agent:
  enabled: false
  podSecurityContext:
    fsGroup: 1001
    runAsNonRoot: true
    runAsUser: 1001
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
aggregator:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: mission-control.datastax.com/role
            operator: In
            values:
            - platform
  enabled: true
  persistence:
    enabled: true
    hostPath:
      enabled: false
    size: **ADMIN_EMAIL**OBSERVABILITY_VECTOR_VOLUME_SIZE**
    storageClassName: **OBSERVABILITY_VECTOR_STORAGE_CLASS**
  podSecurityContext:
    fsGroup: 1001
    runAsNonRoot: true
    runAsUser: 1001
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
    runAsNonRoot: true
allowOperatorsOnDatabaseNodes: false
controlPlane: true
controlPlaneRemon: false
dex:
  config:
    enablePasswordDB: true
    issuer: http://mission-control-dex:5556/dex
    staticPasswords:
    - email: **ADMIN_EMAIL**
      hash: **HASHED_ADMIN_PASSWORD**
      userID: 00000000-0000-0000-0000-000000000000
      username: admin
  image:
    tag: v1.9.0
  podSecurityContext:
    runAsNonRoot: true
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
  volumeMounts:
  - mountPath: /tmp
    name: tmp
  volumes:
  - emptyDir: {}
    name: tmp
disableCertManagerCheck: true
disablePullSecretsGeneration: true
grafana:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: mission-control.datastax.com/role
            operator: In
            values:
            - platform
  enabled: false
image:
  tag: v1.9.0
k8ssandra-operator:
  cass-operator:
    disableCertManagerCheck: true
    nodeSelector:
      mission-control.datastax.com/role: platform
    podSecurityContext:
      runAsNonRoot: true
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
  nodeSelector:
    mission-control.datastax.com/role: platform
  podSecurityContext:
    runAsNonRoot: true
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
kube-state-metrics:
  nodeSelector:
    mission-control.datastax.com/role: platform
kubernetes-ingress:
  controller:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    replicaCount: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
    service:
      annotations: null
      enablePorts:
        http: false
        prometheus: false
        stat: false
      labels: null
      ports:
        http: "8080"
        https: "8443"
        prometheus: "6060"
        stat: "1024"
      type: LoadBalancer
  enabled: false
loki:
  backend:
    affinity: |
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: mission-control.datastax.com/role
                  operator: In
                  values: ["platform"]
    persistence:
      size: 10Gi
      storageClass: ""
      volumeClaimsEnabled: "1"
  enabled: true
  gateway:
    affinity: |
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: mission-control.datastax.com/role
                  operator: In
                  values: ["platform"]
  global:
    clusterDomain: cluster.local
    dnsNamespace: openshift-dns
    dnsService: dns-default
  loki:
    commonConfig:
      replication_factor: 1
    compactor:
      retention_enabled: true
      shared_store: s3
      working_directory: /var/loki/retention
    limits_config:
      ingestion_burst_size_mb: 2000
      ingestion_rate_mb: 1000
      retention_period: **OBSERVABILITY_LOGS_STORAGE_RETENTION**
    rulerConfig:
      storage:
        local:
          directory: /var/loki/rules
        type: local
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
    storage:
      bucketNames:
        chunks: **OBSERVABILITY_LOGS_BUCKET_NAME**
      s3:
        accessKeyId: **OBSERVABILITY_S3_ACCESS_KEY_ID**
        endpoint: s3.**REGION**.amazonaws.com
        http_config:
          insecure_skip_verify: false
        insecure: true
        region: **OBSERVABILITY_S3_REGION**
        s3: s3.**REGION**.amazonaws.com
        s3ForcePathStyle: false
        secretAccessKey: **OBSERVABILITY_S3_SECRET_ACCESS_KEY**
      type: s3
  read:
    affinity: |
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: mission-control.datastax.com/role
                  operator: In
                  values: ["platform"]
    persistence:
      enabled: "1"
      size: 10Gi
      storageClassName: ""
    replicas: 1
  sidecar:
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
  write:
    affinity: |
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: mission-control.datastax.com/role
                  operator: In
                  values: ["platform"]
    persistence:
      size: 10Gi
      storageClass: ""
      volumeClaimsEnabled: "1"
    replicas: 1
mimir:
  alertmanager:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    enabled: true
    extraArgs:
      alertmanager-storage.backend: local
      alertmanager-storage.local.path: /etc/alertmanager/config
      alertmanager.configs.fallback: /etc/alertmanager/config/default.yml
      alertmanager.sharding-ring.replication-factor: "2"
    extraVolumeMounts:
    - mountPath: /etc/alertmanager/config
      name: alertmanager-config
    - mountPath: /alertmanager
      name: alertmanager-config-tmp
    extraVolumes:
    - name: alertmanager-config
      secret:
        secretName: alertmanager-config
    - emptyDir: {}
      name: alertmanager-config-tmp
    persistentVolume:
      accessModes:
      - ReadWriteOnce
      enabled: "1"
      size: **OBSERVABILITY_METRICS_ALERTS_VOLUME_SIZE**
      storageClass: **OBSERVABILITY_METRICS_STORAGE_CLASS**
    replicas: "2"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  compactor:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    extraArgs:
      compactor.blocks-retention-period: **OBSERVABILITY_METRICS_STORAGE_RETENTION**
    persistentVolume:
      accessModes:
      - ReadWriteOnce
      enabled: "1"
      size: **OBSERVABILITY_METRICS_COMPACTOR_VOLUME_SIZE**
      storageClass: **OBSERVABILITY_METRICS_STORAGE_CLASS**
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  distributor:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    extraArgs:
      ingester.ring.replication-factor: "1"
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  enabled: true
  ingester:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    extraArgs:
      ingester.max-global-series-per-user: "0"
      ingester.ring.replication-factor: "1"
    persistentVolume:
      accessModes:
      - ReadWriteOnce
      enabled: "1"
      size: **OBSERVABILITY_METRICS_INGESTER_VOLUME_SIZE**
      storageClass: **OBSERVABILITY_METRICS_STORAGE_CLASS**
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  mimir:
    structuredConfig:
      activity_tracker:
        filepath: /data/activity.log
      blocks_storage:
        backend: s3
        bucket_store:
          sync_dir: /data/tsdb-sync
        s3:
          access_key_id: **OBSERVABILITY_S3_ACCESS_KEY_ID**
          bucket_name: **OBSERVABILITY_BUCKET_NAME**
          endpoint: s3.**REGION**.amazonaws.com
          http:
            insecure_skip_verify: false
          insecure: true
          secret_access_key: **OBSERVABILITY_S3_SECRET_ACCESS_KEY**
        tsdb:
          dir: /data/tsdb
      limits:
        ingestion_burst_size: 100000
        ingestion_rate: 50000
        max_label_names_per_series: 120
        out_of_order_time_window: 5m
  minio:
    buckets:
    - name: mimir-tsdb
      policy: none
      purge: false
    - name: mimir-ruler
      policy: none
      purge: false
    - name: **OBSERVABILITY_LOGS_BUCKET_NAME**
      policy: none
      purge: false
    - name: loki-ruler
      policy: none
      purge: false
    - name: loki-admin
      policy: none
      purge: false
    - name: mc-medusa
      policy: none
      purge: false
    configPathmc: /tmp/minio/mc/
    enabled: false
    mode: standalone
    persistence:
      size: 5Gi
    resources:
      requests:
        cpu: 200m
        memory: 256Mi
    rootPassword: minioadmin
    rootUser: minioadmin
    users:
    - accessKey: mimir-user
      policy: readwrite
      secretKey: mimir-user
  nginx:
    affinity: |
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: mission-control.datastax.com/role
                  operator: In
                  values: ["platform"]
    nginxConfig:
      resolver: dns-default.openshift-dns.svc
  overrides_exporter:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
  querier:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    extraArgs:
      ingester.ring.replication-factor: "1"
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  query_frontend:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  query_scheduler:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  ruler:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    enabled: true
    extraArgs:
      ingester.ring.replication-factor: "1"
      ruler-storage.backend: local
      ruler-storage.local.directory: /etc/rules
      ruler.alertmanager-url: http://mission-control-mimir-alertmanager:8080/alertmanager
      ruler.query-frontend.address: mission-control-mimir-query-frontend:9095
    extraVolumeMounts:
    - mountPath: /etc/rules/anonymous
      name: ruler-config
    extraVolumes:
    - configMap:
        defaultMode: 420
        name: ruler-config
      name: ruler-config
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
  store_gateway:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: mission-control.datastax.com/role
              operator: In
              values:
              - platform
    persistentVolume:
      accessModes:
      - ReadWriteOnce
      enabled: "1"
      size: **OBSERVABILITY_METRICS_STORE_GATEWAY_VOLUME_SIZE**
      storageClass: **OBSERVABILITY_METRICS_STORAGE_CLASS**
    replicas: "1"
    resources:
      limits:
        memory: 2Gi
      requests:
        cpu: 100m
        memory: 128Mi
nodeSelector:
  mission-control.datastax.com/role: platform
podSecurityContext:
  runAsNonRoot: true
replicated:
  enabled: false
  releaseNotes: "## v1.9.0 - 2025-04-14\n\n### RELEASE NOTES\n\n* Previous versions
    of Mission Control would instantiate a default dex user. This behavior has been
    removed. If you previously installed Mission Control with a default user, we recommend
    to change that user's password or delete it entirely.\n  This means the admin
    user password will have to be set upon upgrade by editing the configuration before
    deployment. Preflight checks should fail in case the password is not set.\n* This
    version extends the encryption certificates duration to 20 years to avoid outages
    due to expired certificates. Post upgrade, the following procedure must be applied
    for all clusters to safely rotate the Certificate Authority (CA) and each node's
    certificate in a rolling fashion:\n  1. Find your cluster's superuser name and
    password:\n     ```\n     DBUSER=$(kubectl get secret -n <project namespace> <cluster-name>-superuser
    -o jsonpath='{.data.username}' | base64 --decode | xargs)\n     DBPASS=$(kubectl
    get secret -n <project namespace> <cluster-name>-superuser -o jsonpath='{.data.password}'
    | base64 --decode | xargs)\n     ```\n  2. Reload the truststore in all DSE pods
    to ensure the latest CA is trusted:\n     ```\n     for i in `kubectl get po -l
    app.kubernetes.io/name=cassandra -n <project namespace> | grep sts | awk '{print
    $1}'`; do echo $i; kubectl exec $i -n <project namespace> -c cassandra -- dsetool
    -a $DBUSER -b $DBPASS tsreload server; done\n     ```\n  3. Roll restart the cluster
    by going to the cluster overview screen in the UI, clicking on the \"Bulk Actions\"
    button and selecting \"Restart\". This will ensure all nodes are using refreshed
    certificates with the new CA.\n\n  In the event where nodes wouldn't restart due
    to the presence of already expired certificates, the following procedure can be
    used to force the restart with downtime:\n\n  1. Stop the cluster by setting `.spec.k8ssandra.cassandra.datacenters[*].stopped`
    to `true` (this can be done from the UI by turning the `Stop this DC` toggle on)\n
    \ 2. Wait for all pods to stop\n  3. Trigger the \"Rotate Internode Certificates\"
    bulk action in the UI\n  4. Revert the change from step 1 and wait for the pods
    to be recreated and start up\n\n### CHANGELOG\n\n* [CHANGE] Set cqlsh pod's default
    serviceAccount to match the one used to deploy the target \n* [CHANGE] Upgrade
    the data-api to v1.0.24\n* [CHANGE] Remove the old certificates when merging keystores
    to fix CA rotations.\n* [CHANGE] Upgrade k8ssandra-operator to v1.20.4\n* [CHANGE]
    Update the MissionControlCluster JSON schema to get updated auto completion in
    the UI\n* [CHANGE] Rename yq image references to perNodeConfig image references\n*
    [CHANGE] Use UBI tags for HCD and upgrade all db images to the latest versions\n*
    [CHANGE] Upgrade Gin to v1.10.0 and golang.org/x/net v0.38.0 to fix CVE-2025-22870\n*
    [CHANGE] Override imageConfig values in the values.yaml\n* [CHANGE] Upgrade the
    k8s-sidecar in Loki to v1.30.3\n* [CHANGE] Upgrade Loki's nginx container to v1.27-alpine
    to fix CVEs.\n* [CHANGE] Replace bitnami/kubectl with k8ssandra-client for the
    crdPatcherJob.\n* [CHANGE] Use channel IDs instead of names/slugs for generating
    Replicated releases\n* [ENHANCEMENT] Add rest api endpoint for manually rotating
    out internode leaf certificates.\n* [ENHANCEMENT] Upgrade loki chart to 5.41.4,
    mimir-distributed chart to 5.1.4, Grafana chart to 6.48.0, kube-state-metrics
    chart to 5.30.1, Dex to 2.42.0. Each of these resolves a significant number of
    CVEs.\n* [ENHANCEMENT] Make certificates and CAs Durations configurable through
    CertificateSpec, set the defaults to 20 years\n* [BUGFIX] Fix nodes endpoint so
    that it doesn't present ghost nodes when a rack is not defined at DC level (and
    is instead provided at cluster level).\n* [BUGFIX] Fix Reaper image handling to
    take the input containerImage as the initial input, not an empty image.Image"
  statusInformers:
  - mission-control/deployment/mission-control-cass-operator
  - mission-control/deployment/mission-control-k8ssandra-operator
  - mission-control/deployment/mission-control
  versionLabel: v1.9.0
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  readOnlyRootFilesystem: true
ui:
  baseUrl: ""
  enabled: true
  https:
    enabled: true
  image:
    tag: v1.9.0
