helmfile.yaml.gotmpl

---
helmDefaults:
  wait: true
  timeout: 600
  recreatePods: false
  force: false
  createNamespace: true
  args:
    - --hide-notes

environments:
  default:
    values:
      - ./values.yaml.gotmpl
---
repositories:
  - name: nats
    url: https://nats-io.github.io/k8s/helm/charts
  - name: istio
    url: https://istio-release.storage.googleapis.com/charts
  - name: bitnami
    url: https://charts.bitnami.com/bitnami
  - name: cilium
    url: https://helm.cilium.io/
  - name: cloudfoundry-k8s
    oci: true
    url: ghcr.io/cloudfoundry/helm

releases:
  - name: cilium
    namespace: kube-system
    chart: cilium/cilium
    version: 1.18.4
    values:
      - ./assets/values/cilium.yaml
    hooks:
      - events: ["postsync"]
        showlogs: true
        command: "/bin/sh"
        args:
          - "-c"
          - |
            echo "Waiting for nodes to become ready after CNI installation..."
            kubectl wait --for=condition=Ready nodes --all --timeout=300s

            corefile=$(kubectl -n kube-system get configmap coredns -o jsonpath='{.data.Corefile}' | sed '/kubernetes/i \
              rewrite name regex (.*)\\.127-0-0-1\\.nip\\.io istio-gateway-istio.{{ .Values.systemNamespace }}.svc.cluster.local answer auto\
            ')
            kubectl -n kube-system patch configmap coredns --type=json \
              -p="$(jq -n --arg cf "$corefile" '[{"op":"replace","path":"/data/Corefile","value":$cf}]')"
            kubectl -n kube-system rollout restart deployment/coredns

  - name: istio-base
    namespace: istio-system
    chart: istio/base
    version: 1.29.1
    needs:
      - kube-system/cilium
    values:
      - defaultRevision: minimal

  - name: istiod
    namespace: istio-system
    chart: istio/istiod
    version: 1.29.1
    needs:
      - istio-base
    values:
      - ./assets/values/istiod.yaml
    hooks:
      - events: ["presync"]
        showlogs: true
        command: "/bin/sh"
        args:
          - "-c"
          - |
            kubectl delete validatingwebhookconfiguration istio-validator-istio-system --ignore-not-found=true
  
  - name: base
    namespace: {{ .Values.systemNamespace }}
    chart: ./assets/base-chart
    needs:
      - kube-system/cilium
      - istio-system/istiod
    set:
      - name: caCert
        file: {{ .Values.certsDir }}/ca.crt
      - name: caKey
        file: {{ .Values.certsDir }}/ca.key
      - name: tlsCert
        file: {{ .Values.certsDir }}/all-in-one.crt
      - name: tlsKey
        file: {{ .Values.certsDir }}/all-in-one.key
    hooks:
      - events: ["presync"]
        showlogs: true
        command: "/bin/sh"
        args:
          - "-c"
          - |
            kubectl apply --server-side --filename assets/gateway-api.yaml

  - name: nats
    namespace: {{ .Values.systemNamespace }}
    chart: nats/nats
    version: 2.12.4
    needs:
      - "{{ .Values.systemNamespace }}/base"
    values:
      - ./assets/values/nats.yaml


  - name: postgresql
    namespace: {{ .Values.systemNamespace }}
    chart: bitnami/postgresql
    version: 16.7.27
    needs:
      - "{{ .Values.systemNamespace }}/base"
    values:
      - ./assets/values/postgresql.yaml
      - auth:
          password: {{ .Values.secrets.dbPassword }}

  - name: minio
    namespace: {{ .Values.systemNamespace }}
    chart: bitnami/minio
    version: 17.0.21
    needs:
      - "{{ .Values.systemNamespace }}/base"
    values:
      - extraEnvVars:
          - name: MINIO_DOMAIN
            value: blobstore.127-0-0-1.nip.io
      - console:
          enabled: false
      - resourcesPreset: small
      - auth:
          rootPassword: {{ .Values.secrets.blobstorePassword }}
      - image:
          repository: bitnamilegacy/minio
      - global:
          security:
            allowInsecureImages: true

  - name: loggregator-agent
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/loggregator-agent/helm
    needs:
      - {{ .Values.systemNamespace }}/base
    values:
      - syslogBindingCache:
          enabled: true
          certificateSecret: all-in-one-tls
      - forwarderAgent:
          enabled: true
          certificateSecret: all-in-one-tls
      - loggregatorAgent:
          certificateSecret: all-in-one-tls
      - syslogAgent:
          certificateSecret: all-in-one-tls

  - name: gorouter
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/routing/helm
    needs:
      - {{ .Values.systemNamespace }}/base
      - {{ .Values.systemNamespace }}/nats
    values:
      - gorouter:
          enabled: true
          certificateSecret: all-in-one-tls
      - udpForwarder:
          certificateSecret: all-in-one-tls

  - name: tcp-routing
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/routing/helm
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - loggregator-agent
      - locket
      - uaa
      - postgresql
    values:
      - routingApi:
          enabled: true
          sqldb:
            password: {{ .Values.secrets.dbPassword }}
            caCertificateSecret: all-in-one-tls
            skipSSLVerify: false
          certificateSecret: all-in-one-tls
          locketCertificateSecret: all-in-one-tls
          loggregatorCertificateSecret: all-in-one-tls
          uaaCertificateSecret: all-in-one-tls
      - tcpRouter:
          enabled: true
          oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
          certificateSecret: all-in-one-tls

  - name: loggregator
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/loggregator/helm
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - {{ .Values.systemNamespace }}/base
    values:
      - loggregator:
          enabled: true
      - oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
      - doppler:
          certificateSecret: all-in-one-tls
      - reverseLogProxy:
          certificateSecret: all-in-one-tls
      - reverseLogProxyGateway:
          certificateSecret: all-in-one-tls
      - trafficcontroller:
          certificateSecret: all-in-one-tls

  - name: log-cache
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/log-cache/helm
    needs:
      - "{{ .Values.systemNamespace }}/base"
      - uaa
    values:
      - logCacheApi:
          certificateSecret: all-in-one-tls
      - logCacheBackend:
          certificateSecret: all-in-one-tls

  - name: uaa
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/uaa/helm
    needs:
      - postgresql
      - {{ .Values.systemNamespace }}/base
    values:
      - ccAdminPassword: {{ .Values.secrets.ccAdminPassword }}
      - uaadb:
          password: {{ .Values.secrets.dbPassword }}
          caCertificateSecret: all-in-one-tls
          skipSSLVerify: false
      - oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
      - uaaAdminSecret: {{ .Values.secrets.uaaAdminSecret }}
      - certificateSecret: all-in-one-tls

  - name: credhub
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/credhub/helm
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - uaa
      - postgresql
    values:
      - caCertificateSecret: instance-identity
      - db:
          password: {{ .Values.secrets.dbPassword }}
          caCertificateSecret: all-in-one-tls
          skipSSLVerify: false

  - name: locket
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/diego/helm
    needs:
      - loggregator-agent
      - postgresql
    values:
      - locketdb:
          password: {{ .Values.secrets.dbPassword }}
          caCertificateSecret: all-in-one-tls
          skipSSLVerify: false
      - locket:
          enabled: true
          certificateSecret: all-in-one-tls

  - name: diego
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/diego/helm
    needs:
      - locket
      - uaa
      - loggregator-agent
    values:
      - diegodb:
          password: {{ .Values.secrets.dbPassword }}
          caCertificateSecret: all-in-one-tls
          skipSSLVerify: false
      - diegoSSHCredentials: {{ .Values.secrets.diegoSSHCredentials }}
      - sshProxy:
          oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
      - sshProxyHostKey: |
{{ readFile (printf "%s/ssh_key" .Values.certsDir) | indent 10 }}
      - auctioneer:
          enabled: true
          certificateSecret: all-in-one-tls
      - bbs:
          enabled: true
          certificateSecret: all-in-one-tls
      - fileserver:
          enabled: true
      - sshProxy:
          enabled: true
          certificateSecret: all-in-one-tls

  - name: tps-watcher
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/capi/helm
    needs:
      - capi
    values:
      - tpsWatcher:
          enabled: true
          certificateSecret: all-in-one-tls
      - oauthClientsSecret: ""

  - name: route-emitter
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/diego/helm
    needs:
      - diego
      - nats
    {{ if .Values.installOptionalComponents }}
      - cf-networking
    {{ end }}
    values:
      - diegoSSHCredentials: ""
      - sshProxyHostKey: ""
      - routeEmitter:
          enabled: true
          certificateSecret: all-in-one-tls
          routingApi:
            enabled: {{ .Values.installOptionalComponents }}
            certificateSecret: all-in-one-tls
          oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
          natsCertificateSecret: all-in-one-tls
          loggregatorCertificateSecret: all-in-one-tls
          bbsCertificateSecret: all-in-one-tls
          locketCertificateSecret: all-in-one-tls
          uaaCertificateSecret: all-in-one-tls
          enableInternalEmitter: {{ .Values.installOptionalComponents }}
          enableTcpEmitter: {{ .Values.installOptionalComponents }}

  - name: k8s-rep
    namespace: {{ .Values.systemNamespace }}
    chart: cloudfoundry-k8s/k8s-rep
    version: "{{ .Values.versions.k8sRep }}"
    needs:
      - diego
    values:
      - caCertificate: |
{{ readFile (printf "%s/ca.crt" .Values.certsDir) | indent 10 }}
      - stacks:
          cflinuxfs4: ghcr.io/cloudfoundry/k8s/cflinuxfs4:{{ .Values.versions.cflinuxfs4 }}
      - workloadsNamespace: {{ .Values.workloadsNamespace }}
      - containerProxyVerifySubjectAltName: 
          - gorouter
          - ssh-proxy
          - cf-tcp-router
      - loggregator:
          certificateSecret: all-in-one-tls
      - locket:
          certificateSecret: all-in-one-tls

    hooks:
      - events: ["presync"]
        showlogs: true
        command: "/bin/sh"
        args:
          - "-c"
          - |
            kubectl create namespace {{ .Values.workloadsNamespace }} --dry-run=client -o yaml | kubectl apply -f -
            kubectl create configmap trusted-system-certs --namespace {{ .Values.workloadsNamespace }} --from-file=trusted-ca-1.crt={{ .Values.certsDir }}/ca.crt --dry-run=client -o yaml | kubectl apply -f -

  - name: capi
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/capi/helm
    needs:
      - minio
      - diego
      - postgresql
    values:
      - cloudController:
          enabled: true
          certificateSecret: all-in-one-tls
          blobstore:
            storage_cli:
              aws_secret_access_key: {{ .Values.secrets.blobstorePassword }}
          sshProxyKeyFingerprint: {{ .Values.secrets.sshProxyKeyFingerprint | quote }}
          enableCommaDelimitedDestinations: true
      - ccUploader:
          certificateSecret: all-in-one-tls
      - udpForwarder:
          certificateSecret: all-in-one-tls
      - ccdb:
          password: {{ .Values.secrets.dbPassword }}
          caCertificateSecret: all-in-one-tls
          skipSSLVerify: false
      - oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}

  - name: nfs-volume
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/nfs-volume/helm
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - capi
    values:
      - nfsbroker:
          enabled: true
          certificateSecret: all-in-one-tls
          oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
      - nfsv3driver:
          enabled: true

  - name: cf-networking
    namespace: {{ .Values.systemNamespace }}
    chart: ./releases/cf-networking/helm
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - capi
      - uaa
      - locket
      - loggregator-agent
    values:
      - policyServer:
          enabled: true
          networkpolicydb:
            password: {{ .Values.secrets.dbPassword }}
            caCertificateSecret: all-in-one-tls
            skipSSLVerify: false
          oauthClientsSecret: {{ .Values.secrets.oauthClientsSecret }}
          certificateSecret: all-in-one-tls
      - serviceDiscoveryController:
          enabled: true
          certificateSecret: all-in-one-tls
      - boshDnsAdapter:
          enabled: true
          certificateSecret: all-in-one-tls
      - boshDns:
          certificateSecret: all-in-one-tls

  - name: policy-agent
    namespace: {{ .Values.systemNamespace }}
    chart: cloudfoundry-k8s/policy-agent
    version: "{{ .Values.versions.policyAgent }}"
    installed: {{ .Values.installOptionalComponents }}
    needs:
      - cf-networking
    set:
      - name: certificateSecret
        value: all-in-one-tls
      - name: pollInterval
        value: "5s"
    hooks:
      - events: ["postsync"]
        showlogs: true
        command: "/bin/sh"
        args:
          - "-c"
          - |
            kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' | grep -q "apps.internal:53" || {
              echo "Patching CoreDNS to forward apps.internal to bosh-dns"
              BOSH_DNS_IP=$(kubectl get svc bosh-dns -n {{ .Values.systemNamespace }} -o jsonpath='{.spec.clusterIP}')
              COREFILE=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}')
              printf '%s\n\n%s' "apps.internal:53 {
                errors
                forward . ${BOSH_DNS_IP}
              }" "$COREFILE" | kubectl create configmap coredns -n kube-system --from-file=Corefile=/dev/stdin --dry-run=client -o yaml | kubectl apply -f -
              kubectl rollout restart deployment coredns -n kube-system
            }