# OpenShift overrides for {product} with restricted-v2 SCC
# This configuration enables dynamic UID assignment from the namespace's allocated range

# Top-level operator - remove hard-coded UID
podSecurityContext: null
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
  seccompProfile:
    type: RuntimeDefault

# k8ssandra-operator dependency - restricted-v2 SCC
k8ssandra-operator:
  podSecurityContext: null
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault
    runAsUser: null    # critical - removes hard-coded 65534
    runAsGroup: null   # critical - removes hard-coded 65534
  cass-operator:
    podSecurityContext: null
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: [ALL]
      seccompProfile:
        type: RuntimeDefault
      runAsUser: null  # critical - removes hard-coded 65534
      runAsGroup: null # critical - removes hard-coded 65534

# OpenShift DNS configuration
global:
  clusterDomain: cluster.local
  dnsNamespace: openshift-dns
  dnsService: dns-default

# Dex - required when staticClients are defined
dex:
  config:
    enablePasswordDB: true

# Loki - filesystem mode (no S3 required for dev/test)
loki:
  rbac:
    sccEnabled: true
  podSecurityContext: null
  loki:
    storage:
      type: filesystem
    schemaConfig:
      configs:
        - from: 2025-06-13
          object_store: filesystem
          store: tsdb
          schema: v13
          index:
            period: 24h
            prefix: mc_loki_
  singleBinary:
    replicas: 1
    podSecurityContext: null
  read:
    replicas: 0
  write:
    replicas: 0
  backend:
    replicas: 0
