---
# Kuryr username
kuryr_openstack_username: kuryr

# Kuryr domain name or id containing user
kuryr_openstack_user_domain_name: default

# Kuryr domain name or id containing project
kuryr_openstack_project_domain_name: default

# Kuryr OpenShift namespace
kuryr_namespace: kuryr

# Kuryr global namespaces (e.g.: default)
kuryr_openstack_global_namespaces: default,openshift-monitoring

# Default pod-in-VM link interface
kuryr_cni_link_interface: eth0

# Default controller and CNI images
kuryr_version: "v3.11"

kuryr_controller_dict:
  origin: "quay.io/openshift/origin-kuryr-controller:{{ kuryr_version }}"
  openshift-enterprise: "{{ openshift_facts_versioned_registry_url | regex_replace('${component}' | regex_escape, 'kuryr-controller') }}"
kuryr_cni_dict:
  origin: "quay.io/openshift/origin-kuryr-cni:{{ kuryr_version }}"
  openshift-enterprise: "{{ openshift_facts_versioned_registry_url | regex_replace('${component}' | regex_escape, 'kuryr-cni') }}"

openshift_openstack_kuryr_controller_image: "{{ kuryr_controller_dict[openshift_deployment_type] }}"
openshift_openstack_kuryr_cni_image: "{{ kuryr_cni_dict[openshift_deployment_type] }}"

# Number of kuryr-controller replicas, more than 1 only supported since
# OpenStack Rocky release.
kuryr_controller_replicas: 1

# Image to be used as leader-elector in deployments with kuryr-controller in HA
# mode.
openshift_openstack_kuryr_elector_image: gcr.io/google_containers/leader-elector:0.5

# Port to be used by leader-elector pods when running in HA mode
# (i.e. kuryr_controller_replicas > 1). Note that kuryr-controller uses host
# networking, so this port should be unused by anything on OpenShift nodes.
kuryr_controller_leader_elector_port: 16401

# Enable kuryr ports pool by default
kuryr_openstack_pool_driver: nested

# Enable kuryr healthchecks probes by default
enable_kuryr_controller_probes: True
enable_kuryr_cni_probes: True

# Kuryr health check (probes) server ports
kuryr_controller_healthcheck_port: 8082
kuryr_cni_healthcheck_port: 8090

# Path to the cni binaries
cni_bin_dir: /opt/cni/bin

# Kuryr ClusterRole definition
kuryr_clusterrole:
  name: kuryrctl
  state: present
  rules:
    # Basic read rules for kuryr's functionalities
    - apiGroups:
        - ""
      verbs:
        - get
        - list
        - watch
      resources:
        - endpoints
        - ingress
        - nodes
        - namespaces
        - pods
        - services
    # OpenShift routes support
    - apiGroups: ["oapi"]
      resources:
        - routes
      verbs: ["*"]
    # Basic write rules for kuryr's functionalities
    - apiGroups:
        - ""
      verbs:
        - update
        - patch
      resources:
        - endpoints
        - ingress
        - pods
        - namespaces
        - services
        - services/status
    # Leader elector container
    - apiGroups:
        - ""
      verbs:
        - create
        - delete
      resources:
        - endpoints
    # CRD's for healthchecks
    - apiGroups:
        - apiextensions.k8s.io/v1beta1
      verbs:
        - "*"
      resources:
        - customresourcedefinitions
    # Custom Kuryr Resources
    - apiGroups:
        - openstack.org
      attributeRestrictions: null
      verbs:
        - "*"
      resources:
        - kuryrnets
        - kuryrnetpolicies
    # Network policy support
    - apiGroups: ["networking.k8s.io"]
      resources:
        - networkpolicies
      verbs:
        - get
        - list
        - watch
        - patch
        - update
    # Multi-vif support
    - apiGroups: ["k8s.cni.cncf.io"]
      resources:
        - network-attachment-definitions
      verbs:
        - get
