config.yaml

# Platform Bootstrap Configuration
# DO NOT edit this file directly — copy to config.local.yaml and customize there.
# yaml-language-server: $schema=config.schema.json

# Cluster provider — which approach to use for hub cluster provisioning
# Options: kind-crossplane, byoc
clusterProvider: "kind-crossplane"

# Git repository hosting the gitops platform code
repo:
  url: "https://github.com/<your-org>/<your-repo>.git"
  revision: "main"
  basepath: "gitops/"

# Hub cluster configuration
hub:
  clusterName: "<unique-cluster-name>"       # Must be DNS-compatible, unique per account+region
  kubernetesVersion: "1.37"
  vpcCidr: "10.0.0.0/16"
  autoMode: true                             # EKS Auto Mode — disables OSS LBC, uses built-in ALB
  # Optional: managed node group alongside Auto Mode
  # managedNodeGroup:
  #   enabled: true
  #   instanceTypes: ["m5.large"]
  #   desiredSize: 2
  #   minSize: 1
  #   maxSize: 5
  #   diskSize: 50
  #   capacityType: "ON_DEMAND"
  # Managed EKS Capabilities (KRO / ACK) for this cluster. AWS-managed platform
  # controllers created via provider-aws-eks Capability MRs (wired in the
  # platform-cluster Composition). KRO serves ResourceGraphDefinitions; ACK manages
  # GA AWS resources (iam/s3/…) as Kubernetes CRs. Enabled on the hub by default;
  # set enabled: false (or omit) to opt out. See docs/EKS-Capabilities-KRO-ACK-Setup.md.
  capabilities:
    kro:
      enabled: true
    ack:
      enabled: true

# AWS configuration
aws:
  region: "<aws-region>"                     # e.g. us-west-2
  accountId: "<12-digit-account-id>"         # e.g. 123456789012
  profile: "default"                         # AWS CLI profile (local dev only)

# Domain and networking
# `domain` is the ingress hostname, provisioned by YOU (Route53, CloudFront, etc.).
# The platform never creates it — it only uses it for ingress host rules and URLs.
# It must be known before `task install`, because Keycloak realm URLs, the OIDC issuer
# and every ingress host are derived from it.
domain: "<your-domain>"                      # e.g. idp.example.com

# No registered domain? Reserve a free CloudFront hostname before installing:
#
#   domain=$(scripts/cloudfront-reserve-domain.sh)   # ~1s, no VPC or ALB needed
#   # put that value in `domain` below, and set insecure: true
#   task install
#   scripts/cloudfront-attach-origin.sh              # after install, points CF at the ALB
#
# See docs/platform/cloudfront-exposure.md.

# TLS / exposure:
#   insecure: false (default) — ALB serves HTTPS; uses an ACM cert (auto-discovered
#             by host, or set certificateArn). You bring the domain + cert.
#   insecure: true            — ALB serves plain HTTP; YOU terminate TLS upstream
#             (e.g. CloudFront in front of the ALB). No cert managed by the platform.
#             Also makes the platform ALB `internal`, named <clusterName>-platform.
insecure: false
certificateArn: ""                           # optional ACM ARN for the HTTPS listener (insecure=false)
resourcePrefix: "<prefix>"                   # Used for KRO tenant-facing resources only
ingressName: ""                              # Defaults to {clusterName}-ingress if empty
ingressSecurityGroups: ""

# Platform-wide AWS tags applied to every AWS resource the platform creates:
#   - hub resources (EKS cluster, VPC, NAT, EIP) via CDK Tags.of(stack).add() in
#     platform-engineering-on-eks (Layer 1);
#   - spoke resources (EKS cluster, VPC, NAT, EIP) via the kro EksclusterWithVpc
#     `awsTags` schema field (Layer 2/3), stamped through the hub cluster-secret
#     `platform_tags` annotation.
# Primary use: SpringClean retention (auto-delete=no) so cost/janitor sweepers do
# not reap long-lived workshop infrastructure; also cost-allocation / compliance.
# Values must be strings. Empty/omitted -> no extra tags are applied.
platformTags: {}
  # auto-delete: "no"
  # cost-center: "peeks"

# AWS Identity Center (required for EKS ArgoCD Capability)
identityCenter:
  instanceArn: "<identity-center-instance-arn>"
  region: "<identity-center-region>"         # Often us-east-1
  adminGroupId: "<admin-group-id>"

# EKS ArgoCD Capability
argocdCapability:
  name: "argocd"

# Console admin role name (used by Backstage templates and added as cluster admin if specified)
adminRoleName: "<console-role-name>"       # e.g. WSParticipantRole

# ML model S3 bucket (created by Taskfile if enabled)
modelS3Bucket:
  enabled: false