greymatter.yaml

global:
  environment: openshift
  domain: staging.deciphernow.com
  route_url_name: greymatter
  remove_namespace_from_url: false
  zone: zone-default-zone
  mesh_tls:
    enabled: true
    use_provided_certs: true
  kafka:
    replicas: 3
  dashboard:
    version: 3.1.0
    sidecar:
      version: 0.9.1
  catalog:
    version: 1.0.1
    sidecar:
      version: 0.9.1
  sense:
    enabled: false
  consul:
    enabled: false
    host: ''
    port: 8500
  edge:
    enableTLS: true
    certPath: /etc/proxy/tls/edge
    version: 0.9.1
  spire:
    enabled: false
  waiter:
    serviceAccount:
      create: true
  control:
    # This specifies the service name that all XDS clients will try to connect to
    name: control
    port: 50000
    version: 0.5.1
  data:
    jwt_prefix: '/jwt'
  internal-data:
    jwt_prefix: '/jwt'
  services:
    catalog:
      egressTLS: true
      mTLS: true
      version: 1.0.1
    dashboard:
      egressTLS: false
      mTLS: true
    prometheus:
      egressTLS: false
      mTLS: true
    data:
      egressTLS: true
      mTLS: true
    internal-data:
      egressTLS: true
      mTLS: true
    jwt:
      egressTLS: true
      mTLS: true
    internal-jwt:
      egressTLS: true
      mTLS: true
    slo:
      egressTLS: false
      mTLS: true
    control:
      egressTLS: false
      mTLS: true

  sidecar:
    version: 0.9.1
    envvars:
      # You can customize the sidecar environment variables mesh-wide to enable features in the mesh
      # All the sidecar envvars are documented in `./greymatter/README.md`, and the custom service-level defaults are documented in the services `configuration.md` files.
      # These are sorted by how different the values are for the sidecars running on different services. The options are "all the same", "all except XDS". and "different"
      # TODO: update each service to use default global values and only set the ones that are different.
      # All the same
      proxy_dynamic:
        type: 'value'
        value: 'true'
      xds_cluster:
        type: 'value'
        value: ''
      xds_host:
        type: 'value'
        value: 'control.{{ .Release.Namespace }}.svc.cluster.local'
      xds_port:
        type: 'value'
        value: '{{ .Values.global.control.port }}'
      xds_node_id:
        type: 'value'
        value: 'default'
      envoy_admin_log_path:
        type: 'value'
        value: '/dev/stdout'
      # There may be more sidecar environment variables, but we haven't added them here yet.
      # However, to use an env var with the sidecar, even if it doesn't have a global default,
      # it needs to be set globally as either a value or a secret

control:
  control:
    serviceAccount:
      create: true
    image: docker.production.deciphernow.com/deciphernow/gm-control:0.5.1
    envvars:
      gm_control_console_level:
        type: 'value'
        value: 'debug'
      #gm_control_cmd:
      #  type: 'value'
      #  value: 'consul'
      #gm_control_consul_dc:
      #  type: 'value'
      #  value: 'dc1'
      #gm_control_consul_hostport:
      #  type: 'value'
      #  value: '{{ .Values.global.consul.host }}:{{ .Values.global.consul.port }}'

gm-control-api:
  gmControlApi:
    image: docker.production.deciphernow.com/deciphernow/gm-control-api:0.8.1
    zone: zone-default-zone
    init:
      image: docker.production.deciphernow.com/deciphernow/greymatter:0.5.1
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'

data:
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'data'

  data:
    image: docker.production.deciphernow.com/deciphernow/gm-data:0.2.7
    certs_mount_point: /app/certs
    envvars:
      uses3:
        type: value
        value: 'true'
      aws_access_key_id:
        type: secret
        secret: '{{ .Values.data.name }}-secrets'
        key: aws_access_key_id
      aws_secret_access_key:
        type: secret
        secret: '{{ .Values.data.name }}-secrets'
        key: aws_secret_access_key
      aws_region:
        type: secret
        secret: '{{ .Values.data.name }}-secrets'
        key: aws_region
      aws_s3_bucket:
        type: secret
        secret: '{{ .Values.data.name }}-secrets'
        key: aws_s3_bucket
      aws_s3_partition:
        type: value
        value: data
      gmdata_namespace:
        type: value
        value: home
      gmdata_namespace_userfield:
        type: value
        value: email
      jwt_pub:
        type: secret
        secret: jwt-security
        key: jwt.pub
      jwt_api_key:
        type: secret
        secret: jwt-security
        key: jwt.api_key
      less_chatty_info:
        type: value
        value: 'false'
      masterkey:
        type: secret
        secret: '{{ .Values.data.name }}-secrets'
        key: master_key
      mongo_initdb_root_username:
        type: secret
        secret: '{{ .Values.mongo.credentials.secret_name }}'
        key: root_username
      mongo_initdb_root_password:
        type: secret
        secret: '{{ .Values.mongo.credentials.secret_name }}'
        key: root_password
      mongodb:
        type: secret
        secret: '{{ .Values.mongo.credentials.secret_name }}'
        key: database
      gmdata_use_tls:
        type: value
        value: 'true'
      gmdata_cert:
        type: secret
        secret: jwt-certs
        key: server.cert.pem
      gmdata_key:
        type: secret
        secret: jwt-certs
        key: server.key.pem
      gmdata_trust:
        type: secret
        secret: jwt-certs
        key: server.trust.pem
      client_prefix:
        type: value
        value: /services/data/0.2.7
      client_jwt_prefix:
        type: value
        value: /jwt
      client_jwt_endpoint_address:
        type: value
        value: localhost
      client_jwt_endpoint_port:
        type: value
        value: '8080'
      client_jwt_endpoint_prefix:
        type: value
        value: /jwt
      client_jwt_endpoint_use_tls:
        type: value
        value: 'true'
      client_jwt_endpoint_cert:
        type: secret
        secret: jwt-certs
        key: jwt.cert.pem
      client_jwt_endpoint_key:
        type: secret
        secret: jwt-certs
        key: jwt.key.pem
      client_jwt_endpoint_trust:
        type: secret
        secret: jwt-certs
        key: jwt.trust.pem

  mongo:
    private_image: true
    ssl:
      enabled: false
      name: mongo-ssl-certs
    envvars:
      mongodb_admin_password:
        type: secret
        secret: mongo-credentials
        key: root_username
      mongodb_database:
        type: secret
        secret: mongo-credentials
        key: database
      mongodb_user:
        type: secret
        secret: mongo-credentials
        key: root_username
      mongodb_password:
        type: secret
        secret: mongo-credentials
        key: root_password
      mongo_client_dn:
        type: value
        value: CN=*.greymatter.svc.cluster.local, OU=Engineering, O=Decipher Technology Studios, L=Alexandria, ST=Virginia, C=US

internal-data:
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'data-internal'
  data:
    image: docker.production.deciphernow.com/deciphernow/gm-data:0.2.7
    certs_mount_point: /app/certs
    version: 0.2.7
    name: data-internal
    pvc:
      mountPath: /buckets/{{ $.Values.data.aws.bucket}}/{{ $.Values.data.envvars.aws_s3_partition.value }}

    envvars:
      gmdata_namespace:
        type: value
        value: 'world'
      gmdata_namespace_userfield:
        type: value
        value: email
      uses3:
        type: value
        value: 'false'
      aws_access_key_id:
        type: 'null'
      aws_secret_access_key:
        type: 'null'
      aws_region:
        type: 'null'
      aws_s3_partition:
        type: value
        value: greymatter
      gmdata_use_tls:
        type: value
        value: 'true'
      jwt_pub:
        type: secret
        secret: internal-jwt-security-secret
        key: jwt.pub
      jwt_api_key:
        type: secret
        secret: internal-jwt-security-secret
        key: jwt.api_key
  mongo:
    private_image: true
    name: internal-data-mongo
    credentials:
      secret_name: 'internal-mongo-credentials'
    ssl:
      enabled: false
      name: internal-mongo-ssl-certs
    envvars:
      mongodb_admin_password:
        type: secret
        secret: internal-mongo-credentials
        key: root_username
      mongodb_database:
        type: secret
        secret: internal-mongo-credentials
        key: database
      mongodb_user:
        type: secret
        secret: internal-mongo-credentials
        key: root_username
      mongodb_password:
        type: secret
        secret: internal-mongo-credentials
        key: root_password
      mongo_client_dn:
        type: value
        value: CN=*.greymatter.svc.cluster.local, OU=Engineering, O=Decipher Technology Studios, L=Alexandria, ST=Virginia, C=US

catalog:
  catalog:
    envvars:
      config_source:
        type: value
        value: 'gmdata'
      instance_polling_interval:
        type: value
        value: '5s'
      instance_max_silence:
        type: value
        value: '15s'
      metrics_max_retries:
        type: value
        value: '3'
      metrics_retry_delay:
        type: value
        value: '10s'
      metrics_request_timeout:
        type: value
        value: '15s'
      port:
        type: value
        value: '9080'
      control_server_0_address:
        type: value
        value: '{{ .Values.global.control.name }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.global.control.port }}'
      control_server_0_zone_name:
        type: value
        value: '{{ .Values.global.zone }}'
      control_server_0_request_cluster_name:
        type: value
        value: 'edge'
      use_tls:
        type: value
        value: 'true'
      ca_cert_path:
        type: value
        value: '/etc/pki/ca.crt'
      server_cert_path:
        type: value
        value: '/etc/pki/server.crt'
      server_key_path:
        type: value
        value: '/etc/pki/server.key'
      client_address:
        type: value
        value: localhost
      client_port:
        type: value
        value: '8080'
      client_prefix:
        type: value
        value: '/data'
      client_use_tls:
        type: value
        value: 'true'
      client_cn:
        type: value
        value: '*.greymatter.svc.cluster.local'
      client_cert:
        type: secret
        secret: sidecar-certs
        key: server_b64
      client_key:
        type: secret
        secret: sidecar-certs
        key: key_b64
      client_trust:
        type: secret
        secret: sidecar-certs
        key: ca_b64
      gmdata_startup_delay:
        type: value
        value: '10s'
      gmdata_max_retries:
        type: value
        value: '100'
      gmdata_retry_delay:
        type: value
        value: '5s'
      gmdata_root_event_name:
        type: value
        value: 'world'
      client_identity:
        type: value
        value: 'CN=gm-control,OU=Engineering,O=Decipher Technology Studios,=Alexandria,=Virginia,C=US'
      client_email:
        type: value
        value: 'gm-control@deciphernow.com'

    init:
      image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
      envvars:
        debug:
          type: value
          value: 'true'
  
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'catalog'

dashboard:
  dashboard:
    image: 'docker.production.deciphernow.com/deciphernow/gm-dashboard:3.1.0'
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'dashboard'
  sidecar_prometheus:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
  prometheus:
    serviceAccount:
      create: false

slo:
  slo:
    image: docker.production.deciphernow.com/deciphernow/gm-slo:0.5.0
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'slo'

  postgres:
    private_image: true
    data_mount_point: /var/lib/pgsql/data
    ssl:
      enabled: true
      name: postgres-ssl-certs
      mountPoint: /certs
    credentials:
      secret_name: postgres-credentials
      username: greymatter
      password: greymatter
      database: greymatter

    envvars:
      - type: secret
        name: postgresql_user
        secret: postgres-credentials
        key: username
      - type: secret
        name: POSTGRESQL_PASSWORD
        secret: postgres-credentials
        key: password
      - type: value
        name: POSTGRES_USER_CN
        value: CN=*.greymatter.svc.cluster.local, OU=Engineering, O=Decipher Technology Studios, L=Alexandria, ST=Virginia, C=US
      - type: secret
        name: POSTGRESQL_DATABASE
        secret: postgres-credentials
        key: database

jwt:
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'jwt-security'

  jwt:
    use_aac: true
    users_mount_point: /gm-jwt-security/etc
    image: docker.production.deciphernow.com/deciphernow/gm-jwt-security:0.2.0
    envvars:
      - type: value
        name: HTTPS_PORT
        value: '3000'
      - type: secret
        name: PRIVATE_KEY
        secret: jwt-security
        key: jwt.key
      - type: secret
        name: JWT_API_KEY
        secret: jwt-security
        key: jwt.api_key
      - type: value
        name: ENABLE_TLS
        value: true
      - type: secret
        name: SERVER_TRUST
        secret: jwt-certs
        key: jwt.trust.pem
      - type: secret
        name: SERVER_CERT
        secret: jwt-certs
        key: jwt.cert.pem
      - type: secret
        name: SERVER_KEY
        secret: jwt-certs
        key: jwt.key.pem
      - type: value
        name: JWT_AACHOST
        value: aac.memecore.svc.cluster.local
      - type: value
        name: JWT_AACPORT
        value: 9080
      - type: secret
        name: AAC_TRUST
        secret: jwt-certs
        key: jwt.trust.pem
      - type: secret
        name: AAC_CERT
        secret: jwt-certs
        key: jwt.cert.pem
      - type: secret
        name: AAC_KEY
        secret: jwt-certs
        key: jwt.key.pem

  redis:
    private_image: true

internal-jwt:
  sidecar:
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    create_sidecar_secret: false
    envvars:
      xds_cluster:
        type: value
        value: 'internal-jwt-security'
  jwt:
    name: internal-jwt-security
    certs_mount_point: /gm-jwt-security/certs
    image: docker.production.deciphernow.com/deciphernow/gm-jwt-security:0.2.0
    envvars:
      - type: value
        name: HTTPS_PORT
        value: '3000'
      - type: secret
        name: PRIVATE_KEY
        secret: internal-jwt-security-secret
        key: jwt.key
      - type: secret
        name: JWT_API_KEY
        secret: internal-jwt-security-secret
        key: jwt.api_key
      - type: value
        name: ENABLE_TLS
        value: true
      - type: secret
        name: SERVER_TRUST
        secret: internal-jwt-certs
        key: jwt.trust.pem
      - type: secret
        name: SERVER_CERT
        secret: internal-jwt-certs
        key: jwt.cert.pem
      - type: secret
        name: SERVER_KEY
        secret: internal-jwt-certs
        key: jwt.key.pem

    users_cg_name: internal-jwt-users
    users: |-
      {
        "users": [
        {
          "label": "CN=gm-control,OU=Engineering,O=Decipher Technology Studios,=Alexandria,=Virginia,C=US",
          "values": {
            "email": [
                "gm-control@deciphernow.com"
            ],
            "org": [
                "www.deciphernow.com"
            ],
            "privilege": [
                "root"
            ]
          }
        },
        {
          "label": "CN=gm-catalog,OU=Engineering,O=Decipher Technology Studios,=Alexandria,=Virginia,C=US",
          "values": {
            "email": [
                "engineering@deciphernow.com"
            ],
            "org": [
                "www.deciphernow.com"
            ],
            "privilege": [
                "root"
            ]
          }
        }]
      }
  redis:
    name: internal-redis
    secret_name: internal-redis-password
    password: 'internalRedis'

sidecar:
  image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
  create_sidecar_secret: true

edge:
  sidecar:
    version: 0.9.1
    image: 'docker.production.deciphernow.com/deciphernow/gm-proxy:0.9.1'
    envvars:
      xds_cluster:
        type: value
        value: 'edge'
  edge:
    base_path: /services/edge/0.9.1
    create_edge_secret: true