{{- $name | lower | trunc 54 | trimSuffix "-" -}}
{{- end -}}


{{- /*
chartmuseum.labels.standard prints the standard chartmuseum Helm labels.

The standard labels are frequently used in metadata.
*/ -}}
{{- define "chartmuseum.labels.standard" -}}
app: {{ template "chartmuseum.name" . }}
chart: {{ template "chartmuseum.chartref" . }}
heritage: {{ .Release.Service | quote }}
release: {{ .Release.Name | quote }}
{{- end -}}

{{- /*
chartmuseum.chartref prints a chart name and version.

It does minimal escaping for use in Kubernetes labels.

Example output:

chartmuseum-0.4.5
*/ -}}
{{- define "chartmuseum.chartref" -}}
{{- replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name -}}
{{- end -}}

{{/*
Return the proper image name to change the volume permissions
*/}}
{{- define "chartmuseum.volumePermissions.image" -}}
{{- $registryName := .Values.volumePermissions.image.registry -}}
{{- $repositoryName := .Values.volumePermissions.image.repository -}}
{{- $tag := .Values.volumePermissions.image.tag | toString -}}
{{/*
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
Also, we can't use a single if because lazy evaluation is not an option
*/}}
{{- if .Values.global }}
    {{- if .Values.global.imageRegistry }}
        {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
    {{- else -}}
        {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
    {{- end -}}
{{- else -}}
    {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
{{- end -}}
{{- end -}}

{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "chartmuseum.imagePullSecrets" -}}
{{/*
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
Also, we can not use a single if because lazy evaluation is not an option
*/}}
{{- if .Values.global }}
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
imagePullSecrets:
{{- range .Values.image.pullSecrets }}
  - name: {{ . }}
{{- end }}
{{- range .Values.volumePermissions.image.pullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end -}}
{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
imagePullSecrets:
{{- range .Values.image.pullSecrets }}
  - name: {{ . }}
{{- end }}
{{- range .Values.volumePermissions.image.pullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end -}}
{{- end -}} # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "chartmuseum.fullname" . }}
  annotations:
{{ toYaml .Values.deployment.annotations | indent 4 }}
  labels:
{{ include "chartmuseum.labels.standard" . | indent 4 }}
{{- if .Values.deployment.labels }}
{{ toYaml .Values.deployment.labels | indent 4 }}
{{- end }}
spec:
  selector:
    matchLabels:
      app: {{ template "chartmuseum.name" . }}
      release: {{ .Release.Name | quote }}
{{- if .Values.deployment.labels }}
{{ toYaml .Values.deployment.labels | indent 6 }}
{{- end }}
  replicas: {{ .Values.replicaCount }}
  strategy:
{{ toYaml .Values.strategy | indent 4 }}
  revisionHistoryLimit: 10
{{- if .Values.deployment.matchlabes }}
  selector:
    matchLabels:
{{ toYaml .Values.deployment.matchlabels | indent 6 }}
{{- end }}
  template:
    metadata:
      name: {{ include "chartmuseum.fullname" . }}
      annotations:
{{ toYaml .Values.replica.annotations | indent 8 }}
      labels:
        app: {{ template "chartmuseum.name" . }}
        release: {{ .Release.Name | quote }}
{{- if .Values.deployment.labels }}
{{ toYaml .Values.deployment.labels | indent 8 }}
{{- end }}
    spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      {{- if .Values.securityContext.enabled }}
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
        {{- if .Values.securityContext.runAsNonRoot }}
        runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
        {{- end }}
        {{- if .Values.securityContext.supplementalGroups }}
        supplementalGroups: {{ .Values.securityContext.supplementalGroups }}
        {{- end }}
      {{- else if .Values.persistence.enabled }}
      initContainers:
      - name: volume-permissions
        image: {{ template "chartmuseum.volumePermissions.image" . }}
        imagePullPolicy: "{{ .Values.volumePermissions.image.pullPolicy }}"
        securityContext:
          {{- toYaml .Values.containerSecurityContext | nindent 10 }}
        command: ['sh', '-c', 'chown -R {{ .Values.securityContext.fsGroup }}:{{ .Values.securityContext.fsGroup }} {{ .Values.persistence.path }}']
        volumeMounts:
        - mountPath: {{ .Values.persistence.path }}
          name: storage-volume
      {{- end }}
{{- include "chartmuseum.imagePullSecrets" . | indent 6 }}
      containers:
      - name: {{ .Chart.Name }}
        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        securityContext:
          {{- toYaml .Values.containerSecurityContext | nindent 10 }}
        env:
{{- range $name, $value := .Values.env.open }}
{{- if not (empty $value) }}
        - name: {{ $name | quote }}
          value: {{ $value | quote }}
{{- end }}
{{- end }}
{{- range $name, $value := .Values.env.field }}
{{- if not ( empty $value) }}
        - name: {{ $name | quote }}
          valueFrom:
            fieldRef:
              fieldPath: {{ $value | quote }}
{{- end }}
{{- end }}
{{- if .Values.gcp.secret.enabled }}
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: "/etc/secrets/google/credentials.json"
{{- end }}
{{- if .Values.env.existingSecret }}
{{- $secret_name := .Values.env.existingSecret }}
{{- range $name, $key := .Values.env.existingSecretMappings }}
{{- if not ( empty $key) }}
        - name: {{ $name | quote }}
          valueFrom:
            secretKeyRef:
              name: {{ $secret_name | quote }}
              key: {{ $key | quote }}
{{- end }}
{{- end }}
{{- else }}
{{- $secret_name := include "chartmuseum.fullname" . }}
{{- range $name, $value := .Values.env.secret }}
{{- if not ( empty $value) }}
        - name: {{ $name | quote }}
          valueFrom:
            secretKeyRef:
              name: {{ $secret_name }}
              key: {{ $name | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.bearerAuth.secret.enabled }}
        -  name: AUTH_CERT_PATH
           value: /var/keys/public-key.pem
{{ end }}
        args:
        - --port=8080
{{- if eq .Values.env.open.STORAGE "local" }}
        - --storage-local-rootdir={{ .Values.persistence.path }}
{{- end }}
{{- if .Values.extraArgs }}
{{ toYaml .Values.extraArgs | indent 8 }}
{{- end }}
        ports:
        - name: http
          containerPort: 8080
        livenessProbe:
          httpGet:
            path: {{ .Values.env.open.CONTEXT_PATH }}/health
            port: http
{{ toYaml .Values.probes.liveness | indent 10 }}
        readinessProbe:
          httpGet:
            path: {{ .Values.env.open.CONTEXT_PATH }}/health
            port: http
{{ toYaml .Values.probes.readiness | indent 10 }}
        volumeMounts:
{{- if eq .Values.env.open.STORAGE "local" }}
        - mountPath: {{ .Values.persistence.path }}
          name: storage-volume
{{- end }}
{{- if  .Values.gcp.secret.enabled }}
        - mountPath: /etc/secrets/google
          name: {{ include "chartmuseum.fullname" . }}-gcp
{{- end }}
{{- if  .Values.oracle.secret.enabled }}
        - mountPath: /home/chartmuseum/.oci
          name: {{ include "chartmuseum.fullname" . }}-oracle
{{- end }}
{{- if .Values.bearerAuth.secret.enabled }}
        - name: public-key
          mountPath: /var/keys
          readOnly: true
{{- end }}
      {{- with .Values.resources }}
        resources:
{{ toYaml . | indent 10 }}
      {{- end }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- if .Values.deployment.schedulerName }}
      schedulerName: {{ .Values.deployment.schedulerName }}
    {{- end -}}
    {{- if and .Values.serviceAccount.create .Values.serviceAccount.name }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
    {{- else if .Values.serviceAccount.create }}
      serviceAccountName: {{ include "chartmuseum.fullname" . }}
    {{- else if .Values.serviceAccount.name }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
    {{- end }}
      volumes:
      - name: storage-volume
      {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.persistence.existingClaim | default (include "chartmuseum.fullname" .) }}
      {{- else }}
        emptyDir: {}
      {{- end -}}
      {{ if .Values.gcp.secret.enabled }}
      - name: {{ include "chartmuseum.fullname" . }}-gcp
        secret:
      {{ if .Values.env.secret.GOOGLE_CREDENTIALS_JSON }}
          secretName: {{ include "chartmuseum.fullname" . }}
          items:
          - key: GOOGLE_CREDENTIALS_JSON
            path: credentials.json
      {{ else }}
          secretName: {{ .Values.gcp.secret.name }}
          items:
          - key: {{ .Values.gcp.secret.key }}
            path: credentials.json
      {{ end }}
      {{ end }}
      {{ if .Values.oracle.secret.enabled }}
      - name: {{ include "chartmuseum.fullname" . }}-oracle
        secret:
          secretName: {{ .Values.oracle.secret.name }}
          items:
          - key: {{ .Values.oracle.secret.config }}
            path: config
          - key: {{ .Values.oracle.secret.key_file }}
            path: oci.key
      {{ end }}
{{- if .Values.bearerAuth.secret.enabled }}
      - name: public-key
        secret:
          secretName: {{ .Values.bearerAuth.secret.publicKeySecret }}
{{- end }}
 # ingress.yaml
{{- if .Values.ingress.enabled }}
{{- $servicePort := .Values.service.externalPort -}}
{{- $serviceName := include "chartmuseum.fullname" . -}}
{{- $ingressExtraPaths := .Values.ingress.extraPaths -}}
---
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
apiVersion: networking.k8s.io/v1beta1
{{- else }}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
  name: {{ include "chartmuseum.fullname" . }}
  annotations:
{{ toYaml .Values.ingress.annotations | indent 4 }}
  labels:
{{- if .Values.ingress.labels }}
{{ toYaml .Values.ingress.labels | indent 4 }}
{{- end }}
{{ include "chartmuseum.labels.standard" . | indent 4 }}
spec:
  rules:
  {{- range .Values.ingress.hosts }}
  - host: {{ .name }}
    http:
      paths:
      {{- range $ingressExtraPaths }}
      - path: {{ default "/" .path | quote }}
        backend:
        {{- if $.Values.service.servicename }}
          serviceName: {{ $.Values.service.servicename }}
        {{- else }}
          serviceName: {{ default $serviceName .service }}
        {{- end }}
          servicePort: {{ default $servicePort .port }}
      {{- end }}
      - path: {{ default "/" .path | quote }}
        backend:
        {{- if $.Values.service.servicename }}
          serviceName: {{ $.Values.service.servicename }}
        {{- else }}
          serviceName: {{ default $serviceName .service }}
        {{- end }}
          servicePort: {{ default $servicePort .servicePort }}
  {{- end }}
  tls:
  {{- range .Values.ingress.hosts }}
  {{- if .tls }}
  - hosts:
    - {{ .name }}
    secretName: {{ .tlsSecret }}
  {{- end }}
  {{- end }}
{{- end -}}
 # pv.yaml
{{- if .Values.persistence.pv.enabled -}}
apiVersion: v1
kind: PersistentVolume
metadata:
{{- if .Values.persistence.pv.pvname }}
  name: {{ .Values.persistence.pv.pvname }}
{{- else }}
  name: {{ include "chartmuseum.fullname" . }}
{{- end }}
  labels:
    app: {{ include "chartmuseum.fullname" . }}
    release: {{ .Release.Name | quote }}
spec:
  capacity:
    storage: {{ .Values.persistence.pv.capacity.storage }}
  accessModes:
    - {{ .Values.persistence.pv.accessMode | quote }}
  nfs:
    server: {{ .Values.persistence.pv.nfs.server }}
    path: {{ .Values.persistence.pv.nfs.path | quote }}
{{- end }} # pvc.yaml
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: {{ include "chartmuseum.fullname" . }}
  labels:
    app: {{ include "chartmuseum.fullname" . }}
    release: {{ .Release.Name | quote }}
{{- if .Values.persistence.labels }}
{{ toYaml .Values.persistence.labels | indent 4 }}
{{- end }}
spec:
  accessModes:
    - {{ .Values.persistence.accessMode | quote }}
  resources:
    requests:
      storage: {{ .Values.persistence.size | quote }}
{{- if .Values.persistence.storageClass }}
{{- if (eq "-" .Values.persistence.storageClass) }}
  storageClassName: ""
{{- else }}
  storageClassName: "{{ .Values.persistence.storageClass }}"
{{- end }}
{{- else if and .Values.persistence.volumeName (.Values.persistence.pv.enabled) }}
  volumeName: "{{ .Values.persistence.volumeName }}"
{{- end }}
{{- end }}
 # secret.yaml
{{- if not .Values.env.existingSecret -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "chartmuseum.fullname" . }}
  labels:
{{- if .Values.secret.labels }}
{{ toYaml .Values.secret.labels | indent 4 }}
{{- end }}
{{ include "chartmuseum.labels.standard" . | indent 4 }}
type: Opaque
data:
{{- range $name, $value := .Values.env.secret }}
{{- if not (empty $value) }}
{{- if eq $name "GOOGLE_CREDENTIALS_JSON" }}
  {{ $name }}: {{ $value }}
  {{- else }}
  {{ $name }}: {{ $value | b64enc }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
 # service.yaml
apiVersion: v1
kind: Service
metadata:
{{- if .Values.service.servicename }}
  name: {{ .Values.service.servicename }}
{{- else }}
  name: {{ include "chartmuseum.fullname" . }}
{{- end }}
  labels:
{{ include "chartmuseum.labels.standard" . | indent 4 }}
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
{{- if .Values.service.annotations }}
  annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
spec:
  type: {{ .Values.service.type }}
  {{- if (or (eq .Values.service.type "LoadBalancer") (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort)))) }}
  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }}
  {{- end }}
  {{- if (and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges) }}
  loadBalancerSourceRanges:
  {{- with .Values.service.loadBalancerSourceRanges }}
{{ toYaml . | indent 2 }}
  {{- end }}
  {{- end }}
  {{- if eq .Values.service.type "ClusterIP" }}
  {{- if .Values.service.clusterIP }}
  clusterIP: {{ .Values.service.clusterIP }}
  {{- end }}
  {{- end }}
  ports:
  - port: {{ .Values.service.externalPort }}
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
    nodePort: {{.Values.service.nodePort}}
{{- else }}
    targetPort: http
{{- end }}
    protocol: TCP
    name: http
  selector:
    app: {{ template "chartmuseum.name" . }}
    release: {{ .Release.Name | quote }}
 # serviceaccount.yaml
{{- if .Values.serviceAccount.create -}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
{{- if .Values.serviceAccount.name }}
  name: {{ .Values.serviceAccount.name }}
{{- else }}
  name: {{ include "chartmuseum.fullname" . }}
{{- end }}
  labels:
{{ include "chartmuseum.labels.standard" . | indent 4 }}
{{- if .Values.serviceAccount.annotations }}
  annotations:
{{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
{{- end }}
{{- end -}}
 # servicemonitor.yaml
{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) ( .Values.serviceMonitor.enabled ) }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
{{- if .Values.serviceMonitor.labels }}
  labels:
{{ toYaml .Values.serviceMonitor.labels | indent 4 }}
{{- end }}
  name: {{ template "chartmuseum.fullname" . }}
  namespace: {{ .Release.Namespace }}
{{- if .Values.serviceMonitor.namespace }}
  namespace: {{ .Values.serviceMonitor.namespace }}
{{- end }}
spec:
  endpoints:
  - targetPort: 8080
{{- if .Values.serviceMonitor.interval }}
    interval: {{ .Values.serviceMonitor.interval }}
{{- end }}
{{- if .Values.serviceMonitor.metricsPath }}
    path: {{ .Values.serviceMonitor.metricsPath }}
{{- end }}
{{- if .Values.serviceMonitor.timeout }}
    scrapeTimeout: {{ .Values.serviceMonitor.timeout }}
{{- end }}
  jobLabel: {{ template "chartmuseum.fullname" . }}
  namespaceSelector:
    matchNames:
    - {{ .Release.Namespace }}
  selector:
    matchLabels:
      app: {{ template "chartmuseum.name" . }}
      release: {{ .Release.Name }}
{{- end }}

extraArgs:
  # - --storage-timestamp-tolerance 1s
replicaCount: 1
strategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 0
image:
  repository: chartmuseum/chartmuseum
  tag: v0.12.0
  pullPolicy: IfNotPresent
secret:
  labels: {}
env:
  open:
    # storage backend, can be one of: local, alibaba, amazon, google, microsoft, oracle
    STORAGE: local
    # oss bucket to store charts for alibaba storage backend
    STORAGE_ALIBABA_BUCKET:
    # prefix to store charts for alibaba storage backend
    STORAGE_ALIBABA_PREFIX:
    # oss endpoint to store charts for alibaba storage backend
    STORAGE_ALIBABA_ENDPOINT:
    # server side encryption algorithm for alibaba storage backend, can be one
    # of: AES256 or KMS
    STORAGE_ALIBABA_SSE:
    # s3 bucket to store charts for amazon storage backend
    STORAGE_AMAZON_BUCKET:
    # prefix to store charts for amazon storage backend
    STORAGE_AMAZON_PREFIX:
    # region of s3 bucket to store charts
    STORAGE_AMAZON_REGION:
    # alternative s3 endpoint
    STORAGE_AMAZON_ENDPOINT:
    # server side encryption algorithm
    STORAGE_AMAZON_SSE:
    # gcs bucket to store charts for google storage backend
    STORAGE_GOOGLE_BUCKET:
    # prefix to store charts for google storage backend
    STORAGE_GOOGLE_PREFIX:
    # container to store charts for microsoft storage backend
    STORAGE_MICROSOFT_CONTAINER:
    # prefix to store charts for microsoft storage backend
    STORAGE_MICROSOFT_PREFIX:
    # container to store charts for openstack storage backend
    STORAGE_OPENSTACK_CONTAINER:
    # prefix to store charts for openstack storage backend
    STORAGE_OPENSTACK_PREFIX:
    # region of openstack container
    STORAGE_OPENSTACK_REGION:
    # path to a CA cert bundle for your openstack endpoint
    STORAGE_OPENSTACK_CACERT:
    # compartment id for for oracle storage backend
    STORAGE_ORACLE_COMPARTMENTID:
    # oci bucket to store charts for oracle storage backend
    STORAGE_ORACLE_BUCKET:
    # prefix to store charts for oracle storage backend
    STORAGE_ORACLE_PREFIX:
    # form field which will be queried for the chart file content
    CHART_POST_FORM_FIELD_NAME: chart
    # form field which will be queried for the provenance file content
    PROV_POST_FORM_FIELD_NAME: prov
    # levels of nested repos for multitenancy. The default depth is 0 (singletenant server)
    DEPTH: 0
    # show debug messages
    DEBUG: false
    # output structured logs as json
    LOG_JSON: true
    # disable use of index-cache.yaml
    DISABLE_STATEFILES: false
    # disable Prometheus metrics
    DISABLE_METRICS: true
    # disable all routes prefixed with /api
    DISABLE_API: true
    # allow chart versions to be re-uploaded
    ALLOW_OVERWRITE: false
    # absolute url for .tgzs in index.yaml
    CHART_URL:
    # allow anonymous GET operations when auth is used
    AUTH_ANONYMOUS_GET: false
    # sets the base context path
    CONTEXT_PATH:
    # parallel scan limit for the repo indexer
    INDEX_LIMIT: 0
    # cache store, can be one of: redis (leave blank for inmemory cache)
    CACHE:
    # address of Redis service (host:port)
    CACHE_REDIS_ADDR:
    # Redis database to be selected after connect
    CACHE_REDIS_DB: 0
    # enable bearer auth
    BEARER_AUTH: false
    # auth realm used for bearer auth
    AUTH_REALM:
    # auth service used for bearer auth
    AUTH_SERVICE:
  field:
    # POD_IP: status.podIP
  secret:
    # username for basic http authentication
    BASIC_AUTH_USER:
    # password for basic http authentication
    BASIC_AUTH_PASS:
    # GCP service account json file
    GOOGLE_CREDENTIALS_JSON:
    # Redis requirepass server configuration
    CACHE_REDIS_PASSWORD:
  # Name of an existing secret to get the secret values ftom
  existingSecret:
  # Stores Enviromnt Variable to secret key name mappings
  existingSecretMappings:
    # username for basic http authentication
    BASIC_AUTH_USER:
    # password for basic http authentication
    BASIC_AUTH_PASS:
    # GCP service account json file
    GOOGLE_CREDENTIALS_JSON:
    # Redis requirepass server configuration
    CACHE_REDIS_PASSWORD:

deployment:
  # Define scheduler name. Use of 'default' if empty
  schedulerName: ""
  ## Chartmuseum Deployment annotations
  annotations: {}
  #   name: value
  labels: {}
  #   name: value
  matchlabels: {}
  #   name: value
replica:
  ## Chartmuseum Replicas annotations
  annotations: {}
  ## Read more about kube2iam to provide access to s3 https://github.com/jtblin/kube2iam
  #   iam.amazonaws.com/role: role-arn
service:
  servicename:
  type: ClusterIP
  externalTrafficPolicy: Local
  ## Limits which cidr blocks can connect to service's load balancer
  ## Only valid if service.type: LoadBalancer
  loadBalancerSourceRanges: []
  # clusterIP: None
  externalPort: 8080
  nodePort:
  annotations: {}
  labels: {}

serviceMonitor:
  enabled: false
  # namespace: prometheus
  labels: {}
  metricsPath: "/metrics"
  # timeout: 60
  # interval: 60

resources: {}
#  limits:
#    cpu: 100m
#    memory: 128Mi
#  requests:
#    cpu: 80m
#    memory: 64Mi

probes:
  liveness:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 3
  readiness:
    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 1
    successThreshold: 1
    failureThreshold: 3

serviceAccount:
  create: false
  # name:
  ## Annotations for the Service Account
  annotations: {}

# UID/GID 1000 is the default user "chartmuseum" used in
# the container image starting in v0.8.0 and above. This
# is required for local persistent storage. If your cluster
# does not allow this, try setting securityContext: {}
securityContext:
  enabled: true
  fsGroup: 1000
  ## Optionally, specify supplementalGroups and/or
  ## runAsNonRoot for security purposes
  # runAsNonRoot: true
  # supplementalGroups: [1000]

containerSecurityContext: {}

priorityClassName: ""

nodeSelector: {}

tolerations: []

affinity: {}

persistence:
  enabled: false
  accessMode: ReadWriteOnce
  size: 8Gi
  labels: {}
  path: /storage
  #   name: value
  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  # existingClaim:

  ## Chartmuseum data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>
  ## If set to "-", storageClassName: "", which disables dynamic provisioning
  ## If undefined (the default) or set to null, no storageClassName spec is
  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  ##   GKE, AWS & OpenStack)
  ##
  # storageClass: "-"
  # volumeName:
  pv:
    enabled: false
    pvname:
    capacity:
      storage: 8Gi
    accessMode: ReadWriteOnce
    nfs:
      server:
      path:

## Init containers parameters:
## volumePermissions: Change the owner of the persistent volume mountpoint to RunAsUser:fsGroup
##
volumePermissions:
  image:
    registry: docker.io
    repository: bitnami/minideb
    tag: buster
    pullPolicy: Always
    ## Optionally specify an array of imagePullSecrets.
    ## Secrets must be manually created in the namespace.
    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
    ##
    # pullSecrets:
    #   - myRegistryKeySecretName

## Ingress for load balancer
ingress:
  enabled: false
## Chartmuseum Ingress labels
##
#   labels:
#     dns: "route53"

## Chartmuseum Ingress annotations
##
#   annotations:
#     kubernetes.io/ingress.class: nginx
#     kubernetes.io/tls-acme: "true"

## Chartmuseum Ingress hostnames
## Must be provided if Ingress is enabled
##
#  hosts:
#    - name: chartmuseum.domain1.com
#      path: /
#      tls: false
#    - name: chartmuseum.domain2.com
#      path: /
#
#      ## Set this to true in order to enable TLS on the ingress record
#      tls: true
#
#      ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS
#      ## Secrets must be added manually to the namespace
#      tlsSecret: chartmuseum.domain2-tls

# Adding secrets to tiller is not a great option, so If you want to use an existing
# secret that contains the json file, you can use the following entries
gcp:
  secret:
    enabled: false
    # Name of the secret that contains the encoded json
    name:
    # Secret key that holds the json value.
    key: credentials.json
oracle:
  secret:
    enabled: false
    # Name of the secret that contains the encoded config and key
    name:
    # Secret key that holds the oci config
    config: config
    # Secret key that holds the oci private key
    key_file: key_file
bearerAuth:
  secret:
    enabled: false
    publicKeySecret: chartmuseum-public-key
