values-schema.yaml

$schema: 'http://json-schema.org/draft-07/schema'
additionalProperties: true
definitions:
  rawValues:
    description: "May define value overrides for a chart. WARNING: these values currently have no schema and can't be validated as such, and may break deployment. You are on your own here."
    type: object
  alerts:
    additionalProperties: false
    properties:
      drone:
        default: slack
        enum:
          - slack
          - msteams
        type: string
      email:
        additionalProperties: false
        properties:
          critical:
            $ref: '#/definitions/email'
            description: One or more email addresses (comma separated) for critical events.
            x-secret: ''
          nonCritical:
            $ref: '#/definitions/email'
            description: One or more email addresses (comma separated) for non-critical events.
            x-secret: ''
      groupInterval:
        default: 5m
        description: How long to wait before sending a notification about new alerts that are added to a group of alerts for which an initial notification has already been sent. (Usually ~5m or more.)
        type: string
      msteams:
        additionalProperties: false
        properties:
          highPrio:
            description: The low prio web hook.
            type: string
            x-secret: ''
          lowPrio:
            description: The high prio web hook.
            type: string
            x-secret: ''
      receivers:
        description: Notification receivers.
        items:
          enum:
            - slack
            - msteams
            - email
          type: string
        type: array
      repeatInterval:
        default: 3h
        description: How long to wait before sending a notification again if it has already been sent successfully for an alert. (Usually ~3h or more).
        type: string
      slack:
        additionalProperties: false
        properties:
          channel:
            default: dev-mon-otomi
            description: The Slack channel for non-critical notifications.
            type: string
          channelCrit:
            default: dev-mon-otomi
            description: The Slack channel for critical notifications.
            type: string
          url:
            $ref: '#/definitions/url'
            description: A Slack webhook URL.
            x-secret: ''
    allOf:
      - anyOf:
          - not:
              required:
                - receivers
          - properties:
              receivers:
                contains:
                  enum:
                    - email
            required:
              - email
          - properties:
              receivers:
                contains:
                  enum:
                    - msteams
            required:
              - msteams
          - properties:
              receivers:
                contains:
                  enum:
                    - slack
            required:
              - slack
      - anyOf:
          - not:
              required:
                - drone
          - properties:
              drone:
                const: msteam
            required:
              - msteam
          - properties:
              drone:
                const: slack
            required:
              - slack

  annotations:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of annotations.
  autoscaling:
    additionalProperties: false
    properties:
      enabled:
        default: true
        type: boolean
      maxReplicas:
        type: integer
        default: 10
      minReplicas:
        type: integer
        default: 2
  aws:
    definitions:
      accessKey:
        title: AWS access key
        description: An AWS access key ID.
        type: string
        x-secret: ''
      secretKey:
        title: AWS secret key
        description: An AWS secret key.
        type: string
        x-secret: ''
      region:
        title: AWS region
        description: An AWS region.
        type: string
      role:
        description: Role may be set explicitly if no metadata can be accessed.
        example: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager
        type: string
  azure:
    definitions:
      clientId:
        title: Azure client id
        description: An Azure client id.
        type: string
        x-secret: ''
      clientSecret:
        title: Azure client secret
        description: An Azure client secret.
        type: string
        x-secret: ''
      environment:
        title: Azure environment
        description: An Azure environment. Don't specify this if you don't know what you are doing!
        type: string
        default: AzureCloud
        enum:
          - AzureCloud
          - AzureChinaCloud
          - AzureUSGovernment
          - AzureGermanCloud
      monitor:
        additionalProperties: false
        properties:
          appInsightsApiKey:
            $ref: '#/definitions/azure/definitions/clientSecret'
            title: AppInsights api key
            description: An Azure AppInsights client secret.
          appInsightsAppId:
            $ref: '#/definitions/azure/definitions/clientId'
            title: AppInsights app id
          azureLogAnalyticsSameAs:
            title: LogAnalytics using same creds?
            type: boolean
            default: true
          clientId:
            $ref: '#/definitions/azure/definitions/clientId'
          clientSecret:
            $ref: '#/definitions/azure/definitions/clientSecret'
          logAnalyticsClientId:
            $ref: '#/definitions/azure/definitions/clientId'
            title: LogAnalytics client id
            description: An Azure client secret.
          logAnalyticsClientSecret:
            $ref: '#/definitions/azure/definitions/clientSecret'
            title: LogAnalytics client secret
            description: An Azure client secret.
          logAnalyticsTenantId:
            $ref: '#/definitions/azure/definitions/tenantId'
            title: LogAnalytics tenant id
            description: An Azure tenant id.
          logAnalyticsDefaultWorkspace:
            title: LogAnalytics default workspace to show
            description: An Azure LogAnalytics workspace.
            type: string
          subscriptionId:
            $ref: '#/definitions/azure/definitions/subscriptionId'
          tenantId:
            $ref: '#/definitions/azure/definitions/tenantId'
        required:
          - clientId
          - clientSecret
      tenantId:
        title: Azure tenant id
        description: An Azure tenant id.
        type: string
      subscriptionId:
        title: Azure subscription id
        description: An Azure subscription id.
        type: string
  cluster:
    additionalProperties: false
    properties:
      apiName:
        description: Only used for API/UI to show in app.
        type: string
      apiServer:
        description: Used by kubectl for local deployment to target cluster.
        $ref: '#/definitions/url'
      domainSuffix:
        $ref: '#/definitions/domain'
        description: Domain suffix for the cluster. Also added to list of dns zones in the Otomi Console.
      entrypoint:
        description: A Kubernetes API public IP address (onprem only).
        type: string
      k8sContext:
        $ref: '#/definitions/k8sContext'
      k8sVersion:
        $ref: '#/definitions/k8sVersion'
      name:
        type: string
      owner:
        $ref: '#/definitions/idName'
        description: The name of the organization owning the cluster.
      provider:
        $ref: '#/definitions/provider'
      region:
        description: Dependent on provider.
        examples:
          - europe-west4
          - eu-central-1
          - westeurope
        type: string
      vpcID:
        description: AWS only. If provided will override autodiscovery from metadata.
        type: string
    required:
      - domainSuffix
      - k8sVersion
      - name
      - owner
      - provider
  containerSpecNoSec:
    additionalProperties: false
    properties:
      image:
        $ref: '#/definitions/image'
      resources:
        $ref: '#/definitions/resources'
      env:
        $ref: '#/definitions/env'
      files:
        $ref: '#/definitions/files'
      nativeSecrets:
        $ref: '#/definitions/nativeSecrets'
        description: Reserved for internal use.
      secrets:
        $ref: '#/definitions/secrets'
      secretMounts:
        $ref: '#/definitions/secretMounts'
      command:
        type: array
        items:
          type: string
      args:
        type: array
        items:
          type: string
    required:
      - image
      - resources
  containerSpec:
    allOf:
      - $ref: '#/definitions/securityContext'
      - $ref: '#/definitions/containerSpecNoSec'
  cpuQuantity:
    description: 'Amount of cores, or slice of cpu in millis.'
    examples:
      - '1'
      - 200m
    pattern: '^([0-9]+\.[0-9]{1,2})|([0-9]{2,3}m)?$'
    type: string
  domain:
    pattern: '^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$'
    type: string
  droneGit:
    properties:
      clientID:
        type: string
      clientSecretValue:
        type: string
        x-secret: ''
  email:
    pattern: '^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$'
    type: string
    nullable: true
  env:
    additionalProperties: false
    examples:
      - FOO: bar
      - bar: foo
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Environment variables
  files:
    additionalProperties: false
    description: Dictionary of absolute path > content pairs.
    patternProperties:
      '^[/].*':
        type: string
  google:
    additionalProperties: false
    definitions:
      accountJson:
        type: string
        x-secret: ''
      projectId:
        type: string
  hostPort:
    pattern: '^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]):()([1-9]|[1-5]?[0-9]{2,4}|6[1-4][0-9]{3}|65[1-4][0-9]{2}|655[1-2][0-9]|6553[1-5])$'
    type: string
  idName:
    description: A lowercase name that starts with a letter and may contain dashes.
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
    type: string
  image:
    additionalProperties: false
    properties:
      pullPolicy:
        default: IfNotPresent
        enum:
          - IfNotPresent
          - Always
        type: string
      repository:
        $ref: '#/definitions/repository'
      tag:
        default: latest
        type: string
    title: Container image
  imageSimple:
    additionalProperties: false
    properties:
      pullPolicy:
        default: IfNotPresent
        enum:
          - IfNotPresent
          - Always
        type: string
      tag:
        type: string
    title: Container image
  jobs:
    description: You may pass an array of Job objects. The Kubernetes API accepts
      a Job specification, which is meant for run-to-completion apps (e.g. batch
      Jobs).
    items:
      items:
        allOf:
          - properties:
              id:
                type: string
                readOnly: true
            type: object
          - $ref: '#/definitions/jobSpec'
          - $ref: '#/definitions/podSpec'
    type: array
  jobSpec:
    additionalProperties: false
    properties:
      type:
        default: Job
        enum:
          - Job
          - CronJob
        type: string
      name:
        $ref: '#/definitions/idName'
        title: Name
        description: A job name
        example: some-job
      enabled:
        default: true
        type: boolean
      runPolicy:
        default: OnSpecChange
        description: |
          If runPolicy is set to 'Always', the job controller will always be re-deployed after a successful deployment with Helm.
          If runPolicy is set to 'OnSpecChange', the job controller will only be re-deployed if one changes this specification.
        enum:
          - Always
          - OnSpecChange
        type: string
      schedule:
        default: 0 1 * * *
        description: Must give a cron-type expression if the job type is 'Cronjob'.
        type: string
      script:
        $ref: '#/definitions/script'
      shell:
        default: /bin/sh
        description: Full path to a shell binary that exists in the image.
        type: string
      ttlSecondsAfterFinished:
        default: 86400
        description: Time To Live after job is finished in seconds. Will be removed afterwards.
        title: TTL after finished
        type: integer
      init:
        type: array
        items:
          $ref: '#/definitions/containerSpec'
        nullable: true
    required:
      - name
      - script
      - type
    type: object
  k8sContext:
    description: The cluster k8s context as found in $KUBECONFIG.
    type: string
  k8sVersion:
    description: The cluster k8s version. Otomi supports 2 minor versions backwards compatibility from the suggested default.
    enum:
      - '1.18'
      - '1.19'
      - '1.20'
    type: string
  labels:
    $ref: '#/definitions/labelsAnnotations'
    description: A set of labels.
  labelsAnnotations:
    additionalProperties: false
    patternProperties:
      '^((([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]){1,253}\/)?([a-z0-9A-Z]+[a-z0-9A-Z-_.]+[a-z0-9A-Z]){1,63}$':
        pattern: '^((.){1,253}\/)?(.){1,63}$'
        type: string
  logLevel:
    type: string
    default: info
    enum:
      - error
      - warn
      - info
      - debug
      - trace
  memoryQuantity:
    description: Amount of memory. Valid units are E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki.
    examples:
      - 1Mi
      - 0.5M
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G|M|K|Ei|Pi|Ti|Gi|Mi|Ki)?$'
    type: string
  nativeSecrets:
    description: List of kubernetes secret names.
    additionalProperties: false
    patternProperties:
      '[a-zA-Z_]{1,}[a-zA-Z0-9_]*':
        maxLength: 131072
        type: string
    nullable: true
    type: object
    title: Kubernetes secrets
  podSecurityContext:
    allOf:
      - $ref: '#/definitions/securityContext'
      - properties:
          fsGroup:
            description: Supplementary group ID. Volumes that support ownership management are modified to be owned and writable by this ID.
            type: integer
          fsGroupChangePolicy:
            description:
              'Defines behavior for changing ownership and permission of the volume before being exposed inside a Pod. This field only applies to volume types that support fsGroup controlled ownership and permissions.
              This field has two possible values:
              - OnRootMismatch: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
              - Always: Always change permission and ownership of the volume when volume is mounted.'
            type: string
            enum:
              - Always
              - OnRootMismatch
    description: Security context for the pod.
    title: Pod security context
  podSpec:
    allOf:
      - properties:
          annotations:
            $ref: '#/definitions/annotations'
            title: Pod annotations
        type: object
      - $ref: '#/definitions/podSecurityContext'
      - $ref: '#/definitions/securityContext'
      - $ref: '#/definitions/containerSpec'
    type: object
  portNumber:
    maximum: 32768
    minimum: 80
    type: number
  provider:
    type: string
    enum:
      - aws
      - azure
      - google
      - onprem
  redisChart:
    properties:
      _rawValues:
        $ref: '#/definitions/rawValues'
      architecture:
        type: string
        enum:
          - standalone
          - replication
        default: standalone
      password:
        type: string
        x-secret: 'randAlpha 24'
      resources:
        additionalProperties: false
        properties:
          master:
            $ref: '#/definitions/resources'
          sentinel:
            $ref: '#/definitions/resources'
          slave:
            $ref: '#/definitions/resources'
      sizes:
        additionalProperties: false
        properties:
          master:
            $ref: '#/definitions/size'
          sentinel:
            $ref: '#/definitions/size'
          slave:
            $ref: '#/definitions/size'
    type: object
  registry:
    pattern: '^[a-z0-9]+(?:[._-][a-z0-9]+)*$'
    type: string
  repoUrl:
    description: Path to a remote git repo without protocol. Will use https to access.
    pattern: '^(.+@)*([\w\d\.]+)(:[\d]+){0,1}/*(.*)$'
    type: string
  repository:
    description: A container image repository.
    pattern: '^[a-z0-9]+(?:[/._-]{1,2}[a-z0-9]+)*$'
    type: string
  resource:
    additionalProperties: false
    properties:
      cpu:
        $ref: '#/definitions/cpuQuantity'
      memory:
        $ref: '#/definitions/memoryQuantity'
    required:
      - cpu
      - memory
  resources:
    additionalProperties: false
    description: Compute resources for containers.
    properties:
      limits:
        $ref: '#/definitions/resource'
        description: Requested resources (best effort).
      requests:
        $ref: '#/definitions/resource'
        description: Requested resources (guaranteed).
    title: Pod resources
  runAsUser:
    description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    type: integer
    minimum": 0
    maximum": 65535
    default: 1001
  scaling:
    additionalProperties: false
    description: Min and max number of replicas.
    properties:
      maxReplicas:
        type: integer
      minReplicas:
        type: integer
  script:
    description: May specify a non-empty string containing an executable script.
    type: string
    properties:
      id:
        readOnly: true
        type: string
      name:
        $ref: '#/definitions/idName'
    required:
      - name
      - type
  secret:
    type: object
    properties:
      id:
        readOnly: true
        type: string
      name:
        $ref: '#/definitions/subdomainType'
    required:
      - name
    oneOf:
      - title: Generic
        properties:
          type:
            default: generic
            enum:
              - generic
          entries:
            type: array
            items:
              description: A property name at vaultPath
              minItems: 1
              pattern: '^[a-zA-Z0-9_]*$'
              type: string
            uniqueItems: true
        required:
          - type
          - entries
      - title: Docker registry
        properties:
          type:
            default: docker-registry
            enum:
              - docker-registry
            type: string
        required:
          - type
      - title: TLS
        properties:
          type:
            default: tls
            enum:
              - tls
            type: string
          crt:
            type: string
            default: 'tls.crt'
          key:
            type: string
            default: 'tls.key'
          ca:
            type: string
            default: 'ca.crt'
        required:
          - type
          - crt
          - key
  secrets:
    description: List of secret names that will have their props injected as env vars into the container.
    items:
      type: string
      pattern: '[a-zA-Z_]{1,}[a-zA-Z0-9_]*'
    nullable: true
    title: Secrets
    type: array
  secretMounts:
    description: Dictionary of absolute folder path > secret name. Will mount the contents of the secret in the container at the specified folder path.
    examples:
      - /foo: bar
    nullable: true
    patternProperties:
      '^[/].*$':
        type: string
    title: Secret mounts
    type: object
  secretTemplates:
    definitions:
      otomiAdminUsername:
        x-secret: '"admin"'
  securityContext:
    additionalProperties:
      uniqueItems: true
    properties:
      runAsUser:
        $ref: '#/definitions/runAsUser'
      runAsNonRoot:
        description: Enforces that the container must run as non root. This implies that the UID must also be set with runAsUser.
        type: boolean
        default: true
      runAsGroup:
        description: The GID to run the entrypoint of the container process. Defaults to group specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
        type: integer
        minimum": 0
        maximum": 65535
        default: 1001
  service:
    additionalProperties: false
    properties:
      authz:
        additionalProperties: false
        description: Identifies a workload to authorize.
        properties:
          forwardOriginalToken:
            default: false
            description: If true istio will forward the bearer token instead of removing it from the headers.
            type: boolean
          workload:
            $ref: '#/definitions/labelsAnnotations'
      certArn:
        description: Only available on AWS when an external LB is configured. The cert ARN will be registered on the load balancer for SSL termination.
        example: arn:aws:acm:eu-central-1:xxx:certificate/xxx
        pattern: 'arn:aws(-cn|-us-gov)?:acm:\S+:\d+:\w+\/\S+'
        type: string
      certName:
        description: The name of a TLS secret known to exist in the team namespace.
        example: www-example-com
        type: string
      domain:
        description: A custom service domain name (max 64 bytes).
        maxLength: 64
        type: string
      forwardPath:
        default: false
        description: Whether to forward the path into the service, or 'terminate' it.
        type: boolean
      hasCert:
        description: Select when a certificate exists and should not be generated.
        type: boolean
      hide:
        description: Used by otomi console to determine wether to render it on screen or not. Only used by core services.
        type: boolean
      host:
        description: Reference to another core service name. Used by otomi console to show a variation of a core service with a different path (i.e. Loki). Only used by core services.
        type: string
      id:
        description: Unique identifier created by and used in API. Optional.
        type: string
      auth:
        description: When true the service will get it's own domain by prefixing the app name to the cluster domain. Mostly used by core apps.
        type: boolean
      isShared:
        description: When true the service will get it's own domain by prefixing the app name to the cluster domain. Mostly used by core apps.
        type: boolean
      ksvc:
        anyOf:
          - description: Details for a knative service that will be deployed and operated.
            allOf:
              - properties:
                  annotations:
                    $ref: '#/definitions/annotations'
                    title: Pod annotations
                type: object
              - properties:
                  securityContext:
                    properties:
                      runAsUser:
                        $ref: '#/definitions/runAsUser'
                      readOnlyRootFilesystem:
                        description: Whether this container has a read-only root filesystem. Default is false.
                        type: boolean
                        default: false
              - $ref: '#/definitions/containerSpecNoSec'
              - properties:
                  autoCD:
                    additionalProperties: false
                    description: NOT IN USE YET! Deploys new images based on a tagging strategy.
                    oneOf:
                      - additionalProperties: false
                        nullable: true
                        title: 'Off'
                        type: string
                      - nullable: true
                        type: object
                        properties:
                          additionalProperties: false
                          semver:
                            description: 'Use this filter if your images tags follow semantic versioning rules (MAJOR.MINOR.PATCH). E.g.: PATCH only: "~1.1", MINOR and PATCH only "~1", ALL "*".'
                            example: 'PATCH only: "~1.1", MINOR and PATCH only "~1", ALL "*",  ">=1.2.3-0"'
                            title: Semver version pattern
                            type: string
                          tagMatcher:
                            default: semver
                            enum:
                              - semver
                            type: string
                        required:
                          - semver
                        title: Semver versioning
                      - additionalProperties: false
                        properties:
                          glob:
                            description: 'Use this filter if you want to make simple non-standard patterns. E.g.: "master-v1.*.*".'
                            example: master-v1.*.*
                            title: Glob string pattern
                            type: string
                          tagMatcher:
                            default: glob
                            enum:
                              - glob
                            type: string
                        required:
                          - glob
                        title: Glob pattern matching
                    title: Continuous delivery pipeline
                  containerPort:
                    $ref: '#/definitions/portNumber'
                    description: Container port the knative pod will connect with. Leaving this empty will let knative infer the port from the container, which usually works, but might be problematic when the container does not specifically expose a port. (As is the case with nginx derived images!)
                    title: Container port
                  scaleToZero:
                    default: false
                    description: Scales to zero after 60 seconds and needs approximately 8 seconds to start back up.
                    title: Scale to zero
                    type: boolean
          - description: Choose this when the ksvc is already deployed
            properties:
              predeployed:
                default: true
                description: Has this service been predeployed? Otherwise otomi will start it with the configuration given.
                type: boolean
      logo:
        description: Used by otomi-console as an override mechanism to display another logo.
        properties:
          name:
            type: string
        required:
          - name
      name:
        $ref: '#/definitions/idName'
        description: Short name. Will be used for generation of knative service name, as well as service URL.
      namespace:
        $ref: '#/definitions/idName'
        description: A kubernetes namespace. Only used by core services, so should be disallowed for non-admins.
      ownHost:
        default: true
        description: When true the service will get it's own domain by prefixing the app name to the team domain. Mostly set to true. This will probably be removed soon.
        type: boolean
      path:
        description: Used by otomi-console to render a path for the app. Only used by core services.
        type: string
      paths:
        items:
          description: |
            Path mapping to only route certain paths to the service. This allows micro services to operate on the same domain and port.
            When left empty all paths will go to this service.
          type: string
        # nullable: true
        type: array
      port:
        $ref: '#/definitions/portNumber'
        description: Points to the backing k8s service (only used when 'svc' is set).
      svc:
        $ref: '#/definitions/idName'
        description: When given a backing k8s service is expected to be deployed with this name, which will be exposed through this team service.
      tlsPass:
        description: Will pass the request to the backing service without TLS termination.
        type: boolean
        default: false
      type:
        nullable: true
        default: public
        description: Will determine the ingress routing.
        enum:
          - public
          - private
          - cluster
        type: string
    required:
      - name
      - type
  size:
    description: Disk size. Valid units are E|P|T|G|Ti|Gi.
    examples:
      - 1Gi
      - 0.5Ti
    pattern: '^([0-9]+\.)?[0-9]+(E|P|T|G||Ti|Gi)?$'
    type: string
  subdomainType:
    type: string
    pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
  team:
    additionalProperties: false
    properties:
      alerts:
        $ref: '#/definitions/alerts'
      azureMonitor:
        $ref: '#/definitions/azure/definitions/monitor'
      clusters:
        items:
          type: string
        type: array
      secrets:
        items:
          $ref: '#/definitions/secret'
        type: array
      id:
        $ref: '#/definitions/idName'
        description: Must be the same as the name.
      jobs:
        $ref: '#/definitions/jobs'
      limitRange:
        description: 'Kubernetes limit range. As is.'
        properties:
          default:
            $ref: '#/definitions/resource'
          defaultRequest:
            $ref: '#/definitions/resource'
      oidc:
        additionalProperties: false
        properties:
          groupMapping:
            description: IDP group id to map onto this team.
            type: string
      password:
        description: Will be used to separate team resources.
        type: string
        x-secret: ''
      resourceQuota:
        description: 'List of kubernetes resource quota. Should adhere to the "spec.hard" format as described here: https://kubernetes.io/docs/concepts/policy/resource-quotas/. Not validated as there is no schema published. Change at your own risk.'
        type: object
      selfService:
        $ref: '#/definitions/teamSelfService'
      services:
        items:
          $ref: '#/definitions/service'
        type: array
    required:
      - id
  teamSelfService:
    title: Team self service flags
    description: Grant team permissions to modify certain configuration parameters.
    type: object
    properties:
      Service:
        title: Service
        type: array
        items:
          type: string
          enum: [ingress]
        uniqueItems: true
      Team:
        title: Team
        type: array
        items:
          type: string
          enum: [alerts, oidc, resourceQuota]
        uniqueItems: true
  url:
    pattern: '^(https:\/\/)([\w\-])+\.{1}([a-zA-Z]{2,63})([\/\w-]*)*\/?\??([^#\n\r]*)?#?([^\n\r]*)$'
    type: string
  volumes:
    items:
      additionalProperties: false
      properties:
        name:
          description: Name must match mount name.
          type: string
        configMap:
          properties:
            name:
              type: string
    type: array
properties:
  alerts:
    $ref: '#/definitions/alerts'
  azure:
    description: Azure specific configuration.
    properties:
      storageType:
        properties:
          fast:
            type: string
          standard:
            type: string
      appgw:
        properties:
          isManaged:
            default: true
            description: Is this appgw installed as AKS addon?
            type: boolean
      monitor:
        $ref: '#/definitions/azure/definitions/monitor'
  cloud:
    additionalProperties: true
    properties:
      skipStorageClasses:
        description:
          List of storage classes to exclude from deployment, to avoid k8s errors due to patching not allowed.
          This is a rather hacky way to circumvent the patching problem, going against idempotency, but we need it.
          Without it we can't add new storageclasses to a cluster upgrading otomi.
        type: array
        items:
          type: string
          enum:
            - std
            - std-immediate
            - fast
            - fast-immediate
  charts:
    additionalProperties: true
    properties:
      cert-manager:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          email:
            $ref: '#/definitions/email'
          stage:
            default: production
            description: |
              The Let's Encrypt environment that is used for issuing certificates.
              The 'production' environment issues trusted certificates but has narrow rate limits, whereas the 'staging' environment issues untrusted certificates but provides broader rate limits.
              Read more about rate limits: https://letsencrypt.org/docs/rate-limits/.
            enum:
              - staging
              - production
            type: string
        required:
          - email
          - stage
      cluster-overprovisioner:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          cpu:
            $ref: '#/definitions/cpuQuantity'
          enabled:
            type: boolean
          memory:
            $ref: '#/definitions/memoryQuantity'
      demo-tlspass:
        additionalProperties: false
        properties:
          enabled:
            default: false
            type: boolean
          tlsCert:
            type: string
          tlsKey:
            type: string
      drone:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          adminIsMachine:
            type: boolean
            default: false
          adminUser:
            type: string
          adminToken:
            type: string
            x-secret: ''
          debug:
            default: false
            type: boolean
          enabled:
            default: false
            type: boolean
          githubAdmins:
            additionalProperties: false
            properties:
              org:
                type: string
              team:
                type: string
              token:
                type: string
          orgsFilter:
            type: string
          owner:
            type: string
          repo:
            $ref: '#/definitions/idName'
          repoFilter:
            type: string
          resources:
            additionalProperties: false
            properties:
              runner:
                $ref: '#/definitions/resources'
              server:
                $ref: '#/definitions/resources'
          sharedSecret:
            description: A secret used by drone-admit-members plugin. https://docs.drone.io/runner/kubernetes/configuration/reference/drone-secret-plugin-token/
            type: string
            x-secret: 'randAlphaNum 32'
          sourceControl:
            additionalProperties: false
            properties:
              bitbucketCloud:
                $ref: '#/definitions/droneGit'
              bitbucketServer:
                properties:
                  consumerKey:
                    default: consumerKey
                    type: string
                    x-secret: ''
                  passwordKey:
                    default: password
                    type: string
                    x-secret: ''
                  privateKey:
                    default: privateKey
                    type: string
                    x-secret: ''
                  server:
                    type: string
                  username:
                    type: string
                    x-secret: ''
              gitea:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        type: string
              github:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        default: 'https://github.com'
                        type: string
              gitlab:
                allOf:
                  - $ref: '#/definitions/droneGit'
                  - properties:
                      server:
                        type: string
              gogs:
                properties:
                  server:
                    type: string
              password:
                type: string
              provider:
                default: github
                enum:
                  - github
                  - gitlab
                  - gitea
                  - gogs
                  - bitbucketCloud
                  - bitbucketServer
                type: string
              secret:
                type: string
              username:
                type: string
          trace:
            default: false
            type: boolean
      external-dns:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          domainFilters:
            items:
              type: string
            type: array
          zoneIdFilters:
            items:
              type: string
      gatekeeper-operator:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
          excludedNamespaces:
            type: array
            items:
              type: string
          emitAuditEvents:
            type: boolean
          emitAdmissionEvents:
            type: boolean
          auditFromCache:
            type: boolean
          disableValidatingWebhook:
            type: boolean
          logLevel:
            type: string
          constraintViolationsLimit:
            type: integer
          auditInterval:
            type: integer
          replicas:
            type: integer
          dataSync:
            type: array
            items:
              type: object
      gitea:
        properties:
          enabled:
            type: boolean
          adminPassword:
            type: string
            x-secret: ''
          postgresqlPassword:
            type: string
            description: Once set and deployed it cannot be changed with manual intervention.
            x-secret: 'randAlphaNum 20'
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - required:
                  - postgresqlPassword
      harbor:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          adminPassword:
            type: string
            x-secret: ''
          core:
            properties:
              secret:
                type: string
                x-secret: 'randAlphaNum 16'
              xsrfKey:
                type: string
                x-secret: 'randAlphaNum 32'
          enabled:
            type: boolean
            default: true
          jobservice:
            properties:
              secret:
                type: string
                x-secret: 'randAlphaNum 16'
          persistence:
            additionalProperties: false
            properties:
              imageChartStorage:
                additionalProperties: false
                description: For reference go to https://github.com/distribution/distribution/blob/main/docs/configuration.md#storage
                properties:
                  aws:
                    additionalProperties: false
                    properties:
                      accesskey:
                        $ref: '#/definitions/aws/definitions/accessKey'
                      secretkey:
                        $ref: '#/definitions/aws/definitions/secretKey'
                      region:
                        $ref: '#/definitions/aws/definitions/region'
                      regionendpoint:
                        type: string
                      bucket:
                        type: string
                      encrypt:
                        type: boolean
                      keyid:
                        type: string
                      secure:
                        type: boolean
                      v4auth:
                        type: boolean
                      chunksize:
                        type: integer
                      multipartcopychunksize:
                        type: integer
                      multipartcopymaxconcurrency:
                        type: integer
                      multipartcopythresholdsize:
                        type: integer
                      rootdirectory:
                        type: string
                  azure:
                    additionalProperties: false
                    properties:
                      accountname:
                        type: string
                      accountkey:
                        type: string
                        x-secret: ''
                      container:
                        type: string
                      realm:
                        type: string
                  gcs:
                    additionalProperties: false
                    properties:
                      bucket:
                        type: string
                      encodedkey:
                        type: string
                        x-secret: ''
                      rootdirectory:
                        type: string
                  type:
                    type: string
          registry:
            properties:
              secret:
                type: string
                x-secret: 'randAlpha 16'
              credentials:
                properties:
                  htpasswd:
                    type: string
                    x-secret: 'htpasswd .dot.username (.dot.password | default .o.adminPassword)'
                  username:
                    type: string
                    $ref: '#/definitions/secretTemplates/definitions/otomiAdminUsername'
                  password:
                    type: string
                    x-secret: ''
            required:
              - secret
              - credentials
          resources:
            additionalProperties: false
            properties:
              adapter:
                $ref: '#/definitions/resources'
              chartmuseum:
                $ref: '#/definitions/resources'
              clair:
                $ref: '#/definitions/resources'
              controller:
                $ref: '#/definitions/resources'
              core:
                $ref: '#/definitions/resources'
              database:
                $ref: '#/definitions/resources'
              jobservice:
                $ref: '#/definitions/resources'
              portal:
                $ref: '#/definitions/resources'
              redis:
                $ref: '#/definitions/resources'
              registry:
                $ref: '#/definitions/resources'
              registry-controller:
                $ref: '#/definitions/resources'
          secretKey:
            type: string
            x-secret: 'randAlpha 16'
      hello:
        properties:
          enabled:
            description: Hello world demo chart. When you turn this off you may also have to remove the ingress service.
            type: boolean
            default: false
      httpbin:
        properties:
          enabled:
            description: The famous httpbin application.
            type: boolean
            default: false
      ingress-azure:
        additionalProperties: false
        description: A chart for Azure Application Gateway.
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
          appgw:
            additionalProperties: false
            description: Application Gateway.
            properties:
              name:
                description: A name of the Application Gateway.
                type: string
              resourceGroup:
                description: A name of the Azure Resource Group in which Application Gateway was created.
                type: string
              subnetName:
                description: A subnet of the application gateway.
                type: string
              subnetPrefix:
                description: A subnet in CIDR notation.
                examples:
                  - 10.1.0.0/16
                type: string
              subscriptionId:
                description: The Azure Subscription ID in which Application Gateway resides.
                type: string
              usePrivateIP:
                default: false
                description: Whether a private ip range or not.
                type: boolean
            required:
              - subscriptionId
              - resourceGroup
              - name
              - subnetName
              - subnetPrefix
          armAuth:
            additionalProperties: false
            description: A service Principal secret.
            properties:
              secretJSON:
                description: A service Principal secret JSON key (base64 encoded).
                type: string
            required:
              - secretJSON
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - required:
                  - armAuth
                  - appgw
      istio:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          addonComponents:
            additionalProperties: false
            properties:
              grafana:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
              kiali:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
              prometheus:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
              tracing:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
          autoscaling:
            properties:
              egressgateway:
                $ref: '#/definitions/scaling'
              gateway-local:
                $ref: '#/definitions/scaling'
              ingressgateway:
                $ref: '#/definitions/scaling'
              ingressgateway-auth:
                $ref: '#/definitions/scaling'
              pilot:
                $ref: '#/definitions/scaling'
          egressGateway:
            properties:
              enabled:
                default: false
                type: boolean
          global:
            additionalProperties: false
            properties:
              logging:
                properties:
                  level:
                    type: string
              mtls:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
              proxy:
                additionalProperties: false
                properties:
                  resources:
                    $ref: '#/definitions/resources'
              sds:
                additionalProperties: false
                properties:
                  enabled:
                    type: boolean
          meshConfig:
            properties:
              defaultConfig:
                type: object
            required:
              - defaultConfig
          resources:
            properties:
              egressgateway:
                $ref: '#/definitions/resources'
              gateway-local:
                $ref: '#/definitions/resources'
              ingressgateway:
                $ref: '#/definitions/resources'
              ingressgateway-auth:
                $ref: '#/definitions/resources'
              pilot:
                $ref: '#/definitions/resources'
      keycloak:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: true
          idp:
            additionalProperties: false
            properties:
              alias:
                type: string
              clientID:
                type: string
                x-secret: '"otomi"'
              clientSecret:
                type: string
                x-secret: 'randAlphaNum 32'
          postgresqlPassword:
            type: string
            description: Once set and deployed it cannot be changed with manual intervention.
            x-secret: 'randAlphaNum 20'
          resources:
            additionalProperties: false
            properties:
              keycloak:
                $ref: '#/definitions/resources'
              postgresql:
                $ref: '#/definitions/resources'
          theme:
            enum:
              - default
              - otomi
            type: string
        required:
          - postgresqlPassword
      kubeapps:
        additionalProperties: false
        properties:
          enabled:
            default: true
            type: boolean
          postgresqlPassword:
            type: string
            description: Once set and deployed it cannot be changed with manual intervention.
            x-secret: 'randAlphaNum 20'
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - required:
                  - postgresqlPassword
      kubernetes-external-secrets:
        additionalProperties: false
        properties:
          logLevel:
            $ref: '#/definitions/logLevel'
      kube-descheduler:
        additionalProperties: false
        properties:
          enabled:
            default: true
            type: boolean
          schedule:
            default: '*/30 * * * *'
            type: string
      loki:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          adminPassword:
            type: string
            x-secret: 'randAlphaNum 20'
          persistence:
            additionalProperties: false
            properties:
              size:
                default: 20Gi
                type: string
          retention:
            additionalProperties: false
            properties:
              duration:
                default: 24h
                type: string
              period:
                default: 24h
                description: Should be a multiple of 24h. See https://grafana.com/docs/loki/latest/operations/storage/boltdb-shipper/.
                type: string
            required:
              - duration
          aws:
            type: object
          azure:
            description: Missing from docs but available with this schema.
            properties:
              account_key:
                type: string
                x-secret: ''
              account_name:
                type: string
              container_name:
                type: string
            type: object
          bigtable:
            type: object
          cassandra:
            type: object
          gcs:
            type: object
          swift:
            type: object
          local:
            type: object
          storageType:
            type: string
            enum:
              - aws
              - azure
              - bigtable
              - cassandra
              - filesystem
              - gcs
              - swift
              - local
          v11StartDate:
            description: Set this to a date just after deployment in case of an upgrade. (Otomi started at v9 with filesystem.)
            title: Schema v11 start date
            type: string
        required:
          - adminPassword
      nginx-ingress:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          autoscaling:
            $ref: '#/definitions/autoscaling'
          loadBalancerIP:
            type: string
          loadBalancerRG:
            type: string
          maxBodySize:
            type: string
            default: 1024m
          maxBodySizeBytes:
            type: number
            default: 1073741824
            description: Needed for modsecurity. Should correspond to maxBodySize, but expressed in bytes.
          modsecurity:
            title: MOD Security
            description: Enables MOD Security functionality.
            properties:
              block:
                description: Makes nginx block requests that are marked as violating the modsec rules.
                type: boolean
                default: true
              enabled:
                type: boolean
                default: false
              owasp:
                description: Turns on the default OWASP rule set for modsec. See
                type: boolean
                default: true
            type: object
          resources:
            $ref: '#/definitions/resources'
          private:
            description: Private loadbalancer configuration.
            properties:
              enabled:
                title: Enable private loadbalancer
                description: Enable to start an extra loadbalancer for private network traffic.
                type: boolean
                default: false
              autoscaling:
                $ref: '#/definitions/autoscaling'
              loadBalancerIP:
                type: string
              loadBalancerRG:
                type: string
              resources:
                $ref: '#/definitions/resources'
              service:
                properties:
                  annotations:
                    $ref: '#/definitions/annotations'
            title: Private loadbalancer
            type: object
          service:
            properties:
              annotations:
                $ref: '#/definitions/annotations'
      oauth2-proxy:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          config:
            properties:
              cookieSecret:
                description: Cookie secret must be 128 bit base64 encoded string.
                pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
                type: string
                x-secret: 'randAlphaNum 16'
      oauth2-proxy-redis:
        $ref: '#/definitions/redisChart'
      otomi-api:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          git:
            additionalProperties: false
            properties:
              branch:
                type: string
              email:
                $ref: '#/definitions/email'
              localPath:
                type: string
              password:
                type: string
                x-secret: ''
              repoUrl:
                $ref: '#/definitions/repoUrl'
              user:
                type: string
          image:
            $ref: '#/definitions/imageSimple'
          resources:
            additionalProperties: false
            properties:
              api:
                $ref: '#/definitions/resources'
              tools:
                $ref: '#/definitions/resources'
      otomi-console:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          image:
            $ref: '#/definitions/imageSimple'
        allOf:
          - anyOf:
              - not:
                  properties:
                    enabled:
                      const: true
                  required:
                    - enabled
              - properties:
                  registry:
                    required:
                      - username
                      - password
        type: object
      prometheus-operator:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          additionalProperties: false
          grafana:
            additionalProperties: false
            properties:
              adminPassword:
                type: string
                x-secret: ''
          prometheus:
            additionalProperties: false
            properties:
              storageSize:
                type: string
          resources:
            additionalProperties: false
            properties:
              grafana:
                $ref: '#/definitions/resources'
      redis-shared:
        allOf:
          - $ref: '#/definitions/redisChart'
          - properties:
              enabled:
                type: boolean
                default: false
      sitespeed:
        additionalProperties: false
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
          pvc:
            additionalProperties: false
            properties:
              graphite:
                type: string
              results:
                type: string
          retention:
            type: string
          schedule:
            type: string
      vault:
        additionalProperties: false
        properties:
          enabled:
            type: boolean
            default: true
          logLevel:
            $ref: '#/definitions/logLevel'
          seal:
            description: Use a KMS to encrypt and decrypt the master key
            nullable: true
            type: object
            oneOf:
              - title: gcpckms
                properties:
                  gcpckms:
                    properties:
                      project:
                        type: string
                      region:
                        type: string
                      key_ring:
                        type: string
                      kmsAccount:
                        type: string
                    required:
                      - project
                      - region
                      - key_ring
                      - kmsAccount
                required:
                  - gcpckms
              - title: awskms
                properties:
                  awskms:
                    properties:
                      region:
                        type: string
                      access_key:
                        type: string
                      secret_key:
                        type: string
                        x-secret: ''
                      endpoint:
                        type: string
                    required:
                      - region
                      - access_key
                      - secret_key
                      - endpoint
                required:
                  - awskms
              - title: azurekeyvault
                properties:
                  azurekeyvault:
                    properties:
                      vault_name:
                        type: string
                      tenant_id:
                        type: string
                      client_id:
                        type: string
                      client_secret:
                        type: string
                        x-secret: ''
                    required:
                      - vault_name
                      - tenant_id
                      - client_id
                      - client_secret
                required:
                  - azurekeyvault
          storage:
            description: Storage configuration. See https://www.vaultproject.io/docs/configuration/storage.
      weave-scope:
        properties:
          _rawValues:
            $ref: '#/definitions/rawValues'
          enabled:
            type: boolean
            default: false
  cluster:
    $ref: '#/definitions/cluster'
  dns:
    additionalProperties: false
    properties:
      zones:
        description: Extra dns zones that the cluster can administer (see dns). Team services can use this to publish their URLs on.
        items:
          $ref: '#/definitions/domain'
        type: array
      provider:
        description: The DNS provider managing the domains.
        oneOf:
          - title: AWS
            properties:
              aws:
                properties:
                  accessKeyID:
                    $ref: '#/definitions/aws/definitions/accessKey'
                  secretAccessKey:
                    $ref: '#/definitions/aws/definitions/secretKey'
                  region:
                    $ref: '#/definitions/aws/definitions/region'
                  role:
                    $ref: '#/definitions/aws/definitions/role'
                required:
                  - region
            required:
              - aws
          - title: Azure
            properties:
              azure:
                properties:
                  cloud:
                    title: Cloud
                    type: string
                    description: Azure Cloud
                  resourceGroup:
                    title: Resource group
                    type: string
                    description: Azure resource group
                  hostedZoneName:
                    title: Hosted zone name
                    type: string
                  tenantId:
                    title: Tenant ID
                    type: string
                    description: Azure tenant ID
                  subscriptionId:
                    title: Subscription ID
                    type: string
                    description: Azure subscription ID
                  aadClientId:
                    title: Client ID
                    type: string
                    description: Azure Application Client ID
                  aadClientSecret:
                    title: Client secret
                    type: string
                    description: Azure Application Client Secret
                    x-secret: ''
                  useManagedIdentityExtension:
                    title: Using managed identities?
                    type: boolean
                    description: If you use Azure MSI, this should be set to true
                    default: false
                required:
                  - resourceGroup
                  - aadClientId
                  - aadClientSecret
            required:
              - azure
          - title: Google
            properties:
              google:
                properties:
                  serviceAccountKey:
                    $ref: '#/definitions/google/definitions/accountJson'
                    description: A service account key in json format for managing a DNS zone.
                  project:
                    $ref: '#/definitions/google/definitions/projectId'
                required:
                  - serviceAccountKey
                  - project
            required:
              - google
    required:
      - provider
  home:
    $ref: '#/definitions/alerts'
  kms:
    additionalProperties: false
    properties:
      sops:
        oneOf:
          - properties:
              provider:
                type: string
                const: aws
              aws:
                properties:
                  keys:
                    description: Comma separated list of one or two ARNs to keys as defined in AWS KMS. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: AWS KMS keys
                    type: string
                  accessKey:
                    $ref: '#/definitions/aws/definitions/accessKey'
                  secretKey:
                    $ref: '#/definitions/aws/definitions/secretKey'
                  region:
                    $ref: '#/definitions/aws/definitions/region'
                required:
                  - accessKey
                  - keys
                  - region
                  - secretKey
            required:
              - aws
          - properties:
              provider:
                type: string
                const: azure
              azure:
                properties:
                  keys:
                    description: Comma separated list of one or two paths to keys as defined in Azure Keyvault. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: Azure Keyvault keys
                    type: string
                  clientId:
                    $ref: '#/definitions/azure/definitions/clientId'
                  clientSecret:
                    $ref: '#/definitions/azure/definitions/clientSecret'
                  tenantId:
                    $ref: '#/definitions/azure/definitions/tenantId'
                required:
                  - clientId
                  - clientSecret
                  - keys
                  - tenantId
            required:
              - azure
          - properties:
              provider:
                type: string
                const: google
              google:
                properties:
                  keys:
                    description: Comma separated list of one or two paths to keys as defined in GCP KMS. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: GCP KMS keys
                    type: string
                  accountJson:
                    $ref: '#/definitions/google/definitions/accountJson'
                  project:
                    $ref: '#/definitions/google/definitions/projectId'
                required:
                  - keys
                  - accountJson
                  - project
            required:
              - google
          - properties:
              provider:
                type: string
                const: vault
              vault:
                properties:
                  keys:
                    description: Comma separated list of one or two paths to keys as defined in Vault. One if used for both enc+dec. Two if one for enc, other for dec.
                    title: Vault keys
                    type: string
                  token:
                    type: string
                    x-secret: ''
                required:
                  - keys
                  - token
            required:
              - vault
  letsencryptCA:
    type: string
  letsencryptRootCA:
    type: string
  oidc:
    additionalProperties: false
    description: 'Holds many parts used in different locations. Please see keycloak, grafana, istio and oauth-proxy as those are all consuming (parts of) these settings.'
    properties:
      adminGroupID:
        type: string
      apiUrl:
        $ref: '#/definitions/url'
        description: Only used for grafana when Keycloak is disabled. (Not recommended because that disables authorization.)
      authUrl:
        $ref: '#/definitions/url'
        description: Only used for grafana when Keycloak is disabled. (Not recommended because that disables authorization.)
      clientID:
        type: string
      clientSecret:
        type: string
        x-secret: ''
      issuer:
        $ref: '#/definitions/url'
      scope:
        type: string
        default: openid email profile
        description: Default values are used by keycloak. May be overridden in case keycloak is disabled.
      teamAdminGroupID:
        type: string
      tenantID:
        type: string
      tokenUrl:
        $ref: '#/definitions/url'
      usernameClaimMapper:
        type: string
        description: Claim name used by Keycloak to identify incoming users from identity provider
        default: '${CLAIM.email}'
      subClaimMapper:
        type: string
        description: Select OIDC claim to be passed by Keycloak as a unique user identifier. Best to not change this from the default.
        default: sub
  otomi:
    additionalProperties: false
    properties:
      additionalClusters:
        type: array
        items:
          title: Additional cluster
          description: A k8s cluster managed by Otomi.
          properties:
            domainSuffix:
              $ref: '#/definitions/domain'
            name:
              $ref: '#/definitions/idName'
            provider:
              $ref: '#/definitions/provider'
          required:
            - domainSuffix
            - name
            - provider
      adminPassword:
        type: string
        x-secret: 'randAlphaNum 20'
      globalPullSecret:
        title: Global pullsecret
        description: Will be connected to each "default" service account in all otomi app namespaces.
          Handy for authenticating with DockerHub to avoid rate limiting.
          Also useful when pulling all otomi images from a private repo. (One would need to override all the images in the config first.)
        additionalProperties: false
        properties:
          username:
            type: string
          password:
            type: string
            x-secret: ''
          email:
            type: string
            default: not@us.ed
          server:
            type: string
            default: docker.io
        required:
          - username
          - password
      hasCloudLB:
        default: false
        description: 'Set this to true when an external LB exists or needs to be started (AWS ALB, Azure AppGW, Google Apigee). This will then be configured through ingress controllers. Expects existing LBs to terminate https. Currently this is only working correctly for Azure, and not for AWS and Google. AWS is close to completion.'
        type: boolean
      isHomeMonitored:
        default: false
        description: Whether this cluster is home monitored (like when under a Premium SLA). Sends criticals home.
        type: boolean
      isManaged:
        default: true
        description: Whether masters are managed and not under control. Set this to false when onprem.
        type: boolean
      isMultitenant:
        default: true
        description: Whether to separate team metrics and logs. Disabling this lets everybody be admin and see everything.
        type: boolean
      version:
        default: latest
        description: 'Best pin this to a valid release version found in the repo.'
        type: string
    required:
      - adminPassword
  policies:
    type: object
    description: |
      List of policy objects used by Open Policy Agent tools (Conftest, Gatekeeper) to run policy based validation against both in-cluster Kubernetes contexts and plain Yaml resources
    additionalProperties: false
    properties:
      banned-image-tags:
        additionalProperties: false
        required: [enabled]
        properties:
          tags:
            type: array
            items:
              type: string
          enabled:
            type: boolean
            default: false
      container-limits:
        additionalProperties: false
        required: [enabled]
        properties:
          cpu:
            '$ref': '#/definitions/cpuQuantity'
          memory:
            '$ref': '#/definitions/memoryQuantity'
          enabled:
            type: boolean
            default: false
      psp-allowed-repos:
        additionalProperties: false
        required: [enabled]
        properties:
          repos:
            type: array
            items:
              type: string
          enabled:
            type: boolean
            default: false
      psp-host-filesystem:
        additionalProperties: false
        required: [enabled]
        properties:
          allowedHostPaths:
            type: array
            items:
              type: object
              required: [pathPrefix, readOnly]
              properties:
                pathPrefix:
                  type: string
                readOnly:
                  type: boolean
              additionalProperties: false
          enabled:
            type: boolean
            default: false
      psp-allowed-users:
        additionalProperties: false
        required: [enabled]
        properties:
          runAsUser:
            type: object
            additionalProperties: false
            required: [rule]
            properties:
              rule:
                type: string
                enum: [RunAsAny, MustRunAsNonRoot, MustRunAs]
              ranges:
                type: array
                items:
                  type: object
                  additionalProperties: false
                  required: [min, max]
                  properties:
                    min:
                      type: integer
                    max:
                      type: integer
          runAsGroup:
            type: object
            properties:
              rule:
                type: string
                enum: [RunAsAny, MayRunAs, MustRunAs]
              ranges:
                type: array
                items:
                  type: object
                  additionalProperties: false
                  required: [min, max]
                  properties:
                    min:
                      type: integer
                    max:
                      type: integer
          supplementalGroups:
            type: object
            properties:
              rule:
                type: string
                enum: [RunAsAny, MayRunAs, MustRunAs]
              ranges:
                type: array
                items:
                  type: object
                  additionalProperties: false
                  required: [min, max]
                  properties:
                    min:
                      type: integer
                    max:
                      type: integer
          fsGroup:
            type: object
            properties:
              rule:
                type: string
                enum: [RunAsAny, MayRunAs, MustRunAs]
              ranges:
                type: array
                items:
                  type: object
                  additionalProperties: false
                  required: [min, max]
                  properties:
                    min:
                      type: integer
                    max:
                      type: integer
          enabled:
            type: boolean
            default: false
      psp-host-security:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
      psp-host-networking-ports:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
      psp-privileged:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
      psp-capabilities:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
          allowedCapabilities:
            type: array
            items:
              type: string
          requiredDropCapabilities:
            type: array
            items:
              type: string
      psp-forbidden-sysctls:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
          forbiddenSysctls:
            type: array
            items:
              type: string
      psp-apparmor:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
          allowedProfiles:
            type: array
            items:
              type: string
      psp-seccomp:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
          allowedProfiles:
            type: array
            items:
              type: string
      psp-selinux:
        additionalProperties: false
        required: [enabled]
        properties:
          enabled:
            type: boolean
            default: false
          seLinuxContext:
            type: string
            enum: [MustRunAs, RunAsAny]
          allowedSELinuxOptions:
            type: array
            items:
              type: object
              additionalProperties: false
              properties:
                level:
                  type: string
                role:
                  type: string
                type:
                  type: string
                user:
                  type: string
  smtp:
    additionalProperties: false
    properties:
      auth_identity:
        type: string
      auth_password:
        type: string
        x-secret: ''
      auth_secret:
        type: string
        x-secret: ''
      auth_username:
        type: string
      from:
        $ref: '#/definitions/email'
        description: The "from" address. Defaults to alerts@$clusterDomain.
      hello:
        type: string
      smarthost:
        $ref: '#/definitions/hostPort'
        description: 'The smtp host:port combination.'
    required:
      - smarthost
  teamConfig:
    additionalProperties: false
    properties:
      teams:
        additionalProperties: false
        patternProperties:
          ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$:
            $ref: '#/definitions/team'
required:
  - cluster
  - otomi