{
  "cicd_mode": {
    "authentication": {
      "auth_type": "token",
      "ssh_key_storage": "kms",
      "token_config": {
        "expiry_seconds": 3600,
        "refresh_enabled": false,
        "token_format": "jwt",
        "token_path": "/var/run/secrets/provisioning/token"
      }
    },
    "description": "CI/CD pipeline automated execution",
    "extensions": {
      "oci_registry": {
        "auth_token_path": "/var/run/secrets/provisioning/oci-token",
        "cache_dir": "/tmp/provisioning-oci-cache",
        "enabled": true,
        "endpoint": "registry.cicd.local",
        "namespace": "cicd-extensions",
        "tls_enabled": true,
        "verify_ssl": true
      },
      "source": "oci"
    },
    "mode_name": "cicd",
    "resource_limits": {
      "max_cpu_cores_per_user": 16,
      "max_memory_gb_per_user": 64,
      "max_servers_per_user": 5,
      "max_storage_gb_per_user": 200
    },
    "security": {
      "audit_log_path": "/var/log/provisioning/cicd-audit.log",
      "audit_logging": true,
      "dns_modification": "coredns",
      "encryption_at_rest": true,
      "encryption_in_transit": true,
      "network_isolation": true,
      "secret_provider": {
        "provider": "vault"
      }
    },
    "services": {
      "control_center": {
        "deployment": "disabled"
      },
      "coredns": {
        "deployment": "remote",
        "remote_config": {
          "endpoint": "dns.cicd.local",
          "port": 53
        }
      },
      "gitea": {
        "deployment": "remote",
        "remote_config": {
          "endpoint": "git.cicd.local",
          "port": 443,
          "tls_enabled": true
        }
      },
      "oci_registry": {
        "auth_required": true,
        "deployment": "remote",
        "endpoint": "registry.cicd.local",
        "namespaces": {
          "extensions": "cicd-extensions",
          "kcl_packages": "cicd-kcl",
          "platform_images": "cicd-platform",
          "test_images": "cicd-test"
        },
        "remote": {
          "retries": 5,
          "timeout": 60,
          "verify_ssl": true
        },
        "tls_enabled": true,
        "type": "harbor"
      },
      "orchestrator": {
        "deployment": "remote",
        "remote_config": {
          "endpoint": "orchestrator.cicd.local",
          "port": 8080,
          "retries": 5,
          "timeout": 60,
          "tls_enabled": true,
          "verify_ssl": true
        }
      }
    },
    "workspaces": {
      "git_integration": "required",
      "isolation": "strict",
      "locking": "disabled",
      "max_workspaces_per_user": 1
    }
  },
  "enterprise_mode": {
    "authentication": {
      "auth_type": "mtls",
      "mtls_config": {
        "ca_cert_path": "/etc/provisioning/certs/ca.crt",
        "client_cert_path": "/etc/provisioning/certs/client.crt",
        "client_key_path": "/etc/provisioning/certs/client.key",
        "verify_server": true
      },
      "ssh_key_storage": "kms"
    },
    "description": "Production enterprise deployment with full security",
    "extensions": {
      "oci_registry": {
        "auth_token_path": "/etc/provisioning/tokens/oci",
        "cache_dir": "/var/cache/provisioning/oci",
        "enabled": true,
        "endpoint": "harbor.enterprise.local",
        "namespace": "prod-extensions",
        "tls_enabled": true,
        "verify_ssl": true
      },
      "source": "oci"
    },
    "mode_name": "enterprise",
    "resource_limits": {
      "max_cpu_cores_per_user": 64,
      "max_memory_gb_per_user": 256,
      "max_servers_per_user": 20,
      "max_storage_gb_per_user": 1000,
      "max_total_cpu_cores": 2000,
      "max_total_memory_gb": 8192,
      "max_total_servers": 500
    },
    "security": {
      "audit_log_path": "/var/log/provisioning/enterprise-audit.log",
      "audit_logging": true,
      "dns_modification": "system",
      "encryption_at_rest": true,
      "encryption_in_transit": true,
      "network_isolation": true,
      "secret_provider": {
        "provider": "vault"
      }
    },
    "services": {
      "control_center": {
        "deployment": "k8s",
        "k8s_config": {
          "deployment_name": "control-center",
          "image": "harbor.enterprise.local/provisioning/control-center:latest",
          "namespace": "provisioning-system",
          "replicas": 2,
          "service_name": "control-center-svc"
        }
      },
      "coredns": {
        "deployment": "k8s",
        "k8s_config": {
          "deployment_name": "coredns",
          "image": "registry.k8s.io/coredns/coredns:latest",
          "namespace": "kube-system",
          "replicas": 2,
          "service_name": "kube-dns"
        }
      },
      "gitea": {
        "deployment": "k8s",
        "k8s_config": {
          "deployment_name": "gitea",
          "image": "gitea/gitea:latest",
          "namespace": "provisioning-system",
          "replicas": 2,
          "service_name": "gitea-svc"
        }
      },
      "oci_registry": {
        "auth_required": true,
        "deployment": "remote",
        "endpoint": "harbor.enterprise.local",
        "namespaces": {
          "extensions": "prod-extensions",
          "kcl_packages": "prod-kcl",
          "platform_images": "prod-platform",
          "test_images": "test-images"
        },
        "remote": {
          "retries": 5,
          "timeout": 60,
          "verify_ssl": true
        },
        "tls_enabled": true,
        "type": "harbor"
      },
      "orchestrator": {
        "deployment": "k8s",
        "k8s_config": {
          "deployment_name": "orchestrator",
          "image": "harbor.enterprise.local/provisioning/orchestrator:latest",
          "namespace": "provisioning-system",
          "replicas": 3,
          "resources": {
            "cpu_limit": "2000m",
            "cpu_request": "500m",
            "memory_limit": "4Gi",
            "memory_request": "1Gi"
          },
          "service_name": "orchestrator-svc"
        }
      }
    },
    "workspaces": {
      "git_integration": "required",
      "isolation": "strict",
      "lock_provider": "etcd",
      "locking": "required",
      "max_workspaces_per_user": 3
    }
  }
}