apiVersion: v1
kind: ConfigMap
metadata:
  name: kuryr-config
  namespace: openshift-kuryr
  annotations:
    networkoperator.openshift.io/kuryr-octavia-provider: {{ .OctaviaProvider }}
    networkoperator.openshift.io/kuryr-octavia-version: {{ .OctaviaVersion }}
data:
  kuryr.conf: |+
    [DEFAULT]
    debug = {{ .DebugEnabled }}

    [binding]
    default_driver = kuryr.lib.binding.drivers.vlan

    [cni_daemon]
    daemon_enabled = true
    docker_mode = true
    netns_proc_dir = /host_proc
    vif_annotation_timeout = 500

    [ingress]
    #l7_router_uuid = <None>

    [kubernetes]
    api_root = ""
    ssl_ca_crt_file = /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    token_file = /var/run/secrets/kubernetes.io/serviceaccount/token
    ssl_verify_server_crt = true
    controller_ha = false
    controller_ha_elector_port = 16401
    watch_retry_timeout = 3600
    pod_vif_driver = nested-vlan
    vif_pool_driver = nested
    multi_vif_drivers = noop

    enabled_handlers = vif,kuryrport,service,endpoints,kuryrloadbalancer,policy,pod_label,namespace,openshift_machine,kuryrnetworkpolicy,kuryrnetwork{{ if .EnablePortPoolsPrepopulation }},kuryrnetwork_population{{ end }}
    pod_security_groups_driver = policy
    service_security_groups_driver = policy
    pod_subnets_driver = namespace
    nodes_subnets_driver = openshift

    endpoints_driver_octavia_provider = {{ default "default" .OctaviaProvider }}

    [pod_vif_nested]
    worker_nodes_subnets = {{ .WorkerNodesSubnets }}

    [octavia_defaults]
    member_mode = {{ default "L3" .OctaviaMemberMode }}
    sg_mode = {{ default "update" .OctaviaSGMode }}
    enforce_sg_rules = {{ .OctaviaSGEnforce }}
    lb_algorithm = {{ .OctaviaLBAlgorithm }}

    [namespace_subnet]
    pod_router = {{ .WorkerNodesRouter }}
    pod_subnet_pool = {{ .PodSubnetpool }}

    {{- $AuthInfo := .OpenStackCloud.AuthInfo }}
    [neutron_defaults]
    service_subnet = {{ .ServiceSubnet }}
    project = {{ default "\"\"" $AuthInfo.ProjectID }}
    pod_security_groups = {{ default "default" .PodSecurityGroups }}
    resource_tags = {{ default "" .ResourceTags }}
    external_svc_net = {{ .ExternalNetwork }}
    network_device_mtu = {{ .NodesNetworkMTU }}

    [neutron]
    auth_type = {{ default "password" .OpenStackCloud.AuthType }}
    auth_url = {{ $AuthInfo.AuthURL }}
    insecure = {{ .OpenStackInsecureAPI }}
    token = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.Token) }}
    password = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.Password) }}
    username = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.Username) }}
    project_domain_name = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.ProjectDomainName) }}
    project_domain_id = {{ default "\"\"" $AuthInfo.ProjectDomainID }}
    project_id = {{ default "\"\"" $AuthInfo.ProjectID }}
    project_name = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.ProjectName) }}
    user_domain_name = {{ default "\"\"" (iniEscapeCharacters $AuthInfo.UserDomainName) }}
    user_domain_id = {{ default "\"\"" $AuthInfo.UserDomainID }}
    region_name = {{ default "\"\"" (iniEscapeCharacters .OpenStackCloud.RegionName) }}
{{- if .UserCACertificate }}
    # There's no good way to just "append" user-provided certs to system ones,
    # so just configure openstacksdk to use it.
    cafile = /etc/ssl/certs/user-ca-bundle.crt
{{- end }}

    [vif_pool]
    ports_pool_max = {{ .PoolMaxPorts }}
    ports_pool_min = {{ .PoolMinPorts }}
    ports_pool_batch = {{ .PoolBatchPorts }}
    ports_pool_update_frequency = 30

    [health_server]
    port = {{ default 8091 .ControllerProbesPort }}

    [cni_health_server]
    port = {{ default 8090 .DaemonProbesPort }}

    [prometheus_exporter]
    controller_exporter_port = 9654
    cni_exporter_port = 9655
