apiVersion: core.openstack.org/v1beta1
kind: OpenStackControlPlane
metadata:
  name: central-control-plane
  namespace: openstack
spec:
  galera:
    enabled: true
    templates:
      openstack:
        logToDisk: false
        replicas: 3
        resources: {}
        secret: osp-secret
        storageClass: lvms-vg1
        storageRequest: 20G
        tls: {}
      openstack-cell1:
        logToDisk: false
        replicas: 3
        resources: {}
        secret: osp-secret
        storageClass: lvms-vg1
        storageRequest: 20G
        tls: {}
  ironic:
    apiOverride: {}
    enabled: false
    inspectorOverride: {}
  manila:
    apiOverride:
      route:
        metadata:
          annotations:
            api.manila.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: manila.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: false
    template:
      serviceUser: manila
      preserveJobs: false
      customServiceConfig: '# add your customization here'
      rabbitMqClusterName: rabbitmq
      apiTimeout: 60
      memcachedInstance: memcached
      dbPurge:
        age: 30
        schedule: 1 0 * * *
      secret: osp-secret
      databaseInstance: openstack
      databaseAccount: manila
      debug:
        dbPurge: false
      manilaAPI:
        customServiceConfig: |
          [DEFAULT]
          storage_availability_zone = alh1
          default_share_type = nfs-multiaz
          debug = true
          enabled_share_protocols = nfs
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 192.168.21.30
              spec:
                type: LoadBalancer
        replicas: 3
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
      manilaScheduler:
        customServiceConfig: '# add your customization here'
        replicas: 3
        resources: {}
      manilaShares:
        netapp-alh1:
          customServiceConfig: |
            [DEFAULT]
            debug = true
            enabled_share_backends = netapp-alh1
            enabled_share_protocols = nfs
            [netapp-alh1]
            netapp_server_hostname = <netapp_ip>
            driver_handles_share_servers = True
            share_backend_name = netapp
            share_driver = manila.share.drivers.netapp.common.NetAppDriver
            netapp_storage_family = ontap_cluster
            backend_availability_zone = alh1
          customServiceConfigSecrets:
            - manila-netapp-alh1
          networkAttachments:
            - storagemgmt
          replicas: 1
          resources: {}
          topologyRef:
            name: zone1-node-affinity
      passwordSelectors:
        service: ManilaPassword
  topologyRef:
    name: spread-pods
  placement:
    apiOverride:
      route:
        metadata:
          annotations:
            api.placement.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: placement.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: placement
      preserveJobs: false
      resources: {}
      customServiceConfig: ''
      apiTimeout: 60
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.30
            spec:
              type: LoadBalancer
      secret: osp-secret
      databaseInstance: openstack
      databaseAccount: placement
      passwordSelectors:
        service: PlacementPassword
      tls:
        api:
          internal: {}
          public: {}
      replicas: 3
  keystone:
    apiOverride:
      route:
        metadata:
          annotations:
            api.keystone.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: keystone.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      preserveJobs: false
      trustFlushSchedule: 1 * * * *
      resources: {}
      customServiceConfig: |-
        [federation]
        trusted_dashboard='https://horizon.es-central-1.compute.ttcp.telefonicatech.com/dashboard/auth/websso/'
        [openid]
        remote_id_attribute=HTTP_OIDC_ISS
        [auth]
        methods = password,token,oauth1,mapped,application_credential,openid
      rabbitMqClusterName: rabbitmq
      apiTimeout: 60
      trustFlushArgs: ''
      adminProject: admin
      extraMounts: []
      enableSecureRBAC: true
      memcachedInstance: memcached
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.30
            spec:
              type: LoadBalancer
      federatedRealmConfig: ''
      secret: osp-secret
      trustFlushSuspend: false
      databaseInstance: openstack
      databaseAccount: keystone
      fernetMaxActiveKeys: 5
      region: es-central-1
      httpdCustomization:
        customConfigSecret: keystone-httpd-override
        processNumber: 3
      passwordSelectors:
        admin: AdminPassword
      adminUser: admin
      tls:
        api:
          internal: {}
          public: {}
      replicas: 3
      fernetRotationDays: 1
  ovn:
    enabled: true
    template:
      ovnController:
        external-ids:
          availability-zones: []
          enable-chassis-as-gateway: true
          ovn-bridge: br-int
          ovn-encap-tos: '0'
          ovn-encap-type: geneve
          system-id: random
        metricsEnabled: true
        metricsTLS: {}
        networkAttachment: tenant
        nicMappings:
          octavia: octbr
        resources: {}
        tls: {}
      ovnDBCluster:
        ovndbcluster-nb:
          logLevel: info
          resources: {}
          electionTimer: 10000
          override: {}
          networkAttachment: internalapi
          storageRequest: 10G
          probeIntervalToActive: 60000
          dbType: NB
          metricsTLS: {}
          tls: {}
          replicas: 3
          inactivityProbe: 60000
          metricsEnabled: true
        ovndbcluster-sb:
          logLevel: info
          resources: {}
          electionTimer: 10000
          override: {}
          networkAttachment: internalapi
          storageRequest: 10G
          probeIntervalToActive: 60000
          dbType: SB
          metricsTLS: {}
          tls: {}
          replicas: 3
          inactivityProbe: 180000
          metricsEnabled: true
      ovnNorthd:
        logLevel: info
        metricsEnabled: true
        metricsTLS: {}
        nThreads: 1
        replicas: 1
        resources: {}
        tls: {}
  dns:
    enabled: true
    template:
      dnsDataLabelSelectorValue: dnsdata
      options:
        - key: server
          values:
            - 172.18.224.22
        - key: server
          values:
            - 172.18.224.17
        - key: local
          values:
            - /openstack.svc/
      override:
        service:
          metadata:
            annotations:
              metallb.universe.tf/address-pool: ctlplane
              metallb.universe.tf/allow-shared-ip: ctlplane
              metallb.universe.tf/loadBalancerIPs: 10.143.32.30
          spec:
            type: LoadBalancer
      replicas: 2
  cinder:
    apiOverride:
      route:
        metadata:
          annotations:
            api.cinder.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: cinder.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: cinder
      preserveJobs: false
      customServiceConfig: |
        [DEFAULT]
        storage_availability_zone = alh1
        [keystone_authtoken]
        region_name = es-central-1
        [barbican]
        barbican_region_name = es-central-1
        [nova]
        region_name = es-central-1
      rabbitMqClusterName: rabbitmq
      apiTimeout: 60
      cinderBackup:
        replicas: 0
        resources: {}
      memcachedInstance: memcached
      dbPurge:
        age: 30
        schedule: 1 0 * * *
      cinderVolumes:
        netapp-fc-alh1-1:
          customServiceConfig: |
            [DEFAULT]
            default_volume_type = default-volume
            glance_api_servers = https://glance-alh1-internal.openstack.svc:9292
            [netapp-fc-alh1-1]
            volume_backend_name=t2c-pro-san3000
            volume_driver=cinder.volume.drivers.netapp.common.NetAppDriver
            netapp_vserver=SVMv2-t2c-cinder-san3000-1
            netapp_server_hostname = SVMv2-t2c-cinder-san3000-1.es-central-1.cc.vdc.adm
            netapp_server_port=443
            netapp_storage_protocol=fc
            netapp_transport_type=https
            netapp_storage_family=ontap_cluster
            max_over_subscription_ratio=3.40
            reserved_percentage=5
            netapp_lun_space_reservation=disabled
            reserved_percentage=80
            filter_function="capabilities.utilization < 80"
            netapp_use_legacy_client=True
            thin_provisioning_support=True
            netapp_mirrored=False
            netapp_flexvol_encryption=False
            netapp:qos_policy_group=rhoso_san3000
            netapp:qos_policy_group_is_adaptive=True
            netapp_is_flexgroup=False
            backend_availability_zone = alh1
          customServiceConfigSecrets:
            - cinder-netapp-fc-alh1-1
          networkAttachments:
            - storagemgmt
          replicas: 1
          resources: {}
          topologyRef:
            name: zone1-node-affinity
      secret: osp-secret
      databaseInstance: openstack
      cinderAPI:
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 192.168.21.30
              spec:
                type: LoadBalancer
        replicas: 3
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
      databaseAccount: cinder
      cinderScheduler:
        customServiceConfig: |
          [DEFAULT]
          scheduler_default_filters=AvailabilityZoneFilter,CapabilitiesFilter,CapacityFilter
        replicas: 1
        resources: {}
      passwordSelectors:
        service: CinderPassword
    uniquePodNames: true
  openstackclient:
    template:
      openStackConfigMap: openstack-config
      openStackConfigSecret: openstack-config-secret
  nova:
    apiOverride:
      route:
        metadata:
          annotations:
            api.nova.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: nova.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    cellOverride:
      cell1:
        noVNCProxy:
          route:
            spec:
              host: nova-console-1.es-central-1.compute.ttcp.telefonicatech.com
              to: {}
          tls:
            secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: nova
      metadataServiceTemplate:
        customServiceConfig: |
          [keystone_authtoken]
          region_name = es-central-1
          [placement]
          region_name = es-central-1
          [glance]
          region_name = es-central-1
          [neutron]
          region_name = es-central-1
          [cinder]
          region_name = es-central-1
          [barbican]
          barbican_region_name = es-central-1
          [oslo_limit]
          endpoint_region_name = es-central-1
        enabled: true
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.30
            spec:
              type: LoadBalancer
        replicas: 3
        resources: {}
        tls: {}
      preserveJobs: false
      apiTimeout: 60
      apiMessageBusInstance: rabbitmq
      apiDatabaseInstance: openstack
      memcachedInstance: memcached
      secret: osp-secret
      schedulerServiceTemplate:
        customServiceConfig: |
          [filter_scheduler]
          enabled_filters = AvailabilityZoneFilter, ComputeFilter, ComputeCapabilitiesFilter, ImagePropertiesFilter, ServerGroupAntiAffinityFilter, ServerGroupAffinityFilter, PciPassthroughFilter, AggregateInstanceExtraSpecsFilter, NUMATopologyFilter
          available_filters = nova.scheduler.filters.all_filters
          [keystone_authtoken]
          region_name = es-central-1
          [placement]
          region_name = es-central-1
          [glance]
          region_name = es-central-1
          [neutron]
          region_name = es-central-1
          [cinder]
          region_name = es-central-1
          [barbican]
          barbican_region_name = es-central-1
          [oslo_limit]
          endpoint_region_name = es-central-1
        replicas: 3
        resources: {}
      apiServiceTemplate:
        customServiceConfig: |
          [keystone_authtoken]
          region_name = es-central-1
          [placement]
          region_name = es-central-1
          [glance]
          region_name = es-central-1
          [neutron]
          region_name = es-central-1
          [cinder]
          region_name = es-central-1
          [barbican]
          barbican_region_name = es-central-1
          [oslo_limit]
          endpoint_region_name = es-central-1
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 192.168.21.30
              spec:
                type: LoadBalancer
        replicas: 3
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
      cellTemplates:
        cell0:
          metadataServiceTemplate:
            customServiceConfig: ''
            enabled: false
            override: {}
            replicas: 1
            resources: {}
            tls: {}
          hasAPIAccess: true
          conductorServiceTemplate:
            customServiceConfig: |
              [keystone_authtoken]
              region_name = es-central-1
              [placement]
              region_name = es-central-1
              [glance]
              region_name = es-central-1
              [neutron]
              region_name = es-central-1
              [cinder]
              region_name = es-central-1
              [barbican]
              barbican_region_name = es-central-1
              [oslo_limit]
              endpoint_region_name = es-central-1
            replicas: 1
            resources: {}
          noVNCProxyServiceTemplate:
            customServiceConfig: ''
            enabled: false
            override: {}
            replicas: 1
            resources: {}
            tls:
              service: {}
              vencrypt: {}
          memcachedInstance: ''
          dbPurge:
            archiveAge: 30
            purgeAge: 90
            schedule: 0 0 * * *
          cellMessageBusInstance: rabbitmq
          cellDatabaseAccount: nova-cell0
          cellDatabaseInstance: openstack
        cell1:
          metadataServiceTemplate:
            customServiceConfig: ''
            enabled: false
            override: {}
            replicas: 1
            resources: {}
            tls: {}
          hasAPIAccess: true
          conductorServiceTemplate:
            customServiceConfig: |
              [keystone_authtoken]
              region_name = es-central-1
              [placement]
              region_name = es-central-1
              [glance]
              region_name = es-central-1
              [neutron]
              region_name = es-central-1
              [cinder]
              region_name = es-central-1
              [barbican]
              barbican_region_name = es-central-1
              [oslo_limit]
              endpoint_region_name = es-central-1
            replicas: 1
            resources: {}
          noVNCProxyServiceTemplate:
            customServiceConfig: ''
            enabled: true
            networkAttachments:
              - internalapi
              - ctlplane
            override: {}
            replicas: 1
            resources: {}
            tls:
              service: {}
              vencrypt: {}
          memcachedInstance: ''
          dbPurge:
            archiveAge: 30
            purgeAge: 90
            schedule: 0 0 * * *
          cellMessageBusInstance: rabbitmq-cell1
          cellDatabaseAccount: nova-cell1
          cellDatabaseInstance: openstack-cell1
      apiDatabaseAccount: nova-api
      passwordSelectors:
        metadataSecret: MetadataSecret
        prefixMetadataCellsSecret: MetadataCellsSecret
        service: NovaPassword
      keystoneInstance: keystone
  octavia:
    apiOverride:
      route:
        metadata:
          annotations:
            api.octavia.openstack.org/timeout: 120s
            haproxy.router.openshift.io/timeout: 120s
        spec:
          host: octavia.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: octavia
      preserveJobs: false
      octaviaNetworkAttachment: octavia
      octaviaHealthManager:
        serviceUser: octavia
        networkAttachments:
          - octavia
        lbSecurityGroupID: ''
        resources: {}
        customServiceConfig: |
          [keystone_authtoken]
          region_name=es-central-1
          [service_auth]
          region_name=es-central-1
          [nova]
          region_name=es-central-1
          [cinder]
          region_name=es-central-1
          [glance]
          region_name=es-central-1
          [neutron]
          region_name=es-central-1
        octaviaProviderSubnetGateway: ''
        amphoraCustomFlavors: []
        amphoraImageOwnerID: ''
        octaviaProviderSubnetCIDR: ''
        secret: ''
        redisHosts: []
        databaseInstance: ''
        databaseAccount: octavia
        lbMgmtNetworkID: ''
        persistenceDatabaseAccount: octavia-persistence
        tenantName: service
        role: ''
        serviceAccount: ''
        passwordSelectors:
          database: OctaviaDatabasePassword
          service: OctaviaPassword
        tenantDomainName: Default
        tls: {}
      resources: {}
      redisServiceName: octavia-redis
      customServiceConfig: |
        [keystone_authtoken]
        region_name=es-central-1
        [service_auth]
        region_name=es-central-1
        [nova]
        region_name=es-central-1
        [cinder]
        region_name=es-central-1
        [glance]
        region_name=es-central-1
        [neutron]
        region_name=es-central-1
      rabbitMqClusterName: rabbitmq
      apiTimeout: 120
      apacheContainerImage: ''
      octaviaHousekeeping:
        serviceUser: octavia
        networkAttachments:
          - octavia
        lbSecurityGroupID: ''
        resources: {}
        customServiceConfig: |
          [keystone_authtoken]
          region_name=es-central-1
          [service_auth]
          region_name=es-central-1
          [nova]
          region_name=es-central-1
          [cinder]
          region_name=es-central-1
          [glance]
          region_name=es-central-1
          [neutron]
          region_name=es-central-1
        octaviaProviderSubnetGateway: ''
        amphoraCustomFlavors: []
        amphoraImageOwnerID: ''
        octaviaProviderSubnetCIDR: ''
        secret: ''
        redisHosts: []
        databaseInstance: ''
        databaseAccount: octavia
        lbMgmtNetworkID: ''
        persistenceDatabaseAccount: octavia-persistence
        tenantName: service
        role: ''
        serviceAccount: ''
        passwordSelectors:
          database: OctaviaDatabasePassword
          service: OctaviaPassword
        tenantDomainName: Default
        tls: {}
      amphoraCustomFlavors: []
      sshPubkey: octavia-ssh-pubkey
      octaviaWorker:
        serviceUser: octavia
        networkAttachments:
          - octavia
        lbSecurityGroupID: ''
        resources: {}
        customServiceConfig: |
          [keystone_authtoken]
          region_name=es-central-1
          [service_auth]
          region_name=es-central-1
          [nova]
          region_name=es-central-1
          [cinder]
          region_name=es-central-1
          [glance]
          region_name=es-central-1
          [neutron]
          region_name=es-central-1
        octaviaProviderSubnetGateway: ''
        amphoraCustomFlavors: []
        amphoraImageOwnerID: ''
        octaviaProviderSubnetCIDR: ''
        secret: ''
        redisHosts: []
        databaseInstance: ''
        databaseAccount: octavia
        lbMgmtNetworkID: ''
        persistenceDatabaseAccount: octavia-persistence
        tenantName: service
        role: ''
        serviceAccount: ''
        passwordSelectors:
          database: OctaviaDatabasePassword
          service: OctaviaPassword
        tenantDomainName: Default
        tls: {}
      octaviaAPI:
        serviceUser: octavia
        preserveJobs: false
        resources: {}
        customServiceConfig: |
          [keystone_authtoken]
          region_name=es-central-1
          [service_auth]
          region_name=es-central-1
          [nova]
          region_name=es-central-1
          [cinder]
          region_name=es-central-1
          [glance]
          region_name=es-central-1
          [neutron]
          region_name=es-central-1
        apiTimeout: 0
        override: {}
        secret: ''
        databaseInstance: ''
        databaseAccount: octavia
        persistenceDatabaseAccount: octavia-persistence
        tenantName: service
        serviceAccount: ''
        passwordSelectors:
          database: OctaviaDatabasePassword
          service: OctaviaPassword
        tenantDomainName: Default
        tls:
          api:
            internal: {}
            public: {}
          ovn: {}
        replicas: 1
      secret: ''
      databaseInstance: ''
      databaseAccount: octavia
      persistenceDatabaseAccount: octavia-persistence
      tenantName: service
      lbMgmtNetwork:
        createDefaultLbMgmtNetwork: true
        manageLbMgmtNetworks: true
      sshPrivkeySecret: octavia-ssh-privkey-secret
      passwordSelectors:
        database: OctaviaDatabasePassword
        service: OctaviaPassword
      tenantDomainName: Default
      amphoraImageContainerImage: 'registry.redhat.io/rhoso/octavia-amphora-image-rhel9:18.0.12'
      octaviaRsyslog:
        networkAttachments:
          - octavia
        octaviaProviderSubnetCIDR: ''
        octaviaProviderSubnetGateway: ''
        resources: {}
        serviceAccount: ''
        serviceUser: ''
  heat:
    apiOverride:
      route:
        metadata:
          annotations:
            api.heat.openstack.org/timeout: 600s
            haproxy.router.openshift.io/timeout: 600s
        spec:
          host: heat.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    cnfAPIOverride:
      route:
        metadata:
          annotations:
            api.heat.openstack.org/timeout: 600s
            haproxy.router.openshift.io/timeout: 600s
        spec:
          host: heat-cfn.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: heat
      preserveJobs: false
      customServiceConfig: |
        [DEFAULT]
        region_name_for_services=es-central-1
        [keystone_authtoken]
        region_name=es-central-1
      rabbitMqClusterName: rabbitmq
      apiTimeout: 600
      heatAPI:
        customServiceConfig: |
          [DEFAULT]
          region_name_for_services=es-central-1
          [keystone_authtoken]
          region_name=es-central-1
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 192.168.21.30
              spec:
                type: LoadBalancer
        replicas: 3
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
      memcachedInstance: memcached
      secret: osp-secret
      databaseInstance: openstack
      databaseAccount: heat
      heatEngine:
        customServiceConfig: |
          [DEFAULT]
          region_name_for_services=es-central-1
          [keystone_authtoken]
          region_name=es-central-1
        replicas: 3
        resources: {}
      passwordSelectors:
        authEncryptionKey: HeatAuthEncryptionKey
        service: HeatPassword
        stackDomainAdminPassword: HeatStackDomainAdminPassword
      heatCfnAPI:
        customServiceConfig: |
          [DEFAULT]
          region_name_for_services=es-central-1
          [keystone_authtoken]
          region_name=es-central-1
        override: {}
        replicas: 1
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
  secret: osp-secret
  swift:
    enabled: false
    proxyOverride: {}
  designate:
    apiOverride: {}
    enabled: false
  glance:
    apiOverrides:
      alh1:
        route:
          metadata:
            annotations:
              api.glance.openstack.org/timeout: 60s
              haproxy.router.openshift.io/timeout: 60s
      default:
        route:
          metadata:
            annotations:
              api.glance.openstack.org/timeout: 60s
              haproxy.router.openshift.io/timeout: 60s
          spec:
            host: glance.es-central-1.compute.ttcp.telefonicatech.com
            to: {}
        tls:
          secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: glance
      preserveJobs: false
      customServiceConfig: |
        [keystone_authtoken]
        region_name = es-central-1
        [barbican]
        barbican_region_name = es-central-1
        [oslo_limit]
        endpoint_region_name = es-central-1
      apiTimeout: 60
      imageCache:
        cleanerScheduler: ''
        prunerScheduler: ''
        size: ''
      memcachedInstance: memcached
      dbPurge:
        age: 30
        schedule: 1 0 * * *
      glanceAPIs:
        alh1:
          networkAttachments:
            - storagemgmt
          topologyRef:
            name: zone1-node-affinity
          resources: {}
          customServiceConfig: |
            [DEFAULT]
            enabled_import_methods = [web-download,copy-image,glance-direct]
            enabled_backends = alh1:cinder
            [glance_store]
            default_backend = alh1
            [alh1]
            description = alh1 cinder backend
            cinder_catalog_info = volumev3::internalURL
            cinder_use_multipath = true
            cinder_volume_type = glance-alh1
            cinder_store_project_name = service
            cinder_store_auth_address = {{ .KeystoneInternalURL }}
            cinder_store_user_name = {{ .ServiceUser }}
            cinder_store_password = {{ .ServicePassword }}
            cinder_os_region_name = es-central-1
            [oslo_concurrency]
            lock_path = /var/lib/glance/tmp
            [keystone_authtoken]
            region_name = es-central-1
            [barbican]
            barbican_region_name = es-central-1
            [oslo_limit]
            endpoint_region_name = es-central-1
          apiTimeout: 60
          imageCache:
            cleanerScheduler: '*/30 * * * *'
            prunerScheduler: 1 0 * * *
            size: ''
          override:
            service:
              internal:
                metadata:
                  annotations:
                    metallb.universe.tf/address-pool: internalapi
                    metallb.universe.tf/allow-shared-ip: internalapi
                    metallb.universe.tf/loadBalancerIPs: 192.168.21.32
                  labels:
                    osctlplane: ''
                    osctlplane-service: glance-40c64
                    tlGlanceAPI: glance-40c64-alh1-split
                spec:
                  type: LoadBalancer
              public:
                metadata:
                  labels:
                    osctlplane: ''
                    osctlplane-service: glance-40c64
                    tlGlanceAPI: glance-40c64-alh1-split
          containerImage: 'registry.redhat.io/rhoso/openstack-glance-api-rhel9@sha256:e03a89353743c242d647e7a30abfa7ae23354660c2cda93d4b6454f4f2f6aee0'
          type: split
          tls:
            api:
              internal:
                secretName: cert-glance-alh1-internal-svc
              public:
                secretName: cert-glance-alh1-public-svc
            caBundleSecretName: combined-ca-bundle
          storage: {}
          replicas: 2
        default:
          networkAttachments:
            - storagemgmt
          resources: {}
          customServiceConfig: |
            [DEFAULT]
            enabled_backends = alh1:cinder
            [glance_store]
            default_backend = alh1
            [alh1]
            description = alh1 cinder backend
            cinder_catalog_info = volumev3::internalURL
            cinder_use_multipath = true
            cinder_volume_type = glance-alh1
            cinder_store_project_name = service
            cinder_store_auth_address = {{ .KeystoneInternalURL }}
            cinder_store_user_name = {{ .ServiceUser }}
            cinder_store_password = {{ .ServicePassword }}
            cinder_os_region_name = es-central-1
            [oslo_concurrency]
            lock_path = /var/lib/glance/tmp
            [keystone_authtoken]
            region_name = es-central-1
            [barbican]
            barbican_region_name = es-central-1
            [oslo_limit]
            endpoint_region_name = es-central-1
          apiTimeout: 60
          imageCache:
            cleanerScheduler: '*/30 * * * *'
            prunerScheduler: 1 0 * * *
            size: ''
          override:
            service:
              internal:
                metadata:
                  annotations:
                    metallb.universe.tf/address-pool: internalapi
                    metallb.universe.tf/allow-shared-ip: internalapi
                    metallb.universe.tf/loadBalancerIPs: 192.168.21.30
                spec:
                  type: LoadBalancer
          containerImage: 'registry.redhat.io/rhoso/openstack-glance-api-rhel9@sha256:e03a89353743c242d647e7a30abfa7ae23354660c2cda93d4b6454f4f2f6aee0'
          type: split
          tls:
            api:
              internal: {}
              public: {}
          storage: {}
          replicas: 3
      secret: ''
      databaseInstance: openstack
      databaseAccount: glance
      passwordSelectors:
        service: GlancePassword
      quotas:
        imageCountTotal: 0
        imageCountUpload: 0
        imageSizeTotal: 0
        imageStageTotal: 0
      keystoneEndpoint: default
      storage:
        storageRequest: 10G
    uniquePodNames: true
  barbican:
    apiOverride:
      route:
        metadata:
          annotations:
            api.barbican.openstack.org/timeout: 90s
            haproxy.router.openshift.io/timeout: 90s
        spec:
          host: barbican.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: barbican
      preserveJobs: false
      barbicanAPI:
        apiTimeout: 0
        enableSecureRBAC: true
        override:
          service:
            internal:
              metadata:
                annotations:
                  metallb.universe.tf/address-pool: internalapi
                  metallb.universe.tf/allow-shared-ip: internalapi
                  metallb.universe.tf/loadBalancerIPs: 192.168.21.30
              spec:
                type: LoadBalancer
        replicas: 3
        resources: {}
        tls:
          api:
            internal: {}
            public: {}
      rabbitMqClusterName: rabbitmq
      apiTimeout: 90
      barbicanKeystoneListener:
        replicas: 1
        resources: {}
      secret: osp-secret
      databaseInstance: openstack
      simpleCryptoBackendSecret: osp-secret
      databaseAccount: barbican
      globalDefaultSecretStore: simple_crypto
      barbicanWorker:
        replicas: 3
        resources: {}
      serviceAccount: ''
      passwordSelectors:
        pkcs11pin: PKCS11Pin
        service: BarbicanPassword
        simplecryptokek: BarbicanSimpleCryptoKEK
  memcached:
    enabled: true
    templates:
      memcached:
        cacheSize: 9932
        maxConn: 8192
        replicas: 3
        resources: {}
        tls:
          mtls:
            authCertSecret: {}
  telemetry:
    alertmanagerOverride: {}
    aodhApiOverride:
      route:
        metadata:
          annotations:
            api.aodh.openstack.org/timeout: 60s
            haproxy.router.openshift.io/timeout: 60s
        spec:
          host: aodh.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    prometheusOverride: {}
    template:
      autoscaling:
        aodh:
          serviceUser: aodh
          preserveJobs: false
          customServiceConfig: '# add your customization here'
          rabbitMqClusterName: rabbitmq
          apiTimeout: 60
          memcachedInstance: memcached
          override: {}
          secret: osp-secret
          databaseInstance: openstack
          databaseAccount: aodh
          passwordSelector:
            aodhService: AodhPassword
            ceilometerService: CeilometerPassword
          tls:
            api:
              internal: {}
              public: {}
        enabled: true
        heatInstance: heat
      ceilometer:
        serviceUser: ceilometer
        enabled: true
        mysqldExporterDatabaseAccountPrefix: mysqld-exporter
        customServiceConfig: '# add your customization here'
        rabbitMqClusterName: rabbitmq
        apiTimeout: 60
        secret: osp-secret
        ksmTls: {}
        mysqldExporterTLS: {}
        passwordSelector:
          aodhService: AodhPassword
          ceilometerService: CeilometerPassword
        tls: {}
        ksmEnabled: true
      logging:
        annotations:
          metallb.universe.tf/address-pool: internalapi
          metallb.universe.tf/allow-shared-ip: internalapi
          metallb.universe.tf/loadBalancerIPs: 192.168.21.30
        cloNamespace: openshift-logging
        enabled: true
        port: 10514
        rsyslogQueueSize: 10000
        rsyslogQueueType: linkedList
        rsyslogRetries: 100
        targetPort: 10514
      metricStorage:
        dashboardsEnabled: true
        dataplaneNetwork: ctlplane
        enabled: true
        monitoringStack:
          alertingEnabled: true
          scrapeInterval: 30s
          storage:
            persistent:
              pvcStorageRequest: 20G
              pvcStorageSelector: {}
            retention: 24h
            strategy: persistent
        prometheusTls: {}
  tls:
    caBundleSecretName: cacerts
    ingress:
      ca:
        duration: 87600h0m0s
      cert:
        duration: 43800h0m0s
      enabled: true
    podLevel:
      enabled: true
      internal:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      libvirt:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
      ovn:
        ca:
          duration: 87600h0m0s
        cert:
          duration: 43800h0m0s
  redis:
    enabled: false
  horizon:
    apiOverride:
      route:
        spec:
          host: horizon.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      preserveJobs: false
      resources: {}
      customServiceConfig: |-
        HORIZON_IMAGES_UPLOAD_MODE = 'legacy'
        WEBSSO_DEFAULT_REDIRECT_REGION = 'https://keystone.es-central-1.compute.ttcp.telefonicatech.com/v3'
        WEBSSO_DEFAULT_REDIRECT_PROTOCOL = "openid"
        WEBSSO_DEFAULT_REDIRECT = False # Change when Telefonica tells
        OPENSTACK_ENDPOINT_TYPE = "publicURL"
        OPENSTACK_KEYSTONE_URL='https://keystone.es-central-1.compute.ttcp.telefonicatech.com/v3'
        WEBSSO_DEFAULT_REDIRECT_LOGOUT = "https://sts.vdc.telefonica.com/adfs/oauth2/logout"
        WEBSSO_ENABLED = False # Change when Telefonica tells
        WEBSSO_CHOICES = (
          ("credentials", _("Keystone Credentials")),
          ("OIDC", _("Telefonica Tech Cloud Platform Credentials")),
        )
        WEBSSO_INITIAL_CHOICE = "OIDC"
        WEBSSO_IDP_MAPPING = {
          "OIDC": ("tef-adfs", "openid"),
        }
      extraMounts:
        - extraVol:
            - extraVolType: HorizonTheme
              mounts:
                - mountPath: /etc/openstack-dashboard/theme/t2c.tar.gz
                  name: horizon-theme
                  readOnly: true
                  subPath: t2c.tar.gz
                - mountPath: /etc/openstack-dashboard/local_settings.d/_12_t2c_theme.py
                  name: horizon-theme
                  readOnly: true
                  subPath: _12_t2c_theme.py
              volumes:
                - configMap:
                    name: horizon-theme
                  name: horizon-theme
      memcachedInstance: memcached
      override: {}
      secret: osp-secret
      tls: {}
      replicas: 3
  neutron:
    apiOverride:
      route:
        metadata:
          annotations:
            api.neutron.openstack.org/timeout: 120s
            haproxy.router.openshift.io/timeout: 120s
        spec:
          host: neutron.es-central-1.compute.ttcp.telefonicatech.com
          to: {}
      tls:
        secretName: rhoso-ingress-certs
    enabled: true
    template:
      serviceUser: neutron
      networkAttachments:
        - internalapi
      preserveJobs: false
      ml2MechanismDrivers:
        - ovn
      resources: {}
      customServiceConfig: |
        [default]
        global_physnet_mtu = 9000
        service_plugins=qos,ovn-router,trunk,segments,port_forwarding,log
        [ml2]
        mechanism_drivers = ovn,sriovnicswitch
        extension_drivers=qos,port_security,dns_domain_ports
        [ovn]
        vhost_sock_dir = /var/lib/vhost_sockets
        ovsdb_probe_interval = 180000
        agent_down_time = 2147483
        [ml2_type_vlan]
        network_vlan_ranges = datacentre-alh1:200:4000
        [keystone_authtoken]
        region_name = es-central-1
        [nova]
        region_name = es-central-1
        [placement]
        region_name = es-central-1
      rabbitMqClusterName: rabbitmq
      apiTimeout: 120
      memcachedInstance: memcached
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.30
            spec:
              type: LoadBalancer
      secret: osp-secret
      databaseInstance: openstack
      databaseAccount: neutron
      corePlugin: ml2
      passwordSelectors:
        service: NeutronPassword
      tls:
        api:
          internal: {}
          public: {}
        ovn: {}
      replicas: 1
  watcher:
    apiOverride: {}
    enabled: false
  storageClass: netapp-storage-class
  rabbitmq:
    enabled: true
    templates:
      rabbitmq:
        delayStartSeconds: 30
        secretBackend:
          externalSecret:
            name: ''
        resources:
          limits:
            cpu: '2'
            memory: 2Gi
          requests:
            cpu: '1'
            memory: 2Gi
        terminationGracePeriodSeconds: 604800
        queueType: Mirrored
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.35
            spec:
              type: LoadBalancer
        service:
          type: ClusterIP
        tls: {}
        replicas: 3
        rabbitmq: {}
        persistence:
          storage: 10Gi
      rabbitmq-cell1:
        delayStartSeconds: 30
        secretBackend:
          externalSecret:
            name: ''
        resources:
          limits:
            cpu: '8'
            memory: 20Gi
          requests:
            cpu: '8'
            memory: 20Gi
        terminationGracePeriodSeconds: 604800
        queueType: Mirrored
        override:
          service:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/loadBalancerIPs: 192.168.21.36
            spec:
              type: LoadBalancer
        service:
          type: ClusterIP
        tls: {}
        replicas: 3
        rabbitmq: {}
        persistence:
          storage: 20Gi
