# Default values for couchbase-operator chart.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

# Select what to install
install:
  # install the couchbase operator
  couchbaseOperator: true
  # install the admission controller
  admissionController: true
  # install couchbase cluster
  couchbaseCluster: true
  # install sync gateway
  syncGateway: false

# couchbaseOperator is the controller for couchbase cluster
couchbaseOperator:
  # name of the couchbase operator
  name: "couchbase-operator"
  # image config
  image:
    repository: couchbase/operator
    tag: 2.2.0
  imagePullPolicy: IfNotPresent
  # imagePullSecrets is an optional list of references to secrets  to use for pulling images
  imagePullSecrets: []
  # additional command arguments will be translated to `--key=value`
  commandArgs:
    # pod creation timeout
    pod-create-timeout: 10m
  # resources of couchbase-operator
  resources: {}
  # nodeSelector for couchbase-operator pod assignment
  # Ref: https://kubernetes.io/docs/user-guide/node-selection/
  nodeSelector: {}
  # tolerations of pod match nodes with corresponding taints
  tolerations: []


# admissionController is the controller for couchbase admission controller
# name is derived from chart
admissionController:
  name: "couchbase-admission-controller"
  image:
    repository: couchbase/admission-controller
    tag: 2.2.0
  imagePullPolicy: IfNotPresent
  # imagePullSecrets is an optional list of references to secrets to use for pulling images
  imagePullSecrets: []
  # resources of couchbase-admission-controller
  resources: {}
  # nodeSelector for couchbase-admission-controller pod assignment
  # Ref: https://kubernetes.io/docs/user-guide/node-selection/
  nodeSelector: {}
  # tolerations of pod match nodes with corresponding taints
  tolerations: []
  verboseLogging: false

# admissionService exposes validation to cluster. This service
# is over https and certs are auto-generated based on serviceName.
admissionService:
  # name of the service (auto-generated)
  name:
  # port service exposes
  port: 443
  targetPort: 8443

# admissionCA can be used to override the Certs that will be used
# to sign the keys used by the admsission operator.
admissionCA:
  # A base64 encoded PEM format certificate
  cert:
  # A base64 encoded PEM format private key
  key:
  # Expiry time of CA in days for generated certs
  expiration: 365

# secret with client certs mounted within the admission controller.
admissionSecret:
  # name of the secret (auto-generated)
  name:
  # PEM format certificate (auto-generated)
  # override via --set-file
  cert:
  # PEM format certificate (auto-generated)
  # override via --set-file
  key:


# Default values for couchbase-cluster
cluster:
  # name of the cluster. defaults to name of chart release
  name: apicbdev
  # image is the base couchbase image and version of the couchbase cluster
  image: "couchbase/server:enterprise-6.6.2"
  # guarantees that the pods in the same cluster are unable to be scheduled on the same node
  antiAffinity: false
  upgradeStrategy: RollingUpgrade
  hibernate: false
  hibernationStrategy: Immediate
  recoveryPolicy: PrioritizeDataIntegrity
  # indicates which underlying public cloud platform the Kubernetes cluster is running on
  # when set, must be 'aws', 'gce' or 'azure'
  #platform:
  security:
    # username of the cluster admin.
    username: Administrator
    # password of the cluster admin.
    # auto-generated when empty
    password: bwYq3z!nAyWxa##123
    # adminSecret is name of secret to use instead of using
    # the default secret with username and password specified above
    #adminSecret:
    rbac:
      managed: true
    #ldap: {}
  # networking options
  networking:
    # Option to expose admin console
    exposeAdminConsole: true
    # Option to expose admin console
    adminConsoleServices:
      - data
    # Specific services to use when exposing ui
    exposedFeatures:
      - client
      - xdcr
    # Defines how the admin console service is exposed.
    # Allowed values are NodePort and LoadBalancer.
    # If this field is LoadBalancer then you must also define a spec.dns.domain.
#    adminConsoleServiceType: NodePort
    adminConsoleServiceType: LoadBalancer
    # Defines how the per Couchbase node ports are exposed.
    # Allowed values are NodePort and LoadBalancer.
    # If this field is LoadBalancer then you must also define a spec.dns.domain.
#    exposedFeatureServiceType: NodePort
    exposedFeatureServiceType: LoadBalancer
    # This controls routing to external services.
    exposedFeatureTrafficPolicy: Local
    # The dynamic DNS configuration to use when exposing services
    dns:
      domain: shakticoin.com
    # Custom map of annotations to be added to console and per-pod (exposed feature) services
    serviceAnnotations: {}
    # The Couchbase cluster tls configuration (auto-generated)
#    tls:
#      static:
#        operatorSecret: tls-couchbase
#        serverSecret: tls-couchbase

    # The underlying network platform in use (when set, must be 'Istio')
    #networkPlatform:
    # When the spec.networking.exposedFeatures property is set, the Operator will generate
    # a service that exposes Couchbase services per-pod. This field allows the definition of a
    # base Service resource. The Operator will merge any configuration it controls on top of this template.
    exposedFeatureServiceTemplate: {}
    # When the spec.networking.exposeAdminConsole property is set, the Operator will generate
    # a service that exposes the administrator console. This field allows the definition of a
    # base Service resource. The Operator will merge any configuration it controls on top of this template.
    adminConsoleServiceTemplate: {}
  # xdcr defines remote clusters and replications to them.
  xdcr:
    # managed defines whether the Operator should manage XDCR remote clusters
    managed: false
    # remoteClusters contains references to any remote clusters to replicate to
    #remoteClusters:
  # backup defines values for automated backup.
  backup:
    # managed determines whether Automated Backup is enabled
    managed: true
    # image used by the Operator to perform backup or restore
    image: couchbase/operator-backup:6.6.0-100
    # optional service account to use when performing backups
    # service account will be created if it does not exist
    #serviceAccountName:
    # secret that holds the AWS region name, access key ID, and secret access key
    #s3Secret:
  # defines integration with third party monitoring sofware
  monitoring:
    prometheus:
      # defines whether Prometheus metric collection is enabled
      enabled: false
      # image used by the Operator to perform metric collection
      # (injected as a "sidecar" in each Couchbase Server Pod)
      image: couchbase/exporter:1.0.3
      # Optional Kubernetes secret that clients use to access Prometheus metrics
      #authorizationSecret:
      # resources to apply to the monitoring pods
      resources: {}
  # Cluster wide settings for nodes and services
  cluster:
    # The amount of memory that should be allocated to the data service
    dataServiceMemoryQuota: 3Gi
    # The amount of memory that should be allocated to the index service
    indexServiceMemoryQuota: 512Mi
    # The amount of memory that should be allocated to the search service
    searchServiceMemoryQuota: 512Mi
    # The amount of memory that should be allocated to the eventing service
    eventingServiceMemoryQuota: 512Mi
    # The amount of memory that should be allocated to the analytics service
    analyticsServiceMemoryQuota: 1Gi
    # The index storage mode to use for secondary indexing
    indexStorageSetting: memory_optimized
    # Timeout that expires to trigger the auto failover.
    autoFailoverTimeout: 120s
    # The number of failover events we can tolerate
    autoFailoverMaxCount: 3
    # Whether to auto failover if disk issues are detected
    autoFailoverOnDataDiskIssues: true
    # How long to wait for transient errors before failing over a faulty disk
    autoFailoverOnDataDiskIssuesTimePeriod: 120s
    # configuration of global Couchbase auto-compaction settings.
    autoCompaction:
      # amount of fragmentation allowed in persistent database [2-100]
      databaseFragmentationThreshold:
        percent: 30
        size: 1Gi
      # amount of fragmentation allowed in persistent view files [2-100]
      viewFragmentationThreshold:
        percent: 30
        size: 1Gi
      # whether auto-compaction should be performed in parallel
      parallelCompaction: false
      # how frequently tombstones may be purged
      tombstonePurgeInterval: 72h
      # optional window when an auto-compaction may start (uncomment below)
      timeWindow: {}
      # start: 02:00
      # end: 06:00
      # abortCompactionOutsideWindow: true
  # Configuration of logging functionality in the operator and server
  logging:
    # retention period that log volumes are kept after pods have been deleted
    logRetentionTime: 604800s
    # the maximum number of log volumes that can be kept after pods have been deleted
    logRetentionCount: 20
    # The following are all related to Couchbase Server log management
    server:
      # Optionally enable the log processing and forwarding sidecar
      # To enable this we also need a default or log persistent volume for each server
      enabled: false
      # Indicate whether the operator should manage the configuration
      manageConfiguration: true
      # The name of the Secret used to provide the configuration
      configurationName: fluent-bit-config
      # All specific configuration for the sidecar
      sidecar:
        # The image to be used to run with logging as a sidecar.
        image: couchbase/fluent-bit:1.0.0
        # The location to mount the configurationName Secret into the image.
        # Useful if image is changed and the new one uses a different location.
        configurationMountPath: /fluent-bit/config/
        # Resource limit to apply to the container
        resources: {} 
    # The following section covers configuring audit logging for Couchbase Server
    audit:
      # Optionally enable audit configuration in the operator
      enabled: false
      # The list of event ids (as integers) to disable for auditing purposes.
      # This is passed to the REST API with no verification by the operator.
      # Refer to the documentation for details:
      # https://docs.couchbase.com/server/current/audit-event-reference/audit-event-reference.html
      disabledEvents: []
      # The list of users (as strings) to ignore for auditing purposes.
      # This is passed to the REST API with minimal validation it meets an acceptable regex pattern.
      # Refer to the documentation for full details on how to configure this:
      # https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html#ignoring-events-by-user
      disabledUsers: []
      # The interval to optionally rotate the audit log.
      # This is passed to the REST API, see here for details:
      # https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html
      rotation:
        # The interval at which to rotate audit log files, defaults to 15 minutes.
        interval: 15m
        # Size allows the specification of a rotation size for the log, defaults to 20Mi.
        size: 20Mi
      # Handle all optional garbage collection (GC) configuration for the audit functionality.
      # This is not part of the audit REST API, it is intended to handle GC automatically for the audit logs.
      # By default the Couchbase Server rotates the audit logs but does not clean up the rotated logs.
      # This is left as an operation for the cluster administrator to manage, the operator allows for us to automate this:
      # https://docs.couchbase.com/server/current/manage/manage-security/manage-auditing.html      
      garbageCollection:
        sidecar:
          # Optionally enable the audit cleanup sidecar
          enabled: false
          # Image is the image to be used to run the audit sidecar helper.
          image: busybox:1.32.1
          # The minimum age of rotated log files to remove, defaults to one hour.
          age: 1h
          # The interval at which to check for rotated log files to remove, defaults to 20 minutes.
          interval: 20m
          # Resource limit to apply to the container
          resources: {} 
  # kubernetes security context applied to pods
  # We default to non-root usage, override or remove by setting to null (--set cluster.securityContext=null)
  securityContext:
    # fsGroup of persistent volume mount
    fsGroup: 1000
    runAsUser: 1000
    runAsNonRoot: true
  # cluster buckets
  buckets:
    # Managed defines whether buckets are managed by us or the clients.
    managed: true
  servers:
    # Name for the server configuration. It must be unique.
    default:
      # Size of the couchbase cluster.
      size: 3
      # The services to run on nodes
      services:
        - data
        - index
        - query
        - search
        - analytics
        - eventing
      # Defines whether Autoscale is permitted for this specific server configuration.
      autoscaleEnabled: false
      # ServerGroups define the set of availability zones we want to distribute pods over.
      serverGroups: []
      # Pod defines the policy to create pod for the couchbase pod.
      pod:
        spec: {}
      # volume claims to use for persistent storage
      volumeMounts:
        default: couchbase
        data:  couchbase
  # VolumeClaimTemplates define the desired characteristics of a volume
  # that can be requested and claimed by a pod.
  #volumeClaimTemplates: []
  # As an example to support the logging sidecar, uncomment the following and comment out the defaults above:
  #     volumeMounts:
  #       default: couchbase 
  volumeClaimTemplates: 
    - metadata:
        name: couchbase 
      spec:
        storageClassName: ebs-sc
        resources: 
          requests:
            storage: 15Gi

# couchbase buckets to create
# disable default bucket creation by setting
# buckets.default: null
#
# setting default to null can throw warning https://github.com/helm/helm/issues/5184
buckets:
  # A bucket to create by default
  default:
    # Kind of bucket
    kind: CouchbaseBucket
    # Name of the bucket from kubernetes perspective
    # Defaults to name of the top-level object 'default'
    resourceName:
    # Name of the bucket from couchbase perspective
    name: default
    # The amount of memory that should be allocated to the bucket
    memoryQuota: 128Mi
    # The number of bucket replicates
    replicas: 1
    # The priority when compared to other buckets
    ioPriority: high
    # The bucket eviction policy which determines behavior during expire and high mem usage
    evictionPolicy: fullEviction
    # The bucket's conflict resolution mechanism; which is to be used if a conflict occurs during Cross Data-Center Replication (XDCR). Sequence-based and timestamp-based mechanisms are supported.
    conflictResolution: seqno
    # The enable flush option denotes wether the data in the bucket can be flushed
    enableFlush: true
    # Enable Index replica specifies whether or not to enable view index replicas for this bucket.
    enableIndexReplica: false
    # data compression mode for the bucket to run in [off, passive, active]
    compressionMode: "passive"
  services:
    kind: CouchbaseBucket
    resourceName:
    name: services
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"
  kycdocfiles:
    kind: CouchbaseBucket
    resourceName:
    name: kycdocfiles
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"
  s1-server:
    kind: CouchbaseBucket
    resourceName:
    name: s1-server
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"
  s2-data:
    kind: CouchbaseBucket
    resourceName:
    name: s2-data
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"
  s2-logs:
    kind: CouchbaseBucket
    resourceName:
    name: s2-logs
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"
  shakti-nodes:
    kind: CouchbaseBucket
    resourceName:
    name: shakti-nodes
    memoryQuota: 128Mi
    replicas: 1
    ioPriority: high
    evictionPolicy: fullEviction
    conflictResolution: seqno
    enableFlush: true
    enableIndexReplica: false
    compressionMode: "passive"

# CouchbaseBackups runs a job which preserves data into backups
backups: {}
#
# Uncomment to create a backup named 'my-backup'
#
#   default-backup:
#     name: my-backup
#     strategy: full_incremental
#     full:
#       schedule: "0 3 * * 0"
#     incremental:
#       schedule: "0 3 * * 1-6"
#     successfulJobsHistoryLimit: 1
#     failedJobsHistoryLimit: 3
#     backOffLimit: 2
#     backupRetention: 24h
#     logRetention: 24h
#     size: 5Gi

# CouchbaseBackupRestore restores data from backups
backuprestores: {}
#
# Uncomment to create a restore named 'my-restore'
#
# default-restore:
#   name: my-restore
#   backup: my-backup
#   repo: cb-example-2020-11-12T19_00_03
#   start:
#     int: 1
#     str: oldest
#   end:
#     int: 1
#     str: latest
#   backOffLimit: 2
#   logRetention: 24h

# RBAC users to create
# (requires couchbase server 6.5.0 and higher)
#users: {}
users: 
  addressbook-updater:
   password: 3Zh{s3Wx"BZMTH4c
   authSecret:
   authDomain: local
   roles:
     - name: query_update
       bucket: services
     - name: query_select
       bucket: services
     - name: query_insert
       bucket: services
     - name: query_delete
       bucket: services
     - name: query_update
       bucket: shakti-nodes          
     - name: query_select
       bucket: shakti-nodes         
     - name: query_insert
       bucket: shakti-nodes       
     - name: query_delete
       bucket: shakti-nodes
  bizvault-services:
    password: "A#V2LN@TOoFn0zx05&ts!DLwDL@F&wx0"
    authSecret:
    authDomain: local 
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services
      - name: query_insert
        bucket: services
      - name: query_delete
        bucket: services
  kyc-services:
    password: "0JGjn!k1JvV%Cc8!!7XsbW^w0APFjSHu"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services
      - name: query_insert
        bucket: services
      - name: query_delete
        bucket: services
  license-services:
    password: "GEXl^1w#7ZDw#zViL$fBDDd6lzwt*W9u"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services     
      - name: query_select
        bucket: services 
      - name: query_insert
        bucket: services 
      - name: query_delete
        bucket: services
  onboard-services:
    password: "OBNowISmdXERLl98bf5z$3*qY$g8W&d"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services
      - name: query_insert
        bucket: services
      - name: query_delete
        bucket: services
  otp-services:
    password: "OCoXQOV%RauC5xh757m2QGI%PjPKrGq%"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services 
      - name: query_insert
        bucket: services 
      - name: query_delete
        bucket: services
  payment-services:
    password: "*xgVBw9CHcz7mO8f0Y!@KPLeS@tr1hW@"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services
      - name: query_insert
        bucket: services
      - name: query_delete
        bucket: services
  referral-services:
    password: "8EbpBpKmC855B$6xZHcM9yPmc*2MmNmG"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services
      - name: query_select
        bucket: services
      - name: query_insert
        bucket: services
      - name: query_delete
        bucket: services
  s2-server:
    password: "FWkBymekoePtaTw5"
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: s2-data
      - name: query_select
        bucket: s2-data
      - name: query_insert
        bucket: s2-data
      - name: query_delete
        bucket: s2-data
      - name: query_update
        bucket: s2-logs
      - name: query_select
        bucket: s2-logs
      - name: query_insert
        bucket: s2-logs
      - name: query_delete
        bucket: s2-logs
  selfyid-service:
    password: ZXy!IoXvsMvlB7VVBx2dvBG%dmenShLu
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: services     
      - name: query_select
        bucket: services  
      - name: query_insert
        bucket: services  
      - name: query_delete
        bucket: services
  shakti-nodes:
    password: 0!46JM@Eun*vCgUWa%P4Gly4
    authSecret:
    authDomain: local
    roles:
      - name: query_update
        bucket: shakti-nodes     
      - name: query_select
        bucket: shakti-nodes     
      - name: query_insert
        bucket: shakti-nodes     
      - name: query_delete
        bucket: shakti-nodes

# TLS Certs that will be used to encrypt traffic between operator and couchbase
tls:
  # enable to auto create certs
  generate: true
  # Expiry time of CA in days for generated certs
  expiration: 365
  # This field defines whether node-to-node encryption is enabled.
  # Must be either 'All' or 'ControlPlaneOnly'.
  # If not specified, data between Couchbase Server nodes is not encrypted.
  #nodeToNodeEncryption:

# syncGateway configuration
syncGateway:
  # name of the sync gatway pod.
  # defaults to name of chart
  name:
  # how many sync gateway pods to create
  # horizontally scale the deployment
  replicas: 1
  # optional set to change cleanup policy
  revisionHistoryLimit:
  # labels to apply to the deployment resource
  labels: {}
  # labels to apply to the pods
  podLabels: {}
  # resources to apply to the pods
  resources: {}
  # affinity to apply to the pods
  affinity: {}
  # which nodes to run the pods on
  nodeSelector: {}
  # tolerations to apply to the pods
  tolerations: []  
  admin:
    # defines if the admin api will be exposed by sync gateway
    enabled: false  
  service:
    # additional annotations to add to the Sync Gateway service. useful for setting cloud provider specific annotations controlling the services deployed.
    # optionally configure traffic policy for LoadBalancer and NodePort
    externalTrafficPolicy:
  # defines integration with third party monitoring sofware
  monitoring:
    prometheus:
      # defines whether Prometheus metric collection is enabled
      enabled: false
      # image used by the Sync Gateway to perform metric collection
      # (injected as a "sidecar" in each Sync Gateway Pod)
      image:
        repository: couchbasesamples/sync-gateway-prometheus-exporter
        tag: latest
      # pod
      resources: {}
        # requests:
        #   cpu: 100m
        # limits:
        #   cpu: 100m
  # database config
  config:
    logging:
      console:
        enabled: true
        log_level: "debug"
        log_keys:
          - "*"
    # databases is a list containing
    # bucket replication configs
    databases:
      db:
        # bucket replicated to sync gateway
        bucket: default
        # guest user config
        users:
          GUEST:
            # disable creation of guest user
            disabled: false
            # channels guest user may access.
            # defaults to all channels
            admin_channels: ["*"]
        # server to connect db to, defaults to cluster server
        server:
        # username of db admin, defaults to cluster admin username
        username:
        # password of db admin, defaults to cluster admin password
        password:
        allow_conflicts: false
        revs_limit: 20
        enable_shared_bucket_access: true
        # optional ca.cert for tls connection
        # (auto-generated when tls.generate true)
        cacert:
  # Type of service to use for exposing Sync Gateway
  # Set as empty string to prevent service creation
  exposeServiceType: ClusterIP
  # image of the sync gateway container
  image:
    repository: couchbase/sync-gateway
    tag: 2.8.0-enterprise
  imagePullPolicy: IfNotPresent
  # Optional secret to use with prepoulated database config
  configSecret:


# coredns service config to be applied to
# pods for cross-cluster deployments
coredns:
  # name kubernete service which exposes nameserver (ie coredns)
  service:
  # search list for host-name lookup
  searches:
  - default.svc.cluster.local
  - svc.cluster.local
  - cluster.local