---
# --- OLM operators ---
# Installed in order. RHOAI is pinned to stable-3.5: the MaaS DSC layout
# (aigateway.modelsAsAService) changed between 3.4 and 3.5, so don't float on stable-3.x.
# RHCL must be 1.4.x (Kuadrant >= 1.4.2 for AuthPolicy spec.defaults.rules).
# cert-manager is a prerequisite but already installed by deploy_openshift.yml.
rhoai_maas_operators:
  - name: rhcl-operator
    namespace: openshift-operators
    channel: stable-1.4
  - name: leader-worker-set
    namespace: openshift-lws-operator
    channel: stable-v1.0
    operator_group_target_namespaces:
      - openshift-lws-operator
  - name: rhods-operator
    namespace: redhat-ods-operator
    channel: stable-3.5
    namespace_labels:
      openshift.io/cluster-monitoring: "true"
rhoai_maas_wait_timeout: 900

# --- Gateway ---
# Empty = maas.<cluster ingress domain>.
rhoai_maas_hostname: ""
# The gateway gets its own single-host certificate. Don't use the *.apps wildcard:
# browsers would reuse the MaaS HTTP/2 connection for every other *.apps host
# (console, dashboards), and the MaaS gateway answers those with 404.
rhoai_maas_gateway_cert_secret: maas-gateway-tls
# cert-manager ClusterIssuer for the gateway certificate. Empty = use the existing
# rhoai_maas_gateway_cert_secret as-is and don't create a Certificate.
rhoai_maas_gateway_cert_issuer: letsencrypt-production
# No cloud LB on this cluster: run the gateway Service as ClusterIP and expose it
# through a passthrough Route on the default router. Set to LoadBalancer with MetalLB.
rhoai_maas_gateway_service_type: ClusterIP
rhoai_maas_gateway_create_route: true

# --- MaaS database ---
# PostgreSQL is provisioned by the cloudnativepg_operator role (see the playbook);
# this secret holds its credentials (type kubernetes.io/basic-auth).
rhoai_maas_db_secret_name: maas-postgres-secret
rhoai_maas_db_secret_namespace: rhoai-maas-db
rhoai_maas_db_sslmode: require
rhoai_maas_infra_namespace: redhat-ai-gateway-infra

# --- DataScienceCluster ---
# Minimal component set for MaaS. Anything not listed here is set to Removed.
rhoai_maas_dsc_name: default-dsc
rhoai_maas_dsc_managed_components:
  - dashboard
  - kserve
  - aigateway
  - ogx
rhoai_maas_dsc_removed_components:
  - aipipelines
  - feastoperator
  - kueue
  - mlflowoperator
  - modelregistry
  - ray
  - trainer
  - trainingoperator
  - trustyai
  - workbenches

# --- Models (ExternalModel fronting in-cluster OpenAI-compatible servers) ---
# The api_key_secret must already exist in the model namespace with key `api-key`;
# the role only labels it for MaaS. Names must not collide with existing Services
# in the namespace (the controller creates a Service per provider/model).
rhoai_maas_external_models:
  - name: qwen35-9b-coder
    namespace: llm-coding-assistant
    display_name: Qwen3.5 9B Coder (llama.cpp)
    description: Qwen3.5-9B Q5_K_M served by llama.cpp on the desktop GPU node
    provider_name: llama-coder-provider
    provider_type: openai
    endpoint: llama-coder.llm-coding-assistant.svc.cluster.local
    port: 8080
    tls: false
    api_key_secret: llama-coder-api-key
    # llama-server serves a single model and ignores the request's model field.
    target_model: Qwen3.5-9B-Q5_K_M.gguf
    api_format: openai-chat
    path: /v1/chat/completions

# --- Access policy and quota (CR spec shapes, models-as-a-service namespace) ---
rhoai_maas_auth_policies:
  - name: llama-coder-access
    display_name: llama-coder access
    description: All authenticated users can call the llama-coder model
    groups:
      - system:authenticated
    users: []
    model_refs:
      - name: qwen35-9b-coder
        namespace: llm-coding-assistant

rhoai_maas_subscriptions:
  - name: llama-coder-default
    display_name: llama-coder default
    description: 200k tokens/hour per user for all authenticated users
    priority: 10
    groups:
      - system:authenticated
    users: []
    model_refs:
      - name: qwen35-9b-coder
        namespace: llm-coding-assistant
        tokenRateLimits:
          - limit: 200000
            window: 1h