Change chart directory structure

2026-01-19 16:11:44 +09:00
parent 0f2284bf35
commit 0436749932
5948 changed files with 119 additions and 79 deletions
@@ -0,0 +1,199 @@
+
+configOverrides: 
+  secret: |
+   SECRET_KEY = '{openssl rand -base64 42 실행 값}'
+  log_level: |
+   LOG_LEVEL = logging.INFO
+  enable_oauth: |
+    from flask_appbuilder.security.manager import (AUTH_DB, AUTH_OAUTH)
+    from superset.security import SupersetSecurityManager
+    from flask import request
+
+    import requests
+    import logging
+
+    class CustomSsoSecurityManager(SupersetSecurityManager):
+        def oauth_user_info(self, provider, response=None):  # noqa: ARG002
+            me = self.appbuilder.sm.oauth_remotes[provider].get("openid-connect/userinfo")
+            me.raise_for_status()
+            data = me.json()
+
+            logging.debug("User info from Keycloak: %s", data)
+
+            # 변수 정의
+            role = []
+            username = data.get("preferred_username", "")
+            host = request.host
+            dip_api_url =  "{dip api url}"    # dip api url 수정 필요 ex) https://dip-api.example.org
+            # URL과 데이터 정의
+            url = f"{dip_api_url}/gwapi/v1/projectusers/{username}"
+            request_data = {"url": f"https://{host}"}
+            response = requests.post(url, json=request_data, headers={"Content-Type": "application/json"}, verify=False)
+
+            # 응답 출력
+            if response.status_code == 200:
+                logging.info(f"API 요청 성공: {response.status_code}, {response.text}")
+                role.append(response.json().get("roleName",""))
+            else:
+                logging.info(f"API 요청 실패: {response.status_code}, {response.text}")
+                role.append("")
+
+            return {
+                "username": data.get("preferred_username", ""),
+                "first_name": data.get("given_name", ""),
+                "last_name": data.get("family_name", ""),
+                "email": data.get("email", ""),
+                "role_keys": role,
+            }
+
+    # OIDC 설정
+    AUTH_TYPE = AUTH_OAUTH
+    AUTH_USER_REGISTRATION = True
+    AUTH_USER_REGISTRATION_ROLE = "Public"  # 매핑되지 않은 사용자는 기본적으로 'Public'으로 설정
+    AUTH_ROLES_SYNC_AT_LOGIN = True
+    CUSTOM_SECURITY_MANAGER = CustomSsoSecurityManager # Custom Security Manager 활성화
+
+    ## OIDC provider 정보 설정
+    OAUTH_PROVIDERS = [
+        {
+            "name": "keycloak",
+            "icon": "fa-key",
+            "token_key": "access_token",
+            "remote_app": {
+                "client_id": "superset",
+                "client_secret": "{keycloak client secret}",
+                "client_kwargs": {
+                  "scope": "openid email profile",
+                  'verify': False
+                },
+                'server_metadata_url': 'https://{keycloak url}/auth/realms/paasup/.well-known/openid-configuration', # keycloak url 수정 필요
+                'api_base_url': 'https://{keycloak url}/auth/realms/paasup/protocol/'  # keycloak url 수정 필요
+            }
+        }
+    ]
+
+    # OIDC 권한 맵핑
+    AUTH_ROLES_MAPPING = {
+    'root': ['Admin'],
+    'admin': ['Admin'],
+    'manager': ['Admin'],
+    'member': ['Alpha'],
+    }
+    
+
+# 접속할 DB에 대한 드라이버를 별도 설치해야함.
+bootstrapScript: |
+  #!/bin/bash
+  pip install sqlalchemy-drill psycopg2-binary Authlib
+
+# superset 공통 사용 이미지
+# 워커, 플라워, 
+image:
+  repository: apachesuperset.docker.scarf.sh/apache/superset
+  tag: ~
+  pullPolicy: IfNotPresent
+resources: {}
+nodeSelector: {}
+tolerations: []
+
+
+ingress:
+  enabled: true
+  annotations: 
+    cert-manager.io/cluster-issuer: "selfsigned-issuer" 
+    cert-manager.io/duration: 8760h  
+    cert-manager.io/renew-before: 720h
+  path: /
+  pathType: ImplementationSpecific
+  hosts:
+  - superset.example.org
+  tls: 
+  -  hosts:
+     - superset.example.org
+     secretName: superset-tls-secret
+  
+
+
+# Superset node configuration
+supersetNode:
+  replicas:
+    enabled: true
+    replicaCount: 1
+
+  connections:
+    # -- Change in case of bringing your own redis and then also set redis.enabled:false
+    redis_host: '{{ .Release.Name }}-redis-headless'
+    redis_port: "6379"
+    redis_user: ""
+    # redis_password: superset
+    redis_cache_db: "1"
+    redis_celery_db: "0"
+    # Or SSL port is usually 6380
+    # Update following for using Redis with SSL
+    redis_ssl:
+      enabled: false
+      ssl_cert_reqs: CERT_NONE
+    # You need to change below configuration incase bringing own PostgresSQL instance and also set postgresql.enabled:false
+    db_host: '{{ .Release.Name }}-postgresql'
+    db_port: "5432"
+    db_user: superset
+    db_pass: superset
+    db_name: superset
+  resources: {}
+
+# Superset Celery worker configuration
+supersetWorker:
+  replicas:
+    enabled: true
+    replicaCount: 1
+  resources: {}
+  
+
+# Superset beat configuration (to trigger scheduled jobs like reports)
+supersetCeleryBeat:
+  enabled: false
+  resources: {}
+
+supersetCeleryFlower:
+  enabled: false
+  replicaCount: 1
+  resources: {}
+
+postgresql:
+  enabled: true
+  auth:
+    username: superset
+    password: superset
+    database: superset
+  image:
+    registry: docker.io
+  primary:
+    resources:
+      limits: {}
+      requests:
+        memory: 256Mi
+        cpu: 250m
+    persistence:
+      enabled: true
+      storageClass: ""
+      size: 8Gi
+
+redis:
+  enabled: true
+  architecture: standalone
+  auth:
+    enabled: false    
+    password: superset
+  image:
+    registry: docker.io
+  master:
+    resources:
+      limits: {}
+      requests: {}
+    persistence:
+      enabled: true
+      storageClass: ""
+      size: 8Gi
+
+
+