Add openmetadata chart
This commit is contained in:
wbsong111
@@ -0,0 +1,22 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "OpenMetadata.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "OpenMetadata.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "OpenMetadata.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "OpenMetadata.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8585 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8585:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{/*
|
||||
Renders a value that contains template.
|
||||
Usage:
|
||||
{{ include "tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }}
|
||||
*/}}
|
||||
{{- define "tplvalues.render" -}}
|
||||
{{- if typeIs "string" .value }}
|
||||
{{- tpl .value .context }}
|
||||
{{- else }}
|
||||
{{- tpl (.value | toYaml) .context }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,391 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "OpenMetadata.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "OpenMetadata.labels" -}}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{ toYaml .}}
|
||||
{{- end }}
|
||||
helm.sh/chart: {{ include "OpenMetadata.chart" . }}
|
||||
{{ include "OpenMetadata.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "OpenMetadata.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "OpenMetadata.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "OpenMetadata.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "OpenMetadata.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" (tpl .Values.serviceAccount.name .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Quoted Array of strings with base64 encoding
|
||||
*/}}
|
||||
{{- define "OpenMetadata.commaJoinedQuotedEncodedList" }}
|
||||
{{- $list := list }}
|
||||
{{- range .value }}
|
||||
{{- $list = append $list (. | quote ) }}
|
||||
{{- end }}
|
||||
{{- $list := join "," $list | toString }}
|
||||
{{- $list := printf "[%s]" $list }}
|
||||
{{- $list | b64enc }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Migration Command */}}
|
||||
{{- define "OpenMetadata.buildUpgradeCommand" }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.upgradeMigrationConfigs.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d migrate {{ .Values.openmetadata.config.upgradeMigrationConfigs.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh migrate {{ .Values.openmetadata.config.upgradeMigrationConfigs.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Warning to update openmetadata global keyword to openmetadata.config */}}
|
||||
{{- define "error-message" }}
|
||||
{{- printf "Error: %s" . | fail }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Function to check if passed value is empty string or null value */}}
|
||||
{{- define "OpenMetadata.utils.checkEmptyString" -}}
|
||||
{{- if or (empty .) (eq . "") -}}
|
||||
{{- false -}}
|
||||
{{- else -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations AWS Additional Parameters Environment Variables for Secret Manager*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.aws.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.accessKeyId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.secretAccessKey }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations Azure Additional Parameters Environment Variables for Secret Manager
|
||||
*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.azure.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.clientId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.clientSecret }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.tenantId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_TENANT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.vaultName }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_VAULT_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations GCP Additional Parameters Environment Variables for Secret Manager
|
||||
*/}}
|
||||
{{- define "OpenMetadata.configs.secretManager.gcp.additionalParameters" -}}
|
||||
{{- with .Values.openmetadata.config.secretsManager.additionalParameters.projectId }}
|
||||
{{- if .secretRef }}
|
||||
- name: OM_SM_PROJECT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenMetadata Configurations Environment Variables*/}}
|
||||
{{- define "OpenMetadata.configs" -}}
|
||||
{{- if .Values.openmetadata.config.fernetkey.secretRef -}}
|
||||
{{- with .Values.openmetadata.config.fernetkey -}}
|
||||
- name: FERNET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.openmetadata.config.authentication.clientType "confidential") (.Values.openmetadata.config.authentication.oidcConfiguration.enabled) }}
|
||||
{{- with .Values.openmetadata.config.authentication.oidcConfiguration.clientId }}
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.authentication.oidcConfiguration.clientSecret }}
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.openmetadata.config.authentication.provider "ldap" }}
|
||||
{{- if .Values.openmetadata.config.authentication.ldapConfiguration.dnAdminPassword.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.ldapConfiguration.dnAdminPassword }}
|
||||
- name: AUTHENTICATION_LOOKUP_ADMIN_PWD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( eq .Values.openmetadata.config.authentication.ldapConfiguration.truststoreConfigType "CustomTrustStore" ) ( .Values.openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.authentication.ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePassword }}
|
||||
- name: AUTHENTICATION_LDAP_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.openmetadata.config.authentication.provider "saml" }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.idp.idpX509Certificate.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.idp.idpX509Certificate }}
|
||||
- name: SAML_IDP_CERTIFICATE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.sp.spX509Certificate.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.sp.spX509Certificate }}
|
||||
- name: SAML_SP_CERTIFICATE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.sp.spPrivateKey.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.sp.spPrivateKey }}
|
||||
- name: SAML_SP_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.wantAssertionEncrypted }}
|
||||
# Key Store should only be considered if wantAssertionEncrypted will be true
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.keyStoreAlias.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.security.keyStoreAlias }}
|
||||
- name: SAML_KEYSTORE_ALIAS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.saml.security.keyStorePassword.secretRef }}
|
||||
{{- with .Values.openmetadata.config.authentication.saml.security.keyStorePassword }}
|
||||
- name: SAML_KEYSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( .Values.openmetadata.config.elasticsearch.auth.enabled ) ( .Values.openmetadata.config.elasticsearch.auth.password.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.elasticsearch.auth.password }}
|
||||
- name: ELASTICSEARCH_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and ( .Values.openmetadata.config.elasticsearch.trustStore.enabled ) ( .Values.openmetadata.config.elasticsearch.trustStore.password.secretRef ) }}
|
||||
{{- with .Values.openmetadata.config.elasticsearch.trustStore.password }}
|
||||
- name: ELASTICSEARCH_TRUST_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.database.auth.password.secretRef }}
|
||||
{{- with .Values.openmetadata.config.database.auth.password }}
|
||||
- name: DB_USER_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $pipelineConfig := .Values.openmetadata.config.pipelineServiceClientConfig }}
|
||||
{{- $authConfig := dict }}
|
||||
{{- if and $pipelineConfig.type (eq $pipelineConfig.type "airflow") }}
|
||||
{{- $authConfig = $pipelineConfig.airflow.auth | default dict }}
|
||||
{{- else }}
|
||||
{{- $authConfig = $pipelineConfig.auth | default dict }}
|
||||
{{- end }}
|
||||
{{- if and ($pipelineConfig.enabled | default true) ($authConfig.enabled | default false) }}
|
||||
{{- if $authConfig.password.secretRef }}
|
||||
{{- with $authConfig.password }}
|
||||
- name: AIRFLOW_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $authConfig.trustStorePassword.secretRef }}
|
||||
{{- with $authConfig.trustStorePassword }}
|
||||
- name: AIRFLOW_TRUST_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.additionalParameters.enabled }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "aws" "aws-ssm" "managed-aws" "managed-aws-ssm") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.aws.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "managed-azure-kv" "azure-kv") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.azure.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- if has .Values.openmetadata.config.secretsManager.provider (list "gcp") }}
|
||||
{{ include "OpenMetadata.configs.secretManager.gcp.additionalParameters" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
{{- if .Values.openmetadata.config.rdf.password.secretRef }}
|
||||
{{- with .Values.openmetadata.config.rdf.password }}
|
||||
- name: RDF_REMOTE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .secretRef }}
|
||||
key: {{ .secretKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Deploy Pipelines Command using deployPipelinesConfig */}}
|
||||
{{- define "OpenMetadata.buildDeployPipelinesCommand" }}
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.deployPipelinesConfig.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d deploy-pipelines {{ default "" .Values.openmetadata.config.deployPipelinesConfig.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh deploy-pipelines {{ default "" .Values.openmetadata.config.deployPipelinesConfig.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Build the OpenMetadata Deploy Pipelines Command using reindexConfig */}}
|
||||
{{- define "OpenMetadata.buildReindexCommand" }}
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
{{- if .Values.openmetadata.config.reindexConfig.debug }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh -d reindex {{ default "" .Values.openmetadata.config.reindexConfig.additionalArgs }}"
|
||||
{{- else }}
|
||||
- "/opt/openmetadata/bootstrap/openmetadata-ops.sh reindex {{ default "" .Values.openmetadata.config.reindexConfig.additionalArgs }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- if .Values.openmetadata.config.deployPipelinesConfig.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: cron-deploy-pipelines
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
suspend: true
|
||||
failedJobsHistoryLimit: 1
|
||||
successfulJobsHistoryLimit: 1
|
||||
jobTemplate:
|
||||
metadata:
|
||||
name: cron-deploy-pipelines
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 12 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 12 }}
|
||||
containers:
|
||||
- name: cron-deploy-pipelines
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
{{ include "OpenMetadata.buildDeployPipelinesCommand" . | nindent 12 }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 12 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
schedule: "0/5 * * * *"
|
||||
{{- if ne .Values.startingDeadlineSeconds nil }}
|
||||
startingDeadlineSeconds: {{ .Values.startingDeadlineSeconds }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
{{- if .Values.openmetadata.config.reindexConfig.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: cron-reindex
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
suspend: true
|
||||
failedJobsHistoryLimit: 1
|
||||
successfulJobsHistoryLimit: 1
|
||||
jobTemplate:
|
||||
metadata:
|
||||
name: cron-reindex
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 12 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 12 }}
|
||||
containers:
|
||||
- name: cron-reindex
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
{{ include "OpenMetadata.buildReindexCommand" . | nindent 12 }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 12 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
schedule: "0/5 * * * *"
|
||||
{{- if ne .Values.startingDeadlineSeconds nil }}
|
||||
startingDeadlineSeconds: {{ .Values.startingDeadlineSeconds }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,350 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: cronomjobs.pipelines.openmetadata.org
|
||||
spec:
|
||||
group: pipelines.openmetadata.org
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
schedule:
|
||||
type: string
|
||||
description: "Cron schedule expression"
|
||||
timeZone:
|
||||
type: string
|
||||
description: "Time zone for the schedule (default UTC)"
|
||||
default: "UTC"
|
||||
suspend:
|
||||
type: boolean
|
||||
description: "Whether to suspend scheduling"
|
||||
default: false
|
||||
startingDeadlineSeconds:
|
||||
type: integer
|
||||
description: "Deadline for starting the job if missed"
|
||||
successfulJobsHistoryLimit:
|
||||
type: integer
|
||||
description: "Number of successful jobs to keep"
|
||||
default: 3
|
||||
failedJobsHistoryLimit:
|
||||
type: integer
|
||||
description: "Number of failed jobs to keep"
|
||||
default: 3
|
||||
omJobSpec:
|
||||
type: object
|
||||
description: "OMJob template to create for each scheduled run"
|
||||
properties:
|
||||
mainPodSpec:
|
||||
type: object
|
||||
description: "Pod specification for the main ingestion job"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the ingestion job"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the pod"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the container"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "serviceAccountName", "command"]
|
||||
exitHandlerSpec:
|
||||
type: object
|
||||
description: "Pod specification for the exit handler job (runs after main pod completes)"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the exit handler"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the exit handler container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the exit handler container"
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the exit handler pod"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the exit handler pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "command"]
|
||||
ttlSecondsAfterFinished:
|
||||
type: integer
|
||||
description: "Time in seconds to keep pods after completion"
|
||||
default: 86400
|
||||
required: ["mainPodSpec"]
|
||||
required: ["schedule", "omJobSpec"]
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
lastScheduleTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Last time the CronOMJob was scheduled"
|
||||
lastOMJobName:
|
||||
type: string
|
||||
description: "Name of the last OMJob created"
|
||||
message:
|
||||
type: string
|
||||
description: "Human-readable message about the current status"
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Schedule
|
||||
type: string
|
||||
jsonPath: .spec.schedule
|
||||
- name: Suspended
|
||||
type: boolean
|
||||
jsonPath: .spec.suspend
|
||||
- name: Last Schedule
|
||||
type: date
|
||||
jsonPath: .status.lastScheduleTime
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: cronomjobs
|
||||
singular: cronomjob
|
||||
kind: CronOMJob
|
||||
shortNames:
|
||||
- comj
|
||||
{{- end }}
|
||||
@@ -0,0 +1,221 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.hpa.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
{{- if not (.Values.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- with .Values.preMigrateInitContainers }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
- name: run-db-migrations
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{ include "OpenMetadata.buildUpgradeCommand" . | nindent 8 }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-rdf-secret
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 8 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraInitContainers }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- include "tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
volumeMounts:
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: {{ .Values.openmetadata.config.openmetadata.port }}
|
||||
protocol: TCP
|
||||
- name: http-admin
|
||||
containerPort: {{ .Values.openmetadata.config.openmetadata.adminPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
{{ .Values.livenessProbe | toYaml | indent 12 | trim }}
|
||||
readinessProbe:
|
||||
{{ .Values.readinessProbe | toYaml | indent 12 | trim }}
|
||||
startupProbe:
|
||||
{{ .Values.startupProbe | toYaml | indent 12 | trim }}
|
||||
env:
|
||||
{{- include "OpenMetadata.configs" . | nindent 10 }}
|
||||
{{- with .Values.extraEnvs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
{{- end }}
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
{{- if not .secretRef }}
|
||||
- secretRef:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-fernetkey-secret
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.envFrom }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if .Values.hpa.enabled -}}
|
||||
apiVersion: {{ .Values.hpa.apiVersion }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-hpa
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
{{- with .Values.hpa.behavior }}
|
||||
behavior:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
metrics:
|
||||
{{- toYaml .Values.hpa.metrics | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,64 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "OpenMetadata.fullname" . -}}
|
||||
{{- $svcPort := .Values.service.port -}}
|
||||
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
||||
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
||||
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- if semverCompare "=<1.13-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
datree.skip/K8S_DEPRECATED_APIVERSION_1.16: "Ignore that deprecation in old kubernetes instances"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
pathType: {{ .pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,133 @@
|
||||
{{- if and .Values.openmetadata.config.pipelineServiceClientConfig.enabled (eq .Values.openmetadata.config.pipelineServiceClientConfig.type "k8s") }}
|
||||
{{- $namespace := .Release.Namespace }}
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.k8s.rbac.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- if .Values.serviceAccount.annotations }}
|
||||
{{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Pod management for pipeline jobs and diagnostics
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# ConfigMaps for pipeline configuration
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Secrets for pipeline credentials
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Events for diagnostics (optional - failure diagnostics will work without this)
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "list"]
|
||||
# Jobs and CronJobs management
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
namespace: {{ $namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.serviceAccountName }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# Cross-namespace Role for OpenMetadata server to manage pipeline jobs
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: openmetadata-server-pipeline-manager
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: server
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Pod management for pipeline jobs and diagnostics
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# ConfigMaps for pipeline configuration
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Secrets for pipeline credentials
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# Events for diagnostics (optional - failure diagnostics will work without this)
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "list"]
|
||||
# Jobs and CronJobs management
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
# OMJob management for K8s pipeline client
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["omjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["omjobs/status"]
|
||||
verbs: ["get", "patch"]
|
||||
# CronOMJob management for K8s pipeline client (scheduled jobs)
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["cronomjobs"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["pipelines.openmetadata.org"]
|
||||
resources: ["cronomjobs/status"]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
# RoleBinding for OpenMetadata server to manage pipeline resources
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: openmetadata-server-pipeline-manager
|
||||
namespace: {{ $namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: server
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: openmetadata-server-pipeline-manager
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-networkpolicy
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels: {{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
# Allow inbound connections
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.service.adminPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
@@ -0,0 +1,337 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: omjobs.pipelines.openmetadata.org
|
||||
spec:
|
||||
group: pipelines.openmetadata.org
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
mainPodSpec:
|
||||
type: object
|
||||
description: "Pod specification for the main ingestion job"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the ingestion job"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the pod"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the container"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "serviceAccountName", "command"]
|
||||
exitHandlerSpec:
|
||||
type: object
|
||||
description: "Pod specification for the exit handler job (runs after main pod completes)"
|
||||
properties:
|
||||
image:
|
||||
type: string
|
||||
description: "Container image for the exit handler"
|
||||
imagePullPolicy:
|
||||
type: string
|
||||
description: "Image pull policy"
|
||||
enum: ["Always", "Never", "IfNotPresent"]
|
||||
default: "IfNotPresent"
|
||||
command:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: "Command to execute in the exit handler container"
|
||||
env:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the environment variable"
|
||||
value:
|
||||
type: string
|
||||
description: "Direct value of the environment variable"
|
||||
valueFrom:
|
||||
type: object
|
||||
description: "Source for the environment variable value"
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a ConfigMap"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the ConfigMap"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the ConfigMap"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the ConfigMap must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
secretKeyRef:
|
||||
type: object
|
||||
description: "Reference to a key in a Secret"
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
description: "Name of the Secret"
|
||||
key:
|
||||
type: string
|
||||
description: "Key in the Secret"
|
||||
optional:
|
||||
type: boolean
|
||||
description: "Whether the Secret must exist"
|
||||
required:
|
||||
- name
|
||||
- key
|
||||
fieldRef:
|
||||
type: object
|
||||
description: "Reference to a field in the pod"
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
description: "API version of the field reference"
|
||||
fieldPath:
|
||||
type: string
|
||||
description: "Path to the field"
|
||||
required:
|
||||
- fieldPath
|
||||
resourceFieldRef:
|
||||
type: object
|
||||
description: "Reference to a resource field"
|
||||
properties:
|
||||
containerName:
|
||||
type: string
|
||||
description: "Name of the container"
|
||||
resource:
|
||||
type: string
|
||||
description: "Resource to select"
|
||||
divisor:
|
||||
type: string
|
||||
description: "Divisor for the resource"
|
||||
required:
|
||||
- resource
|
||||
required:
|
||||
- name
|
||||
resources:
|
||||
type: object
|
||||
properties:
|
||||
requests:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
limits:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: "Resource requirements for the exit handler container"
|
||||
serviceAccountName:
|
||||
type: string
|
||||
description: "Service account name for the exit handler pod"
|
||||
nodeSelector:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
imagePullSecrets:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
securityContext:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: "Security context for the exit handler pod"
|
||||
labels:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
annotations:
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
required: ["image", "command"]
|
||||
ttlSecondsAfterFinished:
|
||||
type: integer
|
||||
description: "Time in seconds to keep pods after completion"
|
||||
default: 86400
|
||||
required: ["mainPodSpec"]
|
||||
status:
|
||||
type: object
|
||||
properties:
|
||||
phase:
|
||||
type: string
|
||||
description: "Current phase of the OMJob"
|
||||
enum: ["Pending", "Running", "ExitHandlerRunning", "Succeeded", "Failed"]
|
||||
mainPodName:
|
||||
type: string
|
||||
description: "Name of the main pod"
|
||||
exitHandlerPodName:
|
||||
type: string
|
||||
description: "Name of the exit handler pod"
|
||||
startTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Time when the job started"
|
||||
completionTime:
|
||||
type: string
|
||||
format: date-time
|
||||
description: "Time when the job completed"
|
||||
message:
|
||||
type: string
|
||||
description: "Human-readable message about the current status"
|
||||
mainPodExitCode:
|
||||
type: integer
|
||||
description: "Exit code of the main pod"
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Phase
|
||||
type: string
|
||||
jsonPath: .status.phase
|
||||
- name: Main Pod
|
||||
type: string
|
||||
jsonPath: .status.mainPodName
|
||||
- name: Exit Handler
|
||||
type: string
|
||||
jsonPath: .status.exitHandlerPodName
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: omjobs
|
||||
singular: omjob
|
||||
kind: OMJob
|
||||
shortNames:
|
||||
- omj
|
||||
{{- end }}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-config
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
data:
|
||||
operator.yaml: |
|
||||
# Operator configuration
|
||||
reconciliation:
|
||||
interval: 10s # How often to reconcile OMJobs
|
||||
retryDelay: 30s # Delay before retrying failed reconciliation
|
||||
|
||||
# Pod cleanup settings
|
||||
cleanup:
|
||||
ttlSecondsAfterFinished: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.ttlSecondsAfterFinished | default 604800 }}
|
||||
preserveFailedPods: true # Keep failed pods for debugging
|
||||
|
||||
# Exit handler configuration (image and command come from OMJob spec)
|
||||
exitHandler:
|
||||
timeout: 120 # Seconds to wait for exit handler to complete
|
||||
defaultResources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
|
||||
# Security context defaults (matches openmetadata.yaml structure)
|
||||
securityContext:
|
||||
runAsNonRoot: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsNonRoot | default true }}
|
||||
runAsUser: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsUser | default 1000 }}
|
||||
runAsGroup: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.runAsGroup | default 1000 }}
|
||||
fsGroup: {{ .Values.openmetadata.config.pipelineServiceClientConfig.k8s.fsGroup | default 1000 }}
|
||||
|
||||
# Logging configuration
|
||||
logging:
|
||||
level: INFO
|
||||
format: json
|
||||
{{- end }}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
spec:
|
||||
serviceAccountName: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: "{{ .Values.omjobOperator.image.repository }}:{{ .Values.omjobOperator.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.omjobOperator.image.pullPolicy }}
|
||||
env:
|
||||
- name: OPERATOR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LOG_LEVEL
|
||||
value: {{ .Values.omjobOperator.env.logLevel | quote }}
|
||||
- name: RECONCILIATION_THREADS
|
||||
value: {{ .Values.omjobOperator.env.reconciliationThreads | quote }}
|
||||
- name: HEALTH_CHECK_PORT
|
||||
value: {{ .Values.omjobOperator.env.healthCheckPort | quote }}
|
||||
- name: METRICS_PORT
|
||||
value: {{ .Values.omjobOperator.env.metricsPort | quote }}
|
||||
- name: WATCH_NAMESPACES
|
||||
value: {{ .Values.omjobOperator.env.watchNamespaces | quote }}
|
||||
- name: POLLING_INTERVAL_SECONDS
|
||||
value: {{ .Values.omjobOperator.env.pollingIntervalSeconds | quote }}
|
||||
- name: REQUEUE_DELAY_SECONDS
|
||||
value: {{ .Values.omjobOperator.env.requeueDelaySeconds | quote }}
|
||||
ports:
|
||||
- name: health
|
||||
containerPort: {{ .Values.omjobOperator.env.healthCheckPort }}
|
||||
protocol: TCP
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.omjobOperator.env.metricsPort }}
|
||||
protocol: TCP
|
||||
resources:
|
||||
{{- toYaml .Values.omjobOperator.resources | nindent 10 }}
|
||||
{{- if and .Values.omjobOperator.healthCheck (.Values.omjobOperator.healthCheck.enabled | default false) }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: health
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,239 @@
|
||||
{{- if .Values.omjobOperator.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# OMJob CRD access (cluster-scoped)
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- omjobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- omjobs/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
# CronOMJob CRD access (cluster-scoped)
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- cronomjobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- pipelines.openmetadata.org
|
||||
resources:
|
||||
- cronomjobs/status
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- if and .Values.omjobOperator.env.watchNamespaces (ne .Values.omjobOperator.env.watchNamespaces "ALL") }}
|
||||
{{- $watchNamespaces := splitList "," .Values.omjobOperator.env.watchNamespaces }}
|
||||
{{- range $namespace := $watchNamespaces }}
|
||||
{{- $trimmedNamespace := trim $namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $trimmedNamespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" $ | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# Pod management in watched namespace
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/status
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
# Events for debugging
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
# ConfigMaps for configuration
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Secrets for credentials
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $trimmedNamespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" $ | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" $ }}-omjob-operator
|
||||
namespace: {{ $.Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
rules:
|
||||
# Pod management for all namespaces mode
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/status
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
# Events for debugging
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
# ConfigMaps for configuration
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Secrets for credentials
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: omjob-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator-resources
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omjob-operator
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,67 @@
|
||||
{{- if and .Values.omjobOperator.enabled .Values.omjobOperator.createSample }}
|
||||
# This is a sample OMJob resource for testing purposes
|
||||
# It will be created only if omjobOperator.createSample is true
|
||||
apiVersion: pipelines.openmetadata.org/v1
|
||||
kind: OMJob
|
||||
metadata:
|
||||
name: sample-omjob
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: sample-omjob
|
||||
spec:
|
||||
# Container image for the ingestion job
|
||||
image: {{ .Values.pipelineServiceClient.ingestionImage }}
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
# Service account with necessary permissions
|
||||
serviceAccountName: {{ .Values.pipelineServiceClient.serviceAccountName }}
|
||||
|
||||
# Command to execute
|
||||
command:
|
||||
- python
|
||||
- -c
|
||||
- |
|
||||
import time
|
||||
print("Sample OMJob starting...")
|
||||
time.sleep(10)
|
||||
print("Sample OMJob completing successfully")
|
||||
|
||||
# Environment variables (normally would include pipeline config)
|
||||
env:
|
||||
- name: pipelineType
|
||||
value: "sample"
|
||||
- name: pipelineRunId
|
||||
value: "sample-run-001"
|
||||
- name: LOG_LEVEL
|
||||
value: "INFO"
|
||||
|
||||
# Resource requirements
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: "512Mi"
|
||||
|
||||
# TTL for pod cleanup (24 hours)
|
||||
ttlSecondsAfterFinished: 86400
|
||||
|
||||
# Security context
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
# Labels to apply to pods
|
||||
labels:
|
||||
app.kubernetes.io/name: openmetadata
|
||||
app.kubernetes.io/component: ingestion
|
||||
app.kubernetes.io/pipeline-type: sample
|
||||
|
||||
# Annotations for monitoring
|
||||
annotations:
|
||||
description: "Sample OMJob for testing operator functionality"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-poddisruptionbudget
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
spec:
|
||||
{{- with .Values.podDisruptionBudget.config }}
|
||||
{{- if .minAvailable }}
|
||||
minAvailable: {{ .minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .maxUnavailable }}
|
||||
maxUnavailable: {{ .maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.route.enabled }}
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.route.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.route.host }}
|
||||
host: {{ .Values.route.host }}
|
||||
{{- end }}
|
||||
to:
|
||||
kind: Service
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
weight: 100
|
||||
port:
|
||||
targetPort: http
|
||||
{{- if .Values.route.tls.enabled }}
|
||||
tls:
|
||||
termination: {{ .Values.route.tls.termination }}
|
||||
insecureEdgeTerminationPolicy: {{ .Values.route.tls.insecureEdgeTerminationPolicy }}
|
||||
{{- end }}
|
||||
wildcardPolicy: {{ .Values.route.wildcardPolicy }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,396 @@
|
||||
# Below block is required to create a secret for application once pre-upgrade helm hooks are applied.
|
||||
---
|
||||
{{- if not .Values.openmetadata.config.fernetkey.secretRef }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-fernetkey-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.fernetkey }}
|
||||
FERNET_KEY: {{ .value | b64enc | quote }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.database.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-db-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.database }}
|
||||
DB_HOST: {{ .host | b64enc }}
|
||||
DB_PORT: {{ .port | toString | b64enc }}
|
||||
DB_DRIVER_CLASS: {{ .driverClass | b64enc }}
|
||||
DB_SCHEME: {{ .dbScheme | b64enc }}
|
||||
OM_DATABASE: {{ .databaseName | b64enc }}
|
||||
DB_PARAMS: {{ .dbParams | b64enc | quote }}
|
||||
DB_USER: {{ .auth.username | b64enc }}
|
||||
DB_CONNECTION_POOL_MAX_SIZE: {{ .maxSize | quote | b64enc }}
|
||||
DB_CONNECTION_POOL_MIN_SIZE: {{ .minSize | quote | b64enc }}
|
||||
DB_CONNECTION_POOL_INITIAL_SIZE: {{ .initialSize | quote | b64enc }}
|
||||
DB_CONNECTION_CHECK_CONNECTION_WHILE_IDLE: {{ .checkConnectionWhileIdle | quote | b64enc }}
|
||||
DB_CONNECTION_CHECK_CONNECTION_ON_BORROW: {{ .checkConnectionOnBorrow | quote | b64enc }}
|
||||
DB_CONNECTION_EVICTION_INTERVAL: {{ .evictionInterval | quote | b64enc }}
|
||||
DB_CONNECTION_MIN_IDLE_TIME: {{ .minIdleTime | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.elasticsearch.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-search-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.elasticsearch }}
|
||||
ELASTICSEARCH_HOST: {{ .host | quote | b64enc }}
|
||||
SEARCH_TYPE: {{ .searchType | quote | b64enc }}
|
||||
ELASTICSEARCH_PORT: {{ .port | quote | b64enc }}
|
||||
ELASTICSEARCH_SCHEME: {{ .scheme | quote | b64enc }}
|
||||
ELASTICSEARCH_INDEX_MAPPING_LANG: {{ .searchIndexMappingLanguage | quote| b64enc }}
|
||||
ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS: {{ .keepAliveTimeoutSecs | quote | b64enc }}
|
||||
ELASTICSEARCH_CLUSTER_ALIAS: {{ .clusterAlias | quote | b64enc }}
|
||||
ELASTICSEARCH_PAYLOAD_BYTES_SIZE: {{ .payLoadSize | int | toString | b64enc }}
|
||||
{{- if .trustStore.enabled }}
|
||||
ELASTICSEARCH_TRUST_STORE_PATH: {{ .trustStore.path | b64enc }}
|
||||
{{ end }}
|
||||
{{- if .auth.enabled }}
|
||||
ELASTICSEARCH_USER: {{ .auth.username | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-pipeline-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.openmetadata.config.pipelineServiceClientConfig.enabled }}
|
||||
{{- with .Values.openmetadata.config.pipelineServiceClientConfig }}
|
||||
PIPELINE_SERVICE_CLIENT_ENABLED: {{ .enabled | quote | b64enc }}
|
||||
# Common configuration for all pipeline service clients
|
||||
SERVER_HOST_API_URL: {{ .metadataApiEndpoint | b64enc }}
|
||||
{{- if eq .type "airflow" }}
|
||||
# Airflow configuration
|
||||
{{- with .airflow }}
|
||||
PIPELINE_SERVICE_CLIENT_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_ENDPOINT: {{ .apiEndpoint | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_VERIFY_SSL: {{ .verifySsl | quote | b64enc }}
|
||||
PIPELINE_SERVICE_IP_INFO_ENABLED: {{ .ingestionIpInfoEnabled | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL: {{ .healthCheckInterval | quote | b64enc }}
|
||||
PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH: {{ .sslCertificatePath | quote | b64enc }}
|
||||
{{- if eq (include "OpenMetadata.utils.checkEmptyString" .hostIp) "true" }}
|
||||
PIPELINE_SERVICE_CLIENT_HOST_IP: {{ .hostIp | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- if .auth.enabled }}
|
||||
AIRFLOW_USERNAME: {{ .auth.username | b64enc }}
|
||||
AIRFLOW_TRUST_STORE_PATH: {{ .auth.trustStorePath | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if eq .type "k8s" }}
|
||||
# Kubernetes Jobs configuration
|
||||
{{- with .k8s }}
|
||||
PIPELINE_SERVICE_CLIENT_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
K8S_NAMESPACE: {{ $.Release.Namespace | quote | b64enc }}
|
||||
K8S_INGESTION_IMAGE: {{ .ingestionImage | quote | b64enc }}
|
||||
K8S_IMAGE_PULL_POLICY: {{ .imagePullPolicy | quote | b64enc }}
|
||||
K8S_IMAGE_PULL_SECRETS: {{ .imagePullSecrets | quote | b64enc }}
|
||||
K8S_SERVICE_ACCOUNT_NAME: {{ .serviceAccountName | quote | b64enc }}
|
||||
K8S_TTL_SECONDS_AFTER_FINISHED: {{ .ttlSecondsAfterFinished | quote | b64enc }}
|
||||
K8S_ACTIVE_DEADLINE_SECONDS: {{ .activeDeadlineSeconds | quote | b64enc }}
|
||||
K8S_BACKOFF_LIMIT: {{ .backoffLimit | quote | b64enc }}
|
||||
K8S_SUCCESS_JOBS_HISTORY_LIMIT: {{ .successfulJobsHistoryLimit | quote | b64enc }}
|
||||
K8S_FAILED_JOBS_HISTORY_LIMIT: {{ .failedJobsHistoryLimit | quote | b64enc }}
|
||||
K8S_NODE_SELECTOR: {{ .nodeSelector | quote | b64enc }}
|
||||
K8S_RUN_AS_USER: {{ .securityContext.runAsUser | quote | b64enc }}
|
||||
K8S_RUN_AS_GROUP: {{ .securityContext.runAsGroup | quote | b64enc }}
|
||||
K8S_FS_GROUP: {{ .securityContext.fsGroup | quote | b64enc }}
|
||||
K8S_RUN_AS_NON_ROOT: {{ .securityContext.runAsNonRoot | quote | b64enc }}
|
||||
K8S_LIMITS_CPU: {{ .resources.limits.cpu | quote | b64enc }}
|
||||
K8S_LIMITS_MEMORY: {{ .resources.limits.memory | quote | b64enc }}
|
||||
K8S_REQUESTS_CPU: {{ .resources.requests.cpu | quote | b64enc }}
|
||||
K8S_REQUESTS_MEMORY: {{ .resources.requests.memory | quote | b64enc }}
|
||||
K8S_POD_ANNOTATIONS: {{ .podAnnotations | quote | b64enc }}
|
||||
{{- if .extraEnvVars }}
|
||||
K8S_EXTRA_ENV_VARS: {{ .extraEnvVars | toJson | b64enc }}
|
||||
{{- else }}
|
||||
K8S_EXTRA_ENV_VARS: {{ "[]" | b64enc }}
|
||||
{{- end }}
|
||||
K8S_ENABLE_FAILURE_DIAGNOSTICS: {{ .enableFailureDiagnostics | quote | b64enc }}
|
||||
USE_OMJOB_OPERATOR: {{ .useOMJobOperator | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{- else }}
|
||||
PIPELINE_SERVICE_CLIENT_ENABLED: {{ .Values.openmetadata.config.pipelineServiceClientConfig.enabled | quote | b64enc }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.authorizer.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authorizer-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.authorizer }}
|
||||
AUTHORIZER_CLASS_NAME: {{ .className | quote | b64enc }}
|
||||
AUTHORIZER_REQUEST_FILTER: {{ .containerRequestFilter | quote | b64enc }}
|
||||
AUTHORIZER_PRINCIPAL_DOMAIN: {{ .principalDomain | quote | b64enc }}
|
||||
AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: {{ .enforcePrincipalDomain | quote | b64enc }}
|
||||
AUTHORIZER_ENABLE_SECURE_SOCKET: {{ .enableSecureSocketConnection | quote | b64enc }}
|
||||
AUTHORIZER_ADMIN_PRINCIPALS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .initialAdmins ) }}
|
||||
AUTHORIZER_ALLOWED_DOMAINS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .allowedDomains) }}
|
||||
AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .allowedEmailRegistrationDomains) }}
|
||||
AUTHORIZER_USE_ROLES_FROM_PROVIDER: {{ .useRolesFromProvider | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-omd-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.openmetadata }}
|
||||
SERVER_HOST: {{ .host | b64enc }}
|
||||
SERVER_PORT: {{ .port | quote | b64enc }}
|
||||
SERVER_ADMIN_PORT: {{ .adminPort | quote | b64enc }}
|
||||
SERVER_MAX_THREADS: {{ .maxThreads | quote | b64enc }}
|
||||
SERVER_MIN_THREADS: {{ .minThreads | quote | b64enc }}
|
||||
SERVER_IDLE_THREAD_TIMEOUT: {{ .idleThreadTimeout | quote | b64enc }}
|
||||
{{- end }}
|
||||
{{- $aiProxyState := dict "enabled" false }}
|
||||
{{- with .Values.collate }}
|
||||
{{- with .aiProxy }}
|
||||
{{- $_ := set $aiProxyState "enabled" (default false .enabled) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $aiProxyState.enabled }}
|
||||
AI_PLATFORM_ENABLED: dHJ1ZQo=
|
||||
AI_CHAT_PREVIEW: ZmFsc2U=
|
||||
{{- else }}
|
||||
AI_PLATFORM_ENABLED: ZmFsc2U=
|
||||
AI_CHAT_PREVIEW: dHJ1ZQo=
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.secretsManager.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-secretsmanager-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.secretsManager }}
|
||||
SECRET_MANAGER: {{ .provider | quote | b64enc }}
|
||||
SECRET_MANAGER_PREFIX: {{ .prefix | quote | b64enc }}
|
||||
SECRET_MANAGER_TAGS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .tags) }}
|
||||
{{- if .additionalParameters.enabled }}
|
||||
OM_SM_REGION: {{ .additionalParameters.region | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.jwtTokenConfiguration.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-jwt-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.jwtTokenConfiguration }}
|
||||
RSA_PUBLIC_KEY_FILE_PATH: {{ .rsapublicKeyFilePath | quote | b64enc }}
|
||||
RSA_PRIVATE_KEY_FILE_PATH: {{ .rsaprivateKeyFilePath | quote | b64enc }}
|
||||
JWT_ISSUER: {{ .jwtissuer | quote | b64enc }}
|
||||
JWT_KEY_ID: {{ .keyId | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.web.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-web-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.web }}
|
||||
WEB_CONF_URI_PATH: {{ .uriPath | quote | b64enc }}
|
||||
WEB_CONF_HSTS_ENABLED: {{ .hsts.enabled | quote | b64enc }}
|
||||
WEB_CONF_HSTS_MAX_AGE: {{ .hsts.maxAge | quote | b64enc }}
|
||||
WEB_CONF_HSTS_INCLUDE_SUBDOMAINS: {{ .hsts.includeSubDomains | quote | b64enc }}
|
||||
WEB_CONF_HSTS_PRELOAD: {{ .hsts.preload | quote | b64enc }}
|
||||
WEB_CONF_FRAME_OPTION_ENABLED: {{ .frameOptions.enabled | quote | b64enc }}
|
||||
WEB_CONF_FRAME_OPTION: {{ .frameOptions.option | quote | b64enc }}
|
||||
WEB_CONF_FRAME_ORIGIN: {{ .frameOptions.origin | quote | b64enc }}
|
||||
WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED: {{ .contentTypeOptions.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_ENABLED: {{ .xssProtection.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_ON: {{ .xssProtection.onXss | quote | b64enc }}
|
||||
WEB_CONF_XSS_PROTECTION_BLOCK: {{ .xssProtection.block | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_ENABLED: {{ .csp.enabled | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_POLICY: {{ .csp.policy | quote | b64enc }}
|
||||
WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY: {{ .csp.reportOnlyPolicy | quote | b64enc }}
|
||||
WEB_CONF_REFERRER_POLICY_ENABLED: {{ .referrerPolicy.enabled | quote | b64enc }}
|
||||
WEB_CONF_REFERRER_POLICY_OPTION: {{ .referrerPolicy.option | quote | b64enc }}
|
||||
WEB_CONF_PERMISSION_POLICY_ENABLED: {{ .permissionPolicy.enabled | quote | b64enc }}
|
||||
WEB_CONF_PERMISSION_POLICY_OPTION: {{ .permissionPolicy.option | quote | b64enc }}
|
||||
WEB_CONF_CACHE_CONTROL: {{ .cacheControl | quote | b64enc }}
|
||||
WEB_CONF_PRAGMA: {{ .pragma | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.authentication.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-authentication-secret
|
||||
type: Opaque
|
||||
data:
|
||||
AUTHENTICATION_PUBLIC_KEYS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.publicKeys) }}
|
||||
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.jwtPrincipalClaims) }}
|
||||
{{- if .Values.openmetadata.config.authentication.jwtPrincipalClaimsMapping }}
|
||||
AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.authentication.jwtPrincipalClaimsMapping) }}
|
||||
{{- end }}
|
||||
{{- with .Values.openmetadata.config.authentication }}
|
||||
AUTHENTICATION_PROVIDER: {{ .provider | quote | b64enc }}
|
||||
AUTHENTICATION_RESPONSE_TYPE: {{ .responseType | quote | b64enc }}
|
||||
AUTHENTICATION_AUTHORITY: {{ .authority | quote | b64enc }}
|
||||
AUTHENTICATION_CLIENT_ID: {{ .clientId | quote | b64enc }}
|
||||
AUTHENTICATION_CLIENT_TYPE: {{ .clientType | quote | b64enc }}
|
||||
AUTHENTICATION_CALLBACK_URL: {{ .callbackUrl | quote | b64enc }}
|
||||
AUTHENTICATION_ENABLE_SELF_SIGNUP: {{ .enableSelfSignup | quote | b64enc }}
|
||||
{{- if and (eq .clientType "confidential") (.oidcConfiguration.enabled) }}
|
||||
OIDC_TYPE: {{ .oidcConfiguration.oidcType | quote | b64enc }}
|
||||
OIDC_SCOPE: {{ .oidcConfiguration.scope | quote | b64enc }}
|
||||
OIDC_DISCOVERY_URI: {{ .oidcConfiguration.discoveryUri | quote | b64enc }}
|
||||
OIDC_USE_NONCE: {{ .oidcConfiguration.useNonce | quote | b64enc }}
|
||||
OIDC_PREFERRED_JWS: {{ .oidcConfiguration.preferredJwsAlgorithm | quote | b64enc }}
|
||||
OIDC_RESPONSE_TYPE: {{ .oidcConfiguration.responseType | quote | b64enc }}
|
||||
OIDC_PROMPT_TYPE: {{ .oidcConfiguration.promptType | quote | b64enc }}
|
||||
OIDC_DISABLE_PKCE: {{ .oidcConfiguration.disablePkce | quote | b64enc }}
|
||||
OIDC_CALLBACK: {{ .oidcConfiguration.callbackUrl | quote | b64enc }}
|
||||
OIDC_SERVER_URL: {{ .oidcConfiguration.serverUrl | quote | b64enc }}
|
||||
OIDC_CLIENT_AUTH_METHOD: {{ .oidcConfiguration.clientAuthenticationMethod | quote | b64enc }}
|
||||
OIDC_TENANT: {{ .oidcConfiguration.tenant | quote | b64enc }}
|
||||
OIDC_MAX_CLOCK_SKEW: {{ .oidcConfiguration.maxClockSkew | quote | b64enc }}
|
||||
OIDC_OM_REFRESH_TOKEN_VALIDITY: {{ .oidcConfiguration.tokenValidity | quote | b64enc }}
|
||||
OIDC_CUSTOM_PARAMS: {{ .oidcConfiguration.customParams | b64enc }}
|
||||
OIDC_MAX_AGE: {{ .oidcConfiguration.maxAge | quote | b64enc }}
|
||||
OIDC_SESSION_EXPIRY: {{ .oidcConfiguration.sessionExpiry | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .provider "ldap" }}
|
||||
AUTHENTICATION_LDAP_HOST: {{ .ldapConfiguration.host | b64enc }}
|
||||
AUTHENTICATION_LDAP_PORT: {{ .ldapConfiguration.port | quote | b64enc }}
|
||||
AUTHENTICATION_LOOKUP_ADMIN_DN: {{ .ldapConfiguration.dnAdminPrincipal | quote | b64enc }}
|
||||
AUTHENTICATION_USER_LOOKUP_BASEDN: {{ .ldapConfiguration.userBaseDN | quote | b64enc }}
|
||||
AUTHENTICATION_GROUP_LOOKUP_BASEDN: {{ .ldapConfiguration.groupBaseDN | quote | b64enc }}
|
||||
AUTHENTICATION_USER_ROLE_ADMIN_NAME: {{ .ldapConfiguration.roleAdminName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_ALL_ATTR: {{ .ldapConfiguration.allAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_NAME_ATTR: {{ .ldapConfiguration.usernameAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_ATTR: {{ .ldapConfiguration.groupAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_ATTR_VALUE: {{ .ldapConfiguration.groupAttributeValue | quote | b64enc }}
|
||||
AUTHENTICATION_USER_GROUP_MEMBER_ATTR: {{ .ldapConfiguration.groupMemberAttributeName | quote | b64enc }}
|
||||
AUTH_ROLES_MAPPING: {{ .ldapConfiguration.authRolesMapping | quote | b64enc }}
|
||||
AUTH_REASSIGN_ROLES: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .ldapConfiguration.authReassignRoles) }}
|
||||
AUTHENTICATION_USER_MAIL_ATTR: {{ .ldapConfiguration.mailAttributeName | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_POOL_SIZE: {{ .ldapConfiguration.maxPoolSize | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_ENABLED: {{ .ldapConfiguration.sslEnabled | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_TRUSTSTORE_TYPE: {{ .ldapConfiguration.truststoreConfigType | quote | b64enc }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "CustomTrustStore" }}
|
||||
AUTHENTICATION_LDAP_TRUSTSTORE_PATH: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFilePath | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_KEY_FORMAT: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.trustStoreFileFormat | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.verifyHostname | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: {{ .ldapConfiguration.trustStoreConfig.customTrustManagerConfig.examineValidityDates | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "HostName" }}
|
||||
AUTHENTICATION_LDAP_ALLOW_WILDCARDS: {{ .ldapConfiguration.trustStoreConfig.hostNameConfig.allowWildCards | quote | b64enc }}
|
||||
AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES: {{ .ldapConfiguration.trustStoreConfig.hostNameConfig.acceptableHostNames | b64enc}}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "JVMDefault" }}
|
||||
AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: {{ .ldapConfiguration.trustStoreConfig.jvmDefaultConfig.verifyHostname | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- if eq .ldapConfiguration.truststoreConfigType "TrustAll" }}
|
||||
AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: {{ .ldapConfiguration.trustStoreConfig.trustAllConfig.examineValidityDates | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{- if eq .provider "saml" }}
|
||||
SAML_DEBUG_MODE: {{ .saml.debugMode | quote | b64enc }}
|
||||
SAML_IDP_ENTITY_ID: {{ .saml.idp.entityId | quote | b64enc }}
|
||||
SAML_IDP_SSO_LOGIN_URL: {{ .saml.idp.ssoLoginUrl | quote | b64enc }}
|
||||
SAML_AUTHORITY_URL: {{ .saml.idp.authorityUrl | quote | b64enc }}
|
||||
SAML_IDP_NAME_ID: {{ .saml.idp.nameId | quote | b64enc }}
|
||||
SAML_SP_ENTITY_ID: {{ .saml.sp.entityId | quote | b64enc }}
|
||||
SAML_SP_ACS: {{ .saml.sp.acs | quote | b64enc }}
|
||||
SAML_SP_CALLBACK: {{ .saml.sp.callback | quote | b64enc }}
|
||||
SAML_STRICT_MODE: {{ .saml.security.strictMode | quote | b64enc }}
|
||||
SAML_VALIDATE_XML: {{ .saml.security.validateXml | quote | b64enc }}
|
||||
SAML_SP_TOKEN_VALIDITY: {{ .saml.security.tokenValidity | quote | b64enc }}
|
||||
SAML_SEND_ENCRYPTED_NAME_ID: {{ .saml.security.sendEncryptedNameId | quote | b64enc }}
|
||||
SAML_SEND_SIGNED_AUTH_REQUEST: {{ .saml.security.sendSignedAuthRequest | quote | b64enc }}
|
||||
SAML_SIGNED_SP_METADATA: {{ .saml.security.signSpMetadata | quote | b64enc }}
|
||||
SAML_WANT_MESSAGE_SIGNED: {{ .saml.security.wantMessagesSigned | quote | b64enc }}
|
||||
SAML_WANT_ASSERTION_SIGNED: {{ .saml.security.wantAssertionsSigned | quote | b64enc }}
|
||||
SAML_WANT_ASSERTION_ENCRYPTED: {{ .saml.security.wantAssertionEncrypted | quote | b64enc }}
|
||||
# Key Store should only be considered if wantAssertionEncrypted will be true
|
||||
{{- if .saml.security.wantAssertionEncrypted }}
|
||||
SAML_KEYSTORE_FILE_PATH: {{ .saml.security.keyStoreFilePath | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.eventMonitor.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-eventmonitor-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.eventMonitor }}
|
||||
EVENT_MONITOR: {{ .type | b64enc }}
|
||||
EVENT_MONITOR_BATCH_SIZE: {{ .batchSize | quote | b64enc }}
|
||||
{{ end }}
|
||||
EVENT_MONITOR_PATH_PATTERN: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.eventMonitor.pathPattern) }}
|
||||
EVENT_MONITOR_LATENCY: {{ include "OpenMetadata.commaJoinedQuotedEncodedList" (dict "value" .Values.openmetadata.config.eventMonitor.latency) }}
|
||||
{{ end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-config-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config }}
|
||||
LOG_LEVEL: {{ .logLevel | b64enc }}
|
||||
OPENMETADATA_CLUSTER_NAME: {{ .clusterName | b64enc }}
|
||||
{{ end }}
|
||||
|
||||
{{- if .Values.openmetadata.config.rdf.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}-rdf-secret
|
||||
type: Opaque
|
||||
data:
|
||||
{{- with .Values.openmetadata.config.rdf }}
|
||||
RDF_ENABLED: {{ .enabled | quote | b64enc }}
|
||||
RDF_BASE_URI: {{ .baseUri | quote | b64enc }}
|
||||
RDF_STORAGE_TYPE: {{ .storageType | quote | b64enc }}
|
||||
RDF_REMOTE_ENDPOINT: {{ .remoteEndpoint | b64enc }}
|
||||
RDF_REMOTE_USERNAME: {{ .username | quote | b64enc }}
|
||||
RDF_DATASET: {{ .dataset | quote | b64enc }}
|
||||
{{ end }}
|
||||
{{- end}}
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: {{ .Values.service.adminPort }}
|
||||
targetPort: http-admin
|
||||
protocol: TCP
|
||||
name: http-admin
|
||||
selector:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if .Values.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "OpenMetadata.fullname" . }}
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "OpenMetadata.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: http-admin
|
||||
path: /prometheus
|
||||
interval: {{ .Values.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,40 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "OpenMetadata.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "OpenMetadata.labels" . | indent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
"helm.sh/hook-delete-policy": hook-succeeded
|
||||
spec:
|
||||
{{- with .Values.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: wget
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "OpenMetadata.fullname" . }}:{{ .Values.service.port }}']
|
||||
{{- with .Values.testConnection.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,7 @@
|
||||
{{- if not (has .Values.openmetadata.config.authentication.provider (list "basic" "azure" "auth0" "custom-oidc" "google" "okta" "aws-cognito" "ldap" "saml")) }}
|
||||
{{ required "The authentication provider must be basic, azure, auth0, custom-oidc, google, okta, aws-cognito, ldap, saml" nil }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.openmetadata.config.openmetadata }}
|
||||
{{- include "error-message" "Global key has been replaced by openmetadata.config. Please refer docs for the further explaination." }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user