# go-bananas on the development cluster.
#
# Reproduce with:
#
#   helm upgrade --install go-bananas deploy/helm/go-bananas \
#     --namespace go-insane-dev -f deploy/dev/values-dev-cluster.yaml \
#     --server-side=false --disable-openapi-validation \
#     --wait
#
# Two flags are needed for this cluster specifically, and neither is a chart defect.
#
#   --server-side=false              The cluster's OpenAPI validation is incomplete:
#                                    it rejects `imagePullPolicy` and `lifecycle` at
#                                    `spec.template.spec` as undeclared fields on a
#                                    k8s 1.36 API server. A hand-written Deployment
#                                    with those two fields fails the same way. Helm 4
#                                    uses server-side apply by default, which hits it.
#   --disable-openapi-validation     The same broken schema, on the client side.
#
# Nothing else in the cluster needs these; they are here so this release is
# reproducible rather than "whatever worked when it was deployed".

image:
  # The development cluster pulls from a private registry whose certificate is valid
  # for a different name, so the host and the port have to stay in one piece: putting
  # the port in `repository` renders an image reference without it, and the kubelet
  # then resolves the registry over https on port 443.
  registry: batty1039.startdedicated.net:5000
  repository: go-bananas
  # The development registry is tagged `latest` rather than pinned to a version, to
  # match every other release in this namespace. Consequently the pull policy must be
  # Always: with IfNotPresent a node keeps serving the image it already has, and a
  # redeploy silently does nothing.
  tag: latest
  pullPolicy: Always

config:
  # development, which is what permits the dev identity mode below. The application
  # refuses both of these outside a development environment, so this pair cannot be
  # promoted to production by accident.
  environment: development
  publicBaseUrl: https://bananas-dev.urpi.be

identity:
  # dev, not oidc.
  #
  # OIDC is the correct production mode and the chart is wired for it, but it cannot
  # be used here yet: the cluster's CoreDNS returns NXDOMAIN for public names, so the
  # issuer is unreachable from inside the cluster and the pod crash-loops in OIDC
  # discovery. That is a cluster DNS problem, not a chart one, and it also explains why
  # no certificate in this namespace has been issued.
  #
  # To switch, create the secret and set the OIDC values:
  #
  #   kubectl create secret generic go-bananas-auth -n go-insane-dev \
  #     --from-literal=session-secret="$(openssl rand -base64 48)" \
  #     --from-literal=oidc-client-secret='<from the provider>'
  #
  #   helm upgrade ... --set identity.mode=oidc \
  #     --set identity.oidc.generateSecret=false \
  #     --set identity.oidc.existingSecret=go-bananas-auth \
  #     --set identity.oidc.issuer=https://auth-dev.urpi.be \
  #     --set identity.oidc.clientId=go-bananas
  mode: dev
  oidc:
    issuer: https://auth-dev.urpi.be
    clientId: go-bananas
    existingSecret: go-bananas-auth
    generateSecret: false

ingress:
  enabled: true
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-staging
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  hosts:
    - host: bananas-dev.urpi.be
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: go-bananas-tls
      hosts:
        - bananas-dev.urpi.be

deployment:
  # One replica. The volume is ReadWriteOnce, so a second replica cannot mount it and
  # would sit in ImagePullBackOff-equivalent limbo forever. Scaling needs either this
  # changed to 1 or a ReadWriteMany filesystem.
  replicaCount: 1