# Default values for capsule.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  jobs:
    postInstall:
      # -- Enable Post Install Job
      enabled: true
    preDelete:
      # -- Enable Pre Delete Job
      enabled: true
    kubectl:
      image:
        # -- Set the image repository of the helm chart job
        registry: docker.io
        # -- Set the image repository of the helm chart job
        repository: clastix/kubectl
        # -- Set the image pull policy of the helm chart job
        pullPolicy: IfNotPresent
        # -- Set the image tag of the helm chart job
        tag: ""
      # -- ImagePullSecrets
      imagePullSecrets: []
      # -- Labels to add to the job pod
      podLabels: {}
      # -- Annotations to add to the job pod
      podAnnotations: {}
      # -- Labels to add to the job.
      labels: {}
      # -- Annotations to add to the job.
      annotations: {}
      # -- Set the restartPolicy
      restartPolicy: Never
      # -- Sets the ttl in seconds after a finished certgen job is deleted. Set to -1 to never delete.
      ttlSecondsAfterFinished: 60
      # @schema type: object
      # @schema additionalProperties: true
      # -- Security context for the job pods.
      podSecurityContext:
        enabled: true
        seccompProfile:
          type: "RuntimeDefault"
      # @schema type: object
      # @schema additionalProperties: true
      # -- Security context for the job containers.
      securityContext:
        enabled: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
        runAsGroup: 1002
        runAsNonRoot: true
        runAsUser: 1002
      # -- Job resources
      resources: {}
      # -- Set the node selector
      nodeSelector: {}
      # -- Set list of tolerations
      tolerations: []
      # -- Set affinity rules
      affinity: {}
      # -- Set Topology Spread Constraints
      topologySpreadConstraints: []
      # -- Set a pod priorityClassName
      priorityClassName: ""
      # -- Backofflimit for jobs
      backoffLimit: 4

# Manage CRD Lifecycle
crds:
  # -- Install the CustomResourceDefinitions (This also manages the lifecycle of the CRDs for update operations)
  install: true
  # -- Extra Labels for CRDs
  labels: {}
  # -- Extra Annotations for CRDs
  annnotations: {}
  # -- Render CRDS inline (in this case use --skip-crds when installing the chart and create the capsuleconfiguration independently)
  inline: false
  # -- Only install the CRDs, no other primitives
  exclusive: false
  # -- Create additionally CapsuleConfiguration even if CRDs are exclusive
  createConfig: false
  # -- Create RBAC and Serviceaccount even if CRDs are exclusive
  createRBAC: false
  # -- Create Diagnostic Dashboards even if CRDs are exclusive
  createDiagnostics: false

# Secret Options
tls:
  # -- Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well.
  enableController: false
  # -- When cert-manager is disabled, Capsule will generate the TLS certificate for webhook and CRDs conversion.
  create: false
  # -- Override name of the Capsule TLS Secret name when externally managed.
  name: ""

# Capsule Proxy
proxy:
  # -- Enable Installation of Capsule Proxy
  enabled: false

# These are ClusterRoles which grant permissions for Capsule CRDs to Tenant Owners
rbac:
  # -- Allow the creation of TenantResources
  resources:
    create: false
    labels: {}
    # rbac.authorization.k8s.io/aggregate-to-admin: "true"
  # -- Allow the creation of ResourcePoolClaims
  resourcepoolclaims:
    create: false
    labels: {}
    # rbac.authorization.k8s.io/aggregate-to-admin: "true"
  # -- Allow the creation of CustomQuotas
  customquotas:
    create: false
    labels: {}
    # rbac.authorization.k8s.io/aggregate-to-admin: "true"

# Manager Options
manager:
  apiPriorityAndFairness:
    # -- Change to `true` if you want to insulate the API calls made by Capsule admission controller activities.
    # This will help ensure Capsule stability in busy clusters.
    # Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/
    enabled: false

    # -- Only the first matching FlowSchema for a given request matters. If multiple FlowSchemas match a single inbound request, it will be assigned based on the one with the highest matchingPrecedence.
    # Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#flowschema
    matchingPrecedence: 900

    # -- Declare ApiVersion used for Flow
    flowApiVersion: "flowcontrol.apiserver.k8s.io/v1"

    # @schema type: object
    # @schema additionalProperties: true
    # -- Priority level configuration.
    # The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want.
    # ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#prioritylevelconfiguration
    # @default -- See [values.yaml](values.yaml)
    priorityLevelConfigurationSpec:
      type: Limited
      limited:
        nominalConcurrencyShares: 100
        limitResponse:
          type: Queue
          queuing:
            queues: 64
            handSize: 6
            queueLengthLimit: 100

  # Manager RBAC
  rbac:
    # -- Specifies whether RBAC resources should be created.
    create: true

    # -- Strongly restrict the RBAC assigned to Capsule Controller.
    # The default owner ClusterRoles (admin, provisioner and deleter) can be bound
    # to tenant owners out of the box; add custom owner ClusterRoles via
    # bindableClusterRoles. Permissions beyond binding (e.g. TenantResource
    # replication) must be aggregated by yourself via ClusterRoles labeled
    # projectcapsule.dev/aggregate-to-controller: "true".
    strict: false

    # -- DEPRECATED: use strict instead.
    # Former name of the strict option; takes effect when either flag is true.
    minimal: false

    # -- ClusterRoles the Capsule controller is allowed to bind (verb `bind`) when
    # strict RBAC is enabled, in addition to the roles Capsule manages
    # (manager.options.rbac provisioner, deleter, administrationClusterRoles and
    # promotionClusterRoles), which are always bindable. Add any custom
    # tenant-owner ClusterRoles here.
    bindableClusterRoles:
      - admin

    # -- Specifies further cluster roles to be added to the Capsule manager service account.
    existingClusterRoles: []
    # - cluster-admin

    # -- Specifies further cluster roles to be added to the Capsule manager service account.
    existingRoles: []
    # - namespace-admin

    role:
      # -- Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount.
      extraResources: []

    clusterRole:
      # -- Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount.
      extraResources: []
      #  - apiGroups: ["storage.k8s.io"]
      #    resources: ["storageclasses"]
      #    verbs: ["get", "list", "watch", "update", "patch"]

  # -- Set the controller deployment mode as `Deployment` or `DaemonSet`.
  kind: Deployment

  # -- [Deployment Strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
  deploymentStrategy:
    type: "RollingUpdate"
    # rollingUpdate:
    #   maxUnavailable: 1

  # -- [Daemonset Strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#creating-a-daemonset-with-rollingupdate-update-strategy)
  daemonsetStrategy:
    type: "RollingUpdate"
    # rollingUpdate:
    #   maxUnavailable: 1

  image:
     # -- Set the image registry of capsule.
    registry: ghcr.io
    # -- Set the image repository of capsule.
    repository: projectcapsule/capsule
    # -- Set the image pull policy.
    pullPolicy: IfNotPresent
    # -- Overrides the image tag whose default is the chart appVersion.
    tag: ''

  # -- Specifies if the container should be started in hostNetwork mode.
  #
  # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
  # CNI (such as calico), because control-plane managed by AWS cannot communicate
  # with pods' IP CIDR and admission webhooks are not working
  hostNetwork: false

  # -- Specifies if the container should be started in hostPID mode.
  hostPID: false

  # -- Don't use Host Users (User Namespaces)
  hostUsers: true

  # -- Set an alternative to the default container port.
  #
  # Useful for use in some kubernetes clusters (such as GKE Private) with
  # aggregator routing turned on, because pod ports have to be opened manually
  # on the firewall side
  webhookPort: 9443

  # Additional Capsule Controller Options
  options:
    # -- Create Configuration
    createConfiguration: true
    # -- Change the default name of the capsule configuration name
    capsuleConfiguration: default
    # -- Additional labels to add to the CapsuleConfiguration resource
    labels: {}
    # -- Additional annotations to add to the CapsuleConfiguration resource
    annotations: {}
    # -- Workers (MaxConcurrentReconciles) is the maximum number of concurrent Reconciles which can be run (ALPHA).
    workers: 1
    # -- Set the log verbosity of the capsule with a value from 1 to 5
    logLevel: "info"
    # -- QPS to use for interacting with kubernetes apiserver
    clientConnectionQPS: 20.0
    # -- Burst to use for interacting with kubernetes apiserver
    clientConnectionBurst: 30
    # -- Timeout used when waiting for controller cache synchronization. Empty uses controller-runtime's default.
    cacheSyncTimeout: "4m"
    # -- Duration after which the in-memory cache is invalidated (based on usaage) and re-fetched from the API server
    cacheInvalidation: 0h30m0s
    # Leader Election
    leaderElection:
      # -- Enable Leader Election for capsule controller
      enabled: true
      # -- Leader election lease duration. Empty uses controller-runtime's default.
      leaseDuration: ""
      # -- Leader election renew deadline. Empty uses controller-runtime's default.
      renewDeadline: ""
      # -- Leader election retry period. Empty uses controller-runtime's default.
      retryPeriod: ""
    # -- Define entities which are considered part of the Capsule construct.
    # Users not mentioned here will be ignored by Capsule
    users:
      - kind: "Group"
        name: "projectcapsule.dev"
    # -- Define entities which can act as Administrators in the capsule construct
    # These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label
    # for interacting with namespaces. Because if that label is not defined, it's assumed that namespace interaction was not targeted towards a tenant and will therefore
    # be ignored by capsule. May also be handy in GitOps scenarios where certain service accounts need to be able to manage namespaces for all tenants.
    administrators: []
    # - kind: "User"
    #   name: "kubernetes-admin"
    # - kind: User
    #   name: alice
    # -- Define groups which when found in the request of a user will be ignored by the Capsule
    # this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.
    ignoreUserWithGroups: []
    # -- ServiceAccounts within tenant namespaces can be promoted to owners of the given tenant
    # this can be achieved by labeling the serviceaccount and then they are considered owners. This can only be done by other owners of the tenant.
    # However ServiceAccounts which have been promoted to owner can not promote further serviceAccounts.
    allowServiceAccountPromotion: false
    # -- Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash
    forceTenantPrefix: false
    # -- If specified, disallows creation of namespaces matching the passed regexp
    protectedNamespaceRegex: ""
    # -- Specifies whether capsule webhooks certificates should be generated by capsule operator
    generateCertificates: true
    # -- Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant
    nodeMetadata:
      forbiddenLabels:
        denied: []
        deniedRegex: ""
      forbiddenAnnotations:
        denied: []
        deniedRegex: ""
    # -- Managed RBAC configuration for the controller
    rbac:
      # -- The ClusterRoles applied for Administrators
      administrationClusterRoles:
        - capsule-namespace-deleter
      # -- The ClusterRoles applied for ServiceAccounts which had owner Promotion
      promotionClusterRoles:
        - capsule-namespace-provisioner
        - capsule-namespace-deleter
      # -- Name for the ClusterRole required to grant Namespace Deletion permissions.
      deleter: capsule-namespace-deleter
      # -- Name for the ClusterRole required to grant Namespace Provision permissions.
      provisioner: capsule-namespace-provisioner

    # @schema type: object
    # @schema additionalProperties: true
    # -- Impersonation
    impersonation:
      # Default ServiceAccount for tenant resources (TenantResource) [Namespaced Scope]
      # When defined, users are required to use this ServiceAccount anywhere in the cluster
      # unless they explicitly provide their own. Once this is set, Capsule will add this ServiceAccount
      # for all GlobalTenantResources, if they don't already have a ServiceAccount defined.
      tenantDefaultServiceAccount: "default"

    # Tracing Configuration
    tracing:
      # -- Enable OpenTelemetry tracing for admission webhook requests.
      enabled: false
      # -- OTLP gRPC endpoint for exporting traces. If empty, OpenTelemetry environment variables are used.
      endpoint: ""
      # -- Disable transport security for the OTLP gRPC trace exporter.
      insecure: true
      # -- Trace sampling ratio for admission webhook requests. Must be between 0 and 1.
      sampleRatio: 1.0
      # -- OTLP gRPC metadata headers to send with each trace export request.
      headers: {}
      basicAuth:
        # -- Basic auth username for the OTLP gRPC trace exporter. Prefer existingSecret for production.
        username: ""
        # -- Basic auth password for the OTLP gRPC trace exporter. Prefer existingSecret for production.
        password: ""
        existingSecret:
          # -- Existing Secret containing OTLP basic auth credentials.
          name: ""
          # -- Secret key containing the basic auth username.
          usernameKey: username
          # -- Secret key containing the basic auth password.
          passwordKey: password
      # -- Timeout for exporting a batch of spans. Empty uses OpenTelemetry's default.
      timeout: ""
      # -- Compression for OTLP gRPC trace exports. Supported value: gzip. Empty disables compression.
      compression: ""
      tls:
        # -- TLS server name override for the OTLP gRPC trace exporter.
        serverName: ""
        # -- Skip OTLP gRPC trace exporter TLS certificate verification. Not recommended for production.
        insecureSkipVerify: false

    # -- DEPRECATED: use users properties.
    # Names of the users considered as Capsule users.
    userNames: []
    # -- DEPRECATED: use users properties.
    # Names of the users considered as Capsule users.
    capsuleUserGroups: []

  # -- A list of extra arguments for the capsule controller
  extraArgs: []

  # -- Additional Environment Variables
  env: []

  # @schema type: object
  # @schema additionalProperties: true
  # -- Configure the liveness probe using Deployment probe spec
  livenessProbe:
    httpGet:
      path: /healthz
      port: 10080

  # @schema type: object
  # @schema additionalProperties: true
  # -- Configure the readiness probe using Deployment probe spec
  readinessProbe:
    httpGet:
      path: /readyz
      port: 10080

  # -- Set the resource requests/limits for the Capsule manager container
  resources: {}

  # -- Set the additional volumes needed for the Capsule manager container
  volumes: []

  # -- Set the additional volumeMounts needed for the Capsule manager container
  volumeMounts: []

  # -- Set the securityContext for the Capsule container
  securityContext: {}

# -- Configuration for `imagePullSecrets` so that you can use a private images registry.
imagePullSecrets: []

# -- Labels to add to the capsule pod.
podLabels: {}

# -- Annotations to add to the capsule pod.
podAnnotations: {}
#  The following annotations guarantee scheduling for critical add-on pods
#  podAnnotations:
#    scheduler.alpha.kubernetes.io/critical-pod: ''

# -- Set the priority class name of the Capsule pod
priorityClassName: '' # system-cluster-critical

# @schema type: object
# @schema additionalProperties: true
# -- Set the securityContext for the Capsule pod
podSecurityContext:
  enabled: true
  seccompProfile:
    type: "RuntimeDefault"
  runAsGroup: 1002
  runAsNonRoot: true
  runAsUser: 1002

# @schema type: object
# @schema additionalProperties: true
# -- Set the securityContext for the Capsule container
securityContext:
  enabled: true
  capabilities:
    drop:
    - ALL
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

# -- Set the node selector for the Capsule pod
nodeSelector: {}
#  node-role.kubernetes.io/master: ""

# -- Set list of tolerations for the Capsule pod
tolerations: []
# - key: CriticalAddonsOnly
#   operator: Exists
# - effect: NoSchedule
#   key: node-role.kubernetes.io/master

# -- Set the replica count for capsule pod
replicaCount: 1

# -- Set additional ports for the deployment
ports: []

# -- Set affinity rules for the Capsule pod
affinity: {}

# -- Set topology spread constraints for the Capsule pod
topologySpreadConstraints: []

# -- Deprecated, use .global.jobs.kubectl instead
jobs: {}

# ServiceAccount
serviceAccount:
  # -- Specifies whether a service account should be created.
  create: true
  # -- Annotations to add to the service account.
  annotations: {}
  # -- The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template
  name: ""

  imagePullSecrets: []
  # just string array [ "sec-1", "sec-2" ]

certManager:
  # -- Specifies whether capsule webhooks certificates should be generated using cert-manager
  generateCertificates: true
  # -- Specify additional SANS to add to the certificate
  additionalSANS: []
# -- Additional labels which will be added to all resources created by Capsule helm chart
customLabels: {}

# -- Additional annotations which will be added to all resources created by Capsule helm chart
customAnnotations: {}

# -- Array of additional resources to be created alongside Capsule helm chart
extraManifests: []
  # - apiVersion: v1
  #   kind: ConfigMap
  #   metadata:
  #     name: extra-configmap
  #   data:
  #     key: value

# Monitoring Settings
monitoring:

  diagnostics:
    # -- Enable Diagnostic Dashboards to be deployed
    enabled: false
    # -- Annotations for dashboard configmaps
    annotations: {}
    # -- Labels for dashboard configmaps
    labels:
      grafana_dashboard: "1"

    # Grafana Operator
    operator:
      # -- Enable Operator Resources (GrafanaDashboard)
      enabled: false
      # -- Allow the Operator to match this resource with Grafanas outside the current namespace
      allowCrossNamespaceImport: true
      # -- How often the resource is synced, defaults to 10m0s if not set
      resyncPeriod: "10m"
      # -- Selects Grafana instances for import
      instanceSelector: {}
      # -- folder assignment for dashboard
      folder: ""

  dashboards:
    # -- Enable Dashboards to be deployed
    enabled: false
    # -- Annotations for dashboard configmaps
    annotations: {}
    # -- Labels for dashboard configmaps
    labels:
      grafana_dashboard: "1"
    # -- Custom namespace for dashboard configmaps
    namespace: ""

    # Grafana Operator
    operator:
      # -- Enable Operator Resources (GrafanaDashboard)
      enabled: false
      # -- Allow the Operator to match this resource with Grafanas outside the current namespace
      allowCrossNamespaceImport: true
      # -- How often the resource is synced, defaults to 10m0s if not set
      resyncPeriod: "10m"
      # -- Selects Grafana instances for import
      instanceSelector: {}
      # -- folder assignment for dashboard
      folder: ""

  # ServiceMonitor
  serviceMonitor:
    # -- Enable ServiceMonitor
    enabled: false
    # -- Install the ServiceMonitor into a different Namespace, as the monitoring stack one (default: the release one)
    namespace: ''
    # -- Assign additional labels according to Prometheus' serviceMonitorSelector matching labels
    labels: {}
    # -- Assign additional Annotations
    annotations: {}
    # -- Change matching labels
    matchLabels: {}
    # -- Set targetLabels for the serviceMonitor
    targetLabels: []
    endpoint:
      # -- Set the scrape interval for the endpoint of the serviceMonitor
      interval: "15s"
      # -- Set the scrape timeout for the endpoint of the serviceMonitor
      scrapeTimeout: ""
      # -- Set metricRelabelings for the endpoint of the serviceMonitor
      metricRelabelings: []
      # -- Set relabelings for the endpoint of the serviceMonitor
      relabelings: []

  # PrometheusRules
  prometheusRules:
    # -- Enable PrometheusRules
    enabled: false
    # -- Install the PrometheusRules into a different Namespace, as the monitoring stack one (default: the release one)
    namespace: ''
    # -- Assign additional labels according to Prometheus selector matching labels
    labels: {}
    # -- Assign additional Annotations
    annotations: {}
    # -- Labels add to all Rules
    ruleLabels: {}
    # -- Annotations add to all Rules
    ruleAnnotations: {}
    # -- Prometheus Rules definitions. The block is directly forwarded into the PrometheusRule, so you can use whatever specification you want.
    # @default -- See [values.yaml](values.yaml)
    rules: # @schema itemProperties:{}
      - name: capsule.customquotas
        rules:
          - alert: CapsuleGlobalCustomQuotaNotReady
            expr: |
              capsule_global_custom_quota_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: customquotas
            annotations:
              summary: Capsule GlobalCustomQuota {{ $labels.custom_quota }} is not ready
              description: "GlobalCustomQuota {{ $labels.custom_quota }} is not in Ready state for the last 10 minutes."
          - alert: CapsuleGlobalCustomQuotaHighUsageWarning
            expr: |
              capsule_global_custom_quota_resource_usage_percentage > 90
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: customquotas
            annotations:
              summary: "High resource usage in GlobalCustomQuota {{ $labels.custom_quota }}"
              description: "Usage for GlobalCustomQuota {{ $labels.custom_quota }} is at {{ $value }}% usage for the last 10 minutes."
          - alert: CapsuleGlobalCustomQuotaHighUsageCritical
            expr: |
              capsule_global_custom_quota_resource_usage_percentage > 95
            for: 10m
            labels:
              severity: critical
              app: capsule
              component: customquotas
            annotations:
              summary: "Critical resource usage in GlobalCustomQuota {{ $labels.custom_quota }}"
              description: "Usage for GlobalCustomQuota {{ $labels.custom_quota }} has exceeded 95% usage for the last 10 minutes."
          - alert: CapsuleCustomQuotaNotReady
            expr: |
              capsule_custom_quota_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: customquotas
            annotations:
              summary: "Capsule CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }} is not ready"
              description: "CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }} is not in Ready state for the last 10 minutes."
          - alert: CapsuleCustomQuotaHighUsageWarning
            expr: |
              capsule_custom_quota_resource_usage_percentage > 90
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: customquotas
            annotations:
              summary: "High resource usage in CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }}"
              description: "Usage for CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }} is at {{ $value }}% usage for the last 10 minutes."
          - alert: CapsuleCustomQuotaHighUsageCritical
            expr: |
              capsule_custom_quota_resource_usage_percentage > 95
            for: 10m
            labels:
              severity: critical
              app: capsule
              component: customquotas
            annotations:
              summary: "Critical resource usage in CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }}"
              description: "Usage for CustomQuota {{ $labels.target_namespace }}/{{ $labels.custom_quota }} has exceeded 95% usage for the last 10 minutes."

      - name: capsule.resourcepools
        rules:
          - alert: CapsuleResourcePoolNotReady
            expr: |
              capsule_pool_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: resourcepools
            annotations:
              summary: "Capsule ResourcePool {{ $labels.pool }} is not ready"
              description: "ResourcePool {{ $labels.pool }} is not in Ready state for the last 10 minutes."
          - alert: CapsuleResourcePoolClaimNotReady
            expr: |
              capsule_claim_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: resourcepools
            annotations:
              summary: "Capsule ResourcePoolClaim {{ $labels.target_namespace }}/{{ $labels.name }} is not ready"
              description: "ResourcePoolClaim {{ $labels.target_namespace }}/{{ $labels.name }} is not in Ready state for the last 10 minutes."
          - alert: CapsulePoolHighUsageWarning
            expr: |
              capsule_pool_usage_percentage > 90
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: resourcepools
            annotations:
              summary: "High resource usage in Resourcepool {{ $labels.pool }}"
              description: "Resource {{ $labels.resource }} in pool {{ $labels.pool }} is at {{ $value }}% usage for the last 10 minutes."
          - alert: CapsulePoolHighUsageCritical
            expr: |
              capsule_pool_usage_percentage > 95
            for: 10m
            labels:
              severity: critical
              app: capsule
              component: resourcepools
            annotations:
              summary: "Critical resource usage in Resourcepool {{ $labels.pool }}"
              description: "Resource {{ $labels.resource }} in pool {{ $labels.pool }} has exceeded 95% usage for the last 10 minutes."

      - name: capsule.globalresourcequotas
        rules:
          - alert: CapsuleGlobalResourceQuotaNotReady
            expr: |
              capsule_global_resource_quota_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: globalresourcequotas
            annotations:
              summary: "Capsule GlobalResourceQuota {{ $labels.global_resource_quota }} is not ready"
              description: "GlobalResourceQuota {{ $labels.global_resource_quota }} is not in Ready state for the last 10 minutes."
          - alert: CapsuleGlobalResourceQuotaHighUsage
            expr: |
              capsule_global_resource_quota_usage_percentage > 90
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: globalresourcequotas
            annotations:
              summary: "High resource usage in GlobalResourceQuota {{ $labels.global_resource_quota }}"
              description: "Resource {{ $labels.resource }} in GlobalResourceQuota {{ $labels.global_resource_quota }} is at {{ $value }}% usage for the last 10 minutes."
          - alert: CapsuleGlobalResourceQuotaCriticalUsage
            expr: |
              capsule_global_resource_quota_usage_percentage > 95
            for: 10m
            labels:
              severity: critical
              app: capsule
              component: globalresourcequotas
            annotations:
              summary: "Critical resource usage in GlobalResourceQuota {{ $labels.global_resource_quota }}"
              description: "Resource {{ $labels.resource }} in GlobalResourceQuota {{ $labels.global_resource_quota }} has exceeded 95% usage for the last 10 minutes."

      - name: capsule.replications
        rules:
          - alert: CapsuleGlobalTenantResourceNotReady
            expr: |
              capsule_global_resource_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: replications
            annotations:
              summary: Capsule GlobalTenantResource {{ $labels.name }} is not ready
              description: "GlobalTenantResource {{ $labels.name }} is not in Ready state for the last 10 minutes."
          - alert: CapsuleTenantResourceNotReady
            expr: |
              capsule_resource_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: replications
            annotations:
              summary: Capsule TenantResource {{ $labels.target_namespace }}/{{ $labels.name }} is not ready
              description: "TenantResource {{ $labels.target_namespace }}/{{ $labels.name }} is not in Ready state for the last 10 minutes."

      - name: capsule.tenants
        rules:
          - alert: CapsuleTenantNamespaceQuotaExceeded
            expr: |
              capsule_tenant_namespaces_current >= capsule_tenant_namespaces_max
            for: "5m"
            labels:
              severity: warning
              app: capsule
              component: tenants
            annotations:
              summary: "Capsule Tenant {{ $labels.tenant }} has reached namespace quota"
              description: "Tenant {{ $labels.tenant }} has {{ $value }} namespaces and has reached or exceeded its maximum quota of {{ $labels.max_namespaces }}."
          - alert: CapsuleTenantNotReady
            expr: |
              capsule_tenant_condition{condition="Ready"} != 1
            for: "5m"
            labels:
              severity: critical
              app: capsule
              component: tenants
            annotations:
              summary: "Capsule Tenant {{ $labels.tenant }} is missing or not active"
              description: "Tenant {{ $labels.tenant }} is either missing or not in Active state. This may prevent users from accessing their namespaces."
          - alert: CapsuleTenantNamespaceNotReady
            expr: |
              capsule_tenant_namespace_condition{condition="Ready"} != 1
            for: "5m"
            labels:
              severity: critical
              app: capsule
              component: tenants
            annotations:
              summary: "Namespace {{ $labels.target_namespace }} from Tenant {{ $labels.tenant }} is not Ready."
              description: "Namespace {{ $labels.target_namespace }} from Tenant {{ $labels.tenant }} is not Ready state for the last 10 minutes."

      - name: capsule.rulestatus
        rules:
          - alert: CapsuleRuleStatusNotReady
            expr: |
              capsule_rulestatus_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: rulestatus
            annotations:
              summary: Capsule RuleStatus {{ $labels.target_namespace }}/{{ $labels.name }} is not ready
              description: "RuleStatus {{ $labels.target_namespace }}/{{ $labels.name }} is not in Ready state for the last 10 minutes."

      - name: capsule.tenantowners
        rules:
          - alert: CapsuleTenantOwnerNotReady
            expr: |
              capsule_tenantowner_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: tenantowners
            annotations:
              summary: Capsule TenantOwner {{ $labels.name }} is not ready
              description: "TenantOwner {{ $labels.name }} is not in Ready state for the last 10 minutes."

      - name: capsule.config
        rules:
          - alert: CapsuleConfigurationNotReady
            expr: |
              capsule_config_condition{condition="Ready"} != 1
            for: 10m
            labels:
              severity: warning
              app: capsule
              component: config
            annotations:
              summary: "CapsuleConfiguration {{ $labels.name }} is not ready"
              description: "CapsuleConfiguration {{ $labels.name }} is not in Ready state for the last 10 minutes."

      - name: capsule.controller
        rules:
          # Alert when Capsule controller is down
          - alert: CapsuleControllerDown
            expr: |
              up{job="capsule-controller-manager"} == 0
            for: "5m"
            labels:
              severity: critical
              app: capsule
              component: controller
            annotations:
              summary: "Capsule controller is down"
              description: "The Capsule controller manager has been down for more than 5 minutes. Tenant operations may be impacted."
          - alert: CapsuleWebhookHighErrorRate
            expr: |
              rate(capsule_webhook_requests_total{status=~"5.."}[5m]) / rate(capsule_webhook_requests_total[5m]) > 0.05
            for: "5m"
            labels:
              severity: warning
              app: capsule
              component: controller
            annotations:
              summary: "Capsule webhook experiencing high error rate"
              description: "Capsule webhook has an error rate of {{ $value | humanizePercentage }} over the last 5 minutes. This may block tenant operations."

# Conversions Webhook configurations
conversions:
  # Configure custom webhook service
  service:
    # -- The URL where the capsule webhook services are running (Overwrites cluster scoped service definition)
    url: ""
    # -- CABundle for the webhook service
    caBundle: ""
    # -- Custom service name for the webhook service
    name: ""
    # -- Custom service namespace for the webhook service
    namespace: ""
    # -- (integer, null) Custom service port for the webhook service
    port: # @schema type:[integer, null]


# Webhooks configurations
webhooks:
  # -- When `crds.exclusive` is `true` the webhooks will be installed
  exclusive: false
  # -- Timeout in seconds for mutating webhooks
  mutatingWebhooksTimeoutSeconds: 30
  # -- Timeout in seconds for validating webhooks
  validatingWebhooksTimeoutSeconds: 30

  # -- Additional Labels for all webhooks
  labels: {}

  # -- Additional Annotations for all webhooks
  annotations: {}

  # Configure custom webhook service
  service:
    # -- The URL where the capsule webhook services are running (Overwrites cluster scoped service definition)
    url: ""
    # -- CABundle for the webhook service
    caBundle: ""
    # -- Custom service name for the webhook service
    name: ""
    # -- Custom service namespace for the webhook service
    namespace: ""
    # -- (integer, null) Custom service port for the webhook service
    port: # @schema type:[integer, null]

  # -- MatchConditions for all webhooks
  matchConditions: []
  #  - name: "exclude-privileged-users"
  #    expression: >
  #      request.resource.group == "capsule.clastix.io" ||
  #      !(
  #        request.userInfo.username in [
  #          "kubernetes-admin"
  #        ]
  #      )

  # Admission Webhook Configuration
  hooks:
    customquotas:
      # -- Enable the Hook
      enabled: true
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
        - apiGroups:
            - capsule.clastix.io
          apiVersions:
            - v1beta2
          operations:
            - CREATE
            - UPDATE
            - DELETE
          resources:
            - customquotas
          scope: 'Namespaced'
    globalcustomquotas:
      # -- Enable the Hook
      enabled: true
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
        - apiGroups:
            - capsule.clastix.io
          apiVersions:
            - v1beta2
          operations:
            - CREATE
            - UPDATE
            - DELETE
          resources:
            - globalcustomquotas
          scope: 'Cluster'

    # -- Webhook for admission-time GlobalResourceQuota calculations
    globalresourcequotas:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
        - apiGroups:
            - '*'
          apiVersions:
            - '*'
          operations:
            - CREATE
            - UPDATE
          resources:
            - '*/*'
          scope: Namespaced
        - apiGroups:
            - capsule.clastix.io
          apiVersions:
            - v1beta2
          operations:
            - CREATE
            - UPDATE
          resources:
            - globalresourcequotas
          scope: Cluster

    # -- Webhook for Custom Quota Calculations ([Read More](https://projectcapsule.dev/docs/resource-management/customquotas/#admission))
    calculations:
      # -- Enable the Hook
      enabled: false
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      #  matchExpressions:
      #    - key: capsule.clastix.io/tenant
      #      operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      # Include an explicit status subresource (for example, pods/status) when
      # CustomQuota field selectors depend on status fields.
      rules: []

    # -- Webhook for Rule Status ([Read More](https://projectcapsule.dev/docs/resource-management/customquotas/#admission))
    rulestatus:
      # -- Enable the Hook
      enabled: true
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      #  matchExpressions:
      #    - key: capsule.clastix.io/tenant
      #      operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []

    # -- Additional Metadata webhook
    metadata:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Ignore
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions:
        - name: ignore-subresources
          expression: '!has(request.subResource) || request.subResource == ""'
        - name: ignore-events
          expression: 'request.resource.resource != "events"'

      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
      - apiGroups:
          - '*'
        apiVersions:
          - '*'
        operations:
          - CREATE
          - UPDATE
        resources:
          - '*'
        scope: Namespaced
    # -- Generic Rules API, including the rule-engine validation for Pods and Services
    generic:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions:
        - name: ignore-events
          expression: 'request.resource.resource != "events"'

      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: IfNeeded
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
      - apiGroups:
          - '*'
        apiVersions:
          - '*'
        operations:
          - CREATE
          - UPDATE
        resources:
          - '*/*'
        scope: Namespaced

    resourcepools:
      pools:
        # -- Enable the Hook
        enabled: true
        # -- Capsule Hook Options
        opts: {}
        # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
        failurePolicy: Fail
        # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
        matchPolicy: Equivalent
        # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
        objectSelector: {}
        # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
        namespaceSelector: {}
        # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
        matchConditions: []
        # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
        reinvocationPolicy: Never

      claims:
        # -- Enable the Hook
        enabled: true
        # -- Capsule Hook Options
        opts: {}
        # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
        failurePolicy: Fail
        # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
        matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
        # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
        objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
        # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
        namespaceSelector: {}
        # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
        matchConditions: []
        # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
        reinvocationPolicy: Never


    customresources:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
          - key: projectcapsule.dev/custom-resources
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions:
        - name: ignore-subresources
          expression: '!has(request.subResource) || request.subResource == ""'
        - name: ignore-events
          expression: 'request.resource.resource != "events"'

    namespaces:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never

    cordoning:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
          - key: projectcapsule.dev/cordoned
            operator: In
            values:
              - "true"
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions:
        - name: ignore-subresources
          expression: '!has(request.subResource) || request.subResource == ""'
        - name: ignore-events
          expression: 'request.resource.resource != "events"'
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
      - apiGroups:
          - '*'
        apiVersions:
          - '*'
        operations:
          - CREATE
          - UPDATE
          - DELETE
        resources:
          - '*'
        scope: Namespaced

    gateways:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never


    ingresses:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never


    devices:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never

    pods:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never

    persistentvolumeclaims:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never

    tenants:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never


    owners:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never


    config:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Ignore
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [ReinvocationPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#reinvocation-policy)
      reinvocationPolicy: Never

    managed:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector:
        matchExpressions:
          - key: projectcapsule.dev/managed-by
            operator: In
            values:
              - "controller"
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
        - apiGroups:
            - '*'
          apiVersions:
            - '*'
          operations:
            - CREATE
            - UPDATE
            - DELETE
          resources:
            - '*'
          scope: "Namespaced"
        # Rule-generated GlobalResourceQuotas carry the managed-by label and
        # must receive the same drift protection as namespaced managed objects.
        # The status subresource is intentionally not included.
        - apiGroups:
            - capsule.clastix.io
          apiVersions:
            - v1beta2
          operations:
            - CREATE
            - UPDATE
            - DELETE
          resources:
            - globalresourcequotas
          scope: "Cluster"

    replications:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Equivalent
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector:
        matchExpressions:
          - key: projectcapsule.dev/created-by
            operator: In
            values:
              - "replications"
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []
      #  - name: "exclude-privileged-users"
      #    expression: >
      #      !(
      #        request.userInfo.username in [
      #          "kubernetes-admin"
      #        ]
      #      )

      # -- [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules)
      rules:
        - apiGroups:
            - '*'
          apiVersions:
            - '*'
          operations:
            - UPDATE
            - DELETE
          resources:
            - '*'
          scope: "*"

    services:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []

    nodes:
      # -- Enable the Hook
      enabled: false
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector: {}
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []

    serviceaccounts:
      # -- Enable the Hook
      enabled: true
      # -- Capsule Hook Options
      opts: {}
      # -- [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy)
      failurePolicy: Fail
      # -- [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchPolicy: Exact
      # @schema type: object
      # @schema additionalProperties: true
      # -- [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector)
      objectSelector: {}
      # @schema type: object
      # @schema additionalProperties: true
      # -- [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector)
      namespaceSelector:
        matchExpressions:
          - key: capsule.clastix.io/tenant
            operator: Exists
      # -- [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy)
      matchConditions: []

    # -- Deprecated, use webhooks.hooks.namespaces instead
    namespaceOwnerReference: {}

    defaults:
      # -- Deprecated, use webhooks.hooks.ingresses instead
      ingress: {}
      # -- Deprecated, use webhooks.hooks.persistentvolumeclaims instead
      pvc: {}
      # -- Deprecated, use webhooks.hooks.pods instead
      pods: {}

    # -- Deprecated, use webhooks.hooks.replications instead
    tenantResourceObjects: {}
