# Default values for local service.
# This is a YAML-formatted file.
# Declare environment neutral variables within this file.
# Declare environment specific variables to be passed into your templates within release files (e.g. /environments/values-<environment>.yaml).
#####################################################
#
# !!! FOR USE WITH KVETCH v2 EKS CLUSTERS ONLY !!!
#
#####################################################

# KVETCH Version of the PlutoTV standards for Helm Templates.
kvetchVersion: v2

# Replica Count defines the number of pods to maintain; enabled when autoscaling inactive.
replicaCount: 1

image:
  registry: 972525491246.dkr.ecr.us-east-1.amazonaws.com
  pullPolicy: ""

  # Repository overrides the image repository defined in _helpers.tpl (default: <service name>).
  repository: "plutotv/service-dal"

  # Tag overrides the image tag defined in _helpers.tpl (default: Chart.appVersion).
  tag: latest

imagePullSecrets: []

### MOCK SERVICE ONLY #########################################################
# Enable as Mock Service
# Additionally requires cluster enabled, and not in Production environment.
# Define GRPC subdomains under istio.gateway.grpc.mockSubDomains[] for Mock Service.
# Not Supported on Production clusters (Production enabled configurations ignore this flag)!
isMockService: false

# Name Override overrides the service name defined in _helpers.tpl (default: Chart name).
nameOverride: ""

# Fullname Override overrides the fullname defined in _helpers.tpl (default: service name).
fullnameOverride: ""

# Create Namespace resource, ignored on upgrades.
createNamespace: false

# Namespace Override overrides the namespace the service is deployed into, defined in namespace.yaml (default: <environment>-<service name> or <enviornment>-<stack>-<service-name>).
namespaceOverride: ""

# Domain Override overrides the domain defined in _helpers.tpl (default: pluto.tv).
domainOverride: ""

# Define SubDomain overrides everything before `.<cluster environment>.<domain>` (default, see: _helper.tpl, hostname).
subDomainOverride: ""

# Hostname Override overrides the full hostname including domain (default, see: _helper.tpl, hostname).
hostnameOverride: ""

# Global Accelerator utilizes a specific ALB that routes to the closest region for that request.
# Global Accelerator will not enable when subDomainOverride or hostnameOverride are defined.
# Only supported on Primary Cluster Environments (nonprd, preprd, prd).
globalAccelerator: false

# The Legacy Global Accelerator implementation uses default-ga subdomain for its target.
# Option only utilized when globalAccelerator is enabled.
defaultGATarget: false

# Hostname Include Stack name prepends the stack name (app.stack) if present to the service name within the hostname generation, this is ignored by Service URI (see _helpers.tpl) if using hostnameOverride.
hostnameIncludeStack: false

# Include Legacy Domain hostname within the list of hostnames (see _helpers.tpl, legacyDomain).
includeLegacyDomain: false

# Define Legacy SubDomain for the enabled Legacy Domain (default: <service name> or <stack>-<service name> if hostnameIncludeStack=true).
legacySubDomainOverride: ""

# Disable Live Hosts included for charts on Primary Clusters (nonprd, preprd, prd).
disableLiveHosts: false

# Disable Harness Canary process on deployments by adding the harness.io/direct-apply annotation.
# Does not work for preprd & prd clusters.
harnessCanaryDisabled: false

# Disable Harness from Versioning Secrets resources.
harnessVersionSecrets: false

# Disable Harness from Versioning ConfigMap resources.
harnessVersionConfigMaps: false

# Application specific custom values; requires updating templates as needed.
app:
  # Application Runtime (e.g. go/node/python/java) (default: go).
  runtime: "node"

  # Environment per standards (e.g. dev/staging/preprod/prod) (default: dev).
  env: dev

  # Default Application Port.
  port: 8080

  # Required: Team & Group Names for Service, included with labels.
  # Spec: https://plutotv.atlassian.net/wiki/spaces/POLICIES/pages/3066429862/Kubernetes+Policies+v1.0
  # Team that Created / Owns Application, included with Service & Datadog labels.
  # Note: The suffix `-team` is appended to the team name for the label if not provided.
  team: ""
  # Group within the Team that owns the Service.
  # Note: The suffix `-group` is appended to the group name for the label if not provided.
  group: ""

  # Optional: Stack the Application is part of, included with labels.
  stack: ""

  # Component Type of the Application: service, database, application, job, etc., included with labels (default: service).
  componentType: ""

  # Default Sealights Configuration.
  seaLights:
    # SeaLights (boolean) are enabled by default for most environments, forced disabled on prd. (default: false)
    disabled:
    # Log Level options: off, error, warn, info, debug (default: off)
    logLevel: ""
    # SeaLights Lab ID (default: service hostname)
    labId: ""
    # forceMode: 0 - disabled, 1 - Unit Test, 2 - Integration Test (default: 0)
    forceMode: ""

  # Default Istio Prometheus Configuration.
  prometheus:
    enabled: false
    path: /metrics
    port: 9464
    scrape: false

# OTLP configuration https://opentelemetry.io/docs/specs/otlp/
otlpMetrics:
  enabled: false
  # Required: either http or grpc accepted
  protocol: http
  # Interval for metrics collection (default: 10s)
  exportInterval: "10000"

# https://opentelemetry.io/docs/collector/
openTelemetry:
  # Optional host override for open telemetry service (default: http://otel-collector.opentelemetry-system.svc.cluster.local:9411)
  hostOverride: ""

# https://github.com/external-secrets/external-secrets/blob/main/docs/spec.md
externalSecrets:
  enabled: false

  secretStore:
    # Vault Address Override overrides default external secret address (see: _helpers.tpl).
    vaultAddressOverride: ""

    # Specify Vault Mount Path for authentication (default: <cluster name>).
    mountPath: ""

    # Vault Role for External Secrets Store (default: default-service-role).
    vaultRole: ""

  secret:
    # Three different way to store secrets within the pod, first and default option is to write them as environment
    #   variables as defined by the `secretKey` where we replace "." -> "_" and "-" -> "_" then uppercase.
    # Example:
    #   - foo-bar or foo.bar -> FOO_BAR
    # Optionally you may enable `useSecretRef`, uses it as defined in the externalSecrets below as is.

    # Mount Secrets as Volume to Pod.
    # If you need secrets to dynamically update, then we recommend enabling `volumeMount`. This may be selected in
    #   addition to the default environment variables / secretRef options above.
    # https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod
    volumeMount:
      enabled: false
      # Define Mount Path (default: `secret-<service name>/`
      mountPath: ""
      # Optionally define Items to specify an alternate key & path
      # Example:
      #   items:
      #     - key: foo
      #       path: bar/foobar
      # foo secret is stored under /<mountPath>/bar/foobar file instead of /<mountPath>/foo.
      items: []

    # Use Secret Reference using variables as designed or pulled directly from Vault.
    useSecretRef: false

    refreshInterval: "10m"

    # Secret Name Suffix appends optional suffix to the secret name created (see: _helpers.tpl).
    secretNameSuffix: ""

    # Update SecretVariables, rewrite values to expected key path for Vault Policy, example:
    #   secretVariables:
    #     - secretKey: <ENVIRONMENT_VARIABLE>
    #       remoteRef:
    #         key: app/<namespace>/<property>
    #         property: <key>
    #     - secretKey: <ENVIRONMENT_VARIABLE>
    #       remoteRef:
    #         key: app/common/<property>
    #         property: <key>
    #
    # Kv2 Vault Standards, the supported paths are noted within the confluence document:
    # https://plutotv.atlassian.net/wiki/spaces/DEVOPS/pages/2401370127/KVETCH+2.0+-+Approach+Standards#Vault
    ### Important: This field is OPTIONAL but must have secretVariables and/or secretVariablesFrom defined.
    secretVariables: []

    # Defines secret variables but allows the dataFrom to be specified as defined in the docs.
    # https://external-secrets.io/v0.6.0/api/externalsecret/
    ### Important: This field is OPTIONAL but must have secretVariables and/or secretVariablesFrom defined.
    #   secretVariablesFrom:
    #     - extract:
    #         key: app/common/config
    #         property: foo.nested
    #     - find:
    #         path: app/foo-namespace
    #         name:
    #           regexp: ".*"
    #     - find:
    #         path: app/foo-namespace
    #         tags:
    #           environment: prd
    secretVariablesFrom: []

    # Optional secrets array creates additional secrets based on the following format, same rules apply.
    #   secrets:
    #     - secretNameSuffix: "" (default: {{ randAlphaNum 10 | toString | nospace }})
    #       refreshInterval: <duration> (default: "10m")
    #       secretVariables:
    #       - secretKey: <ENVIRONMENT_VARIABLE>
    #         remoteRef:
    #           key: app/<namespace>/<property>
    #           property: <key>
    #       - secretKey: <ENVIRONMENT_VARIABLE>
    #         remoteRef:
    #           key: app/common/<property>
    #           property: <key>
    #       secretVariablesFrom: []
    secrets: []

# Cluster is defined by region, environment, and increment generating the service hostname as well, example:
#   cluster:
#     region: us-east-1
#     environment: nonprd
#     increment: 1
cluster:
  # AWS Account ID, predetermined when cluster.environment equal [preprd], [prd], defaulting to [nonprd & sandbox] (see: _helpers.tpl "service.awsAccountID").
  accountID: ""

  # AWS Region, converted into Region Prefix as needed (see: _helpers.tpl "service.regionPrefix").
  region: ""

  # AWS Cluster Environment, included with Hostname generation (see: _helpers.tpl "service.hostname").
  # Supported options: [sandbox], [dev], [nonprd], [preprd], [prd].
  environment: ""

  # AWS Cluster Increment, defines which cluster within a multiple cluster region (default: 1).
  increment: ""

  custom: false

# ConfigMap automatically enables when `environmentVariables` contains data, example:
#   environmentVariables:
#     foo: bar
#     baz: fizz
configMap:
  environmentVariables: {}

  # Overrides configmap name standard (default: configmap.<service name>).
  nameOverride: ""

  # Appends annotations to the configmap.
  annotations: {}

  # Additional Configs provide optional configmap generation based on the following format.
  # name (REQUIRED): name of the configmap
  # environmentVariables (REQUIRED): environment variables to be added to the configmap.
  # annotations (OPTIONAL): annotations to be added to the configmap.
  #
  # Example:
  #  additionalConfigs:
  #   - name: "configmap.foo"
  #     environmentVariables:
  #       "foo": "bar"
  additionalConfigs: []

  # Provides option to load the app config along with the main deployment.
  # Example Output:
  #    data:
  #      config: |
  #        {
  #          "foo": "bar",
  #          "test_file": true,
  #          "buzz": [
  #            "this is only a test file, do not adjust your tv!",
  #            "onions have layers!",
  #            "fishy wake up! ... why are you sleeping!"
  #          ]
  #        }
  appConfig:
    enabled: false
    # Optional name override (default: config).
    nameOverride: ""
    # Optional file name, must match the file copied to the service helm charts 'configs/' folder (default: dev)
    # IMPORTANT: Name only; do not include path (configs/) or extension (.json), automation includes this as long as the file exists within the expected path.
    jsonFilename: ""

###  Deprecated, please use custom/job.yaml ###################################
# Jobs are generated from list of specified values, example:
#   jobs:
#    - name: "foo"
#      restartPolicy: Never
#      annotations: {}
#
#      # OTLP configuration https://opentelemetry.io/docs/specs/otlp/
#      otlpMetrics:
#        enabled: false
#        protocol: ""
#        exportInterval: "10000"
#
#      container:
#        # container specific annotations
#        annotations: {}
#
#        # container name (default: service.name)
#        name: ""
#
#        # container image (default: docker.imageURI)
#        image: ""
#        imagePullPolicy: IfNotPresent
#        command: []
#        # args option only available if command is populated
#        args: []
#        env:
#         - name: FOO
#           value: foo-value
#         - name: BAR
#           valueFrom:
#             secretKeyRef:
#               name: 'bar'
#               key: 'baz'
#
#      # backoff limit (default: 5)
#      backoffLimit:
#
#      # active deadline seconds (default: 600)
#      activeDeadlineSeconds:
#
# https://kubernetes.io/docs/concepts/workloads/controllers/job/
###  Deprecated, please use custom/job.yaml ###################################
jobs: []

###  Deprecated, please use custom/cron-job.yaml ##############################
# Cronjobs are generated from list of specified values, example:
#   cronjobs:
#     - name: "foo"
#       schedule: "0 0 * * 0"
#       restartPolicy: OnFailure
#       annotations: {}
#
#      # OTLP configuration https://opentelemetry.io/docs/specs/otlp/
#      otlpMetrics:
#        enabled: false
#        protocol: ""
#        exportInterval: "10000"
#
#       container:
#         # container specific annotations
#         annotations: {}
#
#         # container name (default: service.name)
#         name: ""
#
#         # container image (default: docker.imageURI)
#         image: ""
#
#         imagePullPolicy: IfNotPresent
#         command: []
#         # args option only available if command is populated
#         args: []
#         env:
#           - name: FOO
#             value: foo-value
#           - name: BAR
#             valueFrom:
#               secretKeyRef:
#                 name: 'bar'
#                 key: 'baz'
#
# Define schedule for cronjob (default: weekly `0 0 * * 0`; run once a week at midnight on Sunday morning).
# See templates/cronjob.yaml for more options.
# https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
###  Deprecated, please use custom/cron-job.yaml ##############################
cronjobs: []

# https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
serviceAccount:
  # Disable service account & accompanying rolebinding from being created.
  forceDisabled: false

  # Annotations to add to the service account. The following hooks ensure the service account is recreated successfully if already exists.
  #   hook `pre-install` - Execution happens after resources are rendered but prior to those resources being uploaded to Kubernetes.
  #   hook `pre-upgrade` - Execution happens after resources are rendered but prior to resources being updated in Kubernetes.
  #   hook-delete-policy `before-hook-creation` - The previous resource is deleted before a new instance of this hook is launched. This is the default.
  #   hook-weight - The weight enables more than one hook for the same event to be specified while providing an order in which they will run, negative to positive.
  annotations: {}

  # Specify AWS Account ID to include Role ARN Annotation.
  awsRoleArn:
    # Define roleNameOverride (default: SERVICE_<service name>)
    roleNameOverride: ""

# RBAC: Roles are typically managed through terraform, please check with Infrastructure before creating Role & RoleBinding through Helm.
# Role-based access control (RBAC) is a method of regulating access to resources based on the roles, example:
#   role:
#     create: true
#     name: foo
#     rules:
#       - apiGroups: [""]
#         resources: ["pods"]
#         verbs: ["get"]
#     roleBinding:
#       subjects:
#         - kind: User
#           name: foo-user
#           apiGroup: ""
#         - kind: Group
#           name: foo-group
#           apiGroup: ""
# https://kubernetes.io/docs/reference/access-authn-authz/rbac/
rbac:
  role:
    create: false
    name: ""
    rules: []
    roleBinding:
      additionalSubjects: []
  clusterRoleBinding:
    create: false
    clusterRole: ""
    additionalSubjects: []

# https://kubernetes.io/docs/concepts/services-networking/service/
service:
  # https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
  type: ClusterIP

  # Required with type of ExternalName
  externalName: ""

  # Enable to utilize Hostname  Creation through ExternalDNS Annotation
  hostname:
    externalDNS: false
    # Optional host override (default: "service.hostname").
    hostOverride: ""

  # Specify additional annotations.
  # Example:
  #   annotations:
  #     "service.beta.kubernetes.io/aws-load-balancer-alpn-policy": "HTTP2Preferred"
  #     "service.beta.kubernetes.io/aws-load-balancer-backend-protocol": "tcp"
  #     "service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout": "3600"
  #     "service.beta.kubernetes.io/aws-load-balancer-attributes": "load_balancing.cross_zone.enabled=true"
  #     "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type": "instance"
  #     "service.beta.kubernetes.io/load-balancer-source-ranges": "0.0.0.0/0"
  #     "service.beta.kubernetes.io/aws-load-balancer-type": "external"
  annotations: {}

  # Port & Ports are mapped to the Deployment Resource: targetPort -> containerPort.
  # Override defaults by specifying the Port details.
  port:
    # - Service Port (default: {{ .Values.app.port }}).
    servicePort:
    # - Target Port (default: {{ .Values.app.port }}).
    targetPort:
    # - Protocol (default: TCP).
    protocol: TCP
    # - Port Name (default: http).
    name:
  # Healthcheck is utilized if defined, otherwise defaults to app.port.
  healthcheck:
    # - Service Port, must not duplicate `port.servicePort`.
    servicePort:
    # - Target Port (default: {{ .Values.service.healthcheck.servicePort }}).
    targetPort:
    # - Protocol (default: TCP).
    protocol:

  # Specify additional unique ports for service; port, targetPort, and name are required.
  # Example:
  #   ports:
  #     - port: 3000
  #       targetPort: 3000
  #       protocol: TCP
  #       name: node
  ports: []

  # https://kubernetes.io/docs/concepts/services-networking/service/#headless-services
  # Create additionally a headless service.
  # Headless service returns multiple DNS records of each pod behind the service for the same service name.
  # This is useful to balance gRPC load or other services that require direct pod access.
  # We use same ports and same selectors as the main service, but adding `clusterIP: "None"`.
  # You can create a headless service only with `type: "ClusterIP"`. 
  headless:
    enabled: false

    # Specify additional annotations.
    annotations: {}

# Istio is enabled by default for Production, Pre-Production, and Non-Production clusters (see: _helpers.tpl).
# https://istio.io/latest/docs/concepts/traffic-management/
istio:
  # Block Istio resources from being auto-enabled on supported clusters.
  forceDisabled: false

  # Optional enable override for non-standard clusters.
  enabled: false
  proxyConfig: { "holdApplicationUntilProxyStarts": true }

  # Specifies an alternative Envoy bootstrap configuration file.
  # https://github.com/istio/istio/blob/master/samples/custom-bootstrap/README.md
  bootstrapConfig: {}

  ### CLOUDFRONT ##############################################################
  # Defining CloudFront Hosts will generate its own VirtualService & Public Gateway resources specifically for use with Cloudfront.
  # No DNS records are created by External DNS for Hosts specified.
  cloudfront:
    hosts: []
    httpTlsHttpsRedirect: true

  ### GATEWAY OPTIONS #########################################################
  # Supported multiple Istio Gateways based on enabled `istio.gateway.<option>`, (default: internal-ingressgateway):
  #  * if isMockService or grpc.enabled: `grpc-ingressgateway` (ports: 80, 443, 50051)
  #  * if globalAccelerator or public.enabled:
  #    - if stitcher, `external-ingressgateway-stitcher` (ports: 80, 443)
  #      else, `external-ingressgateway` (ports: 80, 443)
  #  * if custom.enabled and custom.name defined: use custom configuration with enabled ports
  #  * if internal.enabled or no other gateway enabled: `internal-ingressgateway` (ports: 80, 443)
  #### IMPORTANT:
  #- Each option provides a subDomainOverride specific to the enabled gateway: (e.g grpc.subDomainOverride, public.subDomainOverride, custom.subDomainOverride, internal.subDomainOverride)
  #- The GRPC Gateway can be enabled without Mock Service Options, but Mock Service will enable the GRPC Gateway & VirtualService.
  #- If Global Accelerator is required, enabling GRPC or Mock Service will supersede this option.
  #- The Public Gateway can be enabled without Global Accelerator Options, but Global Accelerator will enable the Public Gateway & VirtualService.
  #- Each Gateway includes a VirtualService Override options specific to that Gateway: (e.g grpc.virtualService, public.virtualService, custom.virtualService, internal.virtualService)
  #### INCLUDE HOSTNAMES:
  #- Include Hostnames will default to true if only one gateway is enabled.
  #- Each Gateway may be enabled, if multiple Gateways are enabled and includeHostnames is not set for enabled gateways, then the first option that doesn't override the subdomain will be used in this order: grpc > public > custom > internal.
  #- When more than one Gateway is enabled and `includeHostnames` is set to true for more than one Gateway, then it will error.
  #### UNIQUE HOSTNAMES:
  #- If assigned hosts or additional hosts are not unique across all gateways, it will error.
  #- Hostnames are also checked against additional hosts to ensure uniqueness.
  gateway:
    ### GRPC GATEWAY ##########################################################
    grpc:
      enabled: false
      subDomainOverride: ""
      includeHostnames: false
      additionalHosts: []

      # Requires Mock Service to be enabled: isMockService=true (default: false).
      # Converts list of subdomains into full hostname, applied to VirtualService gRPC hosts only:
      #  - <mockSubDomain>-<cluster region abbreviation>-<cluster increment>-mock.<domain>
      mockSubDomains: []

      # The load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
      httpTlsHttpsRedirect: true

      ### VIRTUAL SERVICE ######################################################
      # Optional Overrides for Virtual Service, if not defined, uses default template settings.
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/
      virtualService:
        # Virtual Service Routing options replaces the default routing defined within the resource.
        #   Please refer to documentation on how to configure routing options.
        #   Additionally, when including DestinationRule, you must define routing instructions for these resources.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
        httpRoute:
          # If httpRoute configOverride is defined, it replaces the default config provided within the template.
          configOverride: []
          # Define custom route configurations
          #   customConfig:
          #    - name: foo
          #      match:
          #        - uri:
          #            prefix: "/heathcheck"
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 123
          #    - name: foobar
          #      match:
          #        - port: 333
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 333
          #      retries:
          #        # Required: attempts (Istio default: 5).
          #        attempts: 3
          #        # Optional per retry timeout (Istio default: 2s).
          #        perTryTimeout: 3s
          #        # Optional retry on response (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          #        retryOn: 5xx
          customConfig: []

          ### ADDITIONAL HOSTS ################################################
          # Note: Only works with additionalHosts.
          # If httpRoute additionalHostsConfigOverride is defined, it replaces the default config
          # for a virtual service of additional hosts provided within the template.
          additionalHostsConfigOverride: []
          # Note: Only works with additionalHosts.
          # Define custom route configurations for a virtual service of additional hosts.
          additionalHostsCustomConfig: []

          ### HTTP OVERRIDES ##################################################
          http:
            # Define timeout for HTTP requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""
            defaultRouting:
              xff:
                set: true

          ### HTTPS OVERRIDES #################################################
          https:
            # Define timeout for HTTPS requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""

          ### GRPC OVERRIDES ##################################################
          grpc:
            # Define timeout for gRPC requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn:

    ### PUBLIC (EXTERNAL) GATEWAY ##############################################
    public:
      enabled: false
      subDomainOverride: ""
      includeHostnames: false
      additionalHosts: []

      # The load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
      httpTlsHttpsRedirect: true

      ### VIRTUAL SERVICE ######################################################
      # Optional Overrides for Virtual Service, if not defined, uses default template settings.
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/
      virtualService:
        # Virtual Service Routing options replaces the default routing defined within the resource.
        #   Please refer to documentation on how to configure routing options.
        #   Additionally, when including DestinationRule, you must define routing instructions for these resources.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
        httpRoute:
          # If httpRoute configOverride is defined, it replaces the default config provided within the template.
          configOverride: []
          # Define custom route configurations
          #   customConfig:
          #    - name: foo
          #      match:
          #        - uri:
          #            prefix: "/heathcheck"
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 123
          #    - name: foobar
          #      match:
          #        - port: 333
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 333
          #      retries:
          #        # Required: attempts (Istio default: 5).
          #        attempts: 3
          #        # Optional per retry timeout (Istio default: 2s).
          #        perTryTimeout: 3s
          #        # Optional retry on response (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          #        retryOn: 5xx
          customConfig: []

          ### ADDITIONAL HOSTS ################################################
          # Note: Only works with additionalHosts.
          # If httpRoute additionalHostsConfigOverride is defined, it replaces the default config
          # for a virtual service of additional hosts provided within the template.
          additionalHostsConfigOverride: []
          # Note: Only works with additionalHosts.
          # Define custom route configurations for a virtual service of additional hosts.
          additionalHostsCustomConfig: []

          ### HTTP OVERRIDES ##################################################
          http:
            # Define timeout for HTTP requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""
            defaultRouting:
              xff:
                set: true

          ### HTTPS OVERRIDES #################################################
          https:
            # Define timeout for HTTPS requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""

    ### INTERNAL GATEWAY ######################################################
    internal:
      enabled: false
      subDomainOverride: ""
      includeHostnames: false
      additionalHosts: []

      # The load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
      httpTlsHttpsRedirect: true

      ### VIRTUAL SERVICE ######################################################
      # Optional Overrides for Virtual Service, if not defined, uses default template settings.
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/
      virtualService:
        # Virtual Service Routing options replaces the default routing defined within the resource.
        #   Please refer to documentation on how to configure routing options.
        #   Additionally, when including DestinationRule, you must define routing instructions for these resources.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
        httpRoute:
          # If httpRoute configOverride is defined, it replaces the default config provided within the template.
          configOverride: []
          # Define custom route configurations
          #   customConfig:
          #    - name: foo
          #      match:
          #        - uri:
          #            prefix: "/heathcheck"
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 123
          #    - name: foobar
          #      match:
          #        - port: 333
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 333
          #      retries:
          #        # Required: attempts (Istio default: 5).
          #        attempts: 3
          #        # Optional per retry timeout (Istio default: 2s).
          #        perTryTimeout: 3s
          #        # Optional retry on response (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          #        retryOn: 5xx
          customConfig: []

          ### ADDITIONAL HOSTS ################################################
          # Note: Only works with additionalHosts.
          # If httpRoute additionalHostsConfigOverride is defined, it replaces the default config
          # for a virtual service of additional hosts provided within the template.
          additionalHostsConfigOverride: []
          # Note: Only works with additionalHosts.
          # Define custom route configurations for a virtual service of additional hosts.
          additionalHostsCustomConfig: []

          ### HTTP OVERRIDES ##################################################
          http:
            # Define timeout for HTTP requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""
            defaultRouting:
              xff:
                set: true

          ### HTTPS OVERRIDES #################################################
          https:
            # Define timeout for HTTPS requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""

    ### CUSTOM GATEWAY #######################################################
    # Custom Istio Gateway (supersedes other gateway options, typically utilized for testing purposes).
    custom:
      # Define istio gateway label for custom to utilize.
      name: ""
      enabled: false
      subDomainOverride: ""
      includeHostnames: false
      additionalHosts: []

      # The load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
      httpTlsHttpsRedirect: true

      ### VIRTUAL SERVICE ######################################################
      # Optional Overrides for Virtual Service, if not defined, uses default template settings.
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/
      virtualService:
        # Virtual Service Routing options replaces the default routing defined within the resource.
        #   Please refer to documentation on how to configure routing options.
        #   Additionally, when including DestinationRule, you must define routing instructions for these resources.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
        httpRoute:
          # If httpRoute configOverride is defined, it replaces the default config provided within the template.
          configOverride: []
          # Define custom route configurations
          #   customConfig:
          #    - name: foo
          #      match:
          #        - uri:
          #            prefix: "/heathcheck"
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 123
          #    - name: foobar
          #      match:
          #        - port: 333
          #      destination:
          #        # Optional host override (default: service host)
          #        host: ""
          #        # Optional port override (default: app.port)
          #        port: 333
          #      retries:
          #        # Required: attempts (Istio default: 5).
          #        attempts: 3
          #        # Optional per retry timeout (Istio default: 2s).
          #        perTryTimeout: 3s
          #        # Optional retry on response (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          #        retryOn: 5xx
          customConfig: []

          ### ADDITIONAL HOSTS ################################################
          # Note: Only works with additionalHosts.
          # If httpRoute additionalHostsConfigOverride is defined, it replaces the default config
          # for a virtual service of additional hosts provided within the template.
          additionalHostsConfigOverride: []
          # Note: Only works with additionalHosts.
          # Define custom route configurations for a virtual service of additional hosts.
          additionalHostsCustomConfig: []

          ### HTTP OVERRIDES ##################################################
          http:
            # Enable http traffic (default: true).
            enabled: true
            # Define timeout for HTTP requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""
            defaultRouting:
              xff:
                set: true

          ### HTTPS OVERRIDES #################################################
          https:
            # Enable https traffic (default: true).
            enabled: true
            # Define timeout for HTTPS requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn: ""

          ### GRPC OVERRIDES ##################################################
          grpc:
            # Enable gRPC traffic (default: false).
            enabled: false
            # Define timeout for gRPC requests.
            timeout:
            # Define match to implement additional match options.
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
            match: []
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
            #  - destination:
            #      host: "foo.pluto.tv"
            #      port:
            #        number: 123
            #      subset: v1
            #    weight: 10
            #  - destination:
            #      host: "bar.pluto.tv"
            #      port:
            #        number: 456
            #      subset: v2
            #    weight: 90
            routeDestination: []
            # Default destination options if routeDestination not defined.
            destination:
              # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
              host: ""
              # Define service port for incoming HTTP traffic (default: app.port).
              port:
            # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
            retries:
              # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
              attempts:
              # Optional. Define timeout per attempt (Istio default: 2s).
              perTryTimeout:
              # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
              retryOn:

  ### CLOUDFRONT VIRTUAL SERVICE ##############################################
  # https://istio.io/latest/docs/reference/config/networking/virtual-service/
  cloudfrontVirtualService:
    httpRoute:
      ### HTTP OVERRIDES ##################################################
      http:
        # Define timeout for HTTP requests.
        timeout:
        # Define match to implement additional match options.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
        match: []
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
          #  - destination:
          #      host: "foo.pluto.tv"
          #      port:
          #        number: 123
          #      subset: v1
          #    weight: 10
          #  - destination:
          #      host: "bar.pluto.tv"
          #      port:
          #        number: 456
          #      subset: v2
        #    weight: 90
        routeDestination: []
        # Default destination options if routeDestination not defined.
        destination:
          # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
          host: ""
          # Define service port for incoming HTTP traffic (default: app.port).
          port:
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
        retries:
          # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
          attempts:
          # Optional. Define timeout per attempt (Istio default: 2s).
          perTryTimeout:
          # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          retryOn: ""
        defaultRouting:
          xff:
            set: true

      ### HTTPS OVERRIDES #################################################
      https:
        # Define timeout for HTTPS requests.
        timeout:
        # Define match to implement additional match options.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
        match: []
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
          #  - destination:
          #      host: "foo.pluto.tv"
          #      port:
          #        number: 123
          #      subset: v1
          #    weight: 10
          #  - destination:
          #      host: "bar.pluto.tv"
          #      port:
          #        number: 456
          #      subset: v2
        #    weight: 90
        routeDestination: []
        # Default destination options if routeDestination not defined.
        destination:
          # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
          host: ""
          # Define service port for incoming HTTP traffic (default: app.port).
          port:
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
        retries:
          # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
          attempts:
          # Optional. Define timeout per attempt (Istio default: 2s).
          perTryTimeout:
          # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          retryOn: ""

      ### GRPC OVERRIDES ##################################################
      grpc:
        # Define timeout for gRPC requests.
        timeout:
        # Define match to implement additional match options.
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
        match: []
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRouteDestination
        #  - destination:
        #      host: "foo.pluto.tv"
        #      port:
        #        number: 123
        #      subset: v1
        #    weight: 10
        #  - destination:
        #      host: "bar.pluto.tv"
        #      port:
        #        number: 456
        #      subset: v2
        #    weight: 90
        routeDestination: []
        # Default destination options if routeDestination not defined.
        destination:
          # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
          host: ""
          # Define service port for incoming HTTP traffic (default: app.port).
          port:
        # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
        retries:
          # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
          attempts:
          # Optional. Define timeout per attempt (Istio default: 2s).
          perTryTimeout:
          # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
          retryOn:

  ### LEGACY VIRTUAL SERVICE #################################################
  # https://istio.io/latest/docs/reference/config/networking/virtual-service/
  legacyVirtualService:
    enabled: false
    # Define gateway override (default: legacy-configs/gw-legacy).
    gatewayOverride: ""
    # Required. Define host for incoming traffic.
    hosts: []
    # Required. Define URI Prefix Paths.
    # Example:
    #   uriPrefixPaths:
    #     - "/foo/bar"
    #     - "/fizz/buzz"
    uriPrefixPaths: []
    httpRoute:
      # Define timeout for legacy requests.
      timeout:
      # Define match to implement additional match options.
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
      #  - destination:
      #      host: "foo.pluto.tv"
      #      port:
      #        number: 123
      #      subset: v1
      #    weight: 10
      #  - destination:
      #      host: "bar.pluto.tv"
      #      port:
      #        number: 456
      #      subset: v2
      #    weight: 90
      routeDestination: []
      # Default destination options if routeDestination not defined.
      destination:
        # Define service host for incoming TCP traffic (default: <fullName>.<namespace>.svc.cluster.local).
        host: ""
        # Define service port for incoming HTTP traffic (default: app.port).
        port:
      # https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRetry
      retries:
        # Required! Define number of attempts to retry (Istio default: 5 when no retry overrides provided).
        attempts:
        # Optional. Define timeout per attempt (Istio default: 2s).
        perTryTimeout:
        # Optional. Define retry on conditions (Istio default: "connect-failure,refused-stream,unavailable,retriable-status-codes,5xx").
        retryOn: ""

  # Istio DestinationRule defines policies that apply to traffic intended for a service after routing has occurred.
  #   These rules specify configuration for load balancing, connection pool size from the sidecar, and outlier detection
  #   settings to detect and evict unhealthy hosts from the load balancing pool.
  # https://istio.io/latest/docs/reference/config/networking/destination-rule/
  destinationRules:
    # If enabled, customPolicies is first analyzed, if populated it initializes it or defaults to the baseTrafficPolicy.
    enabled: false

    # Custom Destination Rules resource builds by iterating through a list of supported options, example:
    #    customPolicies:
    #      - trafficPolicy:
    #          loadBalancer:
    #            simple: LEAST_CONN
    #      - subsets:
    #          - name: default
    #            labels:
    #              version: v1
    #            trafficPolicy:
    #              loadBalancer:
    #                simple: ROUND_ROBIN
    #      - workloadSelector:
    #          matchLabels:
    #            app: foo
    #          trafficPolicy:
    #            loadBalancer:
    #              simple: ROUND_ROBIN
    #            portLevelSettings:
    #              - port:
    #                  number: 31443
    #                tls:
    #                  credentialName: client-credential
    #                  mode: MUTUAL
    #      - exportTo:
    #         - "*"
    customPolicies: []

    # Base Traffic Policy is designed as a base Circuit Breaker for use with most services.
    # Settings defined using Istio defaults within template, please refer to the Istio documentation when defining values for the service.
    # https://istio.io/latest/docs/reference/config/networking/destination-rule/#ConnectionPoolSettings
    # https://istio.io/latest/docs/reference/config/networking/destination-rule/#OutlierDetection
    baseTrafficPolicy:
      connectionPool:
        tcp:
          maxConnections:
        http:
          http1MaxPendingRequests:
          maxRequestsPerConnection:
          http2MaxRequests:
      outlierDetection:
        baseEjectionTime:
        consecutive5xxErrors:
        consecutiveGatewayErrors:
        interval:
        maxEjectionPercent:

  security:
    enabled: false

    # https://istio.io/latest/docs/reference/config/security/request_authentication/
    requestAuth:
      # Optional Matching Labels: Require JWT for all request for workloads that have specified labels.
      # https://istio.io/latest/docs/reference/config/type/workload-selector/#WorkloadSelector
      matchLabels: {}

      # Required JWT Rules
      # Example:
      #  jwtRules:
      #    - issuer: https://example.com
      #      jwksUri: https://example.com/.secret/jwks.json
      #      fromHeaders:
      #        - "x-goog-iap-jwt-assertion"
      # https://istio.io/latest/docs/reference/config/security/jwt/#JWTRule
      jwtRules: []

    # Istio supports multiple AuthorizationPolicy configurations.
    # The chart iterates through each policy defined to create each AuthorizationPolicy resource;
    # Example:
    #   authPolicies:
    #     - policy:
    #         # Required Policy Name, appends to Service Name (e.g. <service name>-<policy name>).
    #         name: ""
    #
    #         # Optional Workload Selector.
    #         # https://istio.io/latest/docs/reference/config/type/workload-selector/#WorkloadSelector
    #         matchLabels: {}
    #
    #         # Optional Rules
    #         # https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule
    #         rules: []
    #
    #         # Optional Action: ALLOW, DENY, AUDIT, CUSTOM.
    #         # https://istio.io/latest/docs/reference/config/security/authorization-policy/#AuthorizationPolicy-Action
    #         action: ""
    #
    #         # Optional provider, requires CUSTOM action.
    #         # https://istio.io/latest/docs/reference/config/security/authorization-policy/#AuthorizationPolicy-ExtensionProvider
    #         provider: ""
    #
    ### Example:
    #    authPolicies:
    #      - policy:
    #          name: foo
    #          action: DENY
    #          rules:
    #            - from:
    #                - source:
    #                    namespaces: [ "dev" ]
    #              to:
    #                - operation:
    #                    methods: [ "POST" ]
    #      - policy:
    #          name: bar
    #          action: ALLOW
    #          rules:
    #            - from:
    #                - source:
    #                    principals: [ "cluster.local/ns/default/sa/sleep" ]
    #                - source:
    #                    namespaces: [ "test" ]
    #              to:
    #                - operation:
    #                    methods: [ "GET" ]
    #                    paths: [ "/info*" ]
    #                - operation:
    #                    methods: [ "POST" ]
    #                    paths: [ "/data" ]
    #              when:
    #                - key: request.auth.claims[iss]
    #                  values: [ "https://accounts.google.com" ]
    #
    ### Whitelist Example:
    #    authPolicies:
    #      - policy:
    #          name: "saas-service"
    #          action: "ALLOW"
    #          matchLabels:
    #            app: internal-ingressgateway
    #          rules:
    #            - from:
    #                - source:
    #                    ipBlocks: [ 1.2.3.4 ]
    #                    remoteIpBlocks: [ 1.2.3.4/24 ]
    #
    ### Blacklist Example:
    #    authPolicies:
    #      - policy:
    #          name: "no-entry"
    #          action: "DENY"
    #          matchLabels:
    #            app: internal-ingressgateway
    #         rules:
    #            - from:
    #                - source:
    #                    ipBlocks: [ 2.3.4.5 ]
    #                    remoteIpBlocks: [ 2.3.4.5/24 ]
    #
    # https://istio.io/v1.17/blog/2019/v1beta1-authorization-policy/
    authPolicies: []

    # https://istio.io/latest/docs/reference/config/networking/envoy-filter/
    envoyFilter:
      http:
        enabled: false

        # Example:
        #  inlineCode: |
        #    function envoy_on_response(response_handle)
        #      if response_handle:headers():get(":status") == "403" then
        #        response_handle:headers():replace("content-type", "application/json")
        #        local jsonString = tostring("{\"statusCode\":403,\"error\":\"Forbidden\",\"errorCode\":\"RBACFailure\",\"message\":\"authorization not allowed\"}")
        #        response_handle:body():setBytes(jsonString)
        #      elseif response_handle:headers():get(":status") == "401" then
        #        response_handle:headers():replace("content-type", "application/json")
        #        local jsonString = tostring("{\"statusCode\":401,\"error\":\"Unauthorized\",\"errorCode\":\"JWTFailure\",\"message\":\"jwt validation failed\"}")
        #        response_handle:body():setBytes(jsonString)
        #      end
        #    end
        inlineCode: ""

      # Enable CORS specific EnvoyFilter resource for the service using the CORS inLineCode.
      cors:
        enabled: false
        # allowCredentials: Boolean
        allowCredentials: true
        # allowHeaders: Accept,Authorization,Content-Type,If-None-Match,X-Requested-With,X-Request-ID,X-Log-Level-Override,X-Forwarded-For
        allowHeaders: ""
        # allowMethods: GET,POST,PUT,DELETE
        allowMethods: ""
        # allowOrigin: https://example.com
        allowOrigin: ""
        # exposeHeaders: WWW-Authenticate,Server-Authorization
        exposeHeaders: ""
        # maxAge: 1728000
        maxAge: ""
        # inlineCode: code block, this may be overridden within the release file, utilizing the provided options above.
        inlineCode: |-
          function envoy_on_response(response_handle)
            local allowCredentials = "%t"
            local allowHeaders = "%s"
            local allowMethods = "%s"
            local allowOrigin = "%s"
            local exposeHeaders = "%s"
            local maxAge = "%s"
            if response_handle:headers():get(":status") == "403" then
              response_handle:headers():add("Access-Control-Allow-Credentials", allowCredentials)
              response_handle:headers():add("Access-Control-Allow-Headers", allowHeaders)
              response_handle:headers():add("Access-Control-Allow-Methods", allowMethods)
              response_handle:headers():add("Access-Control-Allow-Origin", allowOrigin)
              response_handle:headers():add("Access-Control-Expose-Headers", exposeHeaders)
              response_handle:headers():add("Access-Control-Max-Age", maxAge)
              response_handle:headers():add("X-plutotv-istio-security", "true")
              response_handle:headers():replace("content-type", "application/json")    
              response_handle:headers():replace(":status", "401")
              local jsonString = tostring("{\"statusCode\":401,\"error\":\"Unauthorized\",\"errorCode\":\"InvalidExpiredBearerToken\"}")    
              response_handle:body():setBytes(jsonString)    
            elseif response_handle:headers():get(":status") == "401" then
              response_handle:headers():add("Access-Control-Allow-Credentials", allowCredentials)
              response_handle:headers():add("Access-Control-Allow-Headers", allowHeaders)
              response_handle:headers():add("Access-Control-Allow-Methods", allowMethods)
              response_handle:headers():add("Access-Control-Allow-Origin", allowOrigin)
              response_handle:headers():add("Access-Control-Expose-Headers", exposeHeaders)
              response_handle:headers():add("Access-Control-Max-Age", maxAge)
              response_handle:headers():add("X-plutotv-istio-security", "true")
              response_handle:headers():replace("content-type", "application/json")    
              local jsonString = tostring("{\"statusCode\":401,\"error\":\"Unauthorized\",\"errorCode\":\"InvalidExpiredBearerToken\"}")    
              response_handle:body():setBytes(jsonString)    
            end    
          end

      custom:
        enabled: false

        # REQUIRED: name appended to <service.fullname>-<name> with `-grpc-` added when GPRC Gateway enabled
        name: ""

        # Example:
        # configPatches:
        # - applyTo: CLUSTER
        #   patch:
        #     operation: MERGE
        #     value:
        #       http2_protocol_options:
        #       initial_connection_window_size: 1048576
        #       initial_stream_window_size: 65536
        #       max_concurrent_streams: 100
        # - applyTo: NETWORK_FILTER
        #   match:
        #     listener:
        #       filterChain:
        #         filter:
        #           name: envoy.filters.network.http_connection_manager
        #   patch:
        #     operation: MERGE
        #     value:
        #       typed_config:
        #         '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
        #         http2_protocol_options:
        #           initial_connection_window_size: 1048576
        #           initial_stream_window_size: 65536
        #           max_concurrent_streams: 100
        #         stream_idle_timeout: 30s
        configPatches: []

      # Envoy supports two kinds of rate limiting: global and local.
      # Global rate limiting uses a global gRPC rate limiting service to provide rate limiting for the entire mesh.
      # Local rate limiting is used to limit the rate of requests per service instance.
      # Documentation is here https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/
      ratelimit:
        # Istio support enabling rate limiting using Envoy natively. This configuration
        # allows you to enable rate limiting locally for your service.
        # The token bucket configuration to use for rate limiting requests that are processed by this filter.
        # Each request processed by the filter consumes a single token.
        # If the token is available, the request will be allowed. If no tokens are available,
        # the request will receive the configured rate limit status.
        # To change rate limiting modify token_bucket configuration from the configPatches below.
        local:
          enabled: false
          # ConfigPatches for local rate limiting. In this array, you can add some custom configuration for the rate limiting filter.
          # Note: `applyTo` and `match` fields are not required. The filter is applied to the sidecar inbound by default.
          # configPatches:
          # - patch:
          #     operation: INSERT_BEFORE
          #     value:
          #       name: envoy.filters.http.local_ratelimit
          #       typed_config:
          #         "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          #         type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
          #         value:
          #           stat_prefix: http_local_rate_limiter
          #           token_bucket:
          #             max_tokens: 400
          #             tokens_per_fill: 400
          #             fill_interval: 1s
          #           filter_enabled:
          #             runtime_key: local_rate_limit_enabled
          #             default_value:
          #               numerator: 100
          #               denominator: HUNDRED
          #           filter_enforced:
          #             runtime_key: local_rate_limit_enforced
          #             default_value:
          #               numerator: 100
          #               denominator: HUNDRED
          #           response_headers_to_add:
          #             - append: false
          #               header:
          #                 key: x-local-rate-limit
          #                 value: 'true'
          configPatches: []

        # Global rate limiting in Istio involves configuring an external rate limit service that integrates
        # with the Istio service mesh through EnvoyFilter resources. This setup allows you to enforce rate limits on
        # incoming requests to your services at a global level, meaning the limits apply across the entire
        # service mesh rather than to individual instances or services. The external rate limit service evaluates
        # incoming requests against predefined policies and decides whether to allow or block them based on
        # the number of requests over a specified time period.
        global:
          enabled: false
          # The filter’s behaviour in case the rate limiting service does not respond back. When it is set to true,
          # Envoy will not allow traffic in case of communication failure between rate limiting service and the proxy.
          failureModeDeny: false
          # The timeout for the rate limit service RPC. (default: 1s)
          timeout: 1s
          # ConfigPatches for global rate limiting. In this array, you can add some custom configuration for the rate limiting filter.
          # These filters usually include:
          # - The rate limit service configuration.
          # - Parsing service request headers or body to extract some key for rate limiting.
          # Notes:
          # - `envoy.filters.http.ratelimit` is added by default, you do not need to add it here.
          # - `applyTo` and `match` fields are not required. The filter is applied to the sidecar inbound by default.
          # - Sequence of the filters is important. The filters are applied in the order they are defined in the array.
          # Example: Add a custom filter to extract the key for rate limiting from the request path. And add a custom
          # rate limit service configuration based on the extracted key.
          # configPatches:
          # - patch:
          #     operation: INSERT_BEFORE
          #     value:
          #       name: envoy.filters.http.header_to_metadata
          #       typed_config:
          #         '@type': type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config
          #         request_rules:
          #           - header: ':path'
          #             on_header_present:
          #               key: sid
          #               metadata_namespace: service.rl
          #               regex_value_rewrite:
          #                 pattern:
          #                   google_re2: {}
          #                   regex: '.*\&sid=([^&]*)\&{0,1}.*'
          #                 substitution: \1s
          # - patch:
          #     operation: MERGE
          #     value:
          #       rate_limits:
          #         - actions:
          #             - header_value_match:
          #                 descriptor_key: ad-break
          #                 descriptor_value: "true"
          #                 expect_match: true
          #                 headers:
          #                   - name: ':path'
          #                     prefix_match: /ad-break
          #             - metadata:
          #                 descriptor_key: sid
          #                 metadata_key:
          #                   key: service.rl
          #                   path:
          #                     - key: sid
          configPatches: []

  # https://istio.io/v1.15/docs/reference/config/networking/sidecar/
  sidecar:
    enabled: false

    egress:
      # One or more service hosts exposed by the egress listener in namespace/dnsName format.
      # The dnsName should be specified using FQDN format, optionally including a wildcard character in the left-most component
      #   (e.g., prod/*.example.com). Set the dnsName to * to select all services from the specified namespace (e.g., prod/*).
      # Example:
      #   hosts:
      #     - ./*
      #     - opentelemetry-system/*
      #     - istio-system/*
      hosts: []

  # Add one or more ServiceEntry.
  # ServiceEntry name, list of hosts and ports are required.
  # ServiceEntry resolution (default value is DNS) and location (default value is MESH_EXTERNAL) are optional.
  # Example:
  #   serviceentry:
  #     - name: https-external
  #         hosts:
  #           - host1.pluto.tv
  #           - host2.pluto.tv
  #         ports:
  #         - number: 80
  #           name: http
  #           protocol: http
  #         - number: 443
  #           name: https
  #           protocol: TLS
  #      - name: mongodb
  #        hosts:
  #          - mongodb.customdomain
  #        addresses:
  #          - 192.192.192.192/24
  #        ports:
  #        - number: 27018
  #          name: mongodb
  #          protocol: MONGO
  #        resolution: STATIC
  # https://istio.io/latest/docs/reference/config/networking/service-entry/#ServiceEntry
  serviceentry: []

# IMPORTANT: KongPlugin requires Kong Ingress enabled.
# https://docs.konghq.com/hub/
kong:
  plugin:
    enabled: false

    # Define a single or multiple Plugins as follows:
    # REQUIRED: fields `plugin`, `name`, and `config` are required or chart will error on creation
    # OPTIONAL: `annotations`
    #
    # Example:
    # https://docs.konghq.com/hub/kong-inc/aws-lambda/
    #  plugins:
    #    - plugin: aws-lambda
    #      name: stitcher-foo
    #      config:
    #        aws_region: us-east-1
    #        function_name: awesome-lambda
    #    - plugin: aws-lambda
    #      name: stitcher-bar
    #      config:
    #        aws_region: us-east-1
    #        function_name: more-awesome-lambda
    #    - plugin: post-function
    #      name: cool-service
    #      config:
    #        access:
    #          - |
    #            kong.log.err("foo")
    #            kong.response.exit(418)
    #    - plugin: jwt
    #      name: stitcher-auth
    #      config:
    #        uri_param_names:
    #          - paramName_2.2.x
    #
    # For Specific Plugin Config Options, refer to the kong documentation at the top.
    plugins: []

# Ingress requires Ingres Controllers to subscribe to for this to work. Please reach out to DevOps & Infrastructure if an ingress is necessary for your application.
# https://kubernetes.io/docs/concepts/services-networking/ingress/
ingress:
  enabled: false

  # Define to classNameOverride for connecting to kubernetes specific ingress controllers. (default: alb)
  classNameOverride: ""

  # Optional host override (default: "service.hostname")
  hostOverride: ""

  # Specify additional annotations
  annotations: {}

  # Define Annotation options to override default values.
  defaultAnnotationOverrides:
    # (default: "ip")
    albTargetType: ""
    # (default: "ipv4")
    albIPAddressType: ""
    # (default: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}')
    albActionsSSLRedirect: ''
    # (default: "HTTP")
    albBackendProtocol: ""
    # (default: '[{"HTTP": 80}, {"HTTPS":443}]')
    albListenPorts: ''

  # Enable Internet Facing annotation (default: internal)
  internetFacing: false

  # Specify additional ingress path options, example:
  # Host on each rule is driven by hostOverride defaulting to `service.hostname`.
  #   rules:
  #    - paths:
  #       - pathType: Prefix
  #         path: "/"
  #         backend:
  #           service:
  #             name: foo-service-name
  #             port:
  #               number: 3000
  #       - pathType: Prefix
  #         path: "/foo"
  #         backend:
  #           service:
  #             name: foo-service-name
  #             port:
  #               number: 3001
  #    - host: foobar.com
  #      paths:
  #       - pathType: Prefix
  #         path: "/foobar"
  #         backend:
  #           service:
  #             name: foo-service-name
  #             port:
  #               number: 3004
  rules: []

  # Kong Ingress
  # https://docs.konghq.com/kubernetes-ingress-controller/2.11.x/references/annotations/
  kong:
    enabled: false

    # Define to classNameOverride for connecting to kubernetes specific ingress controllers,
    # should either be "kong-oss" or "kong-enterprise" (default: kong-oss)
    classNameOverride: ""

    # Optional host override (default: "service.hostname")
    hostOverride: ""

    # Specify additional annotations
    annotations: {}

    # Define Annotation options to override default values.
    defaultAnnotationOverrides:
      forceSSLRedirect: true
      preserveHost: false

    # Specify additional ingress path options, example:
    # Host on each rule is driven by hostOverride defaulting to `service.hostname`.
    #   rules:
    #    - paths:
    #       - pathType: Prefix
    #         path: "/"
    #         backend:
    #           service:
    #             name: foo-service-name
    #             port:
    #               number: 3000
    #       - pathType: Prefix
    #         path: "/foo"
    #         backend:
    #           service:
    #             name: foo-service-name
    #             port:
    #               number: 3001
    #    - host: foobar.com
    #      paths:
    #       - pathType: Prefix
    #         path: "/foobar"
    #         backend:
    #           service:
    #             name: foo-service-name
    #             port:
    #               number: 3004
    rules: []

# https://kubernetes.io/docs/concepts/storage/persistent-volumes/
persistence:
  # Define name to append to PersistentVolumeClaim name (name: pvc.<service name>-<name>) (default: randAlphaNum 6).
  #   volumeClaims:
  #     - name: ""
  #
  #       # Creates Persistent Volume from default StorageClass if not provided.
  #       storageClassName: ""
  #
  #       # Set Storage of persistent volume created (default: "2Gi").
  #       storageRequest: ""
  # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims
  volumeClaims: []

# Resources specified for containers.
# Recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases
#   chances charts run on environments with little resources, such as Minikube. If you do want to specify resources,
#   uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}

# https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
podDisruptionBudget:
  enabled: false
  annotations:
    helm.sh/hook: "post-upgrade, post-install"
    helm.sh/hook-delete-policy: "before-hook-creation"
  # Only one of minAvailable or maxUnavailable should be set.
  # If you do not specify minAvailable or maxUnavailable, maxUnavailable will be set to "1%" for preprd and prd environments.
  minAvailable:
  maxUnavailable:

# https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
autoscaling:
  horizontal:
    # Autoscaling is enabled by default for Prod & Preprod clusters (see: _helpers.tpl, autoscalingEnabled).
    enabled: false
    minReplicas: 1
    maxReplicas: 2

    # Metrics to be included in addition to those already defined within hpa.yaml, example:
    #   metrics:
    #     - type: Resource
    #       resource:
    #         name: cpu
    #         target:
    #           type: Utilization
    #           averageUtilization: 80
    #     - type: Resource
    #       resource:
    #         name: memory
    #         target:
    #           type: Utilization
    #           averageUtilization: 80
    #     - type: Pods
    #       pods:
    #         metric:
    #           name: packets-per-second
    #         target:
    #           type: AverageValue
    #           averageValue: 1k
    #     - type: Object
    #       object:
    #         metric:
    #           name: requests-per-second
    #         describedObject:
    #           apiVersion: networking.k8s.io/v1beta1
    #           kind: Ingress
    #           name: main-route
    #         target:
    #           type: Value
    #           value: 10k
    # https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
    metrics: []

    # Behavior to be included in addition to those already defined within hpa.yaml, example:
    #   behavior:
    #     scaleDown:
    #       stabilizationWindowSeconds: 300
    #       policies:
    #       - type: Percent
    #         value: 100
    #         periodSeconds: 15
    #     scaleUp:
    #       stabilizationWindowSeconds: 0
    #       policies:
    #       - type: Percent
    #         value: 100
    #         periodSeconds: 15
    #       - type: Pods
    #         value: 4
    #         periodSeconds: 15
    #       selectPolicy: Max
    # https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#default-behavior
    behavior: {}

  ### IMPORTANT: The Kubernetes Metrics Server must be deployed to the cluster for this feature to work.
  # https://docs.aws.amazon.com/eks/latest/userguide/vertical-pod-autoscaler.html
  # https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler
  vertical:
    enabled: false
    containerPolicy:
      # define containerName to target (default: "*")
      containerName: ""
      minAllowed:
        # define minimum allowed cpu (default: "15m")
        cpu: ""
        # define minimum allowed memory (default: "100Mi")
        memory: ""
      maxAllowed:
        # define maximum allowed cpu (default: "1")
        cpu: ""
        # define minimum allowed memory (default: "2Gi")
        memory: ""
      # define controlledResources for container (default: ["cpu", "memory"])
      controlledResources: []

    # define additional container policies along with the default
    #  - containerName: "*"
    #    minAllowed:
    #      cpu: "100m"
    #      memory: "50Mi"
    #    maxAllowed:
    #      cpu: "1"
    #      memory: "500Mi"
    #    controlledResources: ["cpu", "memory"]
    additionalContainerPolicies: []

deployment:
  # Set to true to disable Deployment resource from being created.
  # Typically utilized for Job only deployments.
  ### Important:
  # This disables resources that requires or otherwise works along with the Deployment resource:
  # - Deployment (Primary, Overprovisioning)
  # - All Istio Resources (Gateway, Virtual Service, Service Entry, Sidecar, Destination Rule, Security).
  # - K8s Ingress
  # - K8s Service
  # - HPA
  # - VPA
  # - PDB
  forceDisabled: false

  # Define Customized Environment Variables to be included with your deployment resource
  # Example:
  #   customEnvVars:
  #     - name: FOO
  #       value: bar
  customEnvVars: []

  # DNS Configuration
  # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
  # This value is useful if you need to reduce the DNS load: set "ndots" to 3 to reduce dns resolution latency.
  # Example:
  #   dnsConfig:
  #     nameservers:
  #       - 192.0.2.1 # this is an example
  #     searches:
  #       - ns1.svc.cluster-domain.example
  #       - my.dns.search.suffix
  #     options:
  #       - name: ndots
  #         value: "3"
  dnsConfig: {}

  # Overrides DNS Policy (default: ClusterFirst).
  # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
  dnsPolicy: ""

  # Define additional volumeMounts.
  # IMPORTANT: when using persistent volumes & claims, the volume is automatically included in the deployment volume.
  #   section of the deployment, appending the `persistent.volumeClaims[].name` to `persistent-storage-<name>`.
  #   The same name must be defined within volumeMounts along with the desired mount path (e.g. `mountPath: /opt/foo`).
  # Example:
  #   volumeMounts:
  #     - mountPath: /foo
  #       name: persistent-storage-foo
  #
  # For config files, specify the following for Volume Mounts.
  # Example:
  #   volumeMounts:
  #     - mountPath: /tmp/foo
  #       name: config-foo-volume
  volumeMounts: []

  # Define additional volumes.
  # For config files, specify the following for Volumes.
  # Example:
  #   volumes:
  #     - name: config-foo-volume
  #       configMap:
  #         name: config.foobar
  volumes: []

  # Config Volume Mounts are not deployed by this Helm Chart, enable only if that config already exists within the namespace.
  configVolumeMounts:
    # Enable Volumes & VolumeMounts on Deployment / Pods.
    enabled: false

    # Overrides mount path standard (default: /app/<service name>/config).
    mountPathOverride: ""

    # Overrides configmap volume name standard (default: config.<service name>).
    volumeNameOverride: ""

    # Overrides the configmap volume default key (default: config).
    volumeKeyOverride: ""

    # Overrides the configmap volume default path & filename (default {app.env}.json).
    volumePathOverride: ""

  # Specify annotations for the deployment resource.
  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  annotations:  {}

  # Overprovisioning require preinstalled PriorityClass options.
  # https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/
  overprovisioning:
    # REQUIRED: define PriorityClass for overprovisioning deployment
    priorityClass: ""
    containers:
      resources:
        requests:
          # default 1
          cpu: ""
          # default 2Gi
          memory: ""

  # Enable Rolling update feature for Harness type of Canary deployment.
  # DEPRECATED: please use `deploymentStrategy` instead.
  rollingUpdate:
    maxSurge: ""
    maxUnavailable: ""

  # Define the deployment strategy for the deployment.
  # https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
  deploymentStrategy:
    # Define the deployment strategy for the deployment.
    # Available options: Recreate, RollingUpdate
    type: RollingUpdate
    # Define the maxSurge for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
    maxSurge: ""
    # Define the maxUnavailable for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
    maxUnavailable: ""

pod:
  # Specify annotations for all pod resources.
  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  annotations: {}

  # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
  securityContext: {}

  # Lifecycle, kubernetes supports the postStart and preStop events.
  # Kubernetes sends the postStart event immediately after a Container is started, and it sends the preStop event
  #   immediately before the Container is terminated.
  # A Container may specify one handler per event, example:
  #   lifecycle:
  #     preStop:
  #       exec:
  #         command:
  #           - sleep
  #           - "80"
  # https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
  lifecycle: {}

  # Command, when you create a Pod, you can define a command and arguments for the containers that run in the Pod.
  # https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  command: []
  args: []

  livenessProbe:
    # Utilizes tcpSocket instead of httpGet.
    useTCPSocket: false

    # Utilizes grpc instead of httpGet, superseded by useTCPSocket if true.
    # REQUIRED: Kubernetes v1.23+
    useGRPC: false

    # Specifies liveness probe path defined in _helpers.tpl (default: /healthz).
    path: ""

    # Utilizes exec heathcheck inside of container instead of TCP/GRPC.
    useEXEC: false

    # Command to exec for heathcheck.
    #  - /bin/bash
    #  - -c
    #  - {{ .Values.pod.livenessProbe.command }}
    command: ""

    # Custom command overrides the standard healthcheck command above.
    customCommand: []

    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 5
    successThreshold: 1
    failureThreshold: 3

  readinessProbe:
    # Utilizes tcpSocket instead of httpGet.
    useTCPSocket: false

    # Utilizes grpc instead of httpGet, superseded by useTCPSocket if true.
    # REQUIRED: Kubernetes v1.23+
    useGRPC: false

    # Specifies readiness probe path defined in _helpers.tpl (default: /healthz).
    path: ""

    # Utilizes exec heathcheck inside of container instead of TCP/GRPC.
    useEXEC: false

    # Command to exec for heathcheck.
    #  - /bin/bash
    #  - -c
    #  - {{ .Values.pod.readinessProbe.command }}
    command: ""

    # Custom command overrides the standard healthcheck command above.
    customCommand: []

    initialDelaySeconds: 5
    periodSeconds: 10
    timeoutSeconds: 5
    successThreshold: 1
    failureThreshold: 3

  # Pod Topology Spread Constraints control how Pods are spread across your cluster among failure-domains such as
  #   regions, zones, nodes, and other user-defined topology domains.
  # While minDomains, matchLabelKeys, nodeAffinityPolicy, nodeTaintsPolicy are specified and supported within this
  #   chart, they require specific versions of Kubernetes to work.
  # Properties:
  #   maxSkew: <integer>
  #   topologyKey: <string>
  #   whenUnsatisfiable: [DoNotSchedule|ScheduleAnyway]
  #   labelSelector: <object>
  #   minDomains: <integer> # optional; alpha since v1.24, beta since v1.25
  #   matchLabelKeys: <list> # optional; alpha since v1.25
  #   nodeAffinityPolicy: [Honor|Ignore] # optional; alpha since v1.25
  #   nodeTaintsPolicy: [Honor|Ignore] # optional; alpha since v1.25
  # Example:
  #   topologySpreadConstraints:
  #     - maxSkew: 1
  #       topologyKey: topology.kubernetes.io/zone
  #       whenUnsatisfiable: DoNotSchedule
  #       labelSelector:
  #         app.kubernetes.io/instance: foo
  #     - maxSkew: 2
  #       topologyKey: topology.kubernetes.io/hostname
  #       whenUnsatisfiable: DoNotSchedule
  # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/#topologyspreadconstraints-field
  topologySpreadConstraints: []

  # terminationGracePeriodSeconds specifies the time (in seconds) Kubernetes waits for a pod to shut down gracefully
  # after sending a SIGTERM signal. If the pod doesn’t terminate within this period, Kubernetes forcefully kills
  # it with SIGKILL. Adjust this value to ensure your application has enough time to complete ongoing tasks
  # before termination. The default is 120 seconds.
  # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination
  terminationGracePeriodSeconds: ""

node:
  # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
  selector: {}

  affinity:
    # Inter-pod affinity and anti-affinity allow you to constrain which nodes your pod is eligible to be scheduled based on labels on pods that are already running on the node rather than based on labels on nodes.
    # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
    # Example:
    #    affinity:
    #      podAffinity:
    #        requiredDuringSchedulingIgnoredDuringExecution:
    #          - labelSelector:
    #              matchExpressions:
    #                - key: app-name
    #                  operator: In
    #                  values:
    #                    - web-app
    #            topologyKey: topology.kubernetes.io/zone
    #      podAntiAffinity:
    #        preferredDuringSchedulingIgnoredDuringExecution:
    #          - weight: 10
    #            podAffinityTerm:
    #              labelSelector:
    #                matchExpressions:
    #                  - key: type
    #                    operator: In
    #                    values:
    #                      - frontend
    #              topologyKey: topology.kubernetes.io/zone
    podAffinity: {}
    podAntiAffinity: {}

    # Node Affinity allows you to constrain which nodes your pod is eligible to be scheduled on, based on labels on the node.
    #   If you specify multiple nodeSelectorTerms associated with nodeAffinity types, then the pod can be scheduled onto a node if one of the nodeSelectorTerms can be satisfied.
    #   If you specify multiple matchExpressions associated with nodeSelectorTerms, then the pod can be scheduled onto a node only if all matchExpressions is satisfied.
    # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
    # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#an-example-of-a-pod-that-uses-pod-affinity
    # Example:
    #    affinity:
    #      nodeAffinity:
    #        requiredDuringSchedulingIgnoredDuringExecution:
    #          nodeSelectorTerms:
    #            - key: pluto.tv/instance-compute-type
    #              operator: In
    #              values:
    #                - "true"
    #            - key: pluto.tv/node-group
    #              operator: In
    #              values:
    #                - "compute_3"
    #            - key: beta.kubernetes.io/arch
    #              operator: In
    #              values:
    #                - amd64
    #        preferredDuringSchedulingIgnoredDuringExecution:
    #          - preference:
    #              matchExpressions:
    #                - key: topology.kubernetes.io/region
    #                  operator: In
    #                  values:
    #                    - us-east-1
    #            weight: 1
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        serviceDedicatedGroup:
          # Define the key to match against (default: "DoesNotExist").
          operator: ""
          # Required if operator is "In" or "NotIn".
          values: []
          # Define additional matchExpressions for serviceDedicatedGroup.
          additionalMatchExpressions: []
        # Define additional nodeSelectorTerms.
        nodeSelectorTerms: []
      preferredDuringSchedulingIgnoredDuringExecution: []

  # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
  tolerations: []

# Workers provide additional k8s resources necessary for the correct operation of the main service, they do not accept
#   traffic and perform only certain functionality that has been separated from the main service.
worker:
  # Common Variables added to all ConfigMaps generated
  commonVariables: {}

  #  workers:
  #    - name: ""
  #
  #      # Replica Count defines the number of pods to maintain; enabled when autoscaling inactive.
  #      replicaCount: 1
  #
  #      # Specify annotations for all workers deployment resources.
  #      # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  #      annotations: {}
  #
  #      # ConfigMap automatically enables when `environmentVariables` contains data, example:
  #      #   environmentVariables:
  #      #     foo: bar
  #      #     baz: fizz
  #      configMap:
  #        environmentVariables: {}
  #
  #        # Appends annotations to the worker configmap.
  #        annotations: {}
  #
  #      prometheus:
  #        enabled: true
  #        path: "/metrics"
  #        port: "8080"
  #        scrape: "true"
  #
  #      # OTLP configuration https://opentelemetry.io/docs/specs/otlp/
  #      otlpMetrics:
  #        enabled: false
  #        protocol: ""
  #        exportInterval: "10000"
  #
  #      deployment:
  #        # Define DNS Configuration
  #        dnsConfig: {}
  #
  #        # Define DNS Policy
  #        dnsPolicy: ""
  #
  #        # Define additional volumeMounts.
  #        volumeMounts: []
  #
  #        # Define additional volumes.
  #        volumes: []
  #
  #        # Config Volume Mounts are not deployed by this Helm Chart, enable only if that config already exists within the namespace.
  #        configVolumeMounts:
  #          # Enable Volumes & VolumeMounts on Deployment / Pods.
  #          enabled: false
  #
  #          # Overrides mount path standard (default: /app/<service name>/config).
  #          mountPathOverride: ""
  #
  #          # Overrides configmap volume name standard (default: config.<service name>).
  #          volumeNameOverride: ""
  #
  #          # Overrides the configmap volume default key (default: config)
  #          volumeKeyOverride: ""
  #
  #          # Overrides the configmap volume default key (default: "service.configFile")
  #          volumePathOverride: ""
  #
  #        # Enable Rolling update feature for Harness type of Canary deployment.
  #        # DEPRECATED: please use `deploymentStrategy` instead.
  #        rollingUpdate:
  #          maxSurge: ""
  #          maxUnavailable: ""
  #
  #        # Define the deployment strategy for the deployment.
  #        # https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
  #        deploymentStrategy:
  #          # Define the deployment strategy for the deployment.
  #          # Available options: Recreate, RollingUpdate
  #          type: RollingUpdate
  #          # Define the maxSurge for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
  #          maxSurge: "25%"
  #          # Define the maxUnavailable for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
  #          maxUnavailable: "25%"
  #
  #      # Resources specified for containers.
  #      # Recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases
  #      #   chances charts run on environments with little resources, such as Minikube. If you do want to specify resources,
  #      #   uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  #      # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  #      resources: {}
  #
  #      # https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
  #      autoscaling:
  #        horizontal:
  #          enabled: false
  #          minReplicas: 1
  #          maxReplicas: 2
  #          metrics: []
  #
  #      # Define the deployment strategy for the deployment.
  #      # https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
  #      deploymentStrategy:
  #        # Define the deployment strategy for the deployment.
  #        # Available options: Recreate, RollingUpdate
  #        type: RollingUpdate
  #        # Define the maxSurge for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
  #        maxSurge: "25%"
  #        # Define the maxUnavailable for the deployment strategy (default: see definition "k8s.deploymentStrategyRollingUpdateDefaults").
  #        maxUnavailable: 0
  #
  #      pod:
  #        # Specify annotations for all worker pod resources.
  #        # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  #        annotations: {}
  #
  #        # Command, when you create a Pod, you can define a command and arguments for the containers that run in the Pod.
  #        # https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/
  #        command: []
  #        args: []
  #
  #        ports:
  #          - name: foo
  #            targetPort: 1234
  #          - name: foo-doggy
  #            targetPort: 5555
  #
  #        livenessProbe:
  #          path: /foo/doggy/live
  #          port: 5555
  #
  #        readinessProbe:
  #          path: /foo/doggy/ready
  #          port: 5555
  #
  #        # terminationGracePeriodSeconds specifies the time (in seconds) Kubernetes waits for a pod to shut down gracefully
  #        # after sending a SIGTERM signal. If the pod doesn’t terminate within this period, Kubernetes forcefully kills
  #        # it with SIGKILL. Adjust this value to ensure your application has enough time to complete ongoing tasks
  #        # before termination. The default is 120 seconds.
  #        # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination
  #        terminationGracePeriodSeconds: ""
  #
  workers: []

### CUSTOM TEMPLATES ##########################################################
# Custom Templates are not managed by DevOps nor altered during kvetch upgrades, and intended for
#   specific needs by the engineering team for their service where the standard charts will not suffice.
# Any and all changes to these templates will remain as is, and are up to the engineering team to update.
# Refer to templates/custom/<template> included for defined defaults.
# Confluence docs for reference: https://paramount.atlassian.net/wiki/spaces/DEVOPS/pages/247277620/HowTo+Database+Migrations+custom+job+in+KVETCH+v2+Cluster
customizedTemplates:
  job:
    enabled: false
    # Required: Define name appended to custom job (<service name>-custom-job-<name>).
    name: ""
    otlpMetrics:
      enabled: false
      protocol: ""
      exportInterval: "10000"
  migration:
    enabled: false
    # Required: Define name appended to custom job (<service name>-custom-job-<name>).
    name: ""
    otlpMetrics:
      enabled: false
      protocol: ""
      exportInterval: "10000"
  cronjob:
    enabled: false
    # Required: Define name appended to custom cronjob (<service name>-custom-cronjob-<name>)
    name: ""
    otlpMetrics:
      enabled: false
      protocol: ""
      exportInterval: "10000"
  ###  Deprecated, please use istio/destination-rule.yaml ##############################
  destinationRule:
    enabled: false
    name: ""
    trafficPolicy: {}

### CANARY DEPLOYMENTS WITH ARGO ROLLOUTS ######################################
# A canary rollout is a deployment strategy 
# where the operator releases a new version of their application to a small percentage of the production traffic.
canary:
  enabled: false

  # Minimum number of seconds for which a newly created pod should be ready
  # without any of its container crashing, for it to be considered available.
  # Defaults to 0 (pod will be considered available as soon as it is ready)
  # minReadySeconds: 15

  # The maximum number of pods that can be scheduled above the original
  # number of pods. Value can be an absolute number (ex: 5) or a
  # percentage of total pods at the start of the update (ex: 10%). This
  # can not be 0 if MaxUnavailable is 0. 
  # maxSurge: '25%'

  # The maximum number of pods that can be unavailable during the update.
  # Value can be an absolute number (ex: 5) or a percentage of total pods
  # at the start of update (ex: 10%). 
  # maxUnavailable: 0


  # Users can start leveraging notifications using 
  # notifications.argoproj.io/subscribe.<trigger>.<service>: <recipient> annotation.
  # Look how to configure slack notifications 
  # https://argo-rollouts.readthedocs.io/en/stable/generated/notification-services/slack/
  # annotations:
  #   notifications.argoproj.io/subscribe.on-rollout-completed.slack: deployments-test
  #   notifications.argoproj.io/subscribe.on-rollout-aborted.slack: deployments-test
  #   notifications.argoproj.io/subscribe.on-analysis-run-error.slack: deployments-test
  #   notifications.argoproj.io/subscribe.on-analysis-run-failed.slack: deployments-test

  # Argo Rollouts provides several ways to perform analysis to drive progressive delivery.
  # In the background, an AnalysisRun is started based on the AnalysisTemplate named http-success-rate. 
  # Configured AnalysisTemplates with DataDog integration are: `http-success-rate` for http based services
  # and `grpc-success-rate` for gRPC based services.
  # The http-success-rate template queries a DataDog API, measuring the HTTP success rates at 1 minute intervals/samples.
  # It has no end time, and continues until stopped or failed. If the metric is measured to be less than 90%, 
  # and there are three such measurements, the analysis is considered Failed. 
  # The failed analysis causes the Rollout to abort, setting the canary weight back to zero, 
  # and the Rollout would be considered in a Degraded. Otherwise, if the rollout completes all of its canary steps, 
  # the rollout is considered successful and the analysis run is stopped by the controller.
  # Use the field clusterScope: true to reference a ClusterAnalysisTemplate instead of an AnalysisTemplate.
  # analysis:
  #   templates:
  #   - templateName: http-success-rate
  #     clusterScope: true
  #   startingStep: 2 # delay starting analysis run until setWeight: 40%

  # The following example gradually increments the canary weight by 20% every 5 minutes until it reaches 100%.
  # steps:
  #   - setWeight: 20
  #   - pause: {duration: 5m}
  #   - setWeight: 40
  #   - pause: {duration: 5m}
  #   - setWeight: 60
  #   - pause: {duration: 5m}
  #   - setWeight: 80
  #   - pause: {duration: 5m}

  # Reference to the configured VirtualService route, we use http, https or grpc. 
  # Set required routes to allow Rollout configure canary weight by updating `weight` for each route.
  # routes:
  #   - http
  #   - https

  # Completely working example for gRPC service
  # canary:
  #   enabled: true
  #   minReadySeconds: 15
  #   maxSurge: '25%'
  #   maxUnavailable: 0
  #   annotations:
  #     notifications.argoproj.io/subscribe.on-rollout-completed.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-rollout-aborted.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-analysis-run-error.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-analysis-run-failed.slack: deployments-test
  #   analysis:
  #     templates:
  #     - templateName: grpc-success-rate
  #       clusterScope: true
  #     startingStep: 2
  #   steps:
  #     - setWeight: 20
  #     - pause: {duration: 5m}
  #     - setWeight: 40
  #     - pause: {duration: 5m}
  #     - setWeight: 60
  #     - pause: {duration: 5m}
  #     - setWeight: 80
  #     - pause: {duration: 5m}
  #   routes:
  #     - grpc
  #     - https

  # Completely working example for HTTP service
  # canary:
  #   enabled: true
  #   minReadySeconds: 15
  #   maxSurge: '25%'
  #   maxUnavailable: 0
  #   annotations:
  #     notifications.argoproj.io/subscribe.on-rollout-completed.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-rollout-aborted.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-analysis-run-error.slack: deployments-test
  #     notifications.argoproj.io/subscribe.on-analysis-run-failed.slack: deployments-test
  #   analysis:
  #     templates:
  #     - templateName: http-success-rate
  #       clusterScope: true
  #     startingStep: 2
  #   steps:
  #     - setWeight: 20
  #     - pause: {duration: 5m}
  #     - setWeight: 40
  #     - pause: {duration: 5m}
  #     - setWeight: 60
  #     - pause: {duration: 5m}
  #     - setWeight: 80
  #     - pause: {duration: 5m}
  #   routes:
  #     - http
  #     - https