wc-config.yaml

# This configuration applies to the workload cluster.
# It will override settings set in "defaults/common-config.yaml".
global:
  ## The cluster name.
  ## Used in logs and metrics as to separate these from other clusters.
  clusterName: ${CK8S_ENVIRONMENT_NAME}-wc

  ## If baseDomain for wc and sc are not the same, set the domain of the sc cluster.
  scDomain: ""
  scOpsDomain: ""

## User configuration.
user:
  ## This only controls if the namespaces should be created, user RBAC is always created.
  createNamespaces: true

  ## List of user namespaces to create.
  namespaces:
    - set-me
    - demo

  ## Any namespace listed in constraints are exempted from HNC managed namespaces
  ## This to override the Pod Security Admission level
  ## Example of constraint can be found here: helmfile/charts/gatekeeper/podsecuritypolicies/values.yaml
  ## The only extra label "psaLevel: <baseline/privileged>" is shown in the following example:
  ## <namespace>:
  ##  psaLevel: <baseline/privileged>
  ##  <service-name>:
  ##    ...
  constraints: {}

  ## List of users to create RBAC rules for.
  adminUsers:
    - set-me
    - admin@example.com

  ## List of serviceAccounts to create RBAC rules for, used for dev situations.
  serviceAccounts: []

  ## List of groups to create RBAC rules for.
  adminGroups:
    - set-me

  ## User controlled alertmanager configuration.
  alertmanager:
    enabled: true
    resources:
      requests:
        cpu: 10m
        memory: 50Mi
      limits:
        cpu: 50m
        memory: 100Mi
    tolerations: []
    affinity: {}
    topologySpreadConstraints: []
    # image: quay.io/prometheus/alertmanager:vX.Y.Z

  # Installs required cluster resources needed to install sealedSecrets
  # Requires that gatekeeper.allowUserCRDs.enabled is enabled.
  sealedSecrets:
    enabled: false
  # Installs required cluster resources needed to install mongodb
  # Requires that gatekeeper.allowUserCRDs.enabled is enabled.
  mongodb:
    enabled: false
  # Installs required cluster resources needed to install fluxv2
  # Requires that gatekeeper.allowUserCRDs.enabled is enabled.
  fluxv2:
    enabled: false
  # Installs required cluster resources needed to install kafka-operator
  # Requires that gatekeeper.allowUserCRDs.enabled is enabled.
  kafka:
    enabled: false

falco:
  ## Falco alerting configuration.
  alerts:
    enabled: true
    ## supported: 'alertmanager', 'slack'.
    type: alertmanager
    priority: notice
    hostPort: http://alertmanager-operated.alertmanager:9093

## Prometheus configuration.
## Prometheus collects metrics and pushes it to Thanos.
prometheus:
  ## Additional prometheus scrape config.
  ## ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config
  additionalScrapeConfigs: []

velero:
  storagePrefix: workload-cluster

  ## Excluded namespaces
  excludedNamespaces:
    - cert-manager
    - falco
    - fluentd
    - hnc-system
    - ingress-nginx
    - kube-node-lease
    - kube-public
    - kube-system
    - kured
    - monitoring
    - rook-ceph
    - velero
    - gatekeeper-system

  ## Extra excluded namespace, here we should add the namespaces that are more likely to change
  excludedExtraNamespaces: []

## Hierarchical namespace controller configuration, enable in common-config.yaml
hnc:
  ## Included namespaces, empty string will include all
  includedNamespacesRegex: ""

  ## Excluded namespaces
  excludedNamespaces:
    - alertmanager
    - cert-manager
    - falco
    - fluentd
    - fluentd-system
    - hnc-system
    - ingress-nginx
    - kube-node-lease
    - kube-public
    - kube-system
    - kured
    - monitoring
    - rook-ceph
    - velero
    - gatekeeper-system
    - metallb-system

  ## Extra excluded namespace, here we should add the namespaces that are more likely to change
  excludedExtraNamespaces: []

  ## Additional resources to enable opt-in propagation for.
  ## Objects that should be propagated must have one of the annotations listed here https://github.com/kubernetes-sigs/hierarchical-namespaces/blob/master/docs/user-guide/how-to.md#limit-the-propagation-of-an-object-to-descendant-namespaces
  additionalAllowPropagateResources: []
    ## examples:
    ## - resource: secrets
    ## - resource: networkpolicies
    ##   group: networking.k8s.io

  ## Annotations that will be stripped from propagated objects
  unpropagatedAnnotations: []

  ## Annotations that will be propagated to subnamespaces (allows regex)
  managedNamespaceAnnotations: []
  ## Labels that will be propagated to subnamespaces (allows regex)
  ## Labels in particular must also be configured in the HierarchyConfiguration object to be propagated
  managedNamespaceLabels:
    - pod-security.kubernetes.io/enforce
    - pod-security.kubernetes.io/audit
    - pod-security.kubernetes.io/warn

  ## Manager deployment configuration
  manager:
    resources:
      requests:
        cpu: 100m
        memory: 150Mi
      limits:
        cpu: 100m
        memory: 300Mi

    nodeSelector: {}
    tolerations: []
    affinity: {}

  ## Enables HA mode for hnc webhooks
  ha: true

  ## This feature is only available in Kubernetes v1.28+ (https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions)
  ## It will be changed to true by default when v1.27 is closer to EOL.
  webhookMatchConditions: false

  ## Webhook deployment configuration, only used if hnc.ha is true
  webhook:
    replicaCount: 3
    resources:
      requests:
        cpu: 100m
        memory: 150Mi
      limits:
        cpu: 100m
        memory: 300Mi

    topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/component: hnc-webhook
        maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule

    nodeSelector: {}
    tolerations: []
    affinity: {}

  ## Service monitor configuration
  serviceMonitor:
    relabelings: []

## certmanager:
  ## when using cert-manager with HTTP01 challenge and a custom image registry the below parameter should be added in the extraArgs
  ## !! this works only with public repositories !! see https://github.com/jetstack/cert-manager/issues/2429
  ## update the image tag based on the version used in the helm chart
  ## - --acme-http01-solver-image=<harbor_server_name>/<proxy_project_name>/jetstack/cert-manager-acmesolver:v1.4.0
  ## extraArgs: []

## Configuration for fluentd.
## Fluentd ships logs to OpenSearch using the endpoint 'opensearch.subdomain' set in common-config.yaml.
## Consists of two different deployments, one for running on master nodes
## and and one for running on "user nodes".
fluentd:
  enabled: true
  ## Only run on master nodes.
  forwarder:
    buffer:
      chunkLimitSize: 8MB
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: node-role.kubernetes.io/control-plane
                  operator: Exists

  ## Extra fluentd config to mount.
  extraConfigMaps: {}

  ## User controllable fluentd deployment.
  ## These pods collect logs from nodes where the user can run pods.
  ## Users can specify additional plugins and config in the respective configmaps:
  ## 'fluentd-extra-plugins', and 'fluentd-extra-config'.
  user:
    resources:
      requests:
        cpu: 100m
        memory: 300Mi
      limits:
        cpu: 500m
        memory: 1000Mi

    tolerations: []
    nodeSelector: {}
    affinity: {}

externalTrafficPolicy:
  # Whitelisting requires externalTrafficPolicy.local to be true
  # local: true

  # Comma separated list of CIDRs, e.g. 172.16.0.0/24,172.24.0.0/24
  whitelistRange:
    # global: 0.0.0.0/0
    kubeapiMetrics: false
wcProbeIngress:
  enabled: true

prometheusBlackboxExporter:
  targets:
    gatekeeper: true
    falco: true
    sc: true

ingressNginx:
  subDomain: ingress-nginx

# Network policies for workload cluster
networkPolicies:
  global:
    wcApiserver:
      # usually private ip of control-plane nodes
      ips:
        - set-me
      port: 6443
    wcNodes:
      # ip of all nodes in the cluster for internal communication
      ips:
        - set-me

  monitoring:
    enabled: true

  fluentd:
    enabled: true

  ingressNginx:
    ingressOverride:
      ips: set-me-if-enabled

  certManager:
    namespaces: []

  alertmanager:
    enabled: true

## Open Policy Agent Gatekeeper configuration
gatekeeper:
  allowUserCRDs:
    enabled: false
    enforcement: deny
    # The name of the user specified in /etc/kubernetes/admin.conf kubeconfig file of the control plane nodes
    # Necessary if Kubespray is used for managing the k8s cluster.
    adminConfUser: kubernetes-admin
    extraCRDs: []
    # Sealed secrets and MongoDB CRDs can be enabled via user.sealedsecrets/mongodb
    # - names:
    #     - sealedsecrets.bitnami.com
    #   group: "bitnami.com"

    extraServiceAccounts: []
    #  - namespace: "gatekeeper-system"
    #    name: "gatekeeper-admin-upgrade-crds"