dip-values add

2026-06-09 11:51:43 +09:00
parent 162d9b2c2a
commit e64f933901
33 changed files with 2202 additions and 0 deletions
@@ -0,0 +1,146 @@
+airflow:
+  workers:
+    replicas: 2
+    resources: {}
+  scheduler:
+    resources: {}
+  webserver:
+    resources: {}
+  apiServer:
+    resources: {}
+  triggerer:
+    resources: {}
+  dags:
+    persistence:
+      enabled: true
+      storageClassName: "nfs-client"
+      accessMode: ReadWriteMany
+      size: 1Gi
+  logs:
+    persistence:
+      enabled: true
+      storageClassName: "nfs-client"
+      size: 1Gi
+  data:
+    metadataConnection:
+      pass: "$airflow.mysql.password"       
+
+opensearch:
+  opensearchJavaOpts: "-Xmx1g -Xms1g"
+  persistence:
+    size: 30Gi
+  resources:
+    requests:
+      cpu: "100m"
+      memory: "256M"
+    limits:
+      cpu: "2000m"
+      memory: "2048M"
+
+mysql:
+  enabled: true
+  primary:
+    resources:
+      requests:
+        cpu: "500m"
+        memory: "512Mi"
+      limits:
+        cpu: "750m"
+        memory: "768Mi"
+    persistence:
+      size: 50Gi
+  initdbScripts:
+    init_openmetadata_db_scripts.sql: |
+      CREATE DATABASE openmetadata_db;
+      CREATE USER 'openmetadata_user'@'%' IDENTIFIED BY '$openmetadata.mysql.password';
+      GRANT ALL PRIVILEGES ON openmetadata_db.* TO 'openmetadata_user'@'%' WITH GRANT OPTION;
+      commit;
+    init_airflow_db_scripts.sql: |
+      CREATE DATABASE airflow_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+      CREATE USER 'airflow_user'@'%' IDENTIFIED BY '$airflow.mysql.password';
+      GRANT ALL PRIVILEGES ON airflow_db.* TO 'airflow_user'@'%' WITH GRANT OPTION;
+      commit;
+
+---
+
+openmetadata:
+  config:
+    authorizer:
+      className: "org.openmetadata.service.security.DefaultAuthorizer"
+      containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
+      initialAdmins:
+      - "admin"
+      - "dwshin"
+      - "{{ .Username }}"
+      - "service-account-$KEYCLOAK_CLIENT_ID"
+      principalDomain: "paasup.io"
+
+    authentication:
+      clientType: confidential
+      provider: "custom-oidc"
+      authority: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM"
+      publicKeys:
+      - "https://{{ .Name }}.{{ .Domain }}/api/v1/system/config/jwks"
+      - "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/protocol/openid-connect/certs"
+      clientId: "open-metadata"
+      callbackUrl: "https://{{ .Name }}.{{ .Domain }}/callback"
+      jwtPrincipalClaims:
+        - "email"
+        - "preferred_username"
+        - "sub"
+      oidcConfiguration:
+        enabled: true
+        oidcType: "Keycloak"
+        clientId:
+          secretRef: oidc-secrets
+          secretKey: openmetadata-oidc-client-id
+        clientSecret:
+          secretRef: oidc-secrets
+          secretKey: openmetadata-oidc-client-secret
+        discoveryUri: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/.well-known/openid-configuration"
+        serverUrl: "https://{{ .Name }}.{{ .Domain }}"
+        callbackUrl: "https://{{ .Name }}.{{ .Domain }}/callback"
+        tokenValidity: "3600"
+        sessionExpiry: "604800"
+        maxAge: "300"
+    pipelineServiceClientConfig:
+      metadataApiEndpoint: "http://{{ .Name }}:8585/api"
+      airflow:
+        apiEndpoint: "http://{{ .Namespace }}-dependencies-api-server:8080"
+
+ingress:
+  enabled: true
+  className: "kong"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    cert-manager.io/duration: 8760h
+    cert-manager.io/renew-before: 720h
+    konghq.com/protocols: https
+    konghq.com/https-redirect-status-code: "301"
+  hosts:
+    - host: "{{ .Name }}.{{ .Domain }}"
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - secretName: openmetadata-tls
+      hosts:
+        - "{{ .Name }}.{{ .Domain }}"
+
+extraVolumes:
+  - name: java-truststore
+    secret:
+      secretName: java-truststore
+
+extraVolumeMounts:
+  - name: java-truststore
+    mountPath: /etc/ssl/java
+    readOnly: true
+
+resources: {}
+
+extraEnvs:
+  - name: LOG_LEVEL
+    value: "INFO"
+  - name: "OPENMETADATA_PUBLIC_URL"
+    value: "https://{{ .Name }}.{{ .Domain }}"