replicaCount: 1

# ===========================================================================
# Fail-loud guards
# ===========================================================================
# The chart templates include validation guards that abort with a clear error
# message when values are misconfigured. CI runs negative tests to ensure
# these guards are not accidentally removed during refactoring.
#
#   Guard                    Template              Expected error substring
#   ~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   Empty PAT in pat mode    secret.yaml           GITLAB_PERSONAL_ACCESS_TOKEN is required when AUTH_MODE=pat
#   PDB deadlock             pdb.yaml              would deadlock node drains
#   Secret conflict          secret.yaml           Set EITHER existingSecret OR secret.GITLAB_PERSONAL_ACCESS_TOKEN
#   PDB both fields          pdb.yaml              set EITHER minAvailable OR maxUnavailable
#   Invalid AUTH_MODE        schema.json           values don't meet the specifications
#   PAT non-loopback host    auth-validation.yaml  AUTH_MODE=pat requires HOST
# ===========================================================================

image:
  repository: ghcr.io/yoda-digital/mcp-gitlab-server
  # -- Image tag. Overridden by CI at package time.
  # Default "latest" is safe for local helm install; tagged releases use semver.
  tag: "latest"
  # -- Image digest (sha256:...). When set, takes precedence over tag.
  digest: ""
  pullPolicy: IfNotPresent

nameOverride: ""
fullnameOverride: ""

# -- GitLab MCP server configuration (non-sensitive)
config:
  PORT: "3000"
  # -- Bind address. Pods must bind to all interfaces for the Service to
  # reach them, so the chart sets HOST=0.0.0.0. Combined with AUTH_MODE=oauth
  # below, network exposure is auth-gated. The application's own default is
  # HOST=127.0.0.1 (loopback) for non-Helm local-dev safety.
  HOST: "0.0.0.0"
  USE_SSE: "true"
  USE_STREAMABLE_HTTP: "false"
  GITLAB_API_URL: "https://gitlab.com/api/v4"
  GITLAB_READ_ONLY_MODE: "false"
  # -- Authentication mode: "oauth" (default) or "pat"
  # "oauth" : per-connection Bearer token forwarded in the Authorization header.
  #           This is the only safe mode for cluster-reachable Service exposure.
  # "pat"   : static token from GITLAB_PERSONAL_ACCESS_TOKEN env var / existingSecret.
  #           UNSUPPORTED in Helm — the chart-level guard refuses install because
  #           pods are reachable via Kubernetes Service, which violates the
  #           loopback-only constraint of PAT mode (GHSA-8jr5-6gvj-rfpf).
  AUTH_MODE: "oauth"
  # -- Comma-separated list of allowed CORS origins.
  # In PAT-loopback mode: defaults to "*" if empty (local dev only).
  # In OAuth mode: no default (deny browser cross-origin access).
  CORS_ALLOW_ORIGINS: ""
  # -- Max sessions before /healthz returns 503 (default 10000)
  HEALTHZ_MAX_SESSIONS: "10000"

# -- Sensitive values injected as env vars from a Secret.
# Set these or use existingSecret.
secret:
  GITLAB_PERSONAL_ACCESS_TOKEN: ""

# -- Use an existing Secret instead of creating one.
# The Secret must contain the keys listed in secret{} above.
existingSecret: ""

service:
  type: ClusterIP
  port: 3000

resources:
  requests:
    cpu: 50m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 256Mi

# -- Extra env vars (list of {name, value} or {name, valueFrom})
extraEnv: []

# -- Extra envFrom (list of secretRef/configMapRef)
extraEnvFrom: []

nodeSelector: {}
tolerations: []
affinity: {}

# -- PodDisruptionBudget (recommended when replicaCount > 1).
# NOTE: SSE/Streamable HTTP transports hold in-memory session state.
# Multi-replica requires sticky sessions — see docs/OPERATIONS.md.
podDisruptionBudget:
  enabled: false
  # maxUnavailable: 1 is the safe default — works at any replicaCount.
  maxUnavailable: 1

podAnnotations: {}
podLabels: {}

serviceAccount:
  create: true
  name: ""

# -- Liveness / readiness probes
probes:
  liveness:
    enabled: true
    path: /livez
    initialDelaySeconds: 5
    periodSeconds: 30
  readiness:
    enabled: true
    path: /readyz
    initialDelaySeconds: 3
    periodSeconds: 10