Add unity catalog chart

2025-05-22 16:29:01 +09:00
parent 116b20e7c7
commit 30571ad5e2
78 changed files with 9188 additions and 0 deletions
@@ -0,0 +1,114 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "unitycatalog.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "unitycatalog.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "unitycatalog.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "unitycatalog.commonLabels" -}}
+helm.sh/chart: {{ include "unitycatalog.chart" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "unitycatalog.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "unitycatalog.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Server definitions
+*/}}
+
+{{/*
+Server labels
+*/}}
+{{- define "unitycatalog.server.labels" -}}
+{{ include "unitycatalog.commonLabels" . }}
+{{ include "unitycatalog.server.selectorLabels" . }}
+{{- end }}
+
+{{/*
+Server selector labels
+*/}}
+{{- define "unitycatalog.server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "unitycatalog.name" . }}-server
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Server full name
+*/}}
+{{- define "unitycatalog.server.fullname" -}}
+{{- include "unitycatalog.fullname" . }}-server
+{{- end }}
+
+{{/*
+Server API endpoint
+*/}}
+{{- define "unitycatalog.server.apiEndpoint" -}}
+http://{{ include "unitycatalog.server.fullname" . }}:{{ .Values.server.service.port }}
+{{- end }}
+
+{{/*
+UI definitions
+*/}}
+
+{{/*
+UI labels
+*/}}
+{{- define "unitycatalog.ui.labels" -}}
+{{ include "unitycatalog.commonLabels" . }}
+{{ include "unitycatalog.ui.selectorLabels" . }}
+{{- end }}
+
+{{/*
+UI selector labels
+*/}}
+{{- define "unitycatalog.ui.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "unitycatalog.name" . }}-ui
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+UI full name
+*/}}
+{{- define "unitycatalog.ui.fullname" -}}
+{{- include "unitycatalog.fullname" . }}-ui
+{{- end }}
@@ -0,0 +1,61 @@
+{{- if .Values.server.ingress.enabled -}}
+{{- $fullName := include "unitycatalog.server.fullname" . -}}
+{{- $svcPort := .Values.server.service.port -}}
+{{- if and .Values.server.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.server.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.server.ingress.annotations "kubernetes.io/ingress.class" .Values.server.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "unitycatalog.server.labels" . | nindent 4 }}
+  {{- with .Values.server.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.server.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.server.ingress.className }}
+  {{- end }}
+  {{- if .Values.server.ingress.tls }}
+  tls:
+    {{- range .Values.server.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.server.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
@@ -0,0 +1,41 @@
+{{- define "unitycatalog.server.configTemplate" -}}
+server.env=prod
+{{ if .Values.auth.enabled }}
+server.authorization=enable
+server.authorization-url={{ .Values.auth.authorizationUrl }}
+server.token-url={{ .Values.auth.tokenUrl }}
+server.client-id=${OAUTH_CLIENT_ID}
+server.client-secret=${OAUTH_CLIENT_SECRET}
+server.redirect-port={{ .Values.auth.redirectPort }}
+server.cookie-timeout={{ .Values.auth.cookieTimeout }}
+{{ end }}
+
+storage-root.models={{ .Values.storage.modelStorageRoot | default "file:/tmp/ucroot" }}
+
+{{ range $index, $config := .Values.storage.credentials.s3 }}
+s3.bucketPath.{{ $index }}={{ $config.bucketPath }}
+s3.region.{{ $index }}={{ $config.region }}
+s3.awsRoleArn.{{ $index }}={{ $config.awsRoleArn }}
+s3.accessKey.{{ $index }}=${S3_ACCESS_KEY_{{ $index }}}
+s3.secretKey.{{ $index }}=${S3_SECRET_KEY_{{ $index }}}
+s3.serviceEndpoint.{{ $index }}={{$config.serviceEndpoint}}
+{{ end }}
+
+{{ range $index, $config := .Values.storage.credentials.adls }}
+adls.storageAccountName.{{ $index }}={{ $config.storageAccountName }}
+adls.tenantId.{{ $index }}=${ADLS_TENANT_ID_{{ $index }}}
+adls.clientId.{{ $index }}=${ADLS_CLIENT_ID_{{ $index }}}
+adls.clientSecret.{{ $index }}=${ADLS_CLIENT_SECRET_{{ $index }}}
+{{ end }}
+
+{{ range $index, $config := .Values.storage.credentials.gcs }}
+gcs.bucketPath.{{ $index }}={{ $config.bucketPath }}
+gcs.jsonKeyFilePath.{{ $index }}=/etc/conf/gcs-credentials-{{ $index }}.json
+{{ end }}
+
+{{ range $k, $v := .Values.server.config.extraProperties }}
+{{ $k }}={{ $v }}
+{{ end }}
+
+
+{{- end }}
@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "unitycatalog.server.fullname" . }}-config-templates
+  labels:
+    {{- include "unitycatalog.server.labels" . | nindent 4 }}
+data:
+  server.log4j2.properties.template: |-
+    status=warn
+    appenders=console
+
+    appender.console.type=Console
+    appender.console.name=Console
+    appender.console.layout.type=PatternLayout
+    appender.console.layout.pattern=%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n
+
+    rootLogger.level={{ .Values.server.config.logLevel | upper }}
+    rootLogger.appenderRefs=console
+    rootLogger.appenderRef.console.ref=Console
+  server.properties.template: |-
+    {{- include "unitycatalog.server.configTemplate" . | nindent 4 }}
+  hibernate.properties.template: |-
+    hibernate.connection.driver_class=org.h2.Driver
+    hibernate.connection.url=jdbc:h2:file:./etc/db/h2db;DB_CLOSE_DELAY=-1
+
+    hibernate.hbm2ddl.auto=update
+    hibernate.show_sql=false
+    hibernate.archive.autodetection=class
+    hibernate.use_sql_comments=true
+    org.hibernate.SQL=INFO
+    org.hibernate.type.descriptor.sql.BasicBinder=TRACE
+
+    {{- if eq .Values.db.type "postgresql" }}
+    hibernate.connection.driver_class=org.postgresql.Driver
+    hibernate.connection.url=jdbc:postgresql://{{ .Release.Name }}-postgresql:{{ .Values.db.postgresqlConfig.port }}/{{ .Values.db.postgresqlConfig.database }}
+    hibernate.connection.user={{ .Values.db.postgresqlConfig.user }}
+    hibernate.connection.password={{ .Values.db.postgresqlConfig.password }}
+    {{- end}}
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "unitycatalog.server.fullname" . }}
+  labels:
+    {{- include "unitycatalog.server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.server.service.type }}
+  ports:
+    - port: {{ .Values.server.service.port }}
+      targetPort: api
+      protocol: TCP
+      name: api
+  selector:
+    {{- include "unitycatalog.server.selectorLabels" . | nindent 4 }}
@@ -0,0 +1,273 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "unitycatalog.server.fullname" . }}
+  labels:
+    {{- include "unitycatalog.server.labels" . | nindent 4 }}
+spec:
+  serviceName: unitycatalog-server
+  replicas: {{ .Values.server.statefulset.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "unitycatalog.server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include "unitycatalog.server.configTemplate" . | sha256sum }}
+      {{- with .Values.server.statefulset.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "unitycatalog.server.labels" . | nindent 8 }}
+        {{- with .Values.server.statefulset.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.server.statefulset.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "unitycatalog.serviceAccountName" . }}
+      {{- with .Values.server.statefulset.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      initContainers:
+      {{- if .Values.privateCA.enabled }}
+        - name: generate-truststore
+          image: eclipse-temurin:17-alpine
+          command:
+            - sh
+            - -c
+            - |
+              echo "[INFO] Checking for CA file at /ca/ca.crt..."
+              if [ ! -f /ca/ca.crt ]; then
+                echo "[ERROR] /ca/ca.crt not found. Make sure the 'my-private-ca' Secret contains 'ca.crt'."
+                exit 1
+              fi
+
+              TRUSTSTORE_PATH="/truststore/truststore.jks"
+
+              if [ -f "$TRUSTSTORE_PATH" ]; then
+                echo "[INFO] Existing truststore found. Removing..."
+                rm -f "$TRUSTSTORE_PATH"
+              fi
+
+              echo "[INFO] Copying default Java truststore to $TRUSTSTORE_PATH..."
+              cp "$JAVA_HOME/lib/security/cacerts" "$TRUSTSTORE_PATH"
+
+              echo "[INFO] Importing private CA into truststore..."
+              keytool -importcert -noprompt \
+                -alias private-ca \
+                -file /ca/ca.crt \
+                -keystore "$TRUSTSTORE_PATH" \
+                -storepass changeit
+
+              echo "[INFO] Truststore created successfully with private CA."
+          volumeMounts:
+            - name: ca-tls
+              mountPath: /ca
+            - name: truststore-volume
+              mountPath: /truststore
+      {{- end }}
+        - name: render-config
+          image: "{{ .Values.server.statefulset.initContainer.image.repository }}:{{ .Values.server.statefulset.initContainer.image.tag }}"
+          imagePullPolicy: {{ .Values.server.statefulset.initContainer.image.pullPolicy }}
+          command:
+            - /bin/sh
+            - -c
+            - |-
+              envsubst < /home/unitycatalog/etc/confTemplates/server.properties.template > /home/unitycatalog/etc/conf/server.properties
+              envsubst < /home/unitycatalog/etc/confTemplates/server.log4j2.properties.template > /home/unitycatalog/etc/conf/server.log4j2.properties
+              envsubst < /home/unitycatalog/etc/confTemplates/hibernate.properties.template > /home/unitycatalog/etc/conf/hibernate.properties
+          volumeMounts:
+            - name: config-templates
+              mountPath: /home/unitycatalog/etc/confTemplates
+            - name: config-volume
+              mountPath: /home/unitycatalog/etc/conf
+          env:
+          {{- range $index, $config := .Values.storage.credentials.s3 }}
+            - name: S3_ACCESS_KEY_{{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $config.credentialsSecretName }}
+                  key: accessKey
+            - name: S3_SECRET_KEY_{{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $config.credentialsSecretName }}
+                  key: secretKey
+          {{- end }}
+          {{- range $index, $config := .Values.storage.credentials.adls }}
+            - name: ADLS_TENANT_ID_{{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $config.credentialsSecretName }}
+                  key: tenantId
+            - name: ADLS_CLIENT_ID_{{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $config.credentialsSecretName }}
+                  key: clientId
+            - name: ADLS_CLIENT_SECRET_{{ $index }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $config.credentialsSecretName }}
+                  key: clientSecret
+          {{- end }}
+          {{- if .Values.auth.enabled }}
+            - name: OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.clientSecretName }}
+                  key: clientId
+            - name: OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.clientSecretName }}
+                  key: clientSecret
+          {{- end }}
+      containers:
+        - name: server
+          {{- with .Values.server.statefulset.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.server.statefulset.image.repository }}:{{ .Values.server.statefulset.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.server.statefulset.image.pullPolicy }}
+          ports:
+            - name: api
+              containerPort: {{ .Values.server.statefulset.port }}
+              protocol: TCP
+          {{- with .Values.server.statefulset.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.server.statefulset.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.server.statefulset.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: config-volume
+              mountPath: /home/unitycatalog/etc/conf
+            - name: db-volume
+              mountPath: /home/unitycatalog/etc/db
+          {{- range $index, $config := .Values.storage.credentials.gcs }}
+            - name: gcs-credentials-{{ $index }}
+              mountPath: /home/unitycatalog/etc/conf/gcs-credentials-{{ $index }}.json
+              subPath: jsonKey
+              readOnly: true
+          {{- end }}
+          {{- if .Values.privateCA.enabled }}
+            - name: truststore-volume
+              mountPath: /truststore
+          env:
+            - name: JAVA_TOOL_OPTIONS
+              value: "-Djavax.net.ssl.trustStore=/truststore/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit"
+          {{- end }}
+          {{- with .Values.server.statefulset.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+        {{ if and .Values.auth.enabled .Values.auth.users }}
+        - name: create-users
+          image: "{{ .Values.server.createUsersJob.image.repository }}:{{ .Values.server.createUsersJob.image.tag }}"
+          imagePullPolicy: {{ .Values.server.createUsersJob.image.pullPolicy }}
+          command:
+              - /bin/sh
+              - -c
+              - |-
+                set -ex
+
+                until curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
+                -X GET "http://localhost:{{ .Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
+                -H "Content-Type: application/json"
+                do
+                    echo "Waiting for Unity Catalog server API to be available..."
+                    sleep 1
+                done
+
+                {{- range $index, $user := .Values.auth.users }}
+                if curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
+                -X GET "http://localhost:{{ $.Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
+                -H "Content-Type: application/json" | jq -e '.Resources[] | select(.emails[0].value == "{{ $user.email }}")'
+                then
+                    echo "User {{ $user.email }} already exists"
+                else
+                    echo "User {{ $user.email }} is being created"
+                    curl -H "Authorization: Bearer $(cat /home/unitycatalog/etc/conf/token.txt)" \
+                    -X POST "http://localhost:{{ $.Values.server.statefulset.port }}/api/1.0/unity-control/scim2/Users" \
+                    -H "Content-Type: application/json" \
+                    -d '{"displayName": "{{ $user.name }}", "emails": [{"primary": true, "value": "{{ $user.email }}"}]}'
+                    echo "User {{ $user.email }} created"
+                fi
+                {{- end }}
+
+                tail -f /dev/null
+          volumeMounts:
+            - name: config-volume
+              mountPath: /home/unitycatalog/etc/conf
+        {{- end }}
+      volumes:
+        - configMap:
+            name: {{ include "unitycatalog.fullname" . }}-server-config-templates
+          name: config-templates
+      {{- if not .Values.server.config.persistence.enabled }}
+        - name: config-volume
+          emptyDir: {}
+      {{- end }}
+      {{- if not (and (eq .Values.db.type "file") .Values.db.fileConfig.persistence.enabled) }}
+        - name: db-volume
+          emptyDir: {}
+      {{- end }}
+      {{- range $index, $config := .Values.storage.credentials.gcs }}
+        - name: gcs-credentials-{{ $index }}
+          secret:
+            secretName: {{ $config.credentialsSecretName }}
+      {{- end }}
+      {{- with .Values.server.statefulset.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.privateCA.enabled }}
+        - name: ca-tls
+          secret:
+            secretName: {{ .Values.privateCA.secretName }}
+        - name: truststore-volume
+          emptyDir: {}
+      {{- end }}
+      {{- with .Values.server.statefulset.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.statefulset.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.server.statefulset.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  volumeClaimTemplates:
+    {{- if and (eq .Values.db.type "file") .Values.db.fileConfig.persistence.enabled }}
+    - metadata:
+        name: db-volume
+      spec:
+        accessModes: {{ .Values.db.fileConfig.persistence.accessModes }}
+        resources:
+          requests:
+            storage: {{ .Values.db.fileConfig.persistence.size }}
+        storageClassName: {{ .Values.db.fileConfig.persistence.storageClassName }}
+    {{- end }}
+    {{- if .Values.server.config.persistence.enabled }}
+    - metadata:
+        name: config-volume
+      spec:
+        accessModes: {{ .Values.server.config.persistence.accessModes }}
+        resources:
+          requests:
+            storage: {{ .Values.server.config.persistence.size }}
+        storageClassName: {{ .Values.server.config.persistence.storageClassName }}
+    {{- end }}
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "unitycatalog.serviceAccountName" . }}
+  labels:
+    {{- include "unitycatalog.commonLabels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}
@@ -0,0 +1,136 @@
+{{- if .Values.ui.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "unitycatalog.ui.fullname" . }}
+  labels:
+    {{- include "unitycatalog.ui.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.ui.deployment.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "unitycatalog.ui.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.ui.deployment.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "unitycatalog.ui.labels" . | nindent 8 }}
+        {{- with .Values.ui.deployment.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.ui.deployment.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "unitycatalog.serviceAccountName" . }}
+      {{- with .Values.ui.deployment.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      initContainers:
+        - name: wait-for-server
+          image: "{{ .Values.ui.deployment.initContainer.image.repository }}:{{ .Values.ui.deployment.initContainer.image.tag }}"
+          imagePullPolicy: {{ .Values.ui.deployment.initContainer.image.pullPolicy }}
+          command:
+            - /bin/sh
+            - -c
+            - |-
+              until nc -z {{ include "unitycatalog.server.fullname" . }} {{ .Values.server.service.port }}
+              do
+                echo "Waiting for server ({{ include "unitycatalog.server.fullname" . }}:{{ .Values.server.service.port }}) to be ready..."
+                sleep 2
+              done
+      containers:
+        - name: ui
+          {{- with .Values.ui.deployment.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.ui.deployment.image.repository }}:{{ .Values.ui.deployment.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.ui.deployment.image.pullPolicy }}
+          ports:
+            - name: ui
+              containerPort: {{ .Values.ui.deployment.port }}
+              protocol: TCP
+          command:
+            - /bin/bash
+            - -c
+            - |-
+              jq --arg proxy "{{ include "unitycatalog.server.apiEndpoint" . }}" '.proxy = $proxy' package.json > temp.json
+              mv temp.json package.json
+              yarn start
+          env:
+          {{- if .Values.ui.deployment.host }}
+            - name: HOST
+              value: "{{ .Values.ui.deployment.host }}"
+          {{- end }}
+          {{- if .Values.ui.deployment.disableHostCheck }}
+            - name: DANGEROUSLY_DISABLE_HOST_CHECK
+              value: "{{ .Values.ui.deployment.disableHostCheck }}"
+          {{- end }}
+          {{- if .Values.auth.enabled }}
+            - name: REACT_APP_GOOGLE_AUTH_ENABLED
+              value: "{{ eq .Values.auth.provider "google" }}"
+            - name: REACT_APP_GOOGLE_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.clientSecretName }}
+                  key: clientId
+            - name: REACT_APP_OKTA_AUTH_ENABLED
+              value: "{{ eq .Values.auth.provider "okta" }}"
+            - name: REACT_APP_OKTA_DOMAIN
+              value: "{{ .Values.auth.oktaDomain }}"
+            - name: REACT_APP_OKTA_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.clientSecretName }}
+                  key: clientId
+            - name: REACT_APP_KEYCLOAK_AUTH_ENABLED
+              value: "{{ eq .Values.auth.provider "keycloak" }}"
+            - name: REACT_APP_KEYCLOAK_URL
+              value: "{{ .Values.auth.authorizationUrl }}"
+            - name: REACT_APP_KEYCLOAK_REALM_ID
+              value: "{{ .Values.auth.keycloakRealmId }}"
+            - name: REACT_APP_KEYCLOAK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.clientSecretName }}
+                  key: clientId
+          {{- end }}
+          {{- with .Values.ui.deployment.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.ui.deployment.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.ui.deployment.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.ui.deployment.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.ui.deployment.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ui.deployment.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ui.deployment.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.ui.deployment.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
@@ -0,0 +1,17 @@
+{{- if .Values.ui.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "unitycatalog.ui.fullname" . }}
+  labels:
+    {{- include "unitycatalog.ui.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.ui.service.type }}
+  ports:
+    - port: {{ .Values.ui.service.port }}
+      targetPort: ui
+      protocol: TCP
+      name: ui
+  selector:
+    {{- include "unitycatalog.ui.selectorLabels" . | nindent 4 }}
+{{- end }}