# Example configuration for kctl-tui.
# Copy this file to ~/.kctl-tui/config.yaml and adjust the values to your
# own AWS/Kubernetes setup. Do NOT commit your real config.yaml with
# company- or project-specific account IDs, contexts, or label names to a
# public repository.

# Top-level grouping the tool starts from (e.g. network boundary such as
# internal/external-facing clusters). This is the outermost navigation
# level; press Esc from the team-selection screen to get here.
contexts:
  - "internal"
  - "external"

# Pre-selected on startup so the tool can jump straight to team selection
# instead of asking for the context every time. Falls back to the first
# entry of 'contexts' if omitted.
default_context: "internal"

# Environments switchable from the control panel (e.g. "1) beta" /
# "2) prod"). The first two entries are also used for the two k9s status
# panes shown side by side.
envs:
  - "beta"
  - "prod"

# AWS region used for all AWS Secrets Manager calls.
aws_region: "eu-central-1"

# AWS account ID, used to fill the {account_id} placeholder below.
# 123456789012 is a placeholder, not a real account.
aws_account_id: "123456789012"

# Builds the AWS Secrets Manager secret ID from the chosen namespace and
# environment. Available placeholders: {namespace}, {env}.
secret_name_template: "tf-{namespace}-{env}-secrets"

# Builds the Kubernetes secret name from the chosen namespace. Kept as a
# separate template from secret_name_template above because the AWS side
# and the Kubernetes side commonly follow different naming conventions
# (e.g. the Kubernetes secret is per-namespace only, without an env
# segment, because each environment already has its own cluster).
# Available placeholders: {namespace}.
k8s_secret_name_template: "{namespace}-common-secrets"

# Builds the ExternalSecret CRD object name to annotate when a force-sync
# is requested. This is often different from the Kubernetes secret name
# because the ExternalSecret CRD and the resulting Secret are separate
# objects (e.g. ExternalSecret "job-apply" produces Secret
# "job-apply-common-secrets"). Falls back to k8s_secret_name_template
# if omitted. Available placeholders: {namespace}.
external_secret_name_template: "{namespace}"

# Builds the actual kubectl context name/ARN from region, account ID, env,
# and context. Available placeholders: {region}, {account_id}, {env},
# {context}. Adjust the literal parts ("tf-", "-1", cluster naming, ARN
# shape) to match how your own EKS clusters/contexts are actually named.
context_template: "arn:aws:eks:{region}:{account_id}:cluster/tf-{env}-{context}-1"

# The namespace label key used to group namespaces by team/ownership in
# the team-selection screen. Adjust this to whatever label your
# organization actually uses (can contain a domain prefix, e.g.
# "example.org/team").
team_label_key: "example.org/team"

# Command used to (re-)authenticate with AWS before the Secrets workflow,
# if 'aws sts get-caller-identity' fails (e.g. an expired AWS SSO session).
# Defaults to "aws sso login" if omitted. Override this if your organization
# wraps SSO login in a custom script or needs a specific --profile, e.g.:
#   aws_sso_login_command: "aws sso login --profile my-profile"
aws_sso_login_command: "aws sso login"

# Check for updates on startup and prompt to update if a newer version is
# available. Set to false to disable. Defaults to true if omitted.
# auto_update_check: true

# Terminal multiplexer backend. "tmux" (default) uses tmux/psmux.
# "wt" uses Windows Terminal's native split-pane — avoids the psmux
# focus-freeze issue on Windows. Only effective on Windows.
# multiplexer: "tmux"