coco-pattern/values-global.yaml at main · validatedpatterns/coco-pattern · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
global:
  pattern: coco-pattern
  # singleArgoCD must be under global: (not main:) for the clustergroup chart to read it.
  # When true, child apps are managed by the vp-gitops ArgoCD instance — no second ArgoCD.
  singleArgoCD: true
  multiSourceRepoUrl: quay.io/validatedpatterns
  storageProvider: lvm  # Options: hpp, lvm, external
  clusterVersion: "4.22"  # OCP minor version for operator pins. Options: 4.19, 4.20, 4.21
  secretStore:
    # Warning: This must be present even if it is set to none.
    backend: vault # none, vault, kubernetes
  options:
    useCSV: false
    syncPolicy: Automatic
    installPlanApproval: Automatic
    autoApproveManualInstallPlans: true
  # This defines whether or not to use upstream resources for CoCo.
  # Defines whether or not the hub cluster can be used for confidential containers
  coco:
    runtimeClassName: "kata-cc" # kata-cc (baremetal), kata-remote (Azure/AWS), kata-cc-nvidia-gpu (GPU)
    securityPolicyFlavour: "insecure" # insecure, redhat-secure-gpg, redhat-secure-sigstore, signed or reject
    secured: true # true or false. If true, the cluster will be secured. If false, the cluster will be insecure.
    bypassAttestation: false
    # Enable SSH key injection into podvm for debugging. Do not enable in production.
    # Also requires: COCO_ENABLE_SSH_DEBUG=true ./scripts/gen-secrets.sh
    # and uncommenting the sshKey block in values-secret.yaml.template.
    enableSSHDebug: false
    azure:
      defaultVMFlavour: "Standard_DC2as_v5"
      VMFlavours: "Standard_DC2as_v5,Standard_DC4as_v5,Standard_DC8as_v5,Standard_DC16as_v5"
  hardware:
    profile: intel-tdx  # Options: intel-tdx, amd-snp, intel-tdx-gpu, amd-snp-gpu
  cluster:
    # Hosted Control Planes (HCP) mode. When true, MachineConfig resources are skipped
    # (no Machine Config Daemon on HCP workers). The sandboxed-containers operator
    # auto-detects HCP and uses DaemonSet deployment mode (Tech Preview in OSC 1.13).
    # For multi-cluster: set false on hub, override to true for HCP spokes via helmOverrides.
    hcp: false
main:
  # Set clusterGroupName to match your deployment topology:
  #   azure          — Azure single-cluster (all components in one cluster)
  #   azure-spoke    — Azure spoke (multi-cluster, imported into ACM from trusted-hub)
  #   baremetal      — Bare metal single-cluster (Intel TDX / AMD SEV-SNP, hardware profile gated)
  #   baremetal-hub  — Bare metal hub (Trustee + ACM, mixed TDX/SNP, manages baremetal spokes)
  #   baremetal-spoke — Bare metal spoke (imported into ACM from baremetal-hub)
  #   trusted-hub    — Hub for multi-cluster Azure (Trustee + ACM, manages azure-spoke clusters)
  clusterGroupName: azure
  git:
    # Connected mode: repoURL is inferred from your local git remote.
    # Disconnected: uncomment and set to the HTTP URL served by git-http-server.py
    # repoURL: http://JUMP_HOST_IP:8080/coco-pattern.git
    revision: main
  patternsOperator:
    # Required for airgap -- set to your mirrored catalog source name
    # source: cs-community-operator-index-v4-22
    channel: fast
  gitops:
    # Required for airgap -- set to your mirrored catalog source name
    # operatorSource: cs-redhat-operator-index-v4-22
    # Channel must match what's available in the mirrored catalog.
    # The mirrored catalog may only have 'latest', not version-specific channels.
    channel: latest
  multiSourceConfig:
    enabled: true
    clusterGroupChartVersion: 0.9.58
    # VP OCI Helm charts are mirrored to mirror-registry by oc-mirror additionalImages.
    # Use mirror-registry directly — no Quay dependency for airgap deploys.
    helmRepoUrl: quay.io/validatedpatterns

# Common secret store configuration used across multiple charts.
# NOTE: Charts reference secretStore.* (top-level, not global.secretStore.*).
# Top-level values do not propagate from values-global.yaml — each application
# that needs secretStore must declare it via inline overrides in the topology file.
# This is intentional — it allows different charts to use different secret stores.
secretStore:
  name: vault-backend
  kind: ClusterSecretStore