update lakekeeper/0.11.0
- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2) - deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62 - ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer) - openfga.playground 비활성화 (preshared 인증 패닉 방지) - breaking=false, custom-values 키 전부 호환 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
wbsong111
@@ -0,0 +1,22 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "openfga.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "openfga.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "openfga.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "openfga.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[1].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
@@ -0,0 +1,202 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "openfga.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "openfga.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Expand the namespace of the release.
|
||||
Allows overriding it for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "openfga.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "openfga.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "openfga.labels" -}}
|
||||
helm.sh/chart: {{ include "openfga.chart" . }}
|
||||
{{ include "openfga.selectorLabels" . }}
|
||||
{{- with .Values.commonLabels }}
|
||||
{{ . | toYaml }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: authorization-controller
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: openfga
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "openfga.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "openfga.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "openfga.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "openfga.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object should be created
|
||||
*/}}
|
||||
{{- define "openfga.createSecret" -}}
|
||||
{{- if not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "openfga.datastore.secretName" -}}
|
||||
{{ include "openfga.fullname" . }}-datastore-secret
|
||||
{{- end -}}
|
||||
|
||||
{{- define "openfga.datastore.secondary.secretName" -}}
|
||||
{{ include "openfga.fullname" . }}-secondary-datastore-secret
|
||||
{{- end -}}
|
||||
|
||||
{{- define "openfga.datastore.secondary.envConfig" -}}
|
||||
{{- if .Values.datastore.secondary.engine -}}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_ENGINE
|
||||
value: "{{ .Values.datastore.secondary.engine }}"
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.datastore.secondary.uriSecret }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.secondary.uriSecret }}"
|
||||
key: uri
|
||||
{{- else if and (.Values.datastore.secondary.existingSecret) (.Values.datastore.secondary.secretKeys.uriKey) }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.secondary.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secondary.secretKeys.uriKey }}"
|
||||
{{- else if .Values.datastore.secondary.uri }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secondary.secretName" . | quote }}
|
||||
key: "uri"
|
||||
{{- end -}}
|
||||
|
||||
{{- if and (.Values.datastore.secondary.existingSecret) (.Values.datastore.secondary.secretKeys.usernameKey) }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.secondary.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secondary.secretKeys.usernameKey }}"
|
||||
{{- else if .Values.datastore.secondary.username }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secondary.secretName" . | quote }}
|
||||
key: "username"
|
||||
{{- end -}}
|
||||
|
||||
{{- if and (.Values.datastore.secondary.existingSecret) (.Values.datastore.secondary.secretKeys.passwordKey) }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.secondary.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secondary.secretKeys.passwordKey }}"
|
||||
{{- else if .Values.datastore.secondary.password }}
|
||||
- name: OPENFGA_DATASTORE_SECONDARY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secondary.secretName" . | quote }}
|
||||
key: "password"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "openfga.datastore.envConfig" -}}
|
||||
{{- if .Values.datastore.engine -}}
|
||||
- name: OPENFGA_DATASTORE_ENGINE
|
||||
value: "{{ .Values.datastore.engine }}"
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.datastore.uriSecret }}
|
||||
- name: OPENFGA_DATASTORE_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.uriSecret }}"
|
||||
key: uri
|
||||
{{- else if and (.Values.datastore.existingSecret) (.Values.datastore.secretKeys.uriKey) }}
|
||||
- name: OPENFGA_DATASTORE_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secretKeys.uriKey }}"
|
||||
{{- else if .Values.datastore.uri }}
|
||||
- name: OPENFGA_DATASTORE_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secretName" . | quote }}
|
||||
key: "uri"
|
||||
{{- end -}}
|
||||
|
||||
{{- if and (.Values.datastore.existingSecret) (.Values.datastore.secretKeys.usernameKey) }}
|
||||
- name: OPENFGA_DATASTORE_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secretKeys.usernameKey }}"
|
||||
{{- else if .Values.datastore.username }}
|
||||
- name: OPENFGA_DATASTORE_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secretName" . | quote }}
|
||||
key: "username"
|
||||
{{- end -}}
|
||||
|
||||
{{- if and (.Values.datastore.existingSecret) (.Values.datastore.secretKeys.passwordKey) }}
|
||||
- name: OPENFGA_DATASTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ .Values.datastore.existingSecret }}"
|
||||
key: "{{ .Values.datastore.secretKeys.passwordKey }}"
|
||||
{{- else if .Values.datastore.password }}
|
||||
- name: OPENFGA_DATASTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "openfga.datastore.secretName" . | quote }}
|
||||
key: "password"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,494 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ ternary 1 .Values.replicaCount (eq .Values.datastore.engine "memory")}}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "openfga.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: /metrics
|
||||
prometheus.io/port: "{{ (split ":" .Values.telemetry.metrics.addr)._1 }}"
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 8 }}
|
||||
{{- with .Values.podExtraLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "openfga.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{ if or (and (has .Values.datastore.engine (list "postgres" "mysql")) .Values.datastore.applyMigrations .Values.datastore.waitForMigrations) .Values.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- if and (has .Values.datastore.engine (list "postgres" "mysql")) .Values.datastore.applyMigrations .Values.datastore.waitForMigrations (eq .Values.datastore.migrationType "job") }}
|
||||
- name: wait-for-migration
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.initContainer.repository }}:{{ .Values.initContainer.tag }}"
|
||||
imagePullPolicy: {{ .Values.initContainer.pullPolicy }}
|
||||
args: ["job-wr", '{{ include "openfga.fullname" . }}-migrate']
|
||||
resources:
|
||||
{{- toYaml .Values.datastore.migrations.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and (has .Values.datastore.engine (list "postgres" "mysql")) (eq .Values.datastore.migrationType "initContainer") }}
|
||||
{{- with .Values.migrate.extraInitContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: migrate-database
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
args: [ "migrate" ]
|
||||
env:
|
||||
{{- include "openfga.datastore.envConfig" . | nindent 12 }}
|
||||
{{- if .Values.migrate.timeout }}
|
||||
- name: OPENFGA_TIMEOUT
|
||||
value: "{{ .Values.migrate.timeout }}"
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.datastore.migrations.resources | nindent 12 }}
|
||||
{{- with .Values.migrate.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migrate.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.migrate.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraInitContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["run"]
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: {{ (split ":" .Values.grpc.addr)._1 }}
|
||||
|
||||
- name: http
|
||||
containerPort: {{ (split ":" .Values.http.addr)._1 }}
|
||||
protocol: TCP
|
||||
|
||||
- name: profiler
|
||||
containerPort: {{ (split ":" .Values.profiler.addr)._1 }}
|
||||
protocol: TCP
|
||||
|
||||
- name: playground
|
||||
containerPort: {{ .Values.playground.port }}
|
||||
protocol: TCP
|
||||
|
||||
{{- if .Values.telemetry.metrics.enabled }}
|
||||
- name: metrics
|
||||
containerPort: {{ (split ":" .Values.telemetry.metrics.addr)._1 }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
env:
|
||||
{{- include "openfga.datastore.envConfig" . | nindent 12 }}
|
||||
{{- if .Values.datastore.maxCacheSize }}
|
||||
- name: OPENFGA_DATASTORE_MAX_CACHE_SIZE
|
||||
value: "{{ .Values.datastore.maxCacheSize }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.datastore.maxOpenConns }}
|
||||
- name: OPENFGA_DATASTORE_MAX_OPEN_CONNS
|
||||
value: "{{ .Values.datastore.maxOpenConns }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.datastore.maxIdleConns }}
|
||||
- name: OPENFGA_DATASTORE_MAX_IDLE_CONNS
|
||||
value: "{{ .Values.datastore.maxIdleConns }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.datastore.connMaxIdleTime }}
|
||||
- name: OPENFGA_DATASTORE_CONN_MAX_IDLE_TIME
|
||||
value: "{{ .Values.datastore.connMaxIdleTime }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.datastore.connMaxLifetime }}
|
||||
- name: OPENFGA_DATASTORE_CONN_MAX_LIFETIME
|
||||
value: "{{ .Values.datastore.connMaxLifetime }}"
|
||||
{{- end }}
|
||||
|
||||
{{- include "openfga.datastore.secondary.envConfig" . | nindent 12 }}
|
||||
|
||||
- name: OPENFGA_DATASTORE_METRICS_ENABLED
|
||||
value: "{{ .Values.datastore.metrics.enabled }}"
|
||||
|
||||
{{- if .Values.maxConcurrentReadsForCheck }}
|
||||
- name: OPENFGA_MAX_CONCURRENT_READS_FOR_CHECK
|
||||
value: "{{ .Values.maxConcurrentReadsForCheck }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxConcurrentReadsForListObjects }}
|
||||
- name: OPENFGA_MAX_CONCURRENT_READS_FOR_LIST_OBJECTS
|
||||
value: "{{ .Values.maxConcurrentReadsForListObjects }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxConcurrentReadsForListUsers }}
|
||||
- name: OPENFGA_MAX_CONCURRENT_READS_FOR_LIST_USERS
|
||||
value: "{{ .Values.maxConcurrentReadsForListUsers }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxChecksPerBatchCheck }}
|
||||
- name: OPENFGA_MAX_CHECKS_PER_BATCH_CHECK
|
||||
value: "{{ .Values.maxChecksPerBatchCheck }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxConcurrentChecksPerBatchCheck }}
|
||||
- name: OPENFGA_MAX_CONCURRENT_CHECKS_PER_BATCH_CHECK
|
||||
value: "{{ .Values.maxConcurrentChecksPerBatchCheck }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.experimentals }}
|
||||
- name: OPENFGA_EXPERIMENTALS
|
||||
value: "{{ join "," .Values.experimentals }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.grpc.addr }}
|
||||
- name: OPENFGA_GRPC_ADDR
|
||||
value: "{{ .Values.grpc.addr }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.grpc.tls.enabled }}
|
||||
- name: OPENFGA_GRPC_TLS_ENABLED
|
||||
value: "{{ .Values.grpc.tls.enabled }}"
|
||||
|
||||
- name: OPENFGA_GRPC_TLS_CERT
|
||||
value: {{ .Values.grpc.tls.cert }}
|
||||
|
||||
- name: OPENFGA_GRPC_TLS_KEY
|
||||
value: {{ .Values.grpc.tls.key }}
|
||||
{{- end }}
|
||||
|
||||
- name: OPENFGA_HTTP_ENABLED
|
||||
value: "{{ .Values.http.enabled }}"
|
||||
|
||||
{{- if .Values.http.addr }}
|
||||
- name: OPENFGA_HTTP_ADDR
|
||||
value: "{{ .Values.http.addr }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.http.tls.enabled }}
|
||||
- name: OPENFGA_HTTP_TLS_ENABLED
|
||||
value: "{{ .Values.http.tls.enabled }}"
|
||||
|
||||
- name: OPENFGA_HTTP_TLS_CERT
|
||||
value: {{ .Values.http.tls.cert }}
|
||||
|
||||
- name: OPENFGA_HTTP_TLS_KEY
|
||||
value: {{ .Values.http.tls.key }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.http.upstreamTimeout }}
|
||||
- name: OPENFGA_HTTP_UPSTREAM_TIMEOUT
|
||||
value: "{{ .Values.http.upstreamTimeout }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.http.corsAllowedOrigins }}
|
||||
- name: OPENFGA_HTTP_CORS_ALLOWED_ORIGINS
|
||||
value: "{{ include "common.tplvalues.render" ( dict "value" (join "," .Values.http.corsAllowedOrigins) "context" $ ) }}"
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.http.corsAllowedHeaders }}
|
||||
- name: OPENFGA_HTTP_CORS_ALLOWED_HEADERS
|
||||
value: "{{ join "," .Values.http.corsAllowedHeaders }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.authn.method }}
|
||||
- name: OPENFGA_AUTHN_METHOD
|
||||
value: {{ .Values.authn.method }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.authn.preshared.keysSecret }}
|
||||
- name: OPENFGA_AUTHN_PRESHARED_KEYS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.authn.preshared.keysSecret | quote }}
|
||||
key: keys
|
||||
{{- else if .Values.authn.preshared.keys }}
|
||||
- name: OPENFGA_AUTHN_PRESHARED_KEYS
|
||||
value: "{{ join "," .Values.authn.preshared.keys }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.authn.oidc.audience }}
|
||||
- name: OPENFGA_AUTHN_OIDC_AUDIENCE
|
||||
value: "{{ .Values.authn.oidc.audience }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.authn.oidc.issuer }}
|
||||
- name: OPENFGA_AUTHN_OIDC_ISSUER
|
||||
value: "{{ include "common.tplvalues.render" ( dict "value" .Values.authn.oidc.issuer "context" $ ) }}"
|
||||
{{- end }}
|
||||
|
||||
- name: OPENFGA_PLAYGROUND_ENABLED
|
||||
value: "{{ .Values.playground.enabled }}"
|
||||
- name: OPENFGA_PLAYGROUND_PORT
|
||||
value: "{{ .Values.playground.port }}"
|
||||
|
||||
{{- if .Values.profiler.enabled }}
|
||||
- name: OPENFGA_PROFILER_ENABLED
|
||||
value: "{{ .Values.profiler.enabled }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.log.format }}
|
||||
- name: OPENFGA_LOG_FORMAT
|
||||
value: {{ .Values.log.format }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.log.level }}
|
||||
- name: OPENFGA_LOG_LEVEL
|
||||
value: {{ .Values.log.level }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.log.timestampFormat }}
|
||||
- name: OPENFGA_LOG_TIMESTAMP_FORMAT
|
||||
value: {{ .Values.log.timestampFormat }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxTuplesPerWrite }}
|
||||
- name: OPENFGA_MAX_TUPLES_PER_WRITE
|
||||
value: "{{ .Values.maxTuplesPerWrite }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxTypesPerAuthorizationModel }}
|
||||
- name: OPENFGA_MAX_TYPES_PER_AUTHORIZATION_MODEL
|
||||
value: "{{ .Values.maxTypesPerAuthorizationModel }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.maxAuthorizationModelSizeInBytes }}
|
||||
- name: OPENFGA_MAX_AUTHORIZATION_MODEL_SIZE_IN_BYTES
|
||||
value: "{{ .Values.maxAuthorizationModelSizeInBytes }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.changelogHorizonOffset }}
|
||||
- name: OPENFGA_CHANGELOG_HORIZON_OFFSET
|
||||
value: "{{ .Values.changelogHorizonOffset }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.resolveNodeLimit }}
|
||||
- name: OPENFGA_RESOLVE_NODE_LIMIT
|
||||
value: "{{ .Values.resolveNodeLimit }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.resolveNodeBreadthLimit }}
|
||||
- name: OPENFGA_RESOLVE_NODE_BREADTH_LIMIT
|
||||
value: "{{ .Values.resolveNodeBreadthLimit }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.listObjectsDeadline }}
|
||||
- name: OPENFGA_LIST_OBJECTS_DEADLINE
|
||||
value: "{{ .Values.listObjectsDeadline }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if ne .Values.listObjectsMaxResults nil }}
|
||||
- name: OPENFGA_LIST_OBJECTS_MAX_RESULTS
|
||||
value: "{{ .Values.listObjectsMaxResults }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.listUsersDeadline }}
|
||||
- name: OPENFGA_LIST_USERS_DEADLINE
|
||||
value: "{{ .Values.listUsersDeadline }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if ne .Values.listUsersMaxResults nil }}
|
||||
- name: OPENFGA_LIST_USERS_MAX_RESULTS
|
||||
value: "{{ .Values.listUsersMaxResults }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.requestTimeout }}
|
||||
- name: OPENFGA_REQUEST_TIMEOUT
|
||||
value: "{{ .Values.requestTimeout }}"
|
||||
{{- end}}
|
||||
|
||||
{{- if .Values.checkQueryCache.enabled }}
|
||||
- name: OPENFGA_CHECK_QUERY_CACHE_ENABLED
|
||||
value: "{{ .Values.checkQueryCache.enabled }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.checkQueryCache.limit }}
|
||||
- name: OPENFGA_CHECK_QUERY_CACHE_LIMIT
|
||||
value: "{{ .Values.checkQueryCache.limit }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.checkQueryCache.ttl }}
|
||||
- name: OPENFGA_CHECK_QUERY_CACHE_TTL
|
||||
value: "{{ .Values.checkQueryCache.ttl }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.requestDurationDatastoreQueryCountBuckets }}
|
||||
- name: OPENFGA_REQUEST_DURATION_DATASTORE_QUERY_COUNT_BUCKETS
|
||||
value: "{{ join "," .Values.requestDurationDatastoreQueryCountBuckets }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.allowWriting1_0Models }}
|
||||
- name: OPENFGA_ALLOW_WRITING_1_0_MODELS
|
||||
value: "{{ .Values.allowWriting1_0Models }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.allowEvaluating1_0Models }}
|
||||
- name: OPENFGA_ALLOW_EVALUATING_1_0_MODELS
|
||||
value: "{{ .Values.allowEvaluating1_0Models }}"
|
||||
{{- end }}
|
||||
|
||||
- name: OPENFGA_METRICS_ENABLED
|
||||
value: "{{ .Values.telemetry.metrics.enabled }}"
|
||||
|
||||
{{- if .Values.telemetry.metrics.addr }}
|
||||
- name: OPENFGA_METRICS_ADDR
|
||||
value: "{{ .Values.telemetry.metrics.addr }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.metrics.enableRPCHistograms }}
|
||||
- name: OPENFGA_METRICS_ENABLE_RPC_HISTOGRAMS
|
||||
value: "{{ .Values.telemetry.metrics.enableRPCHistograms }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.trace.enabled }}
|
||||
- name: OPENFGA_TRACE_ENABLED
|
||||
value: "{{ .Values.telemetry.trace.enabled }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.trace.otlp.endpoint }}
|
||||
- name: OPENFGA_TRACE_OTLP_ENDPOINT
|
||||
value: {{ .Values.telemetry.trace.otlp.endpoint }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.trace.otlp.tls.enabled }}
|
||||
- name: OPENFGA_TRACE_OTLP_TLS_ENABLED
|
||||
value: {{ .Values.telemetry.trace.otlp.tls.enabled }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.trace.sampleRatio }}
|
||||
- name: OPENFGA_TRACE_SAMPLE_RATIO
|
||||
value: "{{ .Values.telemetry.trace.sampleRatio }}"
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.readinessProbe.enabled }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }}
|
||||
{{- if .Values.grpc.tls.enabled }}
|
||||
exec:
|
||||
command:
|
||||
- grpc_health_probe
|
||||
- -addr={{ .Values.grpc.addr }}
|
||||
- -tls
|
||||
- -tls-ca-cert={{ .Values.grpc.tls.ca }}
|
||||
- -tls-client-cert={{ .Values.grpc.tls.cert }}
|
||||
- -tls-client-key={{ .Values.grpc.tls.key }}
|
||||
{{- else }}
|
||||
grpc:
|
||||
port: {{ (split ":" .Values.grpc.addr)._1 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.livenessProbe.enabled }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }}
|
||||
{{- if .Values.grpc.tls.enabled }}
|
||||
exec:
|
||||
command:
|
||||
- grpc_health_probe
|
||||
- -addr={{ .Values.grpc.addr }}
|
||||
- -tls
|
||||
- -tls-ca-cert={{ .Values.grpc.tls.ca }}
|
||||
- -tls-client-cert={{ .Values.grpc.tls.cert }}
|
||||
- -tls-client-key={{ .Values.grpc.tls.key }}
|
||||
{{- else }}
|
||||
grpc:
|
||||
port: {{ (split ":" .Values.grpc.addr)._1 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.startupProbe.enabled }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }}
|
||||
{{- if .Values.grpc.tls.enabled }}
|
||||
exec:
|
||||
command:
|
||||
- grpc_health_probe
|
||||
- -addr={{ .Values.grpc.addr }}
|
||||
- -tls
|
||||
- -tls-ca-cert={{ .Values.grpc.tls.ca }}
|
||||
- -tls-client-cert={{ .Values.grpc.tls.cert }}
|
||||
- -tls-client-key={{ .Values.grpc.tls.key }}
|
||||
{{- else }}
|
||||
grpc:
|
||||
port: {{ (split ":" .Values.grpc.addr)._1 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.lifecycle }}
|
||||
lifecycle:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end}}
|
||||
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.extraVolumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if (semverCompare ">=1.18.0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,8 @@
|
||||
{{ range .Values.extraObjects }}
|
||||
---
|
||||
{{ if typeIs "string" . }}
|
||||
{{- tpl . $ }}
|
||||
{{- else }}
|
||||
{{- tpl (toYaml .) $ }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "openfga.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,61 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "openfga.fullname" . -}}
|
||||
{{- $svcPort := .Values.service.port -}}
|
||||
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
||||
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
||||
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
pathType: {{ .pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ .servicePort | default $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ .servicePort | default $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,82 @@
|
||||
{{- if and (has .Values.datastore.engine (list "postgres" "mysql")) .Values.datastore.applyMigrations (eq .Values.datastore.migrationType "job") -}}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}-migrate
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- with .Values.migrate.labels }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end}}
|
||||
{{- with .Values.migrate.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.migrate.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 8 }}
|
||||
{{- with .Values.migrate.labels }}
|
||||
{{- toYaml . | nindent 8}}
|
||||
{{- end}}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "openfga.serviceAccountName" . }}
|
||||
{{- with .Values.migrate.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: migrate-database
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
args: ["migrate"]
|
||||
env:
|
||||
{{- include "openfga.datastore.envConfig" . | nindent 12 }}
|
||||
|
||||
{{- if .Values.migrate.timeout }}
|
||||
- name: OPENFGA_TIMEOUT
|
||||
value: "{{ .Values.migrate.timeout }}"
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.datastore.migrations.resources | nindent 12 }}
|
||||
{{- with .Values.migrate.extraVolumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.migrate.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.migrate.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.migrate.extraVolumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
backoffLimit: 1
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}-job-status-reader
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}-job-status-reader
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "openfga.fullname" . }}-job-status-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "openfga.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- if or .Values.datastore.username .Values.datastore.password .Values.datastore.uri -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "openfga.datastore.secretName" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- if .Values.datastore.password }}
|
||||
password: {{ .Values.datastore.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.datastore.username }}
|
||||
username: {{ .Values.datastore.username | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.datastore.uri }}
|
||||
uri: {{ .Values.datastore.uri | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.datastore.secondary.username .Values.datastore.secondary.password .Values.datastore.secondary.uri }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "openfga.datastore.secondary.secretName" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- if .Values.datastore.secondary.password }}
|
||||
password: {{ .Values.datastore.secondary.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.datastore.secondary.username }}
|
||||
username: {{ .Values.datastore.secondary.username | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.datastore.secondary.uri }}
|
||||
uri: {{ .Values.datastore.secondary.uri | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- name: grpc
|
||||
port: {{ (split ":" .Values.grpc.addr)._1 }}
|
||||
targetPort: grpc
|
||||
protocol: TCP
|
||||
|
||||
{{- if .Values.http.enabled }}
|
||||
- name: http
|
||||
port: {{ (split ":" .Values.http.addr)._1 }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.profiler.enabled }}
|
||||
- name: profiler
|
||||
port: {{ (split ":" .Values.profiler.addr)._1 }}
|
||||
targetPort: profiler
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.playground.enabled }}
|
||||
- name: playground
|
||||
port: {{ .Values.playground.port }}
|
||||
targetPort: playground
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.telemetry.metrics.enabled }}
|
||||
- name: metrics
|
||||
port: {{ (split ":" .Values.telemetry.metrics.addr)._1 }}
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
selector:
|
||||
{{- include "openfga.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "openfga.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,52 @@
|
||||
{{- if and .Values.telemetry.metrics.enabled .Values.telemetry.metrics.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "openfga.fullname" . }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.telemetry.metrics.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ include "openfga.namespace" . }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml .Values.telemetry.metrics.serviceMonitor.additionalLabels | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.annotations }}
|
||||
annotations: {{ toYaml .Values.telemetry.metrics.serviceMonitor.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.telemetry.metrics.serviceMonitor.scrapeInterval }}
|
||||
scrapeTimeout: {{ .Values.telemetry.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: true
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{ toYaml .Values.telemetry.metrics.serviceMonitor.relabelings | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{ toYaml .Values.telemetry.metrics.serviceMonitor.metricRelabelings | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.telemetry.metrics.serviceMonitor.jobLabel | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.namespaceSelector }}
|
||||
namespaceSelector: {{ toYaml .Values.telemetry.metrics.serviceMonitor.namespaceSelector | nindent 4 }}
|
||||
{{- else }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "openfga.namespace" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.telemetry.metrics.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- range .Values.telemetry.metrics.serviceMonitor.targetLabels }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "openfga.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "openfga.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "openfga.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: grpc-health-probe
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["grpc_health_probe", '-addr={{ include "openfga.fullname" . }}:{{ (split ":" .Values.grpc.addr)._1 }}']
|
||||
{{- with .Values.testContainerSpec }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.testPodSpec }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user