# -- (list of image pull secrets) # pull secrets for private repositories imagePullSecrets: [] # -- Override the name of the chart. # @default -- `` nameOverride: "" # -- Override the fully qualified chart name. # @default -- `-` fullnameOverride: "" # -- kubernetes cluster domain name. # Used for service discovery in the catalog. clusterDomain: "cluster.local" # -- Additional labels to add to all resources additionalLabels: {} # -- If true, set the annotation helm-hook-enabled: "false" for jobs that need to run before the catalog is started. # If this is false, helm install --wait will not work. helmWait: false lakekeeper: # -- Lakekeeper Edition to use (core|plus). # Lakekeeper Plus requires a valid license. edition: "core" # -- License key for Lakekeeper Plus. # We strongly recommend using a Kubernetes secret instead by setting # `lakekeeper.useLicenseSecret: true` and creating the secret separately. # If both licenseKey and useLicenseSecret are set, the secret takes precedence. licenseKey: "" # -- If true, the license key is stored in a Kubernetes secret. # If false, the license key is passed as an environment variable. # We recommend setting this to true. useLicenseSecret: true # -- Name of the secret to store the license key. # Only used if `lakekeeper.useLicenseSecret` is true. licenseSecretName: "lakekeeper-license" # -- Key within the secret to store the license key. # Only used if `lakekeeper.useLicenseSecret` is true. licenseSecretKey: "license-key" catalog: image: # -- The image repository to pull from repository: ~ # -- The image tag to pull tag: ~ # -- The image pull policy pullPolicy: IfNotPresent # -- 65532 = nonroot of google container distroless uid: 65532 # -- 65534 = nobody of google container distroless gid: 65534 # -- Number of replicas to deploy. Replicas are stateless. replicas: &catalog_replicas 1 # -- (resource requirements) # resources for the catalog container of the catalog pod resources: {} # ---- EXAMPLE ---- # resources: # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # -- () # node selector configs for the catalog Pods nodeSelector: {} # -- (affinity) # -- affinity for the catalog Pods affinity: {} # -- (toleration) # tolerations for the catalog Pods tolerations: [] # -- (topologySpreadConstraints) # topology spread constraints the catalog Pods topologySpreadConstraints: [] # -- (podsecuritycontext-v1-core) # security context for the catalog Pods. # `runAsUser` and `runAsGroup` are ignored for the catalog container, please set with `catalog.image.uid` and `catalog.image.gid` podSecurityContext: {} # # ---- EXAMPLE ---- # podSecurityContext: # runAsNonRoot: true # seccompProfile: # type: RuntimeDefault # -- (podsecuritycontext-v1-core) # security context for the catalog container. # `runAsUser` is ignored, please set with `catalog.image.uid`, `runAsGroup` is ignored, please set with `catalog.image.gid` containerSecurityContext: {} # # ---- EXAMPLE ---- # containerSecurityContext # allowPrivilegeEscalation: false # readOnlyRootFilesystem: true # capabilities: # drop: # - all # -- Labels for the catalog Deployment labels: {} # -- Pod labels for the catalog Deployment podLabels: {} # -- Kubernetes priority class for scheduling priorityClassName: ~ # -- Annotations for the catalog Deployment annotations: {} # -- Pod annotations for the catalog Deployment podAnnotations: {} # -- (list of envvar-v1-core) # extra variables for the catalog Pods extraEnv: [] # -- (list of envfromsource-v1-core) # extra variables for the catalog Pods extraEnvFrom: [] # -- Configuration options for the catalog. # Please check the documentation for the available options. # https://docs.lakekeeper.io/docs/nightly/configuration/ # Configuration items are mounted as environment variables. config: {} # ---- EXAMPLE ---- # config: # LAKEKEEPER__BASE_URI: "https://data.example.com" # You only need to set LAKEKEEPER__BASE_URI if Lakekeeper is running behind a proxy that does not set x-forwarded-for / x-forwarded-host headers # or if you want to force the same base url for all Iceberg clients interacting with a catalog # More information regarding request routing can be found here: https://docs.lakekeeper.io/docs/latest/configuration/?h=x+forwar # LAKEKEEPER__USE_X_FORWARDED_HEADERS can be set to `false` to disable usage for x-forwarded headers # -- if we add the annotation: "cluster-autoscaler.kubernetes.io/safe-to-evict" = "true" safeToEvict: true podDisruptionBudget: # -- if a PodDisruptionBudget resource is created for the catalog enabled: false # -- the maximum unavailable pods/percentage for the catalog maxUnavailable: "" # -- the minimum available pods/percentage for the catalog minAvailable: "" livenessProbe: # -- if the liveness probes of the catalog Pods are enabled enabled: true initialDelaySeconds: 1 periodSeconds: 5 timeoutSeconds: 5 failureThreshold: 5 # configuration of the readiness probes of the catalog pods readinessProbe: # -- if the readiness probes of the catalog Pods are enabled enabled: true initialDelaySeconds: 1 periodSeconds: 5 timeoutSeconds: 5 failureThreshold: 5 autoscaling: # -- if the HorizontalPodAutoscaler is enabled for the catalog Pods enabled: false # -- maximum number of replicas for the catalog Pods maxReplicas: 2 # -- metrics for the HorizontalPodAutoscaler metrics: [] # ____ EXAMPLE _______________ # autoscaling: # enabled: true # maxReplicas: 16 # metrics: # - type: Resource # resource: # name: memory # target: # type: Utilization # averageUtilization: 80 # -- how many seconds to wait after SIGTERM before SIGKILL of the catalog. # Default is 60 seconds. terminationPeriod: 60 # -- (list of containers) # extra containers for the catalog Pods extraContainers: [] # -- (container) # extra init-containers for the catalog Pods extraInitContainers: [] # -- (volume mount) # extra VolumeMounts for the catalog Pods extraVolumeMounts: [] # ---- EXAMPLE ---- # extraVolumeMounts: # - name: foo # mountPath: "/etc/foo" # readOnly: true # -- (volume) # extra Volumes for the catalog Pods extraVolumes: [] # ---- EXAMPLE ---- # extraVolumes: # - name: foo # secret: # secretName: mysecret # optional: false # -- Overwrite the command of the catalog container. # If not set, the default entrypoint of the image is used command: [] dbMigrations: # -- if the db-migrations Job is created. # if `false`, you have to MANUALLY run `airflow db upgrade` when required enabled: true # -- (resource requirements) # resources for the catalog container of the catalog pod resources: {} # ---- EXAMPLE ---- # resources: # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # -- Labels for the catalog migration job labels: {} # -- Labels for the migration pod podLabels: {} # -- Annotations for the migration job annotations: {} # -- Annotations for the migration pod podAnnotations: {} # -- (container) # extra init-containers for the migration Pod extraInitContainers: [] # Other configurations are equal to the `catalog` section initContainers: checkDb: # -- (resource requirements) # resource requests/limits for the "check-db" init-containers resources: {} # configs for the (backend) Service of the catalog Pods (REST-API) service: # -- catalog service annotations annotations: {} # -- catalog service session affinity sessionAffinity: "None" # -- catalog service session affinity config sessionAffinityConfig: {} # -- catalog service type type: ClusterIP # -- catalog service external port externalPort: 8181 # -- catalog service ip of the load balancer service. # Only used when `type: LoadBalancer` loadBalancerIP: "" # -- Source ip ranges for the catalog services. # Only used when `type: LoadBalancer` loadBalancerSourceRanges: [] # -- catalog service node port # Only used when `type: NodePort` nodePort: http: "" ingress: # -- if we should deploy Ingress resources enabled: false # -- annotations for the catalog Ingress annotations: {} # -- additional labels for the catalog Ingress labels: {} # -- the path for the catalog Ingress. # To host the catalog at the url # `https://data.example.com/iceberg-catalog`, set `path: "/iceberg-catalog"`. # If a path is set, the ingress must strip the path before forwarding to the service! # This helm-chart does not take care of this, as it depends on the type of Ingress Controller used. # For example, for NGINX Ingress Controller, set the annotation # `nginx.ingress.kubernetes.io/rewrite-target: /` path: "" # -- the hostname for the catalog Ingress. # For example, `data.example.com`. host: "" # -- the Ingress Class for the catalog Ingress ingressClassName: "" tls: # -- enable TLS termination for the catalog Ingress enabled: false # -- the name of a pre-created Secret containing a TLS private key and certificate secretName: "" prometheus: # -- Adds the prometheus.io/port and prometheus.io/scrape annotations to the catalog Pods. setScrapeAnnotations: false serviceAccount: # -- Specifies whether a service account should be created. # If `false`, you must create the you must create the service account outside this chart with name: `serviceAccount.name` create: true # -- Option to opt-out of the default behavior of service account token auto-mounting. automount: true # -- Name of the service account to use. # If not set and create is true, a name is generated using the fullname name: "" # -- Annotations to add to the service account annotations: {} # ____ EXAMPLE _______________ # # EKS - IAM Roles for Service Accounts # annotations: # eks.amazonaws.com/role-arn: "arn:aws:iam::XXXXXXXXXX:role/<>" # secretBackend: # -- the type of secret store to use. # Available values: "Postgres", "KV2" type: "Postgres" # postgres specific configurations. postgres: # -- Name of the secret containing the encryption key. # If not set, a random key is generated and stored in a secret. # We recommend setting this to a pre-existing secret. If you loose the key, you loose # access to all secrets. # If this secret is not set here, we use helm's lookup function to not change the key on every upgrade. # This is incompatible with some kubernetes tools such as ArgoCD: https://github.com/argoproj/argo-cd/issues/5202 # Please ensure that you have the `encryptionKeySecret` field set if helm's lookup is not supported in your tool. encryptionKeySecret: "" # -- Name of the key within `encryptionKeySecret` containing the encryption key string encryptionKeySecretKey: "encryptionKey" # kv2 specific configurations kv2: # -- the URL of the KV2 secret store url: "" # -- user name for authentication user: "" # -- password for authentication # consider using a secret for the password password: "" # -- path to the secret mount in the KV2 secret store. secretMount: "kv/data/iceberg" # -- the name of a pre-created secret containing the KV2 user userSecret: "" # -- the key within `kv2.userSecret` containing the user string userSecretKey: "username" # -- the name of a pre-created secret containing the KV2 password passwordSecret: "" # -- the key within `kv2.passwordSecret` containing the password string passwordSecretKey: "password" postgresql: # -- if the `groundhog2k/postgres` chart is used. # [WARNING] embedded Postgres is NOT recommended for production. Use an external database instead. # set to `false` if using `externalDatabase.*` enabled: true nameOverride: "lakekeeper-pg" service: port: 5432 settings: # -- Optional existing secret for the Postgrest superuser existingSecret: superuser: # -- Superuser name (if no existingSecret was specified) - defaults to "postgres" value: # -- Key of existingSecret for the Superuser name secretKey: superuserPassword: # -- Password of Superuser (if no existingSecret was specified) value: "password" # -- Key of existingSecret for the Superuser password secretKey: userDatabase: # -- Optional existing secret with database name, user and password existingSecret: name: # -- Name of the user database (if no existingSecret was specified) - defaults to "lakekeeper" value: "lakekeeper" # -- Key of the existingSecret with database name secretKey: user: # -- User name with full access to user database (if no existingSecret was specified) - defaults to "lakekeeper" value: "lakekeeper" # -- Key of the existingSecret with database user secretKey: password: # -- Password of created user (if no existingSecret was specified) - defaults to "password" value: "password" # -- Key of the existingSecret with password of created user secretKey: storage: # -- Size for new PVC, when no existing PVC is used # if `null`, data will be LOST as postgres Pods restart requestedSize: 5Gi # Default access mode (ReadWriteOnce) accessModes: - ReadWriteOnce # -- the StorageClass used by the PVC className: externalDatabase: # -- the type of external database. # allowed values: "postgres" type: postgres # -- hostname to use for read instances of the external database host_read: "localhost" # -- hostname to use for write instances of the external database. # For single read/write instances, this should be the same as `host_read` host_write: "localhost" # port of the external database port: 5432 # the database/scheme to use within the external database database: catalog # the username for the external database user: catalog # the name of a pre-created secret containing the external database user # - if set, this overrides `externalDatabase.user` userSecret: "" # the key within `externalDatabase.userSecret` containing the user string userSecretKey: "postgresql-user" # the password for the external database # - [WARNING] to avoid storing the password in plain-text within your values, # create a Kubernetes secret and use `externalDatabase.passwordSecret` password: "" # the name of a pre-created secret containing the external database password # - if set, this overrides `externalDatabase.password` passwordSecret: "" # the key within `externalDatabase.passwordSecret` containing the password string passwordSecretKey: "postgresql-password" # Additional connection properties can be specified via environment variables # in the `catalog.extraEnv` list auth: # -- Configuration for the authentication of the catalog. # If `auth.oauth2.providerUri` is not set and `auth.kubernetes.enabled` is false, # authentication is disabled. oauth2: # -- If set, access to rest endpoints is secured via an external OIDC-capable IdP. # The IdP must expose `{provider_url}/.well-known/openid-configuration` # and the openid-configuration needs to have the jwks_uri and issuer defined. # For keycloak set: https://keycloak.local/realms/test # For Entra-ID set: https://login.microsoftonline.com/{your-tenant-id}/v2.0 providerUri: "" # -- The expected Audience of the OIDC App of lakekeeper. # The aud (audience) claim of the JWT token must match this value. Typically this is # the Client ID. audience: "" # -- Additional allow OIDC issuers. # The issuer defined in the issuer field of the ``.well-known/openid-configuration`` # is always trusted. `additionalIssuers` has no effect if `providerUri` is not set. additionalIssuers: [] ui: # -- Client ID used for the Authorization Code Flow of the UI. # Required if Authentication is enabled. clientID: "" # -- Space separated scopes to request scopes: "" # -- Resource to request resource: "" k8s: # -- If true, kubernetes service accounts can authenticate to Lakekeeper. # This option is compatible with `auth.oauth2` - multiple IdPs (OIDC and Kubernetes) # can be enabled simultaneously. enabled: false # -- The expected Audience of the Kubernetes Service Account. # The aud (audience) claim of the JWT token must match this value. # If oauth2 and kubernetes authentication are enabled, this value must be specified. # Most clusters can use the default value of `https://kubernetes.default.svc`. audience: "" # -- If true, will set LAKEKEEPER__KUBERNETES_AUTHENTICATION_ACCEPT_LEGACY_SERVICEACCOUNT to true # This option will allow accepting tokens with `iss` claim set to kubernetes/serviceaccount legacyEnabled: false # -- If true and `auth.k8s.enabled` is true, a ClusterRoleBinding is created # that allows lakekeeper to introspect tokens. createClusterRoleBinding: true authz: # -- type of the authorization backend. # Available values: "openfga", "allowall" # Authorization must not change after bootstrapping! # If type "openfga" is chose, consider setting `internalOpenFGA` to true # to deploy an OpenFGA instance as a subchart. backend: "allowall" # The following values are only required if an external # openfga instance is used as the authorization backend. # An external instance is used if `authz.backend` is set to "openfga" # and `internalOpenFGA` is set to false. openfga: # -- OpenFGA Endpoint (gRPC) # Set automatically if `internalOpenFGA` is true. endpoint: "" # -- Name of the Store to use in OpenFGA # Defaults to "lakekeeper" store: "" # -- API Key used to authenticate with OpenFGA. # This is used for pre-shared key authentication.cc # If `clientId` is set, the `apiKey` is ignored. apiKey: "" # -- Client ID used to authenticate with OpenFGA. # This is used for OIDC authentication. clientId: "" # -- Client Secret used to authenticate with OpenFGA. # This is used for OIDC authentication. clientSecret: "" # -- the name of a pre-created secret containing the OIDC Client ID clientIdSecret: "" # -- the key within `openfga.clientIdSecret` containing the client-id string clientIdSecretKey: "client-id" # -- the name of a pre-created secret containing the OIDC Client Secret clientSecretSecret: "" # -- the key within `openfga.clientSecretSecret` containing the client-secret string clientSecretSecretKey: "client-secret" # -- OIDC token endpoint used to authenticate with OpenFGA. # Used when exchanging client credentials for an access token for OpenFGA. # Required if Client ID is set. tokenEndpoint: "" # -- if an OpenFGA instance is deployed as a subchart. # When setting `internalOpenFGA` to true, the `openfga` subchart is deployed. internalOpenFGA: false # The subchart is only deployed if `internalOpenFGA` is set to true. # All following values belong to the `openfga` subchart. # Please check the [OpenFGA Chart](https://github.com/openfga/helm-charts/tree/main/charts/openfga) # for more information. # By default the openfga API is not secured. We recommend to secure the API or use # network policies to restrict access. openfga: # By default, we use the same number of replicas as the catalog replicaCount: *catalog_replicas migrate: annotations: helm.sh/hook: "post-install, post-upgrade, post-rollback" argocd.argoproj.io/hook: Sync argocd.argoproj.io/sync-wave: "0" datastore: engine: postgres migrationType: initContainer uriSecret: lakekeeper-openfga-pg-svcbind-postgres extraEnvVars: - name: OPENFGA_CACHE_CONTROLLER_ENABLED value: "true" - name: OPENFGA_CHECK_QUERY_CACHE_ENABLED value: "true" - name: OPENFGA_CHECK_ITERATOR_CACHE_ENABLED value: "true" - name: OPENFGA_LIST_OBJECTS_ITERATOR_CACHE_ENABLED value: "false" postgresql: # If not set, postgresql of openfga collides with names of # lakekeeper postgres. If changed, also change the `uriSecret` in `datastore`. fullnameOverride: lakekeeper-openfga-pg enabled: true serviceBindings: enabled: true global: security: # Required due to our own postsgresql image allowInsecureImages: true image: registry: quay.io repository: lakekeeper/postgresql tag: 15.4.0-debian-11-r45