replicaCount: 1

image:
  repository: gcr.io/heptio-images/gangway
  tag: v3.2.0
  pullPolicy: IfNotPresent
  ## Optional array of imagePullSecrets containing private registry credentials
  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
  pullSecrets: []
  # - name: secretName

nameOverride: ""
fullnameOverride: ""

# Specify a CA cert to trust for self signed certificates at the Oauth2 URLs.  Be careful to indent one level beyond the
# trustedCACert key:
# trustedCACert: |-
#  -----BEGIN CERTIFICATE-----
#  ...
#  -----END CERTIFICATE-----

# Add Env Variables to pod
env: {}

# Add annotations to the pod
podAnnotations: {}

gangway:
  # The address to listen on. Defaults to 0.0.0.0 to listen on all interfaces.
  # Env var: GANGWAY_HOST
  # host: 0.0.0.0

  serviceAccountName: ""

  # The port to listen on. Defaults to 8080.
  # Env var: GANGWAY_PORT
  port: 8080

  # Should Gangway serve TLS vs. plain HTTP? Default: false
  # Env var: GANGWAY_SERVE_TLS
  # serveTLS: false

  # The public cert file (including root and intermediates) to use when serving TLS.
  # Env var: GANGWAY_CERT_FILE
  # certFile: /etc/gangway/tls/tls.crt

  # The private key file when serving TLS.
  # Env var: GANGWAY_KEY_FILE
  # keyFile: /etc/gangway/tls/tls.key

  # The cluster name. Used in UI and kubectl config instructions.
  # Env var: GANGWAY_CLUSTER_NAME
  clusterName: "${GANGWAY_CLUSTER_NAME}"

  # OAuth2 URL to start authorization flow.
  # Env var: GANGWAY_AUTHORIZE_URL
  authorizeURL: "https://${DNS_NAME}/authorize"

  # OAuth2 URL to obtain access tokens.
  # Env var: GANGWAY_TOKEN_URL
  tokenURL: "https://${DNS_NAME}/oauth/token"

  # Endpoint that provides user profile information [optional]. Not all providers
  # will require this.
  # Env var: GANGWAY_AUDIENCE
  audience: "https://${DNS_NAME}/userinfo"

  # Used to specify the scope of the requested Oauth authorization.
  scopes: ["openid", "profile", "email", "offline_access"]

  # Where to redirect back to. This should be a URL where gangway is reachable.
  # Typically this also needs to be registered as part of the oauth application
  # with the oAuth provider.
  # Env var: GANGWAY_REDIRECT_URL
  redirectURL: "https://${GANGWAY_REDIRECT_URL}/callback"

  # API client ID as indicated by the identity provider
  # Env var: GANGWAY_CLIENT_ID
  clientID: "${GANGWAY_CLIENT_ID}"

  # API client secret as indicated by the identity provider
  # Env var: GANGWAY_CLIENT_SECRET
  clientSecret: "${GANGWAY_CLIENT_SECRET}"

  # Some identity providers accept an empty client secret, this
  # is not generally considered a good idea. If you have to use an
  # empty secret and accept the risks that come with that then you can
  # set this to true.
  # allowEmptyClientSecret: false

  # The JWT claim to use as the username. This is used in UI.
  # Default is "nickname". This is combined with the clusterName
  # for the "user" portion of the kubeconfig.
  # Env var: GANGWAY_USERNAME_CLAIM
  usernameClaim: "sub"

  # The API server endpoint used to configure kubectl
  # Env var: GANGWAY_APISERVER_URL
  apiServerURL: "https://${GANGWAY_APISERVER_URL}"

  # The path to find the CA bundle for the API server. Used to configure kubectl.
  # This is typically mounted into the default location for workloads running on
  # a Kubernetes cluster and doesn't need to be set.
  # Env var: GANGWAY_CLUSTER_CA_PATH
  # cluster_ca_path: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"


  # The path gangway uses to create urls (defaults to "")
  # Env var: GANGWAY_HTTP_PATH
  # httpPath: "https://${GANGWAY_HTTP_PATH}"

  # The key to use when encrypting the contents of cookies.
  # You can leave this blank and the chart will generate a random key, however
  # you must use that with caution. Subsequent upgrades to the deployment will
  # regenerate this key which will cause Gangway to error when attempting to
  # decrypt cookies stored in users' browsers which were encrypted with the old
  # key.
  # TL;DR: Safe to use the auto generation in test environments, provide your
  # own in procution.
  # sessionKey:

tls: {}
  # certData: |
  #   -----BEGIN CERTIFICATE-----
  #   ...
  #   -----END CERTIFICATE-----
  # keyData: |
  #   -----BEGIN ENCRYPTED PRIVATE KEY-----
  #   ...
  #   -----END ENCRYPTED PRIVATE KEY-----

  # Name of an existing secret containing `tls.cert` and `tls.key`.
  # Mounted on the default tls path `/etc/gangway/tls`
  # existingSecret: ""

extraVolumes: []

extraVolumeMounts: []

livenessProbe:
  # HTTP or HTTPS
  scheme: HTTP

readinessProbe:
  # HTTP or HTTPS
  scheme: HTTP

service:
  type: ClusterIP
  port: 80
  # Specifies a loadBalancerIP when using LoadBalancer service type
  # loadBalancerIP: 192.168.0.51
  annotations: {}

ingress:
  enabled: false
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  path: /
  hosts:
  - chart-example.local
  tls: []
  # - secretName: chart-example-tls
  #   hosts:
  #     - chart-example.local

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}
