Add openmetadata chart
This commit is contained in:
wbsong111
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,53 @@
|
||||
# OpenMetadata 버전 갱신 가이드
|
||||
|
||||
## 1. git 작업 환경 구성
|
||||
|
||||
- 서비스 카탈로그 git 다운로드
|
||||
```
|
||||
$ git clone https://github.com/paasup/dip-catalog.git
|
||||
```
|
||||
|
||||
## 2. helm chart 업데이트
|
||||
|
||||
### 1) 차트 버전 변경
|
||||
|
||||
- BUILD-README.md, CUSTOM-README.md, custom-values.yaml을 제외한 파일 삭제
|
||||
``` sh
|
||||
# chart 디렉토리로 이동
|
||||
cd ~/dip-catalog/manifests/helm/openmetadata/1.12.1
|
||||
|
||||
# 파일 삭제 전 삭제할 파일 목록 확인
|
||||
find . -mindepth 1 \( -name "CUSTOM-README.md" -o -name "BUILD-README.md" -o -name "custom-values.yaml" \) -prune -o -print
|
||||
|
||||
# 파일 삭제
|
||||
find . -mindepth 1 \( -name "CUSTOM-README.md" -o -name "BUILD-README.md" -o -name "custom-values.yaml" \) -prune -o -exec rm -rf {} +
|
||||
```
|
||||
|
||||
- openmetadata 차트 다운로드
|
||||
``` sh
|
||||
# manifests/helm 디렉토리로 이동
|
||||
cd ~/dip-catalog/manifests/helm
|
||||
|
||||
# helm repo 추가
|
||||
helm repo add open-metadata https://helm.open-metadata.org/
|
||||
helm repo update
|
||||
|
||||
# helm 차트 조회
|
||||
helm search repo open-metadata/openmetadata --versions
|
||||
|
||||
# helm 차트 pull
|
||||
helm pull open-metadata/openmetadata --version=1.12.1 --untar --untardir openmetadata/1.12.1-tmp
|
||||
|
||||
# 차트 파일 이동 및 정리
|
||||
mv openmetadata/1.12.1-tmp/openmetadata/* openmetadata/1.12.1/
|
||||
rm -rf openmetadata/1.12.1-tmp
|
||||
```
|
||||
|
||||
## 3. github에 push
|
||||
|
||||
- 갱신작업 진행후 commit 및 push
|
||||
```
|
||||
$ git add .
|
||||
$ git commit -m "update openmetadata/1.12.1"
|
||||
$ git push origin main
|
||||
```
|
||||
@@ -0,0 +1,179 @@
|
||||
# OpenMetadata 배포
|
||||
|
||||
## 1. 배포 방법
|
||||
|
||||
### 1) 배포 시 주의 사항
|
||||
|
||||
- openmetadata를 배포하기 전에 `openmetadata-dependencies`(MySQL, OpenSearch, Airflow)가 먼저 배포되어 있어야 한다.
|
||||
- HTTPS 접근을 위해 `java-truststore` Secret이 배포 네임스페이스에 사전 생성되어 있어야 한다.
|
||||
- Keycloak OIDC 연동 시 `oidc-secrets` Secret이 사전 생성되어 있어야 한다.
|
||||
|
||||
### 2) Secret 사전 생성
|
||||
|
||||
- java-truststore Secret 생성 (내부 CA 인증서 포함 truststore)
|
||||
``` sh
|
||||
kubectl create secret generic java-truststore \
|
||||
--from-file=cacerts=<path-to-cacerts> \
|
||||
-n openmetadata
|
||||
```
|
||||
|
||||
- Keycloak OIDC 연동 시 oidc-secrets Secret 생성
|
||||
``` sh
|
||||
kubectl create secret generic oidc-secrets \
|
||||
--from-literal=openmetadata-oidc-client-id=<client-id> \
|
||||
--from-literal=openmetadata-oidc-client-secret=<client-secret> \
|
||||
-n openmetadata
|
||||
```
|
||||
|
||||
### 3) 배포 방법
|
||||
|
||||
``` sh
|
||||
git clone https://github.com/paasup/dip-catalog.git
|
||||
cd manifests/helm/openmetadata/1.12.1
|
||||
helm upgrade openmetadata ./ -f custom-values.yaml --install -n openmetadata --create-namespace
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2. custom-values.yaml 설명
|
||||
|
||||
### 1) 인가(Authorizer) 설정
|
||||
|
||||
| Name | 설명 | 기본값 |
|
||||
| ---- | ---- | ------ |
|
||||
| `openmetadata.config.authorizer.initialAdmins` | 최초 관리자 계정 목록. 이메일의 `@` 앞 부분을 입력 | `["admin", "paasup"]` |
|
||||
| `openmetadata.config.authorizer.principalDomain` | 조직의 기본 도메인 (예: `paasup.io`) | `"paasup.io"` |
|
||||
| `openmetadata.config.authorizer.allowedDomains` | 로그인을 허용할 도메인 목록 | `["paasup.io"]` |
|
||||
|
||||
### 2) 인증(Authentication) 설정
|
||||
|
||||
#### 2.1) Basic 인증 (기본값)
|
||||
|
||||
- OpenMetadata 자체 계정/비밀번호 인증을 사용한다.
|
||||
|
||||
``` yaml
|
||||
openmetadata:
|
||||
config:
|
||||
authentication:
|
||||
provider: "basic"
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
authority: "https://open-metadata.example.org"
|
||||
publicKeys:
|
||||
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
||||
```
|
||||
|
||||
#### 2.2) Keycloak OIDC 연동
|
||||
|
||||
- `provider`를 `custom-oidc`로 변경하고 `oidcConfiguration`을 활성화한다.
|
||||
- 사전에 `oidc-secrets` Secret이 생성되어 있어야 한다.
|
||||
|
||||
``` yaml
|
||||
openmetadata:
|
||||
config:
|
||||
authentication:
|
||||
clientType: confidential
|
||||
provider: "custom-oidc"
|
||||
publicKeys:
|
||||
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
||||
- "https://keycloak.example.org/realms/paasup/protocol/openid-connect/certs"
|
||||
clientId: "open-metadata"
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
jwtPrincipalClaims:
|
||||
- "email"
|
||||
- "preferred_username"
|
||||
- "sub"
|
||||
oidcConfiguration:
|
||||
enabled: true
|
||||
oidcType: "Keycloak"
|
||||
clientId:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-id
|
||||
clientSecret:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-secret
|
||||
discoveryUri: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
|
||||
serverUrl: "https://open-metadata.example.org"
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
```
|
||||
|
||||
### 3) Ingress 설정
|
||||
|
||||
#### 3.1) cert-manager를 이용한 자동 생성
|
||||
|
||||
- cert-manager를 통해 인증서 자동 생성 시 `custom-values.yaml`을 수정한다.
|
||||
- `ingress.annotations.cert-manager.io/cluster-issuer`에 미리 배포된 Cluster Issuer의 이름으로 변경한다.
|
||||
- Kong Ingress Controller를 사용하며 HTTPS 리다이렉트를 적용한다.
|
||||
|
||||
``` yaml
|
||||
ingress:
|
||||
enabled: true
|
||||
className: "kong"
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: root-ca-issuer
|
||||
cert-manager.io/duration: 8760h
|
||||
cert-manager.io/renew-before: 720h
|
||||
konghq.com/protocols: https
|
||||
konghq.com/https-redirect-status-code: "301"
|
||||
hosts:
|
||||
- host: open-metadata.example.org # 사용할 도메인으로 변경
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- secretName: openmetadata-tls
|
||||
hosts:
|
||||
- open-metadata.example.org # 사용할 도메인으로 변경
|
||||
```
|
||||
|
||||
#### 3.2) TLS Secret 직접 생성
|
||||
|
||||
- 인증서를 직접 관리하는 경우 Secret을 생성하여 제공한다.
|
||||
|
||||
``` sh
|
||||
kubectl create secret tls openmetadata-tls \
|
||||
--cert=<path-to-cert-file> \
|
||||
--key=<path-to-key-file> \
|
||||
-n openmetadata
|
||||
```
|
||||
|
||||
### 4) Java TrustStore 설정
|
||||
|
||||
- 내부 CA 인증서를 신뢰하기 위해 `java-truststore` Secret을 마운트하고 JVM 옵션을 설정한다.
|
||||
|
||||
``` yaml
|
||||
extraVolumes:
|
||||
- name: java-truststore
|
||||
secret:
|
||||
secretName: java-truststore
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: java-truststore
|
||||
mountPath: /etc/ssl/java
|
||||
readOnly: true
|
||||
|
||||
extraEnvs:
|
||||
- name: OPENMETADATA_OPTS
|
||||
value: >
|
||||
-Djavax.net.ssl.trustStore=/etc/ssl/java/cacerts
|
||||
-Djavax.net.ssl.trustStorePassword=changeit
|
||||
```
|
||||
|
||||
### 5) 리소스 설정
|
||||
|
||||
``` yaml
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 2048Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1024Mi
|
||||
```
|
||||
|
||||
### 6) 환경변수 설정
|
||||
|
||||
| Name | 설명 | 기본값 |
|
||||
| ---- | ---- | ------ |
|
||||
| `OPENMETADATA_PUBLIC_URL` | 외부에서 접근하는 OpenMetadata URL. HTTPS 환경에서 반드시 설정 | `"https://open-metadata.example.org"` |
|
||||
| `LOG_LEVEL` | 로그 레벨 (`INFO`, `DEBUG`, `WARN`, `ERROR`) | `"INFO"` |
|
||||
| `OPENMETADATA_OPTS` | JVM 옵션. TrustStore 경로 및 패스워드 설정 | `custom-values.yaml 참조` |
|
||||
@@ -0,0 +1,45 @@
|
||||
annotations:
|
||||
artifacthub.io/images: |
|
||||
- name: openmetadata-server
|
||||
image: docker.io/openmetadata/server:1.12.1
|
||||
artifacthub.io/license: Apache-2.0
|
||||
artifacthub.io/recommendations: |
|
||||
- name: bitnami/mysql
|
||||
- name: apache/airflow
|
||||
- name: opensearchproject/opensearch
|
||||
artifacthub.io/support: https://github.com/open-metadata/openmetadata-helm-charts/issues
|
||||
kubeVersion: '>=1.24'
|
||||
apiVersion: v2
|
||||
appVersion: 1.12.1
|
||||
description: A Helm chart for OpenMetadata on Kubernetes
|
||||
home: https://open-metadata.org/
|
||||
icon: https://open-metadata.org/assets/favicon.png
|
||||
keywords:
|
||||
- metadata
|
||||
- data-science
|
||||
- data
|
||||
- machine-learning
|
||||
- automation
|
||||
- big-data
|
||||
- bigdata
|
||||
- artificial-intelligence
|
||||
- datascience
|
||||
- data-engineering
|
||||
- data-catalog
|
||||
- metadata-api
|
||||
- governance
|
||||
- data-profiling
|
||||
- metadata-management
|
||||
- dataengineering
|
||||
- dataquality
|
||||
- bigdataanalytics
|
||||
- datadiscovery
|
||||
maintainers:
|
||||
- email: support@open-metadata.org
|
||||
name: OpenMetadata
|
||||
name: openmetadata
|
||||
sources:
|
||||
- https://github.com/open-metadata/OpenMetadata
|
||||
- https://github.com/open-metadata/openmetadata-helm-charts
|
||||
type: application
|
||||
version: 1.12.1
|
||||
@@ -0,0 +1,169 @@
|
||||
# OMJob Operator for OpenMetadata
|
||||
|
||||
## Overview
|
||||
|
||||
The OMJob Operator is a Kubernetes operator that manages ingestion pipeline jobs with guaranteed exit handler execution. It ensures that pipeline status is properly updated in OpenMetadata regardless of how the main ingestion pod terminates (success, failure, OOM, external kill, etc.).
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
OMJob CR → OMJob Operator → Main Pod → Exit Handler Pod
|
||||
```
|
||||
|
||||
1. **OMJob Custom Resource**: Defines the pipeline job specification
|
||||
2. **OMJob Operator**: Watches OMJob resources and manages pod lifecycle
|
||||
3. **Main Pod**: Runs the actual ingestion pipeline
|
||||
4. **Exit Handler Pod**: Automatically created after main pod completion to update pipeline status
|
||||
|
||||
## Installation
|
||||
|
||||
### Enable the operator in values.yaml:
|
||||
|
||||
```yaml
|
||||
omjobOperator:
|
||||
enabled: true
|
||||
image:
|
||||
repository: docker.getcollate.io/openmetadata/omjob-operator
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
logLevel: INFO
|
||||
```
|
||||
|
||||
### Deploy using Helm:
|
||||
|
||||
```bash
|
||||
helm upgrade --install openmetadata openmetadata-helm-charts/charts/openmetadata \
|
||||
--namespace openmetadata \
|
||||
--set omjobOperator.enabled=true
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
The K8sPipelineClient will automatically create OMJob resources instead of regular Jobs when the operator is enabled. The OMJob resource structure mirrors a Kubernetes Job but with additional guarantees for exit handler execution.
|
||||
|
||||
### OMJob Lifecycle
|
||||
|
||||
1. **Pending**: OMJob created, waiting to start
|
||||
2. **Running**: Main ingestion pod is running
|
||||
3. **ExitHandlerRunning**: Main pod completed, exit handler is running
|
||||
4. **Succeeded/Failed**: Both pods completed, final status determined
|
||||
|
||||
### Status Fields
|
||||
|
||||
- `phase`: Current phase of the OMJob
|
||||
- `mainPodName`: Name of the main ingestion pod
|
||||
- `exitHandlerPodName`: Name of the exit handler pod
|
||||
- `mainPodExitCode`: Exit code from the main pod
|
||||
- `startTime`: When the job started
|
||||
- `completionTime`: When the job completed
|
||||
- `message`: Human-readable status message
|
||||
|
||||
## Key Features
|
||||
|
||||
### Guaranteed Exit Handler Execution
|
||||
|
||||
The exit handler pod is **always** created after the main pod completes, regardless of:
|
||||
- Normal completion (exit code 0)
|
||||
- Application failures (exit code != 0)
|
||||
- Out of Memory (OOM) kills
|
||||
- External pod termination (`kubectl delete pod`)
|
||||
- Node failures
|
||||
- Resource limit violations
|
||||
|
||||
### Debug-Friendly
|
||||
|
||||
- Pods are retained based on TTL configuration (default: 24 hours)
|
||||
- Exit handler logs are preserved separately from main pod logs
|
||||
- Clear status progression through phases
|
||||
- Kubernetes events track all state transitions
|
||||
|
||||
### Production Ready
|
||||
|
||||
- Single responsibility: operator only manages pod lifecycle
|
||||
- No complex lifecycle hooks or sidecar containers
|
||||
- Clean separation between ingestion and status reporting
|
||||
- Resilient to operator restarts
|
||||
- Handles edge cases (pod deletions, node failures)
|
||||
|
||||
## Monitoring
|
||||
|
||||
### View OMJob status:
|
||||
|
||||
```bash
|
||||
kubectl get omjobs -n openmetadata
|
||||
```
|
||||
|
||||
### Detailed status:
|
||||
|
||||
```bash
|
||||
kubectl describe omjob <job-name> -n openmetadata
|
||||
```
|
||||
|
||||
### Watch exit handler logs:
|
||||
|
||||
```bash
|
||||
kubectl logs -l app.kubernetes.io/component=exit-handler -n openmetadata
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Pipeline Service Client Settings
|
||||
|
||||
The operator respects all existing `pipelineServiceClient` configurations:
|
||||
|
||||
```yaml
|
||||
pipelineServiceClient:
|
||||
enabled: true
|
||||
ingestionImage: docker.getcollate.io/openmetadata/ingestion:latest
|
||||
serviceAccountName: openmetadata-ingestion
|
||||
ttlSecondsAfterFinished: 86400 # 24 hours
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "512Mi"
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: "2Gi"
|
||||
```
|
||||
|
||||
### Security Context
|
||||
|
||||
Both main and exit handler pods use the same security context:
|
||||
|
||||
```yaml
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### OMJob stuck in Running state
|
||||
|
||||
Check if the main pod is still running:
|
||||
```bash
|
||||
kubectl get pods -l omjob=<job-name> -n openmetadata
|
||||
```
|
||||
|
||||
### Exit handler not created
|
||||
|
||||
Check operator logs:
|
||||
```bash
|
||||
kubectl logs deployment/openmetadata-omjob-operator -n openmetadata
|
||||
```
|
||||
|
||||
### View operator events
|
||||
|
||||
```bash
|
||||
kubectl get events --field-selector reason=OMJobOperator -n openmetadata
|
||||
```
|
||||
|
||||
## Benefits Over Lifecycle Hooks
|
||||
|
||||
1. **Reliable**: Exit handler runs for ALL termination scenarios
|
||||
2. **Debuggable**: Separate pods with distinct logs
|
||||
3. **Simple**: No complex hooks or sidecars
|
||||
4. **Kubernetes-native**: Uses standard operator pattern
|
||||
5. **Maintainable**: Clean separation of concerns
|
||||
@@ -0,0 +1,592 @@
|
||||
# Open Metadata
|
||||
|
||||
[](https://artifacthub.io/packages/search?repo=open-metadata)
|
||||
|
||||
A Helm Chart for Open Metadata.
|
||||
|
||||
## Install OpenMetadata
|
||||
|
||||
Assuming kubectl context points to the correct kubernetes cluster, first create kubernetes secrets that contain MySQL and Airflow passwords as secrets.
|
||||
|
||||
```
|
||||
kubectl create secret generic mysql-secrets --from-literal=openmetadata-mysql-password=openmetadata_password
|
||||
kubectl create secret generic airflow-secrets --from-literal=openmetadata-airflow-password=admin
|
||||
```
|
||||
|
||||
The above commands sets the passwords as an example. Change to any password of choice.
|
||||
|
||||
Run the following command to install openmetadata with default configuration.
|
||||
|
||||
```
|
||||
helm repo add open-metadata https://helm.open-metadata.org
|
||||
helm install openmetadata open-metadata/openmetadata
|
||||
```
|
||||
|
||||
If the default configuration is not applicable, you can update the values listed below in a `values.yaml` file and run
|
||||
|
||||
```
|
||||
helm install openmetadata open-metadata/openmetadata --values <<path-to-values-file>>
|
||||
```
|
||||
---
|
||||
|
||||
## Openmetadata Config Chart Values
|
||||
|
||||
| Key | Type | Default | Conf/Openmetadata.yaml |
|
||||
|-----|------|---------| ---------------------- |
|
||||
| openmetadata.config.authentication.enabled | bool | `true` | |
|
||||
| openmetadata.config.authentication.clientType | string | `public` | AUTHENTICATION_CLIENT_TYPE |
|
||||
| openmetadata.config.authentication.provider | string | `basic` | AUTHENTICATION_PROVIDER |
|
||||
| openmetadata.config.authentication.publicKeys | list | `[http://openmetadata:8585/api/v1/system/config/jwks]` | AUTHENTICATION_PUBLIC_KEYS |
|
||||
| openmetadata.config.authentication.authority | string | `https://accounts.google.com` | AUTHENTICATION_AUTHORITY |
|
||||
| openmetadata.config.authentication.clientId | string | `Empty String` | AUTHENTICATION_CLIENT_ID |
|
||||
| openmetadata.config.authentication.callbackUrl | string | `Empty String` | AUTHENTICATION_CALLBACK_URL |
|
||||
| openmetadata.config.authentication.enableSelfSignup | bool | `true` | AUTHENTICATION_ENABLE_SELF_SIGNUP |
|
||||
| openmetadata.config.authentication.jwtPrincipalClaims | list | `[email,preferred_username,sub]` | AUTHENTICATION_JWT_PRINCIPAL_CLAIMS |
|
||||
| openmetadata.config.authentication.jwtPrincipalClaimsMapping | list | `[]` | AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING |
|
||||
| openmetadata.config.authentication.ldapConfiguration.host | string | `localhost` | AUTHENTICATION_LDAP_HOST |
|
||||
| openmetadata.config.authentication.ldapConfiguration.port |int | 10636 | AUTHENTICATION_LDAP_PORT |
|
||||
| openmetadata.config.authentication.ldapConfiguration.dnAdminPrincipal | string | `cn=admin,dc=example,dc=com` | AUTHENTICATION_LOOKUP_ADMIN_DN |
|
||||
| openmetadata.config.authentication.ldapConfiguration.dnAdminPassword.secretRef | string | `ldap-secret` | AUTHENTICATION_LOOKUP_ADMIN_PWD |
|
||||
| openmetadata.config.authentication.ldapConfiguration.dnAdminPassword.secretKey | string | `openmetadata-ldap-secret` | AUTHENTICATION_LOOKUP_ADMIN_PWD |
|
||||
| openmetadata.config.authentication.ldapConfiguration.userBaseDN | string | `ou=people,dc=example,dc=com` | AUTHENTICATION_USER_LOOKUP_BASEDN |
|
||||
| openmetadata.config.authentication.ldapConfiguration.groupBaseDN | string | `Empty String` | AUTHENTICATION_GROUP_LOOKUP_BASEDN |
|
||||
| openmetadata.config.authentication.ldapConfiguration.roleAdminName | string | `Empty String` | AUTHENTICATION_USER_ROLE_ADMIN_NAME |
|
||||
| openmetadata.config.authentication.ldapConfiguration.allAttributeName | string | `Empty String` | AUTHENTICATION_USER_ALL_ATTR |
|
||||
| openmetadata.config.authentication.ldapConfiguration.usernameAttributeName | string | `Empty String` | AUTHENTICATION_USER_NAME_ATTR |
|
||||
| openmetadata.config.authentication.ldapConfiguration.groupAttributeName | string | `Empty String` | AUTHENTICATION_USER_GROUP_ATTR |
|
||||
| openmetadata.config.authentication.ldapConfiguration.groupAttributeValue | string | `Empty String` | AUTHENTICATION_USER_GROUP_ATTR_VALUE |
|
||||
| openmetadata.config.authentication.ldapConfiguration.groupMemberAttributeName | string | `Empty String` | AUTHENTICATION_USER_GROUP_MEMBER_ATTR |
|
||||
| openmetadata.config.authentication.ldapConfiguration.authRolesMapping | string | `Empty String` | AUTH_ROLES_MAPPING |
|
||||
| openmetadata.config.authentication.ldapConfiguration.authReassignRoles | string | `Empty String` | AUTH_REASSIGN_ROLES |
|
||||
| openmetadata.config.authentication.ldapConfiguration.mailAttributeName | string | `email` | AUTHENTICATION_USER_MAIL_ATTR |
|
||||
| openmetadata.config.authentication.ldapConfiguration.maxPoolSize | int | 3 | AUTHENTICATION_LDAP_POOL_SIZE |
|
||||
| openmetadata.config.authentication.ldapConfiguration.sslEnabled | bool | `true` | AUTHENTICATION_LDAP_SSL_ENABLED |
|
||||
| openmetadata.config.authentication.ldapConfiguration.truststoreConfigType | string | `TrustAll` | AUTHENTICATION_LDAP_TRUSTSTORE_TYPE |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePath | string | `Empty String` | AUTHENTICATION_LDAP_TRUSTSTORE_PATH |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword.secretRef | string | `Empty String` | AUTHENTICATION_LDAP_KEYSTORE_PASSWORD |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword.secretKey | string | `Empty String` | AUTHENTICATION_LDAP_KEYSTORE_PASSWORD |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFileFormat | string | `Empty String` | AUTHENTICATION_LDAP_SSL_KEY_FORMAT |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.verifyHostname | string | `Empty String` | AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.examineValidityDate | bool | `true` | AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.hostNameConfig.allowWildCards | bool | `false` | AUTHENTICATION_LDAP_ALLOW_WILDCARDS |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.hostNameConfig.acceptableHostNames | string | `[Empty String]` | AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.jvmDefaultConfig.verifyHostname | string | `Empty String` | AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST |
|
||||
| openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.trustAllConfig.examineValidityDates | bool | `true` | AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES |
|
||||
| openmetadata.config.authentication.oidcConfiguration.callbackUrl | string | `http://openmetadata:8585/callback` | OIDC_CALLBACK |
|
||||
| openmetadata.config.authentication.oidcConfiguration.clientAuthenticationMethod | string | `client_secret_post` | OIDC_CLIENT_AUTH_METHOD |
|
||||
| openmetadata.config.authentication.oidcConfiguration.clientId.secretKey | string | `openmetadata-oidc-client-id` | OIDC_CLIENT_ID |
|
||||
| openmetadata.config.authentication.oidcConfiguration.clientId.secretRef | string | `oidc-secrets` | OIDC_CLIENT_ID |
|
||||
| openmetadata.config.authentication.oidcConfiguration.clientSecret.secretKey | string | `openmetadata-oidc-client-secret` | OIDC_CLIENT_SECRET |
|
||||
| openmetadata.config.authentication.oidcConfiguration.clientSecret.secretRef | string | `oidc-secrets` | OIDC_CLIENT_SECRET |
|
||||
| openmetadata.config.authentication.oidcConfiguration.customParams | string | `{}` | OIDC_CUSTOM_PARAMS |
|
||||
| openmetadata.config.authentication.oidcConfiguration.maxAge | string | `0` | OIDC_MAX_AGE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.disablePkce | bool | true | OIDC_DISABLE_PKCE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.discoveryUri | string | `Empty` | OIDC_DISCOVERY_URI |
|
||||
| openmetadata.config.authentication.oidcConfiguration.enabled | bool | false | |
|
||||
| openmetadata.config.authentication.oidcConfiguration.maxClockSkew | string | `Empty` | OIDC_MAX_CLOCK_SKEW |
|
||||
| openmetadata.config.authentication.oidcConfiguration.oidcType | string | `Empty` | OIDC_TYPE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.preferredJwsAlgorithm | string | `RS256` | OIDC_PREFERRED_JWS |
|
||||
| openmetadata.config.authentication.oidcConfiguration.responseType | string | `code` | OIDC_RESPONSE_TYPE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.promptType | string | `consent` | OIDC_PROMPT_TYPE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.scope | string | `openid email profile` | OIDC_SCOPE |
|
||||
| openmetadata.config.authentication.oidcConfiguration.serverUrl | string | `http://openmetadata:8585` | OIDC_SERVER_URL |
|
||||
| openmetadata.config.authentication.oidcConfiguration.sessionExpiry | string | `604800` | OIDC_SESSION_EXPIRY |
|
||||
| openmetadata.config.authentication.oidcConfiguration.tenant | string | `Empty` | OIDC_TENANT |
|
||||
| openmetadata.config.authentication.oidcConfiguration.tokenValidity | string | `3600` | OIDC_OM_REFRESH_TOKEN_VALIDITY |
|
||||
| openmetadata.config.authentication.oidcConfiguration.useNonce | bool | `true` | OIDC_USE_NONCE |
|
||||
| openmetadata.config.authentication.saml.debugMode | bool | false | SAML_DEBUG_MODE |
|
||||
| openmetadata.config.authentication.saml.idp.entityId | string | `Empty` | SAML_IDP_ENTITY_ID |
|
||||
| openmetadata.config.authentication.saml.idp.ssoLoginUrl | string | `Empty` | SAML_IDP_SSO_LOGIN_URL |
|
||||
| openmetadata.config.authentication.saml.idp.idpX509Certificate.secretRef | string | `Empty` | SAML_IDP_CERTIFICATE |
|
||||
| openmetadata.config.authentication.saml.idp.idpX509Certificate.secretKey | string | `Empty` | SAML_IDP_CERTIFICATE |
|
||||
| openmetadata.config.authentication.saml.idp.authorityUrl | string | `http://openmetadata:8585/api/v1/saml/login` | SAML_AUTHORITY_URL |
|
||||
| openmetadata.config.authentication.saml.idp.nameId | string | `urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress` | SAML_IDP_NAME_ID |
|
||||
| openmetadata.config.authentication.saml.sp.entityId | string | `http://openmetadata:8585/api/v1/saml/metadata` | SAML_SP_ENTITY_ID |
|
||||
| openmetadata.config.authentication.saml.sp.acs | string | `http://openmetadata:8585/api/v1/saml/acs` | SAML_SP_ACS |
|
||||
| openmetadata.config.authentication.saml.sp.spX509Certificate.secretRef | string | `Empty` | SAML_SP_CERTIFICATE |
|
||||
| openmetadata.config.authentication.saml.sp.spX509Certificate.secretKey | string | `Empty` | SAML_SP_CERTIFICATE |
|
||||
| openmetadata.config.authentication.saml.sp.callback | string | `http://openmetadata:8585/saml/callback` | SAML_SP_CALLBACK |
|
||||
| openmetadata.config.authentication.saml.security.strictMode | bool | false | SAML_STRICT_MODE |
|
||||
| openmetadata.config.authentication.saml.security.tokenValidity | int | 3600 | SAML_SP_TOKEN_VALIDITY |
|
||||
| openmetadata.config.authentication.saml.security.sendEncryptedNameId | bool | false | SAML_SEND_ENCRYPTED_NAME_ID |
|
||||
| openmetadata.config.authentication.saml.security.sendSignedAuthRequest | bool | false | SAML_SEND_SIGNED_AUTH_REQUEST |
|
||||
| openmetadata.config.authentication.saml.security.signSpMetadata | bool | false | SAML_SIGNED_SP_METADATA |
|
||||
| openmetadata.config.authentication.saml.security.wantMessagesSigned | bool | false | SAML_WANT_MESSAGE_SIGNED |
|
||||
| openmetadata.config.authentication.saml.security.wantAssertionsSigned | bool | false | SAML_WANT_ASSERTION_SIGNED |
|
||||
| openmetadata.config.authentication.saml.security.wantAssertionEncrypted | bool | false | SAML_WANT_ASSERTION_ENCRYPTED |
|
||||
| openmetadata.config.authentication.saml.security.wantNameIdEncrypted | bool | false | SAML_WANT_NAME_ID_ENCRYPTED |
|
||||
| openmetadata.config.authentication.saml.security.keyStoreFilePath | string | `Empty` | SAML_KEYSTORE_FILE_PATH |
|
||||
| openmetadata.config.authentication.saml.security.keyStoreAlias.secretRef | string | `Empty` | SAML_KEYSTORE_ALIAS |
|
||||
| openmetadata.config.authentication.saml.security.keyStoreAlias.secretKey | string | `Empty` | SAML_KEYSTORE_ALIAS |
|
||||
| openmetadata.config.authentication.saml.security.keyStorePassword.secretRef | string | `Empty` | SAML_KEYSTORE_PASSWORD |
|
||||
| openmetadata.config.authentication.saml.security.keyStorePassword.secretKey | string | `Empty` | SAML_KEYSTORE_PASSWORD |
|
||||
| openmetadata.config.authorizer.enabled | bool | `true` | |
|
||||
| openmetadata.config.authorizer.allowedEmailRegistrationDomains | list | `[all]` | AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN |
|
||||
| openmetadata.config.authorizer.className | string | `org.openmetadata.service.security.DefaultAuthorizer` | AUTHORIZER_CLASS_NAME |
|
||||
| openmetadata.config.authorizer.containerRequestFilter | string | `org.openmetadata.service.security.JwtFilter` | AUTHORIZER_REQUEST_FILTER |
|
||||
| openmetadata.config.authorizer.enforcePrincipalDomain | bool | `false` | AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN |
|
||||
| openmetadata.config.authorizer.enableSecureSocketConnection | bool | `false` | AUTHORIZER_ENABLE_SECURE_SOCKET |
|
||||
| openmetadata.config.authorizer.initialAdmins | list | `[admin]` | AUTHORIZER_ADMIN_PRINCIPALS |
|
||||
| openmetadata.config.authorizer.allowedDomains | list | `[]` | AUTHORIZER_ALLOWED_DOMAINS |
|
||||
| openmetadata.config.authorizer.principalDomain | string | `open-metadata.org` | AUTHORIZER_PRINCIPAL_DOMAIN |
|
||||
| openmetadata.config.authorizer.useRolesFromProvider | bool | `false` | AUTHORIZER_USE_ROLES_FROM_PROVIDER |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.password.secretRef | string | `airflow-secrets` | AIRFLOW_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.password.secretKey | string | `openmetadata-airflow-password` | AIRFLOW_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.username | string | `admin` | AIRFLOW_USERNAME |
|
||||
| openmetadata.config.pipelineServiceClientConfig.enabled | bool | `true` | |
|
||||
| openmetadata.config.pipelineServiceClientConfig.host | string | `http://openmetadata-dependencies-web:8080` | PIPELINE_SERVICE_CLIENT_ENDPOINT |
|
||||
| openmetadata.config.pipelineServiceClientConfig.openmetadata.serverHostApiUrl | string | `http://openmetadata:8585/api` | SERVER_HOST_API_URL |
|
||||
| openmetadata.config.pipelineServiceClientConfig.sslCertificatePath | string | `/no/path` | PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH |
|
||||
| openmetadata.config.pipelineServiceClientConfig.verifySsl | string | `no-ssl` | PIPELINE_SERVICE_CLIENT_VERIFY_SSL |
|
||||
| openmetadata.config.clusterName | string | `openmetadata` | OPENMETADATA_CLUSTER_NAME |
|
||||
| openmetadata.config.database.enabled | bool | `true` | |
|
||||
| openmetadata.config.database.auth.password.secretRef | string | `mysql-secrets` | DB_USER_PASSWORD |
|
||||
| openmetadata.config.database.auth.password.secretKey | string | `openmetadata-mysql-password` | DB_USER_PASSWORD |
|
||||
| openmetadata.config.database.auth.username | string | `openmetadata_user` | DB_USER|
|
||||
| openmetadata.config.database.databaseName | string | `openmetadata_db` | OM_DATABASE |
|
||||
| openmetadata.config.database.dbParams| string | `allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC` | DB_PARAMS |
|
||||
| openmetadata.config.database.dbScheme| string | `mysql` | DB_SCHEME |
|
||||
| openmetadata.config.database.driverClass| string | `com.mysql.cj.jdbc.Driver` | DB_DRIVER_CLASS |
|
||||
| openmetadata.config.database.host | string | `mysql` | DB_HOST |
|
||||
| openmetadata.config.database.port | int | 3306 | DB_PORT |
|
||||
| openmetadata.config.elasticsearch.enabled | bool | `true` | |
|
||||
| openmetadata.config.elasticsearch.auth.enabled | bool | `false` | |
|
||||
| openmetadata.config.elasticsearch.auth.username | string | `elasticsearch` | ELASTICSEARCH_USER |
|
||||
| openmetadata.config.elasticsearch.auth.password.secretRef | string | `elasticsearch-secrets` | ELASTICSEARCH_PASSWORD |
|
||||
| openmetadata.config.elasticsearch.auth.password.secretKey | string | `openmetadata-elasticsearch-password` | ELASTICSEARCH_PASSWORD |
|
||||
| openmetadata.config.elasticsearch.host | string | `opensearch` | ELASTICSEARCH_HOST |
|
||||
| openmetadata.config.elasticsearch.keepAliveTimeoutSecs | int | `600` | ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS |
|
||||
| openmetadata.config.elasticsearch.payLoadSize | int | 10485760 | ELASTICSEARCH_PAYLOAD_BYTES_SIZE |
|
||||
| openmetadata.config.elasticsearch.port | int | 9200 | ELASTICSEARCH_PORT |
|
||||
| openmetadata.config.elasticsearch.searchType | string | `opensearch` | SEARCH_TYPE |
|
||||
| openmetadata.config.elasticsearch.scheme | string | `http` | ELASTICSEARCH_SCHEME |
|
||||
| openmetadata.config.elasticsearch.clusterAlias | string | `Empty String` | ELASTICSEARCH_CLUSTER_ALIAS |
|
||||
| openmetadata.config.elasticsearch.searchIndexMappingLanguage | string | `EN`| ELASTICSEARCH_INDEX_MAPPING_LANG |
|
||||
| openmetadata.config.elasticsearch.trustStore.enabled | bool | `false` | |
|
||||
| openmetadata.config.elasticsearch.trustStore.path | string | `Empty String` | ELASTICSEARCH_TRUST_STORE_PATH |
|
||||
| openmetadata.config.elasticsearch.trustStore.password.secretRef | string | `elasticsearch-truststore-secrets` | ELASTICSEARCH_TRUST_STORE_PASSWORD |
|
||||
| openmetadata.config.elasticsearch.trustStore.password.secretKey | string | `openmetadata-elasticsearch-truststore-password` | ELASTICSEARCH_TRUST_STORE_PASSWORD |
|
||||
| openmetadata.config.eventMonitor.enabled | bool | `true` | |
|
||||
| openmetadata.config.eventMonitor.type | string | `prometheus` | EVENT_MONITOR |
|
||||
| openmetadata.config.eventMonitor.batchSize | int | `10` | EVENT_MONITOR_BATCH_SIZE |
|
||||
| openmetadata.config.eventMonitor.pathPattern | list | `[/api/v1/tables/*,/api/v1/health-check]` | EVENT_MONITOR_PATH_PATTERN |
|
||||
| openmetadata.config.eventMonitor.latency | list | `[]` | EVENT_MONITOR_LATENCY |
|
||||
| openmetadata.config.fernetkey.value | string | `jJ/9sz0g0OHxsfxOoSfdFdmk3ysNmPRnH3TUAbz3IHA=` | FERNET_KEY |
|
||||
| openmetadata.config.fernetkey.secretRef | string | `` | FERNET_KEY |
|
||||
| openmetadata.config.fernetkey.secretKef | string | `` | FERNET_KEY |
|
||||
| openmetadata.config.jwtTokenConfiguration.enabled | bool | `true` | |
|
||||
| openmetadata.config.jwtTokenConfiguration.rsapublicKeyFilePath | string | `./conf/public_key.der` | RSA_PUBLIC_KEY_FILE_PATH |
|
||||
| openmetadata.config.jwtTokenConfiguration.rsaprivateKeyFilePath | string | `./conf/private_key.der` | RSA_PRIVATE_KEY_FILE_PATH |
|
||||
| openmetadata.config.jwtTokenConfiguration.jwtissuer | string | `open-metadata.org` | JWT_ISSUER |
|
||||
| openmetadata.config.jwtTokenConfiguration.keyId | string | `Gb389a-9f76-gdjs-a92j-0242bk94356` | JWT_KEY_ID |
|
||||
| openmetadata.config.logLevel | string | `INFO` | LOG_LEVEL |
|
||||
| openmetadata.config.openmetadata.adminPort | int | 8586 | SERVER_ADMIN_PORT |
|
||||
| openmetadata.config.openmetadata.maxThreads | int | 50 | SERVER_MAX_THREADS |
|
||||
| openmetadata.config.openmetadata.minThreads | int | 10 | SERVER_MIN_THREADS |
|
||||
| openmetadata.config.openmetadata.idleThreadTimeout | string | `1 minute` | SERVER_IDLE_THREAD_TIMEOUT |
|
||||
| openmetadata.config.openmetadata.host | string | `openmetadata` | OPENMETADATA_SERVER_URL |
|
||||
| openmetadata.config.openmetadata.port | int | 8585 | SERVER_PORT |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.password.secretRef | string | `airflow-secrets` | AIRFLOW_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.password.secretKey | string | `openmetadata-airflow-password` | AIRFLOW_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.username | string | `admin` | AIRFLOW_USERNAME |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.trustStorePath | string | `` | AIRFLOW_TRUST_STORE_PATH |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.trustStorePassword.secretRef | string | `` | AIRFLOW_TRUST_STORE_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.auth.trustStorePassword.secretKey | string | `` | AIRFLOW_TRUST_STORE_PASSWORD |
|
||||
| openmetadata.config.pipelineServiceClientConfig.apiEndpoint | string | `http://openmetadata-dependencies-web:8080` | PIPELINE_SERVICE_CLIENT_ENDPOINT |
|
||||
| openmetadata.config.pipelineServiceClientConfig.className | string | `org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient` | PIPELINE_SERVICE_CLIENT_CLASS_NAME |
|
||||
| openmetadata.config.pipelineServiceClientConfig.enabled | bool | `true` | PIPELINE_SERVICE_CLIENT_ENABLED |
|
||||
| openmetadata.config.pipelineServiceClientConfig.healthCheckInterval | int | `300` | PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL |
|
||||
| openmetadata.config.pipelineServiceClientConfig.ingestionIpInfoEnabled | bool | `false` | PIPELINE_SERVICE_IP_INFO_ENABLED |
|
||||
| openmetadata.config.pipelineServiceClientConfig.metadataApiEndpoint | string | `http://openmetadata:8585/api` | SERVER_HOST_API_URL |
|
||||
| openmetadata.config.pipelineServiceClientConfig.sslCertificatePath | string | `/no/path` | PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH |
|
||||
| openmetadata.config.pipelineServiceClientConfig.verifySsl | string | `no-ssl` | PIPELINE_SERVICE_CLIENT_VERIFY_SSL |
|
||||
| openmetadata.config.pipelineServiceClientConfig.hostIp | string | `Empty` | PIPELINE_SERVICE_CLIENT_HOST_IP |
|
||||
| openmetadata.config.secretsManager.enabled | bool | `true` | |
|
||||
| openmetadata.config.secretsManager.provider | string | `Empty String` | SECRET_MANAGER |
|
||||
| openmetadata.config.secretsManager.prefix | string | `Empty String` | SECRET_MANAGER_PREFIX |
|
||||
| openmetadata.config.secretsManager.tags | list | `[]` | SECRET_MANAGER_TAGS |
|
||||
| openmetadata.config.secretsManager.additionalParameters.enabled | bool | `false` | |
|
||||
| openmetadata.config.secretsManager.additionalParameters.accessKeyId.secretRef | string | `aws-access-key-secret` | OM_SM_ACCESS_KEY_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.accessKeyId.secretKey | string | `aws-key-secret` | OM_SM_ACCESS_KEY_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.clientId.secretRef | string | `azure-client-id-secret` | OM_SM_CLIENT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.clientId.secretKey | string | `azure-key-secret` | OM_SM_CLIENT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.clientSecret.secretRef | string | `azure-client-secret` | OM_SM_CLIENT_SECRET |
|
||||
| openmetadata.config.secretsManager.additionalParameters.clientSecret.secretKey | string | `azure-key-secret` | OM_SM_CLIENT_SECRET |
|
||||
| openmetadata.config.secretsManager.additionalParameters.tenantId.secretRef | string | `azure-tenant-id-secret` | OM_SM_TENANT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.tenantId.secretKey | string | `azure-key-secret` | OM_SM_TENANT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.vaultName.secretRef | string | `azure-vault-name-secret` | OM_SM_VAULT_NAME |
|
||||
| openmetadata.config.secretsManager.additionalParameters.vaultName.secretKey | string | `azure-key-secret` | OM_SM_VAULT_NAME |
|
||||
| openmetadata.config.secretsManager.additionalParameters.projectId.secretRef | string | `gcp-project-id-secret` | OM_SM_PROJECT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.projectId.secretKey | string | `gcp-key-secret` | OM_SM_PROJECT_ID |
|
||||
| openmetadata.config.secretsManager.additionalParameters.region | string | `Empty String` | OM_SM_REGION |
|
||||
| openmetadata.config.secretsManager.additionalParameters.secretAccessKey.secretRef | string | `aws-secret-access-key-secret` | OM_SM_ACCESS_KEY |
|
||||
| openmetadata.config.secretsManager.additionalParameters.secretAccessKey.secretKey | string | `aws-key-secret` | OM_SM_ACCESS_KEY |
|
||||
| openmetadata.config.upgradeMigrationConfigs.debug | bool | `false` | |
|
||||
| openmetadata.config.upgradeMigrationConfigs.additionalArgs | string | `Empty String` | |
|
||||
| openmetadata.config.deployPipelinesConfig.debug | bool | `false` | |
|
||||
| openmetadata.config.deployPipelinesConfig.additionalArgs | string | `Empty String` | |
|
||||
| openmetadata.config.reindexConfig.debug | bool | `false` | |
|
||||
| openmetadata.config.reindexConfig.additionalArgs | string | `Empty String` | |
|
||||
| openmetadata.config.web.enabled | bool | `true` | |
|
||||
| openmetadata.config.web.contentTypeOptions.enabled | bool | `false` | WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED |
|
||||
| openmetadata.config.web.csp.enabled | bool | `false` | WEB_CONF_XSS_CSP_ENABLED |
|
||||
| openmetadata.config.web.csp.policy | string | `default-src 'self` | WEB_CONF_XSS_CSP_POLICY |
|
||||
| openmetadata.config.web.csp.reportOnlyPolicy | string | `Empty String` | WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY |
|
||||
| openmetadata.config.web.frameOptions.enabled | bool | `false` | WEB_CONF_FRAME_OPTION_ENABLED |
|
||||
| openmetadata.config.web.frameOptions.option | string | `SAMEORIGIN` | WEB_CONF_FRAME_OPTION |
|
||||
| openmetadata.config.web.frameOptions.origin | string | `Empty String` | WEB_CONF_FRAME_ORIGIN |
|
||||
| openmetadata.config.web.hsts.enabled | bool | `false` | WEB_CONF_HSTS_ENABLED |
|
||||
| openmetadata.config.web.hsts.includeSubDomains | bool | `true` | WEB_CONF_HSTS_INCLUDE_SUBDOMAINS |
|
||||
| openmetadata.config.web.hsts.maxAge | string | `365 days` | WEB_CONF_HSTS_MAX_AGE |
|
||||
| openmetadata.config.web.hsts.preload | bool | `true` | WEB_CONF_HSTS_PRELOAD |
|
||||
| openmetadata.config.web.uriPath | string | `/api` | WEB_CONF_URI_PATH |
|
||||
| openmetadata.config.web.xssProtection.block | bool | `true` | WEB_CONF_XSS_PROTECTION_BLOCK |
|
||||
| openmetadata.config.web.xssProtection.enabled | bool | `false` | WEB_CONF_XSS_PROTECTION_ENABLED |
|
||||
| openmetadata.config.web.xssProtection.onXss | bool | `true` | WEB_CONF_XSS_PROTECTION_ON |
|
||||
| openmetadata.config.web.referrer-policy.enabled | bool | `false` | WEB_CONF_REFERRER_POLICY_ENABLED |
|
||||
| openmetadata.config.web.referrer-policy.option | string | `SAME_ORIGIN'` | WEB_CONF_REFERRER_POLICY_OPTION |
|
||||
| openmetadata.config.web.permission-policy.enabled | bool | `false` | WEB_CONF_PERMISSION_POLICY_ENABLED |
|
||||
| openmetadata.config.web.permission-policy.option | string | `Empty String` | WEB_CONF_PERMISSION_POLICY_OPTION |
|
||||
| openmetadata.config.rdf.enabled | bool | `false` | RDS_ENABLED |
|
||||
| openmetadata.config.rdf.baseUri | string | `https://open-metadata.org/` | RDF_BASE_URI |
|
||||
| openmetadata.config.rdf.storageType | string | `FUSEKI` | RDF_STORAGE_TYPE |
|
||||
| openmetadata.config.rdf.remoteEndpoint | string | `http://localhost:3030/openmetadata` | RDF_ENDPOINT |
|
||||
| openmetadata.config.rdf.username | string | `Empty String` | RDF_REMOTE_USERNAME |
|
||||
| openmetadata.config.rdf.password.secretRef | string | `Empty String` | RDF_REMOTE_PASSWORD |
|
||||
| openmetadata.config.rdf.password.secretKey | string | `Empty String` | RDF_REMOTE_PASSWORD |
|
||||
| openmetadata.config.rdf.dataset | string | `Empty String` | RDF_DATASET |
|
||||
|
||||
|
||||
## Chart Values
|
||||
|
||||
| Key | Type | Default |
|
||||
|-----|------|---------|
|
||||
| affinity | object | `{}` |
|
||||
| commonLabels | object | `{}` |
|
||||
| extraEnvs | Extra [environment variables][] which will be appended to the `env:` definition for the container | `[]` |
|
||||
| extraInitContainers | Templatable string of additional `initContainers` to be passed to `tpl` function | `[]` |
|
||||
| extraVolumes | Templatable string of additional `volumes` to be passed to the `tpl` function | `[]` |
|
||||
| extraVolumeMounts | Templatable string of additional `volumeMounts` to be passed to the `tpl` function | `[]` |
|
||||
| fullnameOverride | string | `"openmetadata"` |
|
||||
| image.pullPolicy | string | `"Always"` |
|
||||
| image.repository | string | `"docker.getcollate.io/openmetadata/server"` |
|
||||
| image.tag | string | `1.12.1` |
|
||||
| imagePullSecrets | list | `[]` |
|
||||
| ingress.annotations | object | `{}` |
|
||||
| ingress.className | string | `""` |
|
||||
| ingress.enabled | bool | `false` |
|
||||
| ingress.hosts[0].host | string | `"open-metadata.local"` |
|
||||
| ingress.hosts[0].paths[0].path | string | `"/"` |
|
||||
| ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` |
|
||||
| ingress.tls | list | `[]` |
|
||||
| livenessProbe.initialDelaySeconds | int | `60` |
|
||||
| livenessProbe.periodSeconds | int | `30` |
|
||||
| livenessProbe.failureThreshold | int | `5` |
|
||||
| livenessProbe.httpGet.path | string | `/healthcheck` |
|
||||
| livenessProbe.httpGet.port | string | `http-admin` |
|
||||
| nameOverride | string | `""` |
|
||||
| nodeSelector | object | `{}` |
|
||||
| podAnnotations | object | `{}` |
|
||||
| podSecurityContext | object | `{}` |
|
||||
| readinessProbe.initialDelaySeconds | int | `60` |
|
||||
| readinessProbe.periodSeconds | int | `30` |
|
||||
| readinessProbe.failureThreshold | int | `5` |
|
||||
| readinessProbe.httpGet.path | string | `/` |
|
||||
| readinessProbe.httpGet.port | string | `http` |
|
||||
| replicaCount | int | `1` |
|
||||
| resources | object | `{}` |
|
||||
| startingDeadlineSeconds | int | `100` |
|
||||
| testConnection.resources | object | `{}` |
|
||||
| securityContext | object | `{}` |
|
||||
| service.adminPort | string | `8586` |
|
||||
| service.annotations | object | `{}` |
|
||||
| service.port | int | `8585` |
|
||||
| service.type | string | `"ClusterIP"` |
|
||||
| serviceAccount.annotations | object | `{}` |
|
||||
| serviceAccount.create | bool | `true` |
|
||||
| serviceAccount.name | string | `nil` |
|
||||
| automountServiceAccountToken| bool | `true` |
|
||||
| serviceMonitor.annotations | object | `{}` |
|
||||
| serviceMonitor.enabled | bool | `false` |
|
||||
| serviceMonitor.interval | string | `30s` |
|
||||
| serviceMonitor.labels | object | `{}` |
|
||||
| sidecars | list | `[]` |
|
||||
| startupProbe.periodSeconds | int | `60` |
|
||||
| startupProbe.failureThreshold | int | `5` |
|
||||
| startupProbe.httpGet.path | string | `/healthcheck` |
|
||||
| startupProbe.httpGet.port | string | `http-admin` |
|
||||
| startupProbe.successThreshold | int | `1` |
|
||||
| tolerations | list | `[]` |
|
||||
| networkPolicy.enabled | bool |`false` |
|
||||
| podDisruptionBudget.enabled | bool | `false` |
|
||||
| podDisruptionBudget.config.maxUnavailable | String | `1` |
|
||||
| podDisruptionBudget.config.minAvailable | String | `1` |
|
||||
| openmetadata.config.deployPipelinesConfig.enabled | bool | `true` |
|
||||
| openmetadata.config.reindexConfig.enabled | bool | `true` |
|
||||
|
||||
---
|
||||
|
||||
## 🚨 BREAKING CHANGES
|
||||
|
||||
### Pipeline Service Client Configuration Restructure (v1.4.0+)
|
||||
|
||||
**Important**: The pipeline service client configuration structure has been **completely restructured** to support both Airflow and native Kubernetes Jobs execution.
|
||||
|
||||
#### What Changed
|
||||
|
||||
The previous flat configuration structure:
|
||||
```yaml
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
|
||||
apiEndpoint: http://openmetadata-dependencies-api-server:8080
|
||||
# ... other airflow specific configs
|
||||
```
|
||||
|
||||
Has been replaced with a nested structure:
|
||||
```yaml
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
type: "airflow" # NEW: choose "airflow" or "k8s"
|
||||
airflow: # NEW: airflow configs nested here
|
||||
className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
|
||||
apiEndpoint: http://openmetadata-dependencies-api-server:8080
|
||||
# ... other airflow configs
|
||||
k8s: # NEW: k8s configs for native execution
|
||||
className: "org.openmetadata.service.clients.pipeline.k8s.K8sPipelineClient"
|
||||
namespace: "openmetadata-pipelines"
|
||||
# ... other k8s configs
|
||||
```
|
||||
|
||||
#### Migration Guide
|
||||
|
||||
##### For Existing Airflow Users (Recommended)
|
||||
|
||||
1. **Update your `values.yaml`** to use the new nested structure:
|
||||
|
||||
```yaml
|
||||
# OLD (will break in v1.4.0+)
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
|
||||
apiEndpoint: http://openmetadata-dependencies-api-server:8080
|
||||
metadataApiEndpoint: http://openmetadata:8585/api
|
||||
verifySsl: "no-ssl"
|
||||
# ... other configs
|
||||
|
||||
# NEW (v1.4.0+)
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
type: "airflow" # Explicitly choose airflow
|
||||
airflow:
|
||||
className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
|
||||
apiEndpoint: http://openmetadata-dependencies-api-server:8080
|
||||
metadataApiEndpoint: http://openmetadata:8585/api
|
||||
verifySsl: "no-ssl"
|
||||
# ... move all existing configs under 'airflow:'
|
||||
```
|
||||
|
||||
2. **No infrastructure changes needed** - your existing Airflow setup will continue to work
|
||||
|
||||
##### For New Kubernetes Native Users
|
||||
|
||||
Use the new Kubernetes Jobs pipeline client for cloud-native execution without Airflow:
|
||||
|
||||
```yaml
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
type: "k8s" # Use native Kubernetes Jobs
|
||||
k8s:
|
||||
className: "org.openmetadata.service.clients.pipeline.k8s.K8sPipelineClient"
|
||||
namespace: "openmetadata-pipelines"
|
||||
ingestionImage: "docker.getcollate.io/openmetadata/ingestion:latest"
|
||||
enableFailureDiagnostics: true
|
||||
# ... see K8s configuration section below
|
||||
```
|
||||
|
||||
#### Configuration Migration Script
|
||||
|
||||
For complex deployments, use this script to migrate your values.yaml:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# migrate-pipeline-config.sh
|
||||
|
||||
# Backup original values
|
||||
cp values.yaml values.yaml.backup
|
||||
|
||||
# Migrate configuration (requires yq)
|
||||
yq eval '
|
||||
.openmetadata.config.pipelineServiceClientConfig.type = "airflow" |
|
||||
.openmetadata.config.pipelineServiceClientConfig.airflow = .openmetadata.config.pipelineServiceClientConfig |
|
||||
del(.openmetadata.config.pipelineServiceClientConfig.enabled) |
|
||||
del(.openmetadata.config.pipelineServiceClientConfig.type) |
|
||||
.openmetadata.config.pipelineServiceClientConfig.enabled = true
|
||||
' values.yaml > values.yaml.migrated
|
||||
|
||||
mv values.yaml.migrated values.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Kubernetes Native Pipeline Execution
|
||||
|
||||
### Overview
|
||||
|
||||
OpenMetadata now supports native Kubernetes Jobs execution as an alternative to Apache Airflow. This eliminates the need for a separate Airflow deployment and provides:
|
||||
|
||||
- **Simplified Architecture**: No Airflow dependency
|
||||
- **Cloud-Native**: Leverages Kubernetes Job scheduling
|
||||
- **Better Resource Management**: Per-pipeline resource allocation
|
||||
- **Failure Diagnostics**: Automatic pod log collection and error reporting
|
||||
- **Security**: Pod-level isolation with RBAC
|
||||
|
||||
### Configuration
|
||||
|
||||
To use Kubernetes native pipeline execution:
|
||||
|
||||
```yaml
|
||||
openmetadata:
|
||||
config:
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
type: "k8s"
|
||||
k8s:
|
||||
# Core configuration
|
||||
className: "org.openmetadata.service.clients.pipeline.k8s.K8sPipelineClient"
|
||||
namespace: "openmetadata-pipelines"
|
||||
ingestionImage: "docker.getcollate.io/openmetadata/ingestion:latest"
|
||||
|
||||
# Resource management
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: "4Gi"
|
||||
requests:
|
||||
cpu: "500m"
|
||||
memory: "1Gi"
|
||||
|
||||
# Security context
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
|
||||
# Failure diagnostics
|
||||
enableFailureDiagnostics: true
|
||||
|
||||
# Job configuration
|
||||
ttlSecondsAfterFinished: 86400 # 24 hours
|
||||
activeDeadlineSeconds: 7200 # 2 hours max runtime
|
||||
backoffLimit: 3 # retry attempts
|
||||
```
|
||||
|
||||
### K8s Pipeline Configuration Reference
|
||||
|
||||
| Parameter | Default | Description |
|
||||
|-----------|---------|-------------|
|
||||
| `k8s.namespace` | `openmetadata-pipelines` | Kubernetes namespace for pipeline jobs |
|
||||
| `k8s.ingestionImage` | `docker.getcollate.io/openmetadata/ingestion:latest` | Container image for ingestion jobs |
|
||||
| `k8s.imagePullPolicy` | `IfNotPresent` | Image pull policy |
|
||||
| `k8s.imagePullSecrets` | `""` | Image pull secrets (comma-separated) |
|
||||
| `k8s.serviceAccountName` | `openmetadata-ingestion` | Service account for ingestion jobs |
|
||||
| `k8s.ttlSecondsAfterFinished` | `86400` | Time to keep completed jobs (24h) |
|
||||
| `k8s.activeDeadlineSeconds` | `7200` | Maximum job runtime (2h) |
|
||||
| `k8s.backoffLimit` | `3` | Maximum retry attempts |
|
||||
| `k8s.successfulJobsHistoryLimit` | `3` | Keep last N successful jobs |
|
||||
| `k8s.failedJobsHistoryLimit` | `3` | Keep last N failed jobs |
|
||||
| `k8s.enableFailureDiagnostics` | `true` | Enable automatic failure analysis |
|
||||
|
||||
### RBAC and Security
|
||||
|
||||
The chart automatically creates the required RBAC resources when using `type: "k8s"`:
|
||||
|
||||
- **Namespace**: `openmetadata-pipelines` (or configured namespace)
|
||||
- **ServiceAccount**: `openmetadata-ingestion`
|
||||
- **Role**: Permissions for Jobs, CronJobs, ConfigMaps, Secrets, Pods, Events
|
||||
- **RoleBinding**: Binds the role to the service account
|
||||
|
||||
### Failure Diagnostics
|
||||
|
||||
When enabled, the K8s pipeline client automatically:
|
||||
|
||||
1. **Detects job failures** in real-time
|
||||
2. **Creates diagnostic jobs** that gather failure information
|
||||
3. **Collects pod logs** (last 500 lines) from failed containers
|
||||
4. **Gathers pod status** including exit codes and termination reasons
|
||||
5. **Fetches Kubernetes events** related to the failed pod
|
||||
6. **Updates pipeline status** in OpenMetadata with comprehensive diagnostics
|
||||
|
||||
Example diagnostic output:
|
||||
```yaml
|
||||
failures:
|
||||
- name: "Main Container Diagnostics"
|
||||
error: "Kubernetes job failed - check logs for details"
|
||||
stackTrace: |
|
||||
Pod Description:
|
||||
Pod: om-pipeline-postgres-abc123
|
||||
Status: Failed
|
||||
Container Statuses:
|
||||
ingestion: Ready=false, RestartCount=0
|
||||
State: Terminated - Reason: Error, ExitCode: 1
|
||||
|
||||
Pod Logs:
|
||||
2024-01-07 16:30:15,123 INFO Starting ingestion pipeline...
|
||||
2024-01-07 16:30:16,456 ERROR Failed to connect to database
|
||||
...
|
||||
```
|
||||
|
||||
### Migration from Airflow to K8s
|
||||
|
||||
To migrate from Airflow to Kubernetes native execution:
|
||||
|
||||
1. **Update configuration** to use `type: "k8s"`
|
||||
2. **Deploy the updated chart** - RBAC resources will be created automatically
|
||||
3. **Test with a simple pipeline** to verify functionality
|
||||
4. **Gradually migrate pipelines** or switch completely
|
||||
5. **Remove Airflow dependencies** when no longer needed
|
||||
|
||||
### Comparison: Airflow vs K8s Native
|
||||
|
||||
| Aspect | Airflow | K8s Native |
|
||||
|--------|---------|------------|
|
||||
| **Dependencies** | Requires separate Airflow deployment | No external dependencies |
|
||||
| **Resource Usage** | Always-on Airflow webserver + scheduler | On-demand job execution |
|
||||
| **Scaling** | Airflow worker scaling | Kubernetes node scaling |
|
||||
| **Monitoring** | Airflow UI + OpenMetadata | OpenMetadata + kubectl |
|
||||
| **Debugging** | Airflow logs + OpenMetadata | Pod logs + diagnostics in OpenMetadata |
|
||||
| **Security** | Airflow RBAC + K8s RBAC | K8s RBAC only |
|
||||
| **Maintenance** | Airflow upgrades + configuration | Minimal (K8s Job API stable) |
|
||||
|
||||
### Troubleshooting K8s Pipelines
|
||||
|
||||
Common issues and solutions:
|
||||
|
||||
```bash
|
||||
# Check pipeline jobs
|
||||
kubectl get jobs -n openmetadata-pipelines
|
||||
|
||||
# View job logs
|
||||
kubectl logs -n openmetadata-pipelines job/om-pipeline-<name>-<runId>
|
||||
|
||||
# Check service account permissions
|
||||
kubectl auth can-i create jobs \
|
||||
--as=system:serviceaccount:openmetadata-pipelines:openmetadata-ingestion \
|
||||
-n openmetadata-pipelines
|
||||
|
||||
# View RBAC resources
|
||||
kubectl get serviceaccounts,roles,rolebindings \
|
||||
-n openmetadata-pipelines \
|
||||
-l app.kubernetes.io/component=ingestion
|
||||
```
|
||||
@@ -0,0 +1,97 @@
|
||||
openmetadata:
|
||||
config:
|
||||
authorizer:
|
||||
className: "org.openmetadata.service.security.DefaultAuthorizer"
|
||||
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
|
||||
initialAdmins: # john.doe from john.doe@example.com
|
||||
- "admin"
|
||||
- "paasup"
|
||||
principalDomain: "paasup.io" # Update with your Domain,The primary domain for the organization (example.com from john.doe@example.com).
|
||||
allowedDomains:
|
||||
- "paasup.io"
|
||||
|
||||
authentication:
|
||||
provider: "basic"
|
||||
# HTTPS로 변경: 프론트엔드가 외부 HTTPS URL로 JWT 검증
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
authority: "https://open-metadata.example.org"
|
||||
publicKeys:
|
||||
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
||||
|
||||
# OIDC 연동 (비활성화)
|
||||
clientType: confidential
|
||||
provider: "custom-oidc"
|
||||
publicKeys:
|
||||
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
||||
- "https://keycloak.example.org/realms/paasup/protocol/openid-connect/certs"
|
||||
clientId: "open-metadata"
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
jwtPrincipalClaims:
|
||||
- "email"
|
||||
- "preferred_username"
|
||||
- "sub"
|
||||
oidcConfiguration:
|
||||
enabled: true
|
||||
oidcType: "Keycloak"
|
||||
clientId:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-id
|
||||
clientSecret:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-secret
|
||||
discoveryUri: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
|
||||
serverUrl: "https://open-metadata.example.org"
|
||||
callbackUrl: "https://open-metadata.example.org/callback"
|
||||
tokenValidity: "3600"
|
||||
sessionExpiry: "604800"
|
||||
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: "kong"
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: root-ca-issuer
|
||||
cert-manager.io/duration: 8760h
|
||||
cert-manager.io/renew-before: 720h
|
||||
# HTTPS 활성화: Kong이 TLS 종료 후 HTTP로 pod에 전달
|
||||
konghq.com/protocols: https
|
||||
konghq.com/https-redirect-status-code: "301"
|
||||
# cookie-secure-modifier 제거: forward-headers-strategy=NATIVE로 Spring Boot가 자동 처리
|
||||
# konghq.com/plugins: openmetadata-cors
|
||||
hosts:
|
||||
- host: open-metadata.example.org
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- secretName: openmetadata-tls
|
||||
hosts:
|
||||
- open-metadata.example.org
|
||||
|
||||
extraVolumes:
|
||||
- name: java-truststore
|
||||
secret:
|
||||
secretName: java-truststore
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: java-truststore
|
||||
mountPath: /etc/ssl/java
|
||||
readOnly: true
|
||||
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 1
|
||||
# memory: 2048Mi
|
||||
# requests:
|
||||
# cpu: 500m
|
||||
# memory: 1024Mi
|
||||
|
||||
extraEnvs:
|
||||
- name: OPENMETADATA_OPTS
|
||||
value: >
|
||||
-Djavax.net.ssl.trustStore=/etc/ssl/java/cacerts
|
||||
-Djavax.net.ssl.trustStorePassword=changeit
|
||||
- name: LOG_LEVEL
|
||||
value: "INFO"
|
||||
- name: "OPENMETADATA_PUBLIC_URL"
|
||||
value: "https://open-metadata.example.org"
|
||||
@@ -0,0 +1,22 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "OpenMetadata.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "OpenMetadata.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "OpenMetadata.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "OpenMetadata.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8585 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8585:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "tplvalues.render" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,391 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "OpenMetadata.labels" -}}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{ toYaml .}}
|
||||
{{- end }}
|
||||
helm.sh/chart: {{ include "OpenMetadata.chart" . }}
|
||||
{{ include "OpenMetadata.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "OpenMetadata.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "OpenMetadata.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "OpenMetadata.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "OpenMetadata.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" (tpl .Values.serviceAccount.name .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Quoted Array of strings with base64 encoding
|
||||
*/}}
|
||||
{{- define "OpenMetadata.commaJoinedQuotedEncodedList" }}
|
||||
{{- $list := list }}
|
||||
{{- range .value }}
|
||||
{{- $list = append $list (. | quote ) }}
|
||||
{{- end }}
|
||||
{{- $list := join "," $list | toString }}
|
||||
{{- $list := printf "[%s]" $list }}
|
||||
{{- $list | b64enc }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Migration Command */}}
|
||||
{{- define "OpenMetadata.buildUpgradeCommand" }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.upgradeMigrationConfigs.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d migrate {{ .Values.openmetadata.config.upgradeMigrationConfigs.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh migrate {{ .Values.openmetadata.config.upgradeMigrationConfigs.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Warning to update openmetadata global keyword to openmetadata.config */}}
|
||||
{{- define "error-message" }}
|
||||
{{- printf "Error: %s" . | fail }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Function to check if passed value is empty string or null value */}}
|
||||
{{- define "OpenMetadata.utils.checkEmptyString" -}}
|
||||
{{- if or (empty .) (eq . "") -}}
|
||||
{{- false -}}
|
||||
{{- else -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations AWS Additional Parameters Environment Variables for Secret Manager*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.aws.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.accessKeyId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.secretAccessKey }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations Azure Additional Parameters Environment Variables for Secret Manager
|
||||
*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.azure.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.clientId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.clientSecret }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.tenantId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_TENANT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.vaultName }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_VAULT_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations GCP Additional Parameters Environment Variables for Secret Manager
|
||||
*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.gcp.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.projectId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_PROJECT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations Environment Variables*/}}
|
||||
{{- define "OpenMetadata.configs" -}}
|
||||
{{- if .Values.openmetadata.config.fernetkey.secretRef -}}
|
||||
{{- with .Values.openmetadata.config.fernetkey -}}
|
||||
- name: FERNET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.openmetadata.config.authentication.clientType "confidential") (.Values.openmetadata.config.authentication.oidcConfiguration.enabled) }}
|
||||
{{- with .Values.openmetadata.config.authentication.oidcConfiguration.clientId }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.authentication.oidcConfiguration.clientSecret }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.openmetadata.config.authentication.provider "ldap" }}
|
||||
{{- if .Values.openmetadata.config.authentication.ldapConfiguration.dnAdminPassword.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.ldapConfiguration.dnAdminPassword }}
|
||||
- name: AUTHENTICATION_LOOKUP_ADMIN_PWD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( eq .Values.openmetadata.config.authentication.ldapConfiguration.truststoreConfigType "CustomTrustStore" ) ( .Values.openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword }}
|
||||
- name: AUTHENTICATION_LDAP_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.openmetadata.config.authentication.provider "saml" }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.idp.idpX509Certificate.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.idp.idpX509Certificate }}
|
||||
- name: SAML_IDP_CERTIFICATE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.sp.spX509Certificate.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.sp.spX509Certificate }}
|
||||
- name: SAML_SP_CERTIFICATE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.sp.spPrivateKey.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.sp.spPrivateKey }}
|
||||
- name: SAML_SP_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.wantAssertionEncrypted }}
|
||||
# Key Store should only be considered if wantAssertionEncrypted will be true
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.keyStoreAlias.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.security.keyStoreAlias }}
|
||||
- name: SAML_KEYSTORE_ALIAS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.keyStorePassword.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.security.keyStorePassword }}
|
||||
- name: SAML_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( .Values.openmetadata.config.elasticsearch.auth.enabled ) ( .Values.openmetadata.config.elasticsearch.auth.password.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.elasticsearch.auth.password }}
|
||||
- name: ELASTICSEARCH_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( .Values.openmetadata.config.elasticsearch.trustStore.enabled ) ( .Values.openmetadata.config.elasticsearch.trustStore.password.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.elasticsearch.trustStore.password }}
|
||||
- name: ELASTICSEARCH_TRUST_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.database.auth.password.secretRef }}
|
||||
{{- with .Values.openmetadata.config.database.auth.password }}
|
||||
- name: DB_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $pipelineConfig := .Values.openmetadata.config.pipelineServiceClientConfig }}
|
||||
{{- $authConfig := dict }}
|
||||
{{- if and $pipelineConfig.type (eq $pipelineConfig.type "airflow") }}
|
||||
{{- $authConfig = $pipelineConfig.airflow.auth | default dict }}
|
||||
{{- else }}
|
||||
{{- $authConfig = $pipelineConfig.auth | default dict }}
|
||||
{{- end }}
|
||||
{{- if and ($pipelineConfig.enabled | default true) ($authConfig.enabled | default false) }}
|
||||
{{- if $authConfig.password.secretRef }}
|
||||
{{- with $authConfig.password }}
|
||||
- name: AIRFLOW_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $authConfig.trustStorePassword.secretRef }}
|
||||
{{- with $authConfig.trustStorePassword }}
|
||||
- name: AIRFLOW_TRUST_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.additionalParameters.enabled }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "aws" "aws-ssm" "managed-aws" "managed-aws-ssm") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.aws.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "managed-azure-kv" "azure-kv") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.azure.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "gcp") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.gcp.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
{{- if .Values.openmetadata.config.rdf.password.secretRef }}
|
||||
{{- with .Values.openmetadata.config.rdf.password }}
|
||||
- name: RDF_REMOTE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Deploy Pipelines Command using deployPipelinesConfig */}}
|
||||
{{- define "OpenMetadata.buildDeployPipelinesCommand" }}
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.deployPipelinesConfig.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d deploy-pipelines {{ default "" .Values.openmetadata.config.deployPipelinesConfig.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh deploy-pipelines {{ default "" .Values.openmetadata.config.deployPipelinesConfig.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Deploy Pipelines Command using reindexConfig */}}
|
||||
{{- define "OpenMetadata.buildReindexCommand" }}
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.reindexConfig.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d reindex {{ default "" .Values.openmetadata.config.reindexConfig.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh reindex {{ default "" .Values.openmetadata.config.reindexConfig.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- if .Values.openmetadata.config.deployPipelinesConfig.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: cron-deploy-pipelines
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
suspend: true
|
||||
failedJobsHistoryLimit: 1
|
||||
successfulJobsHistoryLimit: 1
|
||||
jobTemplate:
|
||||
metadata:
|
||||
name: cron-deploy-pipelines
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 12 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 12 }}
|
||||
containers:
|
||||
- name: cron-deploy-pipelines
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
{{ include "OpenMetadata.buildDeployPipelinesCommand" . | nindent 12 }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 12 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
schedule: "0/5 * * * *"
|
||||
{{- if ne .Values.startingDeadlineSeconds nil }}
|
||||
startingDeadlineSeconds: {{ .Values.startingDeadlineSeconds }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- if .Values.openmetadata.config.reindexConfig.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: cron-reindex
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
suspend: true
|
||||
failedJobsHistoryLimit: 1
|
||||
successfulJobsHistoryLimit: 1
|
||||
jobTemplate:
|
||||
metadata:
|
||||
name: cron-reindex
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 12 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 12 }}
|
||||
containers:
|
||||
- name: cron-reindex
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
{{ include "OpenMetadata.buildReindexCommand" . | nindent 12 }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 12 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
schedule: "0/5 * * * *"
|
||||
{{- if ne .Values.startingDeadlineSeconds nil }}
|
||||
startingDeadlineSeconds: {{ .Values.startingDeadlineSeconds }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,350 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: cronomjobs.pipelines.openmetadata.org
|
||||
spec:
|
||||
group: pipelines.openmetadata.org
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
schedule:
|
||||
type: string
|
||||
description: "Cron schedule expression"
|
||||
timeZone:
|
||||
type: string
|
||||
description: "Time zone for the schedule (default UTC)"
|
||||
default: "UTC"
|
||||
suspend:
|
||||
type: boolean
|
||||
description: "Whether to suspend scheduling"
|
||||
default: false
|
||||
startingDeadlineSeconds:
|
||||
type: integer
|
||||
description: "Deadline for starting the job if missed"
|
||||
successfulJobsHistoryLimit:
|
||||
type: integer
|
||||
description: "Number of successful jobs to keep"
|
||||
default: 3
|
||||
failedJobsHistoryLimit:
|
||||
type: integer
|
||||
description: "Number of failed jobs to keep"
|
||||
default: 3
|
||||
omJobSpec:
|
||||
type: object
|
||||
description: "OMJob template to create for each scheduled run"
|
||||
properties:
|
||||
mainPodSpec:
|
||||
type: object
|
||||
description: "Pod specification for the main ingestion job"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the ingestion job"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the pod"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the container"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "serviceAccountName", "command"]
|
||||
exitHandlerSpec:
|
||||
type: object
|
||||
description: "Pod specification for the exit handler job (runs after main pod completes)"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the exit handler"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the exit handler container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the exit handler container"
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the exit handler pod"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the exit handler pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "command"]
|
||||
ttlSecondsAfterFinished:
|
||||
type: integer
|
||||
description: "Time in seconds to keep pods after completion"
|
||||
default: 86400
|
||||
required: ["mainPodSpec"]
|
||||
required: ["schedule", "omJobSpec"]
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
lastScheduleTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Last time the CronOMJob was scheduled"
|
||||
lastOMJobName:
|
||||
type: string
|
||||
description: "Name of the last OMJob created"
|
||||
message:
|
||||
type: string
|
||||
description: "Human-readable message about the current status"
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Schedule
|
||||
type: string
|
||||
jsonPath: .spec.schedule
|
||||
- name: Suspended
|
||||
type: boolean
|
||||
jsonPath: .spec.suspend
|
||||
- name: Last Schedule
|
||||
type: date
|
||||
jsonPath: .status.lastScheduleTime
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: cronomjobs
|
||||
singular: cronomjob
|
||||
kind: CronOMJob
|
||||
shortNames:
|
||||
- comj
|
||||
{{- end }}
|
||||
@@ -0,0 +1,221 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.hpa.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- with .Values.preMigrateInitContainers }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
- name: run-db-migrations
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{ include "OpenMetadata.buildUpgradeCommand" . | nindent 8 }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-rdf-secret
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 8 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraInitContainers }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.openmetadata.config.openmetadata.port }}
|
||||
protocol: TCP
|
||||
- name: http-admin
|
||||
containerPort: {{ .Values.openmetadata.config.openmetadata.adminPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
{{ .Values.livenessProbe | toYaml | indent 12 | trim }}
|
||||
readinessProbe:
|
||||
{{ .Values.readinessProbe | toYaml | indent 12 | trim }}
|
||||
startupProbe:
|
||||
{{ .Values.startupProbe | toYaml | indent 12 | trim }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 10 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if .Values.hpa.enabled -}}
|
||||
apiVersion: {{ .Values.hpa.apiVersion }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-hpa
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
{{- with .Values.hpa.behavior }}
|
||||
behavior:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
metrics:
|
||||
{{- toYaml .Values.hpa.metrics | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,64 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "OpenMetadata.fullname" . -}}
|
||||
{{- $svcPort := .Values.service.port -}}
|
||||
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
||||
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
||||
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- if semverCompare "=<1.13-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
datree.skip/K8S_DEPRECATED_APIVERSION_1.16: "Ignore that deprecation in old kubernetes instances"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
pathType: {{ .pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,133 @@
|
||||
{{- if and .Values.openmetadata.config.pipelineServiceClientConfig.enabled (eq .Values.openmetadata.config.pipelineServiceClientConfig.type "k8s") }}
|
||||
{{- $namespace := .Release.Namespace }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.k8s.rbac.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if .Values.serviceAccount.annotations }}
|
||||
{{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Pod management for pipeline jobs and diagnostics
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# ConfigMaps for pipeline configuration
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Secrets for pipeline credentials
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Events for diagnostics (optional - failure diagnostics will work without this)
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "list"]
|
||||
# Jobs and CronJobs management
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# Cross-namespace Role for OpenMetadata server to manage pipeline jobs
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: openmetadata-server-pipeline-manager
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: server
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Pod management for pipeline jobs and diagnostics
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# ConfigMaps for pipeline configuration
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Secrets for pipeline credentials
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Events for diagnostics (optional - failure diagnostics will work without this)
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "list"]
|
||||
# Jobs and CronJobs management
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# OMJob management for K8s pipeline client
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["omjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["omjobs/status"]
|
||||
verbs: ["get", "patch"]
|
||||
# CronOMJob management for K8s pipeline client (scheduled jobs)
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["cronomjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["cronomjobs/status"]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
# RoleBinding for OpenMetadata server to manage pipeline resources
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: openmetadata-server-pipeline-manager
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: server
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: openmetadata-server-pipeline-manager
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-networkpolicy
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels: {{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
# Allow inbound connections
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.service.adminPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
@@ -0,0 +1,337 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: omjobs.pipelines.openmetadata.org
|
||||
spec:
|
||||
group: pipelines.openmetadata.org
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
mainPodSpec:
|
||||
type: object
|
||||
description: "Pod specification for the main ingestion job"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the ingestion job"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the pod"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the container"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "serviceAccountName", "command"]
|
||||
exitHandlerSpec:
|
||||
type: object
|
||||
description: "Pod specification for the exit handler job (runs after main pod completes)"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the exit handler"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the exit handler container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the exit handler container"
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the exit handler pod"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the exit handler pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "command"]
|
||||
ttlSecondsAfterFinished:
|
||||
type: integer
|
||||
description: "Time in seconds to keep pods after completion"
|
||||
default: 86400
|
||||
required: ["mainPodSpec"]
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
phase:
|
||||
type: string
|
||||
description: "Current phase of the OMJob"
|
||||
enum: ["Pending", "Running", "ExitHandlerRunning", "Succeeded", "Failed"]
|
||||
mainPodName:
|
||||
type: string
|
||||
description: "Name of the main pod"
|
||||
exitHandlerPodName:
|
||||
type: string
|
||||
description: "Name of the exit handler pod"
|
||||
startTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Time when the job started"
|
||||
completionTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Time when the job completed"
|
||||
message:
|
||||
type: string
|
||||
description: "Human-readable message about the current status"
|
||||
mainPodExitCode:
|
||||
type: integer
|
||||
description: "Exit code of the main pod"
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Phase
|
||||
type: string
|
||||
jsonPath: .status.phase
|
||||
- name: Main Pod
|
||||
type: string
|
||||
jsonPath: .status.mainPodName
|
||||
- name: Exit Handler
|
||||
type: string
|
||||
jsonPath: .status.exitHandlerPodName
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: omjobs
|
||||
singular: omjob
|
||||
kind: OMJob
|
||||
shortNames:
|
||||
- omj
|
||||
{{- end }}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-config
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
data:
|
||||
operator.yaml: |
|
||||
# Operator configuration
|
||||
reconciliation:
|
||||
interval: 10s # How often to reconcile OMJobs
|
||||
retryDelay: 30s # Delay before retrying failed reconciliation
|
||||
|
||||
# Pod cleanup settings
|
||||
cleanup:
|
||||
ttlSecondsAfterFinished: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.ttlSecondsAfterFinished | default 604800 }}
|
||||
preserveFailedPods: true # Keep failed pods for debugging
|
||||
|
||||
# Exit handler configuration (image and command come from OMJob spec)
|
||||
exitHandler:
|
||||
timeout: 120 # Seconds to wait for exit handler to complete
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
|
||||
# Security context defaults (matches openmetadata.yaml structure)
|
||||
securityContext:
|
||||
runAsNonRoot: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsNonRoot | default true }}
|
||||
runAsUser: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsUser | default 1000 }}
|
||||
runAsGroup: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsGroup | default 1000 }}
|
||||
fsGroup: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.fsGroup | default 1000 }}
|
||||
|
||||
# Logging configuration
|
||||
logging:
|
||||
level: INFO
|
||||
format: json
|
||||
{{- end }}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
spec:
|
||||
serviceAccountName: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: "{{ .Values.omjobOperator.image.repository }}:{{ .Values.omjobOperator.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.omjobOperator.image.pullPolicy }}
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LOG_LEVEL
|
||||
value: {{ .Values.omjobOperator.env.logLevel | quote }}
|
||||
- name: RECONCILIATION_THREADS
|
||||
value: {{ .Values.omjobOperator.env.reconciliationThreads | quote }}
|
||||
- name: HEALTH_CHECK_PORT
|
||||
value: {{ .Values.omjobOperator.env.healthCheckPort | quote }}
|
||||
- name: METRICS_PORT
|
||||
value: {{ .Values.omjobOperator.env.metricsPort | quote }}
|
||||
- name: WATCH_NAMESPACES
|
||||
value: {{ .Values.omjobOperator.env.watchNamespaces | quote }}
|
||||
- name: POLLING_INTERVAL_SECONDS
|
||||
value: {{ .Values.omjobOperator.env.pollingIntervalSeconds | quote }}
|
||||
- name: REQUEUE_DELAY_SECONDS
|
||||
value: {{ .Values.omjobOperator.env.requeueDelaySeconds | quote }}
|
||||
ports:
|
||||
- name: health
|
||||
containerPort: {{ .Values.omjobOperator.env.healthCheckPort }}
|
||||
protocol: TCP
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.omjobOperator.env.metricsPort }}
|
||||
protocol: TCP
|
||||
resources:
|
||||
{{- toYaml .Values.omjobOperator.resources | nindent 10 }}
|
||||
{{- if and .Values.omjobOperator.healthCheck (.Values.omjobOperator.healthCheck.enabled | default false) }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,239 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# OMJob CRD access (cluster-scoped)
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- omjobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- omjobs/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
# CronOMJob CRD access (cluster-scoped)
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- cronomjobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- cronomjobs/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- if and .Values.omjobOperator.env.watchNamespaces (ne .Values.omjobOperator.env.watchNamespaces "ALL") }}
|
||||
{{- $watchNamespaces := splitList "," .Values.omjobOperator.env.watchNamespaces }}
|
||||
{{- range $namespace := $watchNamespaces }}
|
||||
{{- $trimmedNamespace := trim $namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $trimmedNamespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" $ | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# Pod management in watched namespace
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/status
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
# Events for debugging
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
# ConfigMaps for configuration
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Secrets for credentials
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $trimmedNamespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" $ | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $.Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# Pod management for all namespaces mode
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/status
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
# Events for debugging
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
# ConfigMaps for configuration
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Secrets for credentials
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,67 @@
|
||||
{{- if and .Values.omjobOperator.enabled .Values.omjobOperator.createSample }}
|
||||
# This is a sample OMJob resource for testing purposes
|
||||
# It will be created only if omjobOperator.createSample is true
|
||||
apiVersion: pipelines.openmetadata.org/v1
|
||||
kind: OMJob
|
||||
metadata:
|
||||
name: sample-omjob
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: sample-omjob
|
||||
spec:
|
||||
# Container image for the ingestion job
|
||||
image: {{ .Values.pipelineServiceClient.ingestionImage }}
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
# Service account with necessary permissions
|
||||
serviceAccountName: {{ .Values.pipelineServiceClient.serviceAccountName }}
|
||||
|
||||
# Command to execute
|
||||
command:
|
||||
- python
|
||||
- -c
|
||||
- |
|
||||
import time
|
||||
print("Sample OMJob starting...")
|
||||
time.sleep(10)
|
||||
print("Sample OMJob completing successfully")
|
||||
|
||||
# Environment variables (normally would include pipeline config)
|
||||
env:
|
||||
- name: pipelineType
|
||||
value: "sample"
|
||||
- name: pipelineRunId
|
||||
value: "sample-run-001"
|
||||
- name: LOG_LEVEL
|
||||
value: "INFO"
|
||||
|
||||
# Resource requirements
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
|
||||
# TTL for pod cleanup (24 hours)
|
||||
ttlSecondsAfterFinished: 86400
|
||||
|
||||
# Security context
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
# Labels to apply to pods
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
app.kubernetes.io/pipeline-type: sample
|
||||
|
||||
# Annotations for monitoring
|
||||
annotations:
|
||||
description: "Sample OMJob for testing operator functionality"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-poddisruptionbudget
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- with .Values.podDisruptionBudget.config }}
|
||||
{{- if .minAvailable }}
|
||||
minAvailable: {{ .minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .maxUnavailable }}
|
||||
maxUnavailable: {{ .maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.route.enabled }}
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.route.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.route.host }}
|
||||
host: {{ .Values.route.host }}
|
||||
{{- end }}
|
||||
to:
|
||||
kind: Service
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
weight: 100
|
||||
port:
|
||||
targetPort: http
|
||||
{{- if .Values.route.tls.enabled }}
|
||||
tls:
|
||||
termination: {{ .Values.route.tls.termination }}
|
||||
insecureEdgeTerminationPolicy: {{ .Values.route.tls.insecureEdgeTerminationPolicy }}
|
||||
{{- end }}
|
||||
wildcardPolicy: {{ .Values.route.wildcardPolicy }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,396 @@
|
||||
# Below block is required to create a secret for application once pre-upgrade helm hooks are applied.
|
||||
---
|
||||
{{- if not .Values.openmetadata.config.fernetkey.secretRef }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-fernetkey-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
FERNET_KEY: {{ .value | b64enc | quote }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.database }}
|
||||
DB_HOST: {{ .host | b64enc }}
|
||||
DB_PORT: {{ .port | toString | b64enc }}
|
||||
DB_DRIVER_CLASS: {{ .driverClass | b64enc }}
|
||||
DB_SCHEME: {{ .dbScheme | b64enc }}
|
||||
OM_DATABASE: {{ .databaseName | b64enc }}
|
||||
DB_PARAMS: {{ .dbParams | b64enc | quote }}
|
||||
DB_USER: {{ .auth.username | b64enc }}
|
||||
DB_CONNECTION_POOL_MAX_SIZE: {{ .maxSize | quote | b64enc }}
|
||||
DB_CONNECTION_POOL_MIN_SIZE: {{ .minSize | quote | b64enc }}
|
||||
DB_CONNECTION_POOL_INITIAL_SIZE: {{ .initialSize | quote | b64enc }}
|
||||
DB_CONNECTION_CHECK_CONNECTION_WHILE_IDLE: {{ .checkConnectionWhileIdle | quote | b64enc }}
|
||||
DB_CONNECTION_CHECK_CONNECTION_ON_BORROW: {{ .checkConnectionOnBorrow | quote | b64enc }}
|
||||
DB_CONNECTION_EVICTION_INTERVAL: {{ .evictionInterval | quote | b64enc }}
|
||||
DB_CONNECTION_MIN_IDLE_TIME: {{ .minIdleTime | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.elasticsearch }}
|
||||
ELASTICSEARCH_HOST: {{ .host | quote | b64enc }}
|
||||
SEARCH_TYPE: {{ .searchType | quote | b64enc }}
|
||||
ELASTICSEARCH_PORT: {{ .port | quote | b64enc }}
|
||||
ELASTICSEARCH_SCHEME: {{ .scheme | quote | b64enc }}
|
||||
ELASTICSEARCH_INDEX_MAPPING_LANG: {{ .searchIndexMappingLanguage | quote| b64enc }}
|
||||
ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS: {{ .keepAliveTimeoutSecs | quote | b64enc }}
|
||||
ELASTICSEARCH_CLUSTER_ALIAS: {{ .clusterAlias | quote | b64enc }}
|
||||
ELASTICSEARCH_PAYLOAD_BYTES_SIZE: {{ .payLoadSize | int | toString | b64enc }}
|
||||
{{- if .trustStore.enabled }}
|
||||
ELASTICSEARCH_TRUST_STORE_PATH: {{ .trustStore.path | b64enc }}
|
||||
{{ end }}
|
||||
{{- if .auth.enabled }}
|
||||
ELASTICSEARCH_USER: {{ .auth.username | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
{{- with .Values.openmetadata.config.pipelineServiceClientConfig }}
|
||||
PIPELINE_SERVICE_CLIENT_ENABLED: {{ .enabled | quote | b64enc }}
|
||||
# Common configuration for all pipeline service clients
|
||||
SERVER_HOST_API_URL: {{ .metadataApiEndpoint | b64enc }}
|
||||
{{- if eq .type "airflow" }}
|
||||
# Airflow configuration
|
||||
{{- with .airflow }}
|
||||
PIPELINE_SERVICE_CLIENT_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_ENDPOINT: {{ .apiEndpoint | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_VERIFY_SSL: {{ .verifySsl | quote | b64enc }}
|
||||
PIPELINE_SERVICE_IP_INFO_ENABLED: {{ .ingestionIpInfoEnabled | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL: {{ .healthCheckInterval | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH: {{ .sslCertificatePath | quote | b64enc }}
|
||||
{{- if eq (include "OpenMetadata.utils.checkEmptyString" .hostIp) "true" }}
|
||||
PIPELINE_SERVICE_CLIENT_HOST_IP: {{ .hostIp | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .auth.enabled }}
|
||||
AIRFLOW_USERNAME: {{ .auth.username | b64enc }}
|
||||
AIRFLOW_TRUST_STORE_PATH: {{ .auth.trustStorePath | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if eq .type "k8s" }}
|
||||
# Kubernetes Jobs configuration
|
||||
{{- with .k8s }}
|
||||
PIPELINE_SERVICE_CLIENT_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
K8S_NAMESPACE: {{ $.Release.Namespace | quote | b64enc }}
|
||||
K8S_INGESTION_IMAGE: {{ .ingestionImage | quote | b64enc }}
|
||||
K8S_IMAGE_PULL_POLICY: {{ .imagePullPolicy | quote | b64enc }}
|
||||
K8S_IMAGE_PULL_SECRETS: {{ .imagePullSecrets | quote | b64enc }}
|
||||
K8S_SERVICE_ACCOUNT_NAME: {{ .serviceAccountName | quote | b64enc }}
|
||||
K8S_TTL_SECONDS_AFTER_FINISHED: {{ .ttlSecondsAfterFinished | quote | b64enc }}
|
||||
K8S_ACTIVE_DEADLINE_SECONDS: {{ .activeDeadlineSeconds | quote | b64enc }}
|
||||
K8S_BACKOFF_LIMIT: {{ .backoffLimit | quote | b64enc }}
|
||||
K8S_SUCCESS_JOBS_HISTORY_LIMIT: {{ .successfulJobsHistoryLimit | quote | b64enc }}
|
||||
K8S_FAILED_JOBS_HISTORY_LIMIT: {{ .failedJobsHistoryLimit | quote | b64enc }}
|
||||
K8S_NODE_SELECTOR: {{ .nodeSelector | quote | b64enc }}
|
||||
K8S_RUN_AS_USER: {{ .securityContext.runAsUser | quote | b64enc }}
|
||||
K8S_RUN_AS_GROUP: {{ .securityContext.runAsGroup | quote | b64enc }}
|
||||
K8S_FS_GROUP: {{ .securityContext.fsGroup | quote | b64enc }}
|
||||
K8S_RUN_AS_NON_ROOT: {{ .securityContext.runAsNonRoot | quote | b64enc }}
|
||||
K8S_LIMITS_CPU: {{ .resources.limits.cpu | quote | b64enc }}
|
||||
K8S_LIMITS_MEMORY: {{ .resources.limits.memory | quote | b64enc }}
|
||||
K8S_REQUESTS_CPU: {{ .resources.requests.cpu | quote | b64enc }}
|
||||
K8S_REQUESTS_MEMORY: {{ .resources.requests.memory | quote | b64enc }}
|
||||
K8S_POD_ANNOTATIONS: {{ .podAnnotations | quote | b64enc }}
|
||||
{{- if .extraEnvVars }}
|
||||
K8S_EXTRA_ENV_VARS: {{ .extraEnvVars | toJson | b64enc }}
|
||||
{{- else }}
|
||||
K8S_EXTRA_ENV_VARS: {{ "[]" | b64enc }}
|
||||
{{- end }}
|
||||
K8S_ENABLE_FAILURE_DIAGNOSTICS: {{ .enableFailureDiagnostics | quote | b64enc }}
|
||||
USE_OMJOB_OPERATOR: {{ .useOMJobOperator | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{- else }}
|
||||
PIPELINE_SERVICE_CLIENT_ENABLED: {{ .Values.openmetadata.config.pipelineServiceClientConfig.enabled | quote | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.authorizer }}
|
||||
AUTHORIZER_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
AUTHORIZER_REQUEST_FILTER: {{ .containerRequestFilter | quote | b64enc }}
|
||||
AUTHORIZER_PRINCIPAL_DOMAIN: {{ .principalDomain | quote | b64enc }}
|
||||
AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: {{ .enforcePrincipalDomain | quote | b64enc }}
|
||||
AUTHORIZER_ENABLE_SECURE_SOCKET: {{ .enableSecureSocketConnection | quote | b64enc }}
|
||||
AUTHORIZER_ADMIN_PRINCIPALS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .initialAdmins ) }}
|
||||
AUTHORIZER_ALLOWED_DOMAINS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .allowedDomains) }}
|
||||
AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .allowedEmailRegistrationDomains) }}
|
||||
AUTHORIZER_USE_ROLES_FROM_PROVIDER: {{ .useRolesFromProvider | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.openmetadata }}
|
||||
SERVER_HOST: {{ .host | b64enc }}
|
||||
SERVER_PORT: {{ .port | quote | b64enc }}
|
||||
SERVER_ADMIN_PORT: {{ .adminPort | quote | b64enc }}
|
||||
SERVER_MAX_THREADS: {{ .maxThreads | quote | b64enc }}
|
||||
SERVER_MIN_THREADS: {{ .minThreads | quote | b64enc }}
|
||||
SERVER_IDLE_THREAD_TIMEOUT: {{ .idleThreadTimeout | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- $aiProxyState := dict "enabled" false }}
|
||||
{{- with .Values.collate }}
|
||||
{{- with .aiProxy }}
|
||||
{{- $_ := set $aiProxyState "enabled" (default false .enabled) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $aiProxyState.enabled }}
|
||||
AI_PLATFORM_ENABLED: dHJ1ZQo=
|
||||
AI_CHAT_PREVIEW: ZmFsc2U=
|
||||
{{- else }}
|
||||
AI_PLATFORM_ENABLED: ZmFsc2U=
|
||||
AI_CHAT_PREVIEW: dHJ1ZQo=
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.secretsManager }}
|
||||
SECRET_MANAGER: {{ .provider | quote | b64enc }}
|
||||
SECRET_MANAGER_PREFIX: {{ .prefix | quote | b64enc }}
|
||||
SECRET_MANAGER_TAGS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .tags) }}
|
||||
{{- if .additionalParameters.enabled }}
|
||||
OM_SM_REGION: {{ .additionalParameters.region | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.jwtTokenConfiguration }}
|
||||
RSA_PUBLIC_KEY_FILE_PATH: {{ .rsapublicKeyFilePath | quote | b64enc }}
|
||||
RSA_PRIVATE_KEY_FILE_PATH: {{ .rsaprivateKeyFilePath | quote | b64enc }}
|
||||
JWT_ISSUER: {{ .jwtissuer | quote | b64enc }}
|
||||
JWT_KEY_ID: {{ .keyId | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.web }}
|
||||
WEB_CONF_URI_PATH: {{ .uriPath | quote | b64enc }}
|
||||
WEB_CONF_HSTS_ENABLED: {{ .hsts.enabled | quote | b64enc }}
|
||||
WEB_CONF_HSTS_MAX_AGE: {{ .hsts.maxAge | quote | b64enc }}
|
||||
WEB_CONF_HSTS_INCLUDE_SUBDOMAINS: {{ .hsts.includeSubDomains | quote | b64enc }}
|
||||
WEB_CONF_HSTS_PRELOAD: {{ .hsts.preload | quote | b64enc }}
|
||||
WEB_CONF_FRAME_OPTION_ENABLED: {{ .frameOptions.enabled | quote | b64enc }}
|
||||
WEB_CONF_FRAME_OPTION: {{ .frameOptions.option | quote | b64enc }}
|
||||
WEB_CONF_FRAME_ORIGIN: {{ .frameOptions.origin | quote | b64enc }}
|
||||
WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED: {{ .contentTypeOptions.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_ENABLED: {{ .xssProtection.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_ON: {{ .xssProtection.onXss | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_BLOCK: {{ .xssProtection.block | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_ENABLED: {{ .csp.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_POLICY: {{ .csp.policy | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY: {{ .csp.reportOnlyPolicy | quote | b64enc }}
|
||||
WEB_CONF_REFERRER_POLICY_ENABLED: {{ .referrerPolicy.enabled | quote | b64enc }}
|
||||
WEB_CONF_REFERRER_POLICY_OPTION: {{ .referrerPolicy.option | quote | b64enc }}
|
||||
WEB_CONF_PERMISSION_POLICY_ENABLED: {{ .permissionPolicy.enabled | quote | b64enc }}
|
||||
WEB_CONF_PERMISSION_POLICY_OPTION: {{ .permissionPolicy.option | quote | b64enc }}
|
||||
WEB_CONF_CACHE_CONTROL: {{ .cacheControl | quote | b64enc }}
|
||||
WEB_CONF_PRAGMA: {{ .pragma | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
type: Opaque
|
||||
data:
|
||||
AUTHENTICATION_PUBLIC_KEYS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.publicKeys) }}
|
||||
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.jwtPrincipalClaims) }}
|
||||
{{- if .Values.openmetadata.config.authentication.jwtPrincipalClaimsMapping }}
|
||||
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.jwtPrincipalClaimsMapping) }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.authentication }}
|
||||
AUTHENTICATION_PROVIDER: {{ .provider | quote | b64enc }}
|
||||
AUTHENTICATION_RESPONSE_TYPE: {{ .responseType | quote | b64enc }}
|
||||
AUTHENTICATION_AUTHORITY: {{ .authority | quote | b64enc }}
|
||||
AUTHENTICATION_CLIENT_ID: {{ .clientId | quote | b64enc }}
|
||||
AUTHENTICATION_CLIENT_TYPE: {{ .clientType | quote | b64enc }}
|
||||
AUTHENTICATION_CALLBACK_URL: {{ .callbackUrl | quote | b64enc }}
|
||||
AUTHENTICATION_ENABLE_SELF_SIGNUP: {{ .enableSelfSignup | quote | b64enc }}
|
||||
{{- if and (eq .clientType "confidential") (.oidcConfiguration.enabled) }}
|
||||
OIDC_TYPE: {{ .oidcConfiguration.oidcType | quote | b64enc }}
|
||||
OIDC_SCOPE: {{ .oidcConfiguration.scope | quote | b64enc }}
|
||||
OIDC_DISCOVERY_URI: {{ .oidcConfiguration.discoveryUri | quote | b64enc }}
|
||||
OIDC_USE_NONCE: {{ .oidcConfiguration.useNonce | quote | b64enc }}
|
||||
OIDC_PREFERRED_JWS: {{ .oidcConfiguration.preferredJwsAlgorithm | quote | b64enc }}
|
||||
OIDC_RESPONSE_TYPE: {{ .oidcConfiguration.responseType | quote | b64enc }}
|
||||
OIDC_PROMPT_TYPE: {{ .oidcConfiguration.promptType | quote | b64enc }}
|
||||
OIDC_DISABLE_PKCE: {{ .oidcConfiguration.disablePkce | quote | b64enc }}
|
||||
OIDC_CALLBACK: {{ .oidcConfiguration.callbackUrl | quote | b64enc }}
|
||||
OIDC_SERVER_URL: {{ .oidcConfiguration.serverUrl | quote | b64enc }}
|
||||
OIDC_CLIENT_AUTH_METHOD: {{ .oidcConfiguration.clientAuthenticationMethod | quote | b64enc }}
|
||||
OIDC_TENANT: {{ .oidcConfiguration.tenant | quote | b64enc }}
|
||||
OIDC_MAX_CLOCK_SKEW: {{ .oidcConfiguration.maxClockSkew | quote | b64enc }}
|
||||
OIDC_OM_REFRESH_TOKEN_VALIDITY: {{ .oidcConfiguration.tokenValidity | quote | b64enc }}
|
||||
OIDC_CUSTOM_PARAMS: {{ .oidcConfiguration.customParams | b64enc }}
|
||||
OIDC_MAX_AGE: {{ .oidcConfiguration.maxAge | quote | b64enc }}
|
||||
OIDC_SESSION_EXPIRY: {{ .oidcConfiguration.sessionExpiry | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .provider "ldap" }}
|
||||
AUTHENTICATION_LDAP_HOST: {{ .ldapConfiguration.host | b64enc }}
|
||||
AUTHENTICATION_LDAP_PORT: {{ .ldapConfiguration.port | quote | b64enc }}
|
||||
AUTHENTICATION_LOOKUP_ADMIN_DN: {{ .ldapConfiguration.dnAdminPrincipal | quote | b64enc }}
|
||||
AUTHENTICATION_USER_LOOKUP_BASEDN: {{ .ldapConfiguration.userBaseDN | quote | b64enc }}
|
||||
AUTHENTICATION_GROUP_LOOKUP_BASEDN: {{ .ldapConfiguration.groupBaseDN | quote | b64enc }}
|
||||
AUTHENTICATION_USER_ROLE_ADMIN_NAME: {{ .ldapConfiguration.roleAdminName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_ALL_ATTR: {{ .ldapConfiguration.allAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_NAME_ATTR: {{ .ldapConfiguration.usernameAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_ATTR: {{ .ldapConfiguration.groupAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_ATTR_VALUE: {{ .ldapConfiguration.groupAttributeValue | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_MEMBER_ATTR: {{ .ldapConfiguration.groupMemberAttributeName | quote | b64enc }}
|
||||
AUTH_ROLES_MAPPING: {{ .ldapConfiguration.authRolesMapping | quote | b64enc }}
|
||||
AUTH_REASSIGN_ROLES: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .ldapConfiguration.authReassignRoles) }}
|
||||
AUTHENTICATION_USER_MAIL_ATTR: {{ .ldapConfiguration.mailAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_POOL_SIZE: {{ .ldapConfiguration.maxPoolSize | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_ENABLED: {{ .ldapConfiguration.sslEnabled | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_TRUSTSTORE_TYPE: {{ .ldapConfiguration.truststoreConfigType | quote | b64enc }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "CustomTrustStore" }}
|
||||
AUTHENTICATION_LDAP_TRUSTSTORE_PATH: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePath | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_KEY_FORMAT: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFileFormat | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.verifyHostname | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.examineValidityDates | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "HostName" }}
|
||||
AUTHENTICATION_LDAP_ALLOW_WILDCARDS: {{ .ldapConfiguration.trustStoreConfig.hostNameConfig.allowWildCards | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES: {{ .ldapConfiguration.trustStoreConfig.hostNameConfig.acceptableHostNames | b64enc}}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "JVMDefault" }}
|
||||
AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: {{ .ldapConfiguration.trustStoreConfig.jvmDefaultConfig.verifyHostname | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "TrustAll" }}
|
||||
AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: {{ .ldapConfiguration.trustStoreConfig.trustAllConfig.examineValidityDates | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if eq .provider "saml" }}
|
||||
SAML_DEBUG_MODE: {{ .saml.debugMode | quote | b64enc }}
|
||||
SAML_IDP_ENTITY_ID: {{ .saml.idp.entityId | quote | b64enc }}
|
||||
SAML_IDP_SSO_LOGIN_URL: {{ .saml.idp.ssoLoginUrl | quote | b64enc }}
|
||||
SAML_AUTHORITY_URL: {{ .saml.idp.authorityUrl | quote | b64enc }}
|
||||
SAML_IDP_NAME_ID: {{ .saml.idp.nameId | quote | b64enc }}
|
||||
SAML_SP_ENTITY_ID: {{ .saml.sp.entityId | quote | b64enc }}
|
||||
SAML_SP_ACS: {{ .saml.sp.acs | quote | b64enc }}
|
||||
SAML_SP_CALLBACK: {{ .saml.sp.callback | quote | b64enc }}
|
||||
SAML_STRICT_MODE: {{ .saml.security.strictMode | quote | b64enc }}
|
||||
SAML_VALIDATE_XML: {{ .saml.security.validateXml | quote | b64enc }}
|
||||
SAML_SP_TOKEN_VALIDITY: {{ .saml.security.tokenValidity | quote | b64enc }}
|
||||
SAML_SEND_ENCRYPTED_NAME_ID: {{ .saml.security.sendEncryptedNameId | quote | b64enc }}
|
||||
SAML_SEND_SIGNED_AUTH_REQUEST: {{ .saml.security.sendSignedAuthRequest | quote | b64enc }}
|
||||
SAML_SIGNED_SP_METADATA: {{ .saml.security.signSpMetadata | quote | b64enc }}
|
||||
SAML_WANT_MESSAGE_SIGNED: {{ .saml.security.wantMessagesSigned | quote | b64enc }}
|
||||
SAML_WANT_ASSERTION_SIGNED: {{ .saml.security.wantAssertionsSigned | quote | b64enc }}
|
||||
SAML_WANT_ASSERTION_ENCRYPTED: {{ .saml.security.wantAssertionEncrypted | quote | b64enc }}
|
||||
# Key Store should only be considered if wantAssertionEncrypted will be true
|
||||
{{- if .saml.security.wantAssertionEncrypted }}
|
||||
SAML_KEYSTORE_FILE_PATH: {{ .saml.security.keyStoreFilePath | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.eventMonitor }}
|
||||
EVENT_MONITOR: {{ .type | b64enc }}
|
||||
EVENT_MONITOR_BATCH_SIZE: {{ .batchSize | quote | b64enc }}
|
||||
{{ end }}
|
||||
EVENT_MONITOR_PATH_PATTERN: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.eventMonitor.pathPattern) }}
|
||||
EVENT_MONITOR_LATENCY: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.eventMonitor.latency) }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config }}
|
||||
LOG_LEVEL: {{ .logLevel | b64enc }}
|
||||
OPENMETADATA_CLUSTER_NAME: {{ .clusterName | b64enc }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-rdf-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.rdf }}
|
||||
RDF_ENABLED: {{ .enabled | quote | b64enc }}
|
||||
RDF_BASE_URI: {{ .baseUri | quote | b64enc }}
|
||||
RDF_STORAGE_TYPE: {{ .storageType | quote | b64enc }}
|
||||
RDF_REMOTE_ENDPOINT: {{ .remoteEndpoint | b64enc }}
|
||||
RDF_REMOTE_USERNAME: {{ .username | quote | b64enc }}
|
||||
RDF_DATASET: {{ .dataset | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- end}}
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: {{ .Values.service.adminPort }}
|
||||
targetPort: http-admin
|
||||
protocol: TCP
|
||||
name: http-admin
|
||||
selector:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if .Values.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: http-admin
|
||||
path: /prometheus
|
||||
interval: {{ .Values.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,40 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "OpenMetadata.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
"helm.sh/hook-delete-policy": hook-succeeded
|
||||
spec:
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: wget
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "OpenMetadata.fullname" . }}:{{ .Values.service.port }}']
|
||||
{{- with .Values.testConnection.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,7 @@
|
||||
{{- if not (has .Values.openmetadata.config.authentication.provider (list "basic" "azure" "auth0" "custom-oidc" "google" "okta" "aws-cognito" "ldap" "saml")) }}
|
||||
{{ required "The authentication provider must be basic, azure, auth0, custom-oidc, google, okta, aws-cognito, ldap, saml" nil }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.openmetadata.config.openmetadata }}
|
||||
{{- include "error-message" "Global key has been replaced by openmetadata.config. Please refer docs for the further explaination." }}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,683 @@
|
||||
# Default values for OpenMetadata.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
replicaCount: 1
|
||||
|
||||
# Overrides the openmetadata config file with the help of Environment Variables
|
||||
# Below are defaults as per openmetadata-dependencies Helm Chart Values
|
||||
openmetadata:
|
||||
config:
|
||||
upgradeMigrationConfigs:
|
||||
debug: false
|
||||
# You can pass the additional argument flags to the openmetadata-ops.sh migrate command
|
||||
# Example if you want to force migration runs, use additionalArgs: "--force"
|
||||
additionalArgs: ""
|
||||
deployPipelinesConfig:
|
||||
enabled: true
|
||||
debug: false
|
||||
additionalArgs: ""
|
||||
reindexConfig:
|
||||
enabled: true
|
||||
debug: false
|
||||
# You can pass the additional argument flags to the openmetadata-ops.sh reindex command
|
||||
additionalArgs: ""
|
||||
# Values can be OFF, ERROR, WARN, INFO, DEBUG, TRACE, or ALL
|
||||
logLevel: INFO
|
||||
clusterName: openmetadata
|
||||
openmetadata:
|
||||
host: "0.0.0.0"
|
||||
port: 8585
|
||||
adminPort: 8586
|
||||
maxThreads: 50
|
||||
minThreads: 10
|
||||
idleThreadTimeout: "1 minute"
|
||||
elasticsearch:
|
||||
enabled: true
|
||||
host: opensearch
|
||||
searchType: opensearch
|
||||
port: 9200
|
||||
scheme: http
|
||||
clusterAlias: ""
|
||||
# Value in Bytes
|
||||
payLoadSize: 10485760
|
||||
connectionTimeoutSecs: 5
|
||||
socketTimeoutSecs: 60
|
||||
batchSize: 100
|
||||
searchIndexMappingLanguage: "EN"
|
||||
keepAliveTimeoutSecs: 600
|
||||
trustStore:
|
||||
enabled: false
|
||||
path: ""
|
||||
password:
|
||||
secretRef: "elasticsearch-truststore-secrets"
|
||||
secretKey: "openmetadata-elasticsearch-truststore-password"
|
||||
auth:
|
||||
enabled: false
|
||||
username: "elasticsearch"
|
||||
password:
|
||||
secretRef: elasticsearch-secrets
|
||||
secretKey: openmetadata-elasticsearch-password
|
||||
database:
|
||||
enabled: true
|
||||
host: mysql
|
||||
port: 3306
|
||||
driverClass: com.mysql.cj.jdbc.Driver
|
||||
dbScheme: mysql
|
||||
databaseName: openmetadata_db
|
||||
auth:
|
||||
username: openmetadata_user
|
||||
password:
|
||||
secretRef: mysql-secrets
|
||||
secretKey: openmetadata-mysql-password
|
||||
dbParams: "allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC"
|
||||
maxSize: 50
|
||||
minSize: 10
|
||||
initialSize: 10
|
||||
checkConnectionWhileIdle: true
|
||||
checkConnectionOnBorrow: true
|
||||
evictionInterval: 5 minutes
|
||||
minIdleTime: 1 minute
|
||||
pipelineServiceClientConfig:
|
||||
enabled: true
|
||||
# Pipeline service client type - choose between "airflow" or "k8s"
|
||||
type: "airflow"
|
||||
|
||||
# Common configurations for all pipeline service clients
|
||||
# This will be the api endpoint url of OpenMetadata Server
|
||||
metadataApiEndpoint: http://openmetadata:8585/api
|
||||
|
||||
# Airflow configuration (used when type: "airflow")
|
||||
airflow:
|
||||
className: "org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"
|
||||
# endpoint url for airflow (updated for Apache Airflow chart compatibility)
|
||||
apiEndpoint: http://openmetadata-dependencies-api-server:8080
|
||||
# possible values are "no-ssl", "ignore", "validate"
|
||||
verifySsl: "no-ssl"
|
||||
hostIp: ""
|
||||
ingestionIpInfoEnabled: false
|
||||
# healthCheckInterval in seconds
|
||||
healthCheckInterval: 300
|
||||
# local path in Airflow Pod
|
||||
sslCertificatePath: "/no/path"
|
||||
auth:
|
||||
enabled: true
|
||||
username: admin
|
||||
password:
|
||||
secretRef: airflow-secrets
|
||||
secretKey: openmetadata-airflow-password
|
||||
trustStorePath: ""
|
||||
trustStorePassword:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
|
||||
# Kubernetes Jobs configuration (used when type: "k8s")
|
||||
k8s:
|
||||
className: "org.openmetadata.service.clients.pipeline.k8s.K8sPipelineClient"
|
||||
# Container image for ingestion jobs
|
||||
ingestionImage: "docker.getcollate.io/openmetadata/ingestion-base:latest"
|
||||
# Image pull policy
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
# Image pull secrets (comma-separated)
|
||||
imagePullSecrets: ""
|
||||
# Service account name for ingestion jobs
|
||||
serviceAccountName: "openmetadata-ingestion"
|
||||
# Time to keep completed jobs (seconds)
|
||||
ttlSecondsAfterFinished: 86400
|
||||
# Maximum job runtime (seconds)
|
||||
activeDeadlineSeconds: 7200
|
||||
# Maximum retry attempts
|
||||
backoffLimit: 3
|
||||
# Job history limits
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
# Node selector (comma-separated key=value pairs)
|
||||
nodeSelector: ""
|
||||
# Pod security context
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
# Resource limits and requests
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: "4Gi"
|
||||
requests:
|
||||
cpu: "500m"
|
||||
memory: "1Gi"
|
||||
# Pod annotations (comma-separated key=value pairs)
|
||||
podAnnotations: ""
|
||||
# Extra environment variables (list of key:value pairs)
|
||||
extraEnvVars: []
|
||||
# Enable failure diagnostics
|
||||
enableFailureDiagnostics: true
|
||||
# Use OMJob operator for guaranteed exit handler execution
|
||||
# Requires omjobOperator.enabled: true
|
||||
useOMJobOperator: false
|
||||
# RBAC configuration
|
||||
rbac:
|
||||
# Set to false if RBAC is managed externally
|
||||
enabled: true
|
||||
authorizer:
|
||||
enabled: true
|
||||
className: "org.openmetadata.service.security.DefaultAuthorizer"
|
||||
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
|
||||
initialAdmins:
|
||||
- "admin"
|
||||
allowedEmailRegistrationDomains:
|
||||
- "all"
|
||||
principalDomain: "open-metadata.org"
|
||||
allowedDomains: []
|
||||
enforcePrincipalDomain: false
|
||||
enableSecureSocketConnection: false
|
||||
useRolesFromProvider: false
|
||||
authentication:
|
||||
enabled: true
|
||||
clientType: public
|
||||
provider: "basic"
|
||||
publicKeys:
|
||||
- "http://openmetadata:8585/api/v1/system/config/jwks"
|
||||
authority: "https://accounts.google.com"
|
||||
clientId: ""
|
||||
callbackUrl: ""
|
||||
responseType: id_token
|
||||
jwtPrincipalClaims:
|
||||
- "email"
|
||||
- "preferred_username"
|
||||
- "sub"
|
||||
jwtPrincipalClaimsMapping: []
|
||||
# jwtPrincipalClaimsMapping:
|
||||
# - username:sub
|
||||
# - email:email
|
||||
enableSelfSignup: true
|
||||
oidcConfiguration:
|
||||
enabled: false
|
||||
oidcType: ""
|
||||
clientId:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-id
|
||||
clientSecret:
|
||||
secretRef: oidc-secrets
|
||||
secretKey: openmetadata-oidc-client-secret
|
||||
scope: "openid email profile"
|
||||
discoveryUri: ""
|
||||
useNonce: true
|
||||
preferredJwsAlgorithm: RS256
|
||||
responseType: code
|
||||
promptType: "consent"
|
||||
disablePkce: true
|
||||
callbackUrl: http://openmetadata:8585/callback
|
||||
serverUrl: http://openmetadata:8585
|
||||
clientAuthenticationMethod: client_secret_post
|
||||
tenant: ""
|
||||
maxClockSkew: ""
|
||||
tokenValidity: "3600"
|
||||
customParams: '{}'
|
||||
maxAge: "0"
|
||||
# 7 days
|
||||
sessionExpiry: "604800"
|
||||
ldapConfiguration:
|
||||
host: localhost
|
||||
port: 10636
|
||||
dnAdminPrincipal: "cn=admin,dc=example,dc=com"
|
||||
dnAdminPassword:
|
||||
secretRef: ldap-admin-secret
|
||||
secretKey: openmetadata-ldap-secret
|
||||
userBaseDN: "ou=people,dc=example,dc=com"
|
||||
mailAttributeName: email
|
||||
maxPoolSize: 3
|
||||
sslEnabled: false
|
||||
groupBaseDN: ""
|
||||
roleAdminName: ""
|
||||
allAttributeName: ""
|
||||
usernameAttributeName: ""
|
||||
groupAttributeName: ""
|
||||
groupAttributeValue: ""
|
||||
groupMemberAttributeName: ""
|
||||
authRolesMapping: ""
|
||||
authReassignRoles: []
|
||||
# Possible values are CustomTrustStore, HostName, JVMDefault, TrustAll
|
||||
truststoreConfigType: TrustAll
|
||||
trustStoreConfig:
|
||||
customTrustManagerConfig:
|
||||
trustStoreFilePath: ""
|
||||
trustStoreFilePassword:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
trustStoreFileFormat: ""
|
||||
verifyHostname: true
|
||||
examineValidityDates: true
|
||||
hostNameConfig:
|
||||
allowWildCards: false
|
||||
acceptableHostNames: []
|
||||
jvmDefaultConfig:
|
||||
verifyHostname: true
|
||||
trustAllConfig:
|
||||
examineValidityDates: true
|
||||
saml:
|
||||
debugMode: false
|
||||
idp:
|
||||
entityId: ""
|
||||
ssoLoginUrl: ""
|
||||
idpX509Certificate:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
authorityUrl: "http://openmetadata:8585/api/v1/saml/login"
|
||||
nameId: "urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"
|
||||
sp:
|
||||
entityId: "http://openmetadata:8585/api/v1/saml/metadata"
|
||||
acs: "http://openmetadata:8585/api/v1/saml/acs"
|
||||
spX509Certificate:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
spPrivateKey:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
callback: "http://openmetadata:8585/saml/callback"
|
||||
security:
|
||||
strictMode: false
|
||||
validateXml: false
|
||||
tokenValidity: 3600
|
||||
sendEncryptedNameId: false
|
||||
sendSignedAuthRequest: false
|
||||
signSpMetadata: false
|
||||
wantMessagesSigned: false
|
||||
wantAssertionsSigned: false
|
||||
wantAssertionEncrypted: false
|
||||
keyStoreFilePath: ""
|
||||
keyStoreAlias:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
keyStorePassword:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
|
||||
jwtTokenConfiguration:
|
||||
enabled: true
|
||||
# File Path on Airflow Container
|
||||
rsapublicKeyFilePath: "./conf/public_key.der"
|
||||
# File Path on Airflow Container
|
||||
rsaprivateKeyFilePath: "./conf/private_key.der"
|
||||
jwtissuer: "open-metadata.org"
|
||||
keyId: "Gb389a-9f76-gdjs-a92j-0242bk94356"
|
||||
fernetkey:
|
||||
value: "jJ/9sz0g0OHxsfxOoSfdFdmk3ysNmPRnH3TUAbz3IHA="
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
eventMonitor:
|
||||
enabled: true
|
||||
# Possible values are prometheus and cloudwatch
|
||||
type: prometheus
|
||||
batchSize: 10
|
||||
pathPattern:
|
||||
- "/api/v1/tables/*"
|
||||
- "/api/v1/health-check"
|
||||
# For value p99=0.99, p90=0.90, p50=0.50 etc.
|
||||
latency: []
|
||||
# - "p99=0.99"
|
||||
# - "p90=0.90"
|
||||
# - "p50=0.50"
|
||||
secretsManager:
|
||||
enabled: true
|
||||
# Possible values are db, aws, aws-ssm, managed-aws, managed-aws-ssm, in-memory, managed-azure-kv, azure-kv, gcp
|
||||
provider: db
|
||||
# Define the secret key ID as /<prefix>/<clusterName>/<key> for AWS
|
||||
# Define the secret key ID as <prefix>-<clusterName>-<key> for Azure
|
||||
prefix: ""
|
||||
# Add tags to the created resource, e.g., in AWS. Format is `[key1:value1,key2:value2,...]`
|
||||
tags: []
|
||||
additionalParameters:
|
||||
enabled: false
|
||||
region: ""
|
||||
# For AWS
|
||||
accessKeyId:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
secretAccessKey:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
# accessKeyId:
|
||||
# secretRef: aws-access-key-secret
|
||||
# secretKey: aws-key-secret
|
||||
# secretAccessKey:
|
||||
# secretRef: aws-secret-access-key-secret
|
||||
# secretKey: aws-key-secret
|
||||
# For Azure
|
||||
clientId:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
clientSecret:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
tenantId:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
vaultName:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
# clientId:
|
||||
# secretRef: azure-client-id-secret
|
||||
# secretKey: azure-key-secret
|
||||
# clientSecret:
|
||||
# secretRef: azure-client-secret
|
||||
# secretKey: azure-key-secret
|
||||
# tenantId:
|
||||
# secretRef: azure-tenant-id-secret
|
||||
# secretKey: azure-key-secret
|
||||
# vaultName:
|
||||
# secretRef: azure-vault-name-secret
|
||||
# secretKey: azure-key-secret
|
||||
# For GCP
|
||||
projectId:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
# projectId:
|
||||
# secretRef: gcp-project-id-secret
|
||||
# secretKey: gcp-key-secret
|
||||
# You can create Kubernetes secrets from AWS Credentials with the below command
|
||||
# kubectl create secret generic aws-key-secret \
|
||||
# --from-literal=aws-access-key-secret=<access_key_id_value> \
|
||||
# --from-literal=aws-secret-access-key-secret=<access_key_secret_value>
|
||||
web:
|
||||
enabled: true
|
||||
uriPath: "/api"
|
||||
hsts:
|
||||
enabled: false
|
||||
maxAge: "365 days"
|
||||
includeSubDomains: "true"
|
||||
preload: "true"
|
||||
frameOptions:
|
||||
enabled: false
|
||||
option: "SAMEORIGIN"
|
||||
origin: ""
|
||||
contentTypeOptions:
|
||||
enabled: false
|
||||
xssProtection:
|
||||
enabled: false
|
||||
onXss: true
|
||||
block: true
|
||||
csp:
|
||||
enabled: false
|
||||
policy: "default-src 'self'"
|
||||
reportOnlyPolicy: ""
|
||||
referrerPolicy:
|
||||
enabled: false
|
||||
option: "SAME_ORIGIN"
|
||||
permissionPolicy:
|
||||
enabled: false
|
||||
option: ""
|
||||
cacheControl: ""
|
||||
pragma: ""
|
||||
rdf:
|
||||
enabled: false
|
||||
baseUri: "https://open-metadata.org/"
|
||||
storageType: "FUSEKI"
|
||||
remoteEndpoint: "http://localhost:3030/openmetadata"
|
||||
username: ""
|
||||
password:
|
||||
secretRef: ""
|
||||
secretKey: ""
|
||||
dataset: "openmetadata"
|
||||
|
||||
networkPolicy:
|
||||
# If networkPolicy is true, following values can be set
|
||||
# for ingress on port 8585 and 8586
|
||||
enabled: false
|
||||
|
||||
# Example Google SSO Auth Config
|
||||
# authorizer:
|
||||
# className: "org.openmetadata.service.security.DefaultAuthorizer"
|
||||
# containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
|
||||
# initialAdmins:
|
||||
# - "suresh"
|
||||
# principalDomain: "open-metadata.org"
|
||||
# authentication:
|
||||
# provider: "google"
|
||||
# publicKeys:
|
||||
# - "https://www.googleapis.com/oauth2/v3/certs"
|
||||
# authority: "https://accounts.google.com"
|
||||
# clientId: "<client_id>"
|
||||
# callbackUrl: "<callback_url>"
|
||||
|
||||
image:
|
||||
repository: docker.getcollate.io/openmetadata/server
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
pullPolicy: "Always"
|
||||
|
||||
sidecars: []
|
||||
# - name: "busybox"
|
||||
# image: "busybox:1.34.1"
|
||||
# imagePullPolicy: "Always"
|
||||
# command: ["ls"]
|
||||
# args: ["-latr", "/usr/share"]
|
||||
# env:
|
||||
# - name: DEMO
|
||||
# value: "DEMO"
|
||||
# volumeMounts:
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: "openmetadata"
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
automountServiceAccountToken: true
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 100
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8585
|
||||
adminPort: 8586
|
||||
annotations: {}
|
||||
|
||||
# Service monitor for Prometheus metrics
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
interval: 30s
|
||||
annotations: {}
|
||||
labels: {}
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations: {}
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
hosts:
|
||||
- host: open-metadata.local
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls: []
|
||||
# - secretName: tls-open-metadata.local
|
||||
# hosts:
|
||||
# - open-metadata.local
|
||||
|
||||
# OpenShift Route — use instead of ingress when deploying on OpenShift.
|
||||
# Requires route.openshift.io/v1 API (available on all OpenShift clusters).
|
||||
route:
|
||||
enabled: false
|
||||
# host is optional. When omitted, OpenShift auto-assigns a hostname under
|
||||
# the cluster's default subdomain (e.g. openmetadata-openmetadata.apps.<cluster>).
|
||||
host: ""
|
||||
annotations: {}
|
||||
wildcardPolicy: None
|
||||
tls:
|
||||
enabled: true
|
||||
# termination controls where TLS is terminated:
|
||||
# edge — TLS terminated at the router; traffic to the pod is plain HTTP (recommended)
|
||||
# reencrypt — TLS terminated at the router and re-encrypted to the pod
|
||||
# passthrough — TLS passed through to the pod unchanged (pod must serve TLS)
|
||||
termination: edge
|
||||
# insecureEdgeTerminationPolicy controls HTTP traffic when termination is edge or reencrypt:
|
||||
# Redirect — redirect HTTP to HTTPS (recommended)
|
||||
# Allow — serve both HTTP and HTTPS
|
||||
# None — drop HTTP traffic
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
|
||||
extraEnvs: []
|
||||
# - name: MY_ENVIRONMENT_VAR
|
||||
# value: the_value_goes_here
|
||||
|
||||
envFrom: []
|
||||
# - secretRef:
|
||||
# name: secret_containing_config
|
||||
|
||||
extraVolumes: []
|
||||
# - name: extras
|
||||
# emptyDir: {}
|
||||
|
||||
extraVolumeMounts: []
|
||||
# - name: extras
|
||||
# mountPath: /usr/share/extras
|
||||
# readOnly: true
|
||||
|
||||
# Provision for InitContainers to be running after the `run-db-migration` InitContainer
|
||||
extraInitContainers: []
|
||||
|
||||
# Provision for InitContainers to be running before the `run-db-migration` InitContainer
|
||||
preMigrateInitContainers: []
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube.The resources configuration is required to enable autoscaling.
|
||||
# To specify resources, uncomment the following lines, adjust them as necessary, and remove
|
||||
# the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 1
|
||||
# memory: 2048Mi
|
||||
# requests:
|
||||
# cpu: 500m
|
||||
# memory: 1024Mi
|
||||
|
||||
startingDeadlineSeconds: 100
|
||||
|
||||
# Test connection pod configuration
|
||||
testConnection:
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube.
|
||||
# To specify resources, uncomment the following lines, adjust them as necessary, and remove
|
||||
# the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /api/v1/system/health
|
||||
port: http
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /api/v1/system/health
|
||||
port: http
|
||||
startupProbe:
|
||||
periodSeconds: 60
|
||||
failureThreshold: 5
|
||||
successThreshold: 1
|
||||
httpGet:
|
||||
path: /healthcheck
|
||||
port: http-admin
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
config:
|
||||
maxUnavailable: "1"
|
||||
minAvailable: "1"
|
||||
|
||||
commonLabels: {}
|
||||
deploymentAnnotations: {}
|
||||
podAnnotations: {}
|
||||
|
||||
# Prerequisites for enabling Horizontal Pod Autoscaler (HPA):
|
||||
# 1. Install metrics-server (https://github.com/kubernetes-sigs/metrics-server)
|
||||
# 2. Define resource request and limits for the pods
|
||||
hpa:
|
||||
enabled: false
|
||||
apiVersion: autoscaling/v2
|
||||
minReplicas: 1
|
||||
maxReplicas: 5
|
||||
behavior: {}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
|
||||
# OMJob Operator Configuration
|
||||
# This installs the CRD and operator for guaranteed exit handler execution
|
||||
omjobOperator:
|
||||
enabled: false # Set to true to install OMJob CRD and operator
|
||||
|
||||
# Image configuration
|
||||
image:
|
||||
repository: docker.getcollate.io/openmetadata/omjob-operator
|
||||
tag: "1.12.0-SNAPSHOT"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Resource configuration
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "128Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "256Mi"
|
||||
|
||||
# Environment variables
|
||||
env:
|
||||
logLevel: "INFO"
|
||||
reconciliationThreads: "5"
|
||||
healthCheckPort: "8080"
|
||||
metricsPort: "8081"
|
||||
# Polling interval in seconds - how often the operator checks pod status
|
||||
pollingIntervalSeconds: "10"
|
||||
# Requeue delay in seconds - delay when requeueing after errors
|
||||
requeueDelaySeconds: "30"
|
||||
# Namespace watching configuration:
|
||||
# - "ALL" = watch all namespaces (less secure, high resource usage)
|
||||
# - "namespace1,namespace2" = watch specific namespaces (recommended)
|
||||
# - Leave empty for operator's own namespace only
|
||||
watchNamespaces: ""
|
||||
Reference in New Issue
Block a user