airflow:
  workers:
    replicas: 2
    resources: {}
  scheduler:
    resources: {}
  webserver:
    resources: {}
  apiServer:
    resources: {}
  triggerer:
    resources: {}
  dags:
    persistence:
      enabled: true
      storageClassName: "nfs-client"
      accessMode: ReadWriteMany
      size: 1Gi
  logs:
    persistence:
      enabled: true
      storageClassName: "nfs-client"
      size: 1Gi
  data:
    metadataConnection:
      pass: "$airflow.mysql.password"       

opensearch:
  opensearchJavaOpts: "-Xmx1g -Xms1g"
  persistence:
    size: 30Gi
  resources:
    requests:
      cpu: "100m"
      memory: "256M"
    limits:
      cpu: "2000m"
      memory: "2048M"

mysql:
  enabled: true
  primary:
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "750m"
        memory: "768Mi"
    persistence:
      size: 50Gi
  initdbScripts:
    init_openmetadata_db_scripts.sql: |
      CREATE DATABASE openmetadata_db;
      CREATE USER 'openmetadata_user'@'%' IDENTIFIED BY '$openmetadata.mysql.password';
      GRANT ALL PRIVILEGES ON openmetadata_db.* TO 'openmetadata_user'@'%' WITH GRANT OPTION;
      commit;
    init_airflow_db_scripts.sql: |
      CREATE DATABASE airflow_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
      CREATE USER 'airflow_user'@'%' IDENTIFIED BY '$airflow.mysql.password';
      GRANT ALL PRIVILEGES ON airflow_db.* TO 'airflow_user'@'%' WITH GRANT OPTION;
      commit;

---

openmetadata:
  config:
    authorizer:
      className: "org.openmetadata.service.security.DefaultAuthorizer"
      containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
      initialAdmins:
      - "admin"
      - "dwshin"
      - "{{ .Username }}"
      - "service-account-$KEYCLOAK_CLIENT_ID"
      principalDomain: "paasup.io"

    authentication:
      clientType: confidential
      provider: "custom-oidc"
      authority: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM"
      publicKeys:
      - "https://{{ .Name }}.{{ .Domain }}/api/v1/system/config/jwks"
      - "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/protocol/openid-connect/certs"
      clientId: "open-metadata"
      callbackUrl: "https://{{ .Name }}.{{ .Domain }}/callback"
      jwtPrincipalClaims:
        - "email"
        - "preferred_username"
        - "sub"
      oidcConfiguration:
        enabled: true
        oidcType: "Keycloak"
        clientId:
          secretRef: oidc-secrets
          secretKey: openmetadata-oidc-client-id
        clientSecret:
          secretRef: oidc-secrets
          secretKey: openmetadata-oidc-client-secret
        discoveryUri: "$KEYCLOAK_URL/realms/$KEYCLOAK_REALM/.well-known/openid-configuration"
        serverUrl: "https://{{ .Name }}.{{ .Domain }}"
        callbackUrl: "https://{{ .Name }}.{{ .Domain }}/callback"
        tokenValidity: "3600"
        sessionExpiry: "604800"
        maxAge: "300"
    pipelineServiceClientConfig:
      metadataApiEndpoint: "http://{{ .Name }}:8585/api"
      airflow:
        apiEndpoint: "http://{{ .Namespace }}-dependencies-api-server:8080"

ingress:
  enabled: true
  className: "apisix"
  annotations:
    cert-manager.io/cluster-issuer: root-ca-issuer
    cert-manager.io/duration: 8760h
    cert-manager.io/renew-before: 720h
    k8s.apisix.apache.org/plugin-config-name: https-redirect
    k8s.apisix.apache.org/enable-websocket: "true"
  hosts:
    - host: "{{ .Name }}.{{ .Domain }}"
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: openmetadata-tls
      hosts:
        - "{{ .Name }}.{{ .Domain }}"

extraVolumes:
  - name: java-truststore
    secret:
      secretName: java-truststore

extraVolumeMounts:
  - name: java-truststore
    mountPath: /etc/ssl/java
    readOnly: true

resources: {}

extraEnvs:
  - name: LOG_LEVEL
    value: "INFO"
  - name: "OPENMETADATA_PUBLIC_URL"
    value: "https://{{ .Name }}.{{ .Domain }}"