openmetadata:
  config:
    authorizer:
      className: "org.openmetadata.service.security.DefaultAuthorizer"
      containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
      initialAdmins:  # john.doe from john.doe@example.com
      - "admin"
      - "paasup"
      principalDomain: "paasup.io"  # Update with your Domain,The primary domain for the organization (example.com from john.doe@example.com).
      allowedDomains:
      - "paasup.io"

    authentication:
      provider: "basic"
      # HTTPS로 변경: 프론트엔드가 외부 HTTPS URL로 JWT 검증
      callbackUrl: "https://open-metadata.example.org/callback"
      authority: "https://open-metadata.example.org"
      publicKeys:
      - "https://open-metadata.example.org/api/v1/system/config/jwks"

      # OIDC 연동 (비활성화)
      clientType: confidential
      provider: "custom-oidc"
      publicKeys:
      - "https://open-metadata.example.org/api/v1/system/config/jwks"
      - "https://keycloak.example.org/realms/paasup/protocol/openid-connect/certs"
      clientId: "open-metadata"
      callbackUrl: "https://open-metadata.example.org/callback"
      jwtPrincipalClaims:
        - "email"
        - "preferred_username"
        - "sub"
      oidcConfiguration:
        enabled: true
        oidcType: "Keycloak"
        clientId:
          secretRef: oidc-secrets
          secretKey: openmetadata-oidc-client-id
        clientSecret:
          secretRef: oidc-secrets
          secretKey: openmetadata-oidc-client-secret
        discoveryUri: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
        serverUrl: "https://open-metadata.example.org"
        callbackUrl: "https://open-metadata.example.org/callback"
        tokenValidity: "3600"
        sessionExpiry: "604800"


ingress:
  enabled: true
  className: "kong"
  annotations:
    cert-manager.io/cluster-issuer: root-ca-issuer
    cert-manager.io/duration: 8760h
    cert-manager.io/renew-before: 720h
    # HTTPS 활성화: Kong이 TLS 종료 후 HTTP로 pod에 전달
    konghq.com/protocols: https
    konghq.com/https-redirect-status-code: "301"
    # cookie-secure-modifier 제거: forward-headers-strategy=NATIVE로 Spring Boot가 자동 처리
    # konghq.com/plugins: openmetadata-cors
  hosts:
    - host: open-metadata.example.org
      paths:
        - path: /
          pathType: ImplementationSpecific
  tls:
    - secretName: openmetadata-tls
      hosts:
        - open-metadata.example.org

extraVolumes:
  - name: java-truststore
    secret:
      secretName: java-truststore

extraVolumeMounts:
  - name: java-truststore
    mountPath: /etc/ssl/java
    readOnly: true

resources: {}
#  limits:
#    cpu: 1
#    memory: 2048Mi
#  requests:
#    cpu: 500m
#    memory: 1024Mi

extraEnvs:
  - name: OPENMETADATA_OPTS
    value: >
      -Djavax.net.ssl.trustStore=/etc/ssl/java/cacerts
      -Djavax.net.ssl.trustStorePassword=changeit
  - name: LOG_LEVEL
    value: "INFO"
  - name: "OPENMETADATA_PUBLIC_URL"
    value: "https://open-metadata.example.org"