---
# Source: eirini/templates/core/api-configmap.yml
apiVersion: v1
kind: ConfigMap
metadata:
  name: api
  namespace: cf-system
data:
  api.yml: |
    # app_namespace is the namespace used by Eirini to deploy LRPs that do
    # not specify their own namespace in the request.
    app_namespace: cf-workloads

    # serve_plaintext specifies whether the Eirini REST API should be served
    # over plain HTTP or not.
    #
    # When serve_plaintext is false, which is the default, a secret must be
    # provided for the eirini-certs volume in core/api-deployment.yml. This
    # must have entries tls.ca, tls.crt and tls.key, for the TLS certificate
    # authority, certificate and key respectively, used to serve TLS.
    serve_plaintext: true

    # plaintext_port is the port used by Eirini to serve its REST API over
    # plain HTTP.  Required when serve_plaintext is set to true.
    plaintext_port: 8080

    # tls_port is the port used by Eirini to serve its REST API over HTTPS
    # Required when serve_plaintext is set to false or omitted.
    tls_port: 8085

    # cc_tls_disabled specifies wether Eirini should communicate to the Cloud
    # Controller via HTTPS or not. This should be set to false if TLS is
    # handled transparently, e.g. by a service mesh.
    #
    # When cc_tls_disabled is false, which is the default, a secret must be
    # provided for the cc-certs volume in core/api-deployment.yml. This must
    # have entries tls.ca, tls.crt and tls.key, for the TLS certificate
    # authority, client certificate and key respectively, used for mTLS with
    # the Cloud Controller.
    cc_tls_disabled: true

    # application_service_account is name of the service account used by
    # running LRPs and tasks. It must match the service account name in
    # workloads/app-rbac.yml
    application_service_account: eirini

    # registry_secret_name is the name of the secret containing the docker
    # credentials to pull LRP images
    registry_secret_name: app-registry-credentials

    # allow_run_image_as_root will allow containers to run as root when set
    # to true.  As kubernetes does not use user namespaces, this will be the
    # same root user as on the kubernetes node, and so is a security concern.
    # It should be generally left as false.
    allow_run_image_as_root: false

    # unsafe_allow_automount_service_account_token when set to true causes
    # Kubernetes to mount the service account token in the LRP and task
    # containers. This gives the code running there access to the Kubernetes
    # API with the privileges of the application service account.
    #
    # This should generally be left as the default false unless there is a
    # good reason and the implications are understood. It is required when
    # running cf-for-k8s in a kind cluster, for example.
    unsafe_allow_automount_service_account_token: false
