# Set the namespace in which the node will be deployed. Optional, by default the
# Release.Namespace is used
namespace: vantage6-node

node:

  # The name of the node.
  name: node-1

  # The API key of the node.
  apiKey: abcdefghijklmnopqrstuvwxyz1234567890

  # The image to use for the node.
  image: harbor2.vantage6.ai/infrastructure/node:latest
  # Node image pull policy. Possible values are: Always (default), IfNotPresent, Never
  imagePullPolicy: Always

  # The URL, port and API path to the vantage6 server
  server:
    url: http://my-vantage6-server.org
    port: 7601
    path: /server

  # Namespace in which the task kubernetes resources are created. This must be a
  # namespace where the node has access to create pods.
  taskNamespace: vantage6-tasks

  # Kubernetes node name, used for local persistent volumes
  k8sNodeName: docker-desktop

  # Keycloak configuration to authenticate the node with the server.
  keycloakUrl: http://my-vantage6-auth-keycloak.org
  keycloakRealm: vantage6

  encryption:
    # Whether encryption is enabled or not. This should be the same as the `encrypted`
    # setting of the collaboration to which this node belongs.
    enabled: false

    # Location to the private key file. Required if encryption is enabled.
    private_key: /path/to/private_key.pem

  # Whether kubernetes secrets should be created for the node. If set to False, it will
  # be expected that the secrets are already created. By default true.
  createSecrets: true

  # Port for the node proxy to run on
  proxyPort: 7654

  # Storage settings on host of the node machine. This defines where the database is
  # stored as well as the task directory (which will contain the input/output of the
  # tasks).
  persistence:
    tasks:
      storageClass: local-storage
      size: 10Gi
      hostPath: /path/to/where/task/files/are/stored
    database:
      storageClass: local-storage
      size: 5Gi

  # Database settings
  databases:
    # File-based databases - these must be existing local files on the node machine.
    # They will be mounted in the node container.
    fileBased:
    - name: olympic_athletes_db
      uri: /my/local/path/to/data/olympic_athletes_2016.csv
      type: csv
      volumePath: /my/local/path/to/data
      originalName: olympic_athletes_2016.csv
    # Service-based databases - these are databases that are running on the node
    # machine. They will be accessed using the URI.
    serviceBased:
    - name: myPostgres
      uri: postgres://vantage6-postgres:5432/vantage6
      type: other

      # The environment variables set here will be passed to the algorithm containers as
      # DATABASE_<NAME>_<ENV_VAR_NAME>. In this example, the node will set the
      # DATABASE_MYPOSTGRES_USER and DATABASE_MYPOSTGRES_PASSWORD environment variables.
      env:
        USER: vantage6
        PASSWORD: vantage6
      # It is also possible not to specify the details of the service-based databases
      # in this configuration file, but elsewhere in kubernetes (e.g. a parent chart's
      # values.yaml file).
      #
      # In this case, the node expects the following environment variables to be set:
      #
      # DATABASE_LABELS: comma-separated list of database names
      # DATABASE_<NAME>_URI: URI of the database
      # DATABASE_<NAME>_TYPE: type of the database
      #
      # Optionally, you can also specify additional environment variables for each
      # database by setting DATABASE_<NAME>_<ENV_VAR_NAME> variables, for example:
      #
      # DATABASE_<NAME>_MY_ENV_VAR: my_value
      #
      # It is recommended to do this through Kubernetes secrets.

  # Whether or not your node shares some configuration (e.g. which images are
  # allowed to run on your node) with the central server. This can be useful
  # for other organizations in your collaboration to understand why a task
  # is not completed. Obviously, no sensitive data is shared. Default true
  share_config: true

  # Whether or not to share algorithm logs with the server. Otherwise they will
  # only be displayed as part of the node logs. Default is true.
  # NOTE: It's recommented to set this to false when using sensitive data
  share_algorithm_logs: true

  # Define who is allowed to run which algorithms on this node.
  policies:
    # Control which algorithm images are allowed to run on this node. This is
    # expected to be a valid regular expression. It's important to set this policy when
    # using sensitive data to control which algorithms are allowed to run on the node.
    allowed_algorithms:
      - ^harbor2\.vantage6\.ai/[a-zA-Z]+/[a-zA-Z]+
      - ^myalgorithm\.ai/some-algorithm

    # It is also possible to allow all algorithms from a particular algorithm store. Set
    # these stores here. They may be strings or regular expressions. If you don't
    # specify this, algorithms from any store are allowed (unless other policies prevent
    # this).
    allowed_algorithm_stores:
      # allow all algorithms from the vantage6 community store
      - https://store.uluru.vantage6.ai
      # allow any store that is a subdomain of vantage6.ai
      - ^https://[a-z]+\.vantage6\.ai$

    # If you define both `allowed_algorithm_stores` and `allowed_algorithms`, you can
    # choose to only allow algorithms that both policies allow, or you can allow
    # algorithms that either of them allows. By default, this is False: only algorithms
    # that are given in *both* the `allowed_algorithms` and `allowed_algorithm_stores`
    # are allowed.
    allow_either_whitelist_or_store: false

    # Define which users are allowed to run algorithms on your node by their ID
    allowed_users:
      - 2
    # Define which organizations are allowed to run images on your node by
    # their ID or name
    allowed_organizations:
      - 6
      - root

    # Whether or not to always require that the algorithm image is successfully pulled
    # before running it. This ensures that no potentially outdated local images are used
    # if internet connection is not available. Default value is true.
    require_algorithm_pull: true

  # Whitelisting settings to specify external addresses algorithms are allowed to
  # connect to. Only Kubernetes network policies are supported. See:
  # https://kubernetes.io/docs/concepts/services-networking/network-policies
  # Only add egress destinations that are absolutely necessary for your algorithm
  # to function (for example, a required database server). Whitelists are defined
  # per task type. The allowed task types are: data_extraction, preprocessing,
  # federated_compute, central_compute, postprocessing.
  #
  # Each entry in the whitelist defines one allowed connection path. Multiple entries
  # are OR'd together (traffic is allowed if it matches any entry). You can specify:
  # - namespaceSelector: to allow connections to all pods in a namespace or a subset of
  #   pods in a namespace when used in combination with podSelector
  # - podSelector: to allow connections to pods matching labels (make sure that the
  #   namespace of this pod is whitelisted)
  # - ipBlock: to allow connections to IP addresses or CIDR ranges (e.g. a database
  #   server that is not part of the cluster)
  whitelist:
    data_extraction:
      egress:
      # Whitelist the namespace 'frontend' and 'backend'
      - namespaceSelector:
        matchExpressions:
        - key: namespace
          operator: In
          values: ["frontend", "backend"]
      # Whitelist the namespace 'ops' and the pod (within this namespace) with the
      # label 'app: ledger'
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: ops
        podSelector:
          matchLabels:
            app: ledger
    central_compute:
      egress:
        # Whitelist the IP block 10.20.0.0/16
        - ipBlock:
            cidr: 10.20.0.0/16

  # Prometheus settings, for sending system metadata to the server.
  prometheus:
    # Whether or not to enable Prometheus reporting. Default is false.
    enabled: false

    # Interval (in seconds) at which the node sends system metadata to the server.
    # This should align with the Prometheus scrape_interval to avoid stale data.
    report_interval_seconds: 45

  # If your project uses a private Docker registry for algorithm images, you can specify
  # them here so that the node can login and pull private images.
  private_docker_registries:
    - registry: my-private-registry.com
      username: my-username
      password: my-password

  # Logging settings for the node.
  logging:
    # Controls the logging output level. Could be one of the following
    # levels: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET
    level: DEBUG

    # Location to the log file
    file: node.log

    # Size in kb of a single log file
    max_size: 1024
    use_console: true

    # Date format for the log file
    datefmt: "%Y-%m-%d %H:%M:%S"

    # Format for the log file
    format: "%(asctime)s - %(name)-14s - %(levelname)-8s - %(message)s"

    # Storage configuration for logs. Storage size is set to 128M by default,
    # and storage class is k8s storage class that is used for the node.
    storageSize: "128M"
    storageClass: "local-storage"

    # Host path for storing the logs (required for local-storage PV)
    volumeHostPath: "/var/log/vantage6-node"

    # Maximum number of log files to keep. Log files are rotated when the size of the
    # current log file exceeds `max_size`.
    backup_count: 5

    # Loggers to include in the log file
    loggers:
    - level: warning
      name: urllib3
    - level: warning
      name: socketIO-client
    - level: warning
      name: socketio.server
    - level: warning
      name: engineio.server
    - level: warning
      name: sqlalchemy.engine

  # Additional debug flags
  debug:
    # Set to `true` to enable the Flask/socketio into debug mode.
    socketio: false
    # Set to `true` to set the Flask app used for the LOCAL proxy service
    # into debug mode
    proxy_server: false

  # Development settings - these should ONLY be used when running `v6 dev` environment,
  # which will use these settings automatically.
  dev:
    # Set extension for the task directory. In the development environment, the task
    # directory is mounted as a volume and shared by multiple nodes. This extension is
    # added to the task directory to avoid conflicts in storing the task results for
    # this node.
    task_dir_extension: my_node_1
