core.yaml

# NOTE: This file is merged with other values in ./helmfile.d/snippets/env.gotmpl
k8s:
  namespaces:
    - name: argocd
      app: argocd
      disableIstioInjection: true
    - name: cert-manager
      disableIstioInjection: true
    - name: cnpg-system
      app: cnpg
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: default
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: external-dns
      disableIstioInjection: true
    - name: harbor
      app: harbor
    - name: apl-harbor-operator
      disableIstioInjection: true
    - name: gitea
    - name: apl-gitea-operator
      disableIstioInjection: true
    - name: apl-operator
      disableIstioInjection: true
    - name: grafana
      app: grafana
    - name: istio-system
      disableIstioInjection: true
      labels:
        'apl.io/ingress-controller-scope': 'true'
    - name: ingress
      # disabling istio sidecar as it does not preserve client ip (yet)
      # TODO: enable once it does
      disableIstioInjection: true
      labels:
        'apl.io/ingress-controller-scope': 'true'
    - name: keycloak
    - name: apl-keycloak-operator
      disableIstioInjection: true
    - name: knative-serving
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kserve
      app: kserve
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: knative-operator
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kfp
      app: kubeflow-pipelines
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kyverno
      app: kyverno
      disableIstioInjection: true
    - name: tekton-dashboard
      app: tekton-pipelines
    - name: tekton-pipelines
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: tekton-triggers
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: otel
      app: otel
      disableIstioInjection: true
    - name: maintenance
      disableIstioInjection: true
    - name: monitoring
      disableIstioInjection: true
    - name: otomi
    - name: otomi-operator
      disableIstioInjection: true
    - name: rabbitmq
      app: rabbitmq
      disableIstioInjection: true
    - name: redis
      app: prometheus
      disableIstioInjection: true
    - name: team-admin
    - name: trivy-operator
      app: trivy
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: sealed-secrets
      app: sealed-secrets
    - name: external-secrets
      app: external-secrets
      disableIstioInjection: true
    - name: apl-secrets
      disableIstioInjection: true
    - name: policy-reporter
      app: policy-reporter
      disablePolicyChecks: true
      disableIstioInjection: true

adminApps:
  - name: alertmanager
    tags: [alerting, observability]
    deps: [prometheus]
    ownHost: true
    ingress:
      - svc: po-alertmanager
        namespace: monitoring
        # namespace: alertmanager
        port: 9093
        type: public
        auth: true
  - name: argocd
    tags: [cicd, gitops]
    isShared: true
    ownHost: true
    ingress:
      - svc: argocd-server
        namespace: argocd
        type: public
        auth: true
  - name: cert-manager
    tags: [ingress, security, tls]
  - name: cnpg
    tags: [database]
  - name: tty
    tags: [tty]
    isShared: true
    ownHost: true
    ingress:
      - svc: tty
        # virtual service is not going to be used.
        namespace: ingress
        type: public
        auth: true
  - name: external-dns
    tags: [ingress, security, tls]
  - name: gitea
    tags: [git]
    isShared: true
    ownHost: true
    path: /user/oauth2/otomi-idp
    ingress:
      - namespace: gitea
        svc: gitea-http
        port: 3000
        type: public
  - name: grafana
    tags: [tracing, telemetry, observability]
    deps: [prometheus]
    path: /dashboards
    ownHost: true
    ingress:
      - svc: po-grafana
        namespace: grafana
        removeRequestHeaders:
          - authorization
        type: public
        auth: true
  - name: harbor
    tags: [security]
    isShared: true
    ownHost: true
    ingress:
      - svc: harbor-portal
        namespace: harbor
        type: public
        auth: true
      - svc: harbor-core
        namespace: harbor
        paths: [/api/, /c/]
        forwardPath: true
        type: public
        auth: true
      - svc: harbor-core
        namespace: harbor
        paths: [/chartrepo/, /service/, /v1/, /v2/]
        forwardPath: true
        type: public
        hasOwnIngress: true
  - name: hello
    hide: true
    tags: [demo]
  - name: ingress-nginx
    tags: [ingress, auth]
  - name: istio
    tags: [ingress, egress, routing, security, tls, observability, policies]
  - name: keycloak
    path: /admin/otomi/console/
    tags: [auth, sso]
    # isShared: true
    ownHost: true
    ingress:
      - namespace: keycloak
        svc: keycloak-keycloakx-http
        type: public
        port: 8080
  - name: knative
    tags: [serverless, functions]
    deps: [istio]
  - name: kubeflow-pipelines
    tags: [ai, ml]
    ownHost: true
    isShared: true
    ingress:
      - svc: ml-pipeline-ui
        namespace: kfp
        port: 80
        type: public
        auth: true
  - name: kserve
    tags: [ai]
  - name: tekton
    tags: [buildpacks, ci, pipelines]
    ownHost: true
    path: /#/namespaces/team-admin/pipelineruns
    ingress:
      - svc: tekton-dashboard
        namespace: tekton-dashboard
        port: 9097
        type: public
        auth: true
        removeRequestHeaders:
          - authorization
  - name: loki
    tags: [logging, telemetry, observability]
    deps: [grafana, prometheus, otel]
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A"%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: console
    hide: true
    isShared: true
    ownHost: true
    ingress:
      - svc: otomi-api
        namespace: otomi
        paths: [/api/]
        type: public
        auth: true
      - svc: otomi-console
        namespace: otomi
        type: public
        auth: true
  - name: api # Used by any client that do not support cookies
    hide: true
    isShared: true
    ownHost: true
    ingress:
      - svc: otomi-api
        namespace: otomi
        type: public
        # RequestAuthentication and AuthorizationPolicy ensure Authorization header validation
        auth: false

  - name: prometheus
    tags: [metrics, observability]
    ownHost: true
    ingress:
      - svc: po-prometheus
        port: 9090
        namespace: monitoring
        # namespace: prometheus
        type: public
        auth: true
  - name: sealed-secrets
    tags: [secrets, security, observability]
    ownHost: true
  - name: otel
    tags: [logging, tracing]
  - name: trivy
    tags: [security]
    deps: [prometheus, grafana]
  - name: kyverno
    tags: [security]
  - name: rabbitmq
    tags: [messaging]

teamApps:
  - name: alertmanager
    ownHost: true
    path: /#/alerts?silenced=false&inhibited=false&active=true&filter=%7Bnamespace%3D"team-#TEAM#"%7D
    ingress:
      - svc: po-alertmanager
        hasPrefix: true
        port: 9093
        type: public
        auth: true
  - name: grafana
    ownHost: true
    path: /dashboards
    ingress:
      - svc: po-grafana
        hasPrefix: true
        forwardPath: true
        removeRequestHeaders:
          - authorization
        type: public
        auth: true
  - name: loki
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: tekton
    ownHost: true
    ingress:
      - svc: tekton-dashboard
        hasPrefix: true
        port: 9097
        type: public
        auth: true
        removeRequestHeaders:
          - authorization