# GKE values for the vendored cert-manager chart (helm-templates/cert-manager,
# v1.20.1). Written fresh rather than copied from k8s-admin-prd-ase1, whose
# file was never adapted from the fleet: it pulls images from a private
# Meesho Artifact Registry and pins pods to a "dedicated: devops" node pool
# that does not exist here.
#
# Installed once by hand with `helm install cert-manager` (namespace
# "cert-manager"), then adopted by the cert-manager Application in
# devops-infra-argo-config-gcp.
#
# Its job here is Harbor's certificate, issued from the private registry CA
# that toolshed-gke-infra's 10-infra creates and the node pool trusts. The
# CA key pair reaches the cluster as the "registry-ca" Secret in this
# namespace (kubectl, from terraform output); the ClusterIssuer that uses it
# lives with Harbor's config, not here.
# The vendored chart's own values.yaml was edited in the fleet to pull every
# image from Meesho's private Artifact Registry, which these nodes cannot
# reach. Back to upstream's registry (quay.io/jetstack/cert-manager-*).
imageRegistry: quay.io
imageNamespace: jetstack

crds:
  enabled: true
  # A helm uninstall must not take every Certificate in the cluster with it.
  keep: true

replicaCount: 1
resources:
  requests:
    cpu: 50m
    memory: 96Mi
  limits:
    memory: 256Mi

webhook:
  replicaCount: 1
  resources:
    requests:
      cpu: 20m
      memory: 48Mi
    limits:
      memory: 128Mi

cainjector:
  enabled: true
  replicaCount: 1
  resources:
    requests:
      cpu: 20m
      memory: 96Mi
    limits:
      memory: 256Mi

startupapicheck:
  enabled: true
  resources:
    requests:
      cpu: 10m
      memory: 32Mi
    limits:
      memory: 64Mi

prometheus:
  enabled: true
  servicemonitor:
    enabled: false