image:
  registry: docker.io
  repository: wbsong111/kafka-ui
  tag: "v1.3.0"
  pullPolicy: IfNotPresent
yamlApplicationConfig:
  kafka:
    clusters:
    - name: kafka-cluster
      bootstrapServers: SASL_PLAINTEXT://kafka-cluster-kafka-tls-bootstrap.$kafka_cluster_namespace.svc.cluster.local:9093
      properties:
        security.protocol: SASL_PLAINTEXT
        sasl.mechanism: OAUTHBEARER
        sasl.jaas.config: |
          org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required 
          oauth.token.endpoint.uri="$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/protocol/openid-connect/token" 
          oauth.client.id="$KAFKA_CLIENT_ID" 
          oauth.client.secret="$KAFKA_CLIENT_SECRET"
          oauth.ssl.truststore.location="/etc/kafka/secrets/truststore.jks"
          oauth.ssl.truststore.password="kafka";
        sasl.login.callback.handler.class: "io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler"
  auth:
    type: disabled

  management:
    health:
      ldap:
        enabled: false

volumes:
  - name: truststore
    secret:
      secretName: truststore

volumeMounts:
  - name: truststore
    mountPath: /etc/kafka/secrets
    readOnly: true 

ingress:
  enabled: true
  ingressClassName: "apisix"
  annotations:
    cert-manager.io/cluster-issuer: "root-ca-issuer"
    cert-manager.io/duration: 8760h
    cert-manager.io/renew-before: 720h
    kubernetes.io/ingress.class: apisix
    k8s.apisix.apache.org/plugin-config-name: oidc-keycloak-authz
  host: "{{ .Name }}.{{ .Domain }}"
  tls:
    enabled: true
    secretName: "{{ .Name }}-tls-secret"