---
# --- OLM subscription ---
# Automation Orchestrator is published in redhat-operators. To install a pre-release
# build instead (as aapctl's scripts/create-catalogsources.sh does), set:
#   automation_orchestrator_operator_catalog_source_name: cs-automation-orchestrator
#   automation_orchestrator_operator_catalog_image: quay.io/aap/ansible-automation-platform/automation-orchestrator-operator-index@sha256:...
# plus automation_orchestrator_operator_image_digest_mirrors below.
#
# To adopt an existing install (e.g. from OperatorHub), point operator_namespace at
# it: an existing OperatorGroup in that namespace is reused, not duplicated, and an
# already-installed CSV skips InstallPlan approval.
automation_orchestrator_operator_operator_namespace: automation-orchestrator
automation_orchestrator_operator_channel: stable
automation_orchestrator_operator_name: automation-orchestrator-operator
automation_orchestrator_operator_catalog_source_name: redhat-operators
# Index image for a custom CatalogSource; "" uses the existing catalog_source_name as-is.
automation_orchestrator_operator_catalog_image: ""
# Manual: the role approves the initial InstallPlan only (upgrades stay pending).
automation_orchestrator_operator_install_plan_approval: Manual
automation_orchestrator_operator_wait_timeout: 600

# --- Pre-release image mirrors (ImageDigestMirrorSet) ---
# Only needed for pre-release builds whose images are not on registry.redhat.io.
# Cluster-wide; applying it triggers a MachineConfigPool rollout. Pre-release example:
#   - source: registry.redhat.io/ansible-automation-platform-27-next
#     mirrors: [quay.io/aap/ansible-automation-platform-27-next]
#   - source: registry.redhat.io/ansible-automation-platform-27
#     mirrors: [quay.io/aap/ansible-automation-platform-27-next]
automation_orchestrator_operator_idms_name: idms-aap-27-next
automation_orchestrator_operator_image_digest_mirrors: []
automation_orchestrator_operator_mcp_wait_timeout: 1800

# --- AutomationOrchestrator CR ---
# Same as the operator namespace by default (aapctl runs OLM + CR in one namespace);
# override only if you need to split the cluster-scoped operator from the app instance.
automation_orchestrator_operator_app_namespace: "{{ automation_orchestrator_operator_operator_namespace }}"
automation_orchestrator_operator_instance_name: automation-orchestrator

# --- PostgreSQL (bring-your-own) ---
# Defaults match the Secrets/Service created by the cloudnativepg_operator role
# (run it first, or point these at a customer-managed PostgreSQL instance instead).
automation_orchestrator_operator_postgres_host: orchestrator-postgres-rw
automation_orchestrator_operator_postgres_port: 5432
automation_orchestrator_operator_postgres_ssl_mode: verify-ca
# Name of a pre-existing Secret (key ca.crt). CloudNativePG auto-generates
# "<cluster-name>-ca" for its Cluster CR. Only used with sslMode verify-ca/verify-full.
automation_orchestrator_operator_postgres_ca_cert_secret: orchestrator-postgres-ca

# Names of pre-existing Secrets (keys: database, username, password) — created by
# cloudnativepg_operator, or your own Secrets when using a customer-managed PostgreSQL.
automation_orchestrator_operator_backend_db_secret_name: orchestrator-postgres-secret
automation_orchestrator_operator_temporal_db_secret_name: temporal-postgres-secret

# --- Ingress ---
# Route (OpenShift) or Ingress (AKS); the operator manages the resource itself.
automation_orchestrator_operator_ingress_type: Route
automation_orchestrator_operator_ingress_host: ""
automation_orchestrator_operator_ingress_annotations: {}
# Only used when ingress_type is Ingress — name of a pre-existing kubernetes.io/tls Secret.
automation_orchestrator_operator_ingress_tls_secret_name: ""

# --- Component workload images (only needed for private registries) ---
automation_orchestrator_operator_image_pull_secrets: []

# --- Per-component overrides (replicas, resources, affinity, tolerations, nodeSelector) ---
# Passed through as-is into the matching spec.<component> block; leave {} for operator defaults.
automation_orchestrator_operator_backend: {}
automation_orchestrator_operator_ui: {}
automation_orchestrator_operator_worker: {}
automation_orchestrator_operator_background_worker: {}
automation_orchestrator_operator_redis: {}
automation_orchestrator_operator_temporal_server: {}

# Escape hatch: recursively merged into the generated spec last, for fields
# (fileStorage, otel, tls, secrets, workflowHttpRequestAllowedHosts, ...) not
# otherwise exposed as dedicated variables above.
automation_orchestrator_operator_extra_spec: {}

# --- Debugging ---
# Set to false to disable no_log and expose secret values in task output.
automation_orchestrator_operator_no_log: true