# apps/rancher/values.yaml
# Rancher - Kubernetes Management Platform with Authentik SSO

hostname: rancher.kube.huskypup.net

# Exposed via Istio edge Gateway + VirtualService (apps/rancher/istio-virtualservice.yaml)
ingress:
  enabled: false

# TLS terminates at Istio ingressgateway
tls: external

# Single replica for homelab (scale up if needed)
replicas: 1

# Storage class for Rancher's internal state
# Note: Rancher itself is mostly stateless; state is in etcd/k8s
resources:
  requests:
    cpu: 50m
    memory: 512Mi
  limits:
    # Bumped from 2Gi 2026-08-18: OOMKilled repeatedly while recovering from
    # a network disruption that forced several rapid restarts in a row -
    # each restart's startup reconciliation is memory-hungry, and 2Gi wasn't
    # enough headroom for that burst even though steady-state usage is
    # normally fine. Nodes have ample free memory (26-36% used).
    memory: 3Gi

# Allow Rancher to manage the local cluster
addLocal: "true"

# Audit logging
auditLog:
  level: 1
  maxAge: 7
  maxBackup: 3
  maxSize: 100

# Bootstrap password - will be rotated post-deploy via Authentik SSO
# This is used only for initial access before SSO is configured
bootstrapPassword: "ChangeMe-BootstrapOnly"

# Extra environment variables (not used for OIDC - configured via AuthConfig CRD post-deploy)
extraEnv: []

# Disable Rancher's bundled cert-manager (we already have it)
certmanager:
  version: ""

# Feature flags
features: "multi-cluster-management=true"