You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
127 lines
5.7 KiB
127 lines
5.7 KiB
{{/* Checks for `catalog.ingress.path` */}}
|
|
{{- if .Values.catalog.ingress.path }}
|
|
{{- if not (.Values.catalog.ingress.path | hasPrefix "/") }}
|
|
{{ required "The `catalog.ingress.path` should start with a '/'!" nil }}
|
|
{{- end }}
|
|
{{- if and (ne .Values.catalog.ingress.path "/") (.Values.catalog.ingress.path | hasSuffix "/") }}
|
|
{{ required "The `catalog.ingress.path` should NOT include a trailing '/'!" nil }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "iceberg-catalog.fullname" . }}-config-envs
|
|
labels:
|
|
{{- include "iceberg-catalog.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: config
|
|
data:
|
|
# Database Configs
|
|
{{- if not .Values.postgresql.enabled }}
|
|
{{- if .Values.externalDatabase.host_read }}
|
|
LAKEKEEPER__PG_HOST_R: {{ .Values.externalDatabase.host_read | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.externalDatabase.host_write }}
|
|
LAKEKEEPER__PG_HOST_W: {{ .Values.externalDatabase.host_write | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.externalDatabase.port }}
|
|
LAKEKEEPER__PG_PORT: {{ .Values.externalDatabase.port | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.externalDatabase.database }}
|
|
LAKEKEEPER__PG_DATABASE: {{ .Values.externalDatabase.database | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if not .Values.externalDatabase.userSecret }}
|
|
LAKEKEEPER__PG_USER: {{ .Values.externalDatabase.user | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if not .Values.externalDatabase.passwordSecret }}
|
|
LAKEKEEPER__PG_PASSWORD: {{ .Values.externalDatabase.password | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
# Lakekeeper License Configs
|
|
{{- if and .Values.lakekeeper.licenseKey (not .Values.lakekeeper.useLicenseSecret) }}
|
|
LAKEKEEPER__LICENSE__KEY: {{ .Values.lakekeeper.licenseKey | toString | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
# OPENID Auth Configs
|
|
{{- if .Values.auth.oauth2.providerUri }}
|
|
LAKEKEEPER__OPENID_PROVIDER_URI: {{ .Values.auth.oauth2.providerUri | toString | b64enc | quote }}
|
|
{{- if .Values.auth.oauth2.audience }}
|
|
LAKEKEEPER__OPENID_AUDIENCE: {{ .Values.auth.oauth2.audience | toString | b64enc | quote }}
|
|
{{- end }}
|
|
# .Values.auth.oauth2.additionalIssuers is a list.
|
|
# If it is not empty, join the list with a comma and set the value to LAKEKEEPER__OPENID_ADDITIONAL_ISSUERS
|
|
{{- if .Values.auth.oauth2.additionalIssuers }}
|
|
LAKEKEEPER__OPENID_ADDITIONAL_ISSUERS: {{ .Values.auth.oauth2.additionalIssuers | join "," | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
# UI Auth configs
|
|
{{- if .Values.auth.oauth2.ui.clientID }}
|
|
LAKEKEEPER__UI__OPENID_CLIENT_ID: {{ .Values.auth.oauth2.ui.clientID | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.auth.oauth2.ui.scopes }}
|
|
LAKEKEEPER__UI__OPENID_SCOPE: {{ .Values.auth.oauth2.ui.scopes | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.auth.oauth2.ui.resource }}
|
|
LAKEKEEPER__UI__OPENID_RESOURCE: {{ .Values.auth.oauth2.ui.resource | toString | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
# Kubernetes Auth Configs
|
|
{{- if .Values.auth.k8s.enabled }}
|
|
LAKEKEEPER__ENABLE_KUBERNETES_AUTHENTICATION: {{ "true" | b64enc | quote }}
|
|
{{- if .Values.auth.k8s.audience }}
|
|
LAKEKEEPER__KUBERNETES_AUTHENTICATION_AUDIENCE: {{ .Values.auth.k8s.audience | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.auth.k8s.legacyEnabled }}
|
|
LAKEKEEPER__KUBERNETES_AUTHENTICATION_ACCEPT_LEGACY_SERVICEACCOUNT: {{ "true" | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
# Secret store configs
|
|
{{- if eq "postgres" (lower .Values.secretBackend.type) }}
|
|
LAKEKEEPER__SECRET_BACKEND: {{ "Postgres" | b64enc | quote }}
|
|
# LAKEKEEPER__PG_ENCRYPTION_KEY is mounted as secret
|
|
{{- end }}
|
|
{{- if eq "kv2" (lower .Values.secretBackend.type) }}
|
|
LAKEKEEPER__KV2__URL: {{ .Values.secretBackend.kv2.url | toString | b64enc | quote }}
|
|
{{- if .Values.secretBackend.kv2.user }}
|
|
LAKEKEEPER__KV2__USER: {{ .Values.secretBackend.kv2.user | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretBackend.kv2.password }}
|
|
LAKEKEEPER__KV2__PASSWORD: {{ .Values.secretBackend.kv2.password | toString | b64enc | quote }}
|
|
{{- end }}
|
|
LAKEKEEPER__KV2__SECRET_MOUNT: {{ .Values.secretBackend.kv2.secret_mount | toString | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
# Authorization configs
|
|
LAKEKEEPER__AUTHZ_BACKEND: {{ .Values.authz.backend | toString | b64enc | quote }}
|
|
{{- if eq "openfga" (lower .Values.authz.backend) }}
|
|
|
|
{{- if .Values.authz.openfga.endpoint }}
|
|
LAKEKEEPER__OPENFGA__ENDPOINT: {{ .Values.authz.openfga.endpoint | toString | b64enc | quote }}
|
|
{{- else if .Values.internalOpenFGA }}
|
|
LAKEKEEPER__OPENFGA__ENDPOINT: {{ printf "http://%s.%s.svc.%s:%d" ( include "iceberg-catalog.openfga.fullname" . ) (.Release.Namespace) (.Values.clusterDomain) (int (split ":" .Values.openfga.grpc.addr)._1) | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.authz.openfga.store }}
|
|
LAKEKEEPER__OPENFGA__STORE_NAME: {{ .Values.authz.openfga.store | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.authz.openfga.apiKey }}
|
|
LAKEKEEPER__OPENFGA__API_KEY: {{ .Values.authz.openfga.apiKey | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.authz.openfga.clientId }}
|
|
LAKEKEEPER__OPENFGA__CLIENT_ID: {{ .Values.authz.openfga.clientId | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.authz.openfga.clientSecret }}
|
|
LAKEKEEPER__OPENFGA__CLIENT_SECRET: {{ .Values.authz.openfga.clientSecret | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.authz.openfga.tokenEndpoint }}
|
|
LAKEKEEPER__OPENFGA__TOKEN_ENDPOINT: {{ .Values.authz.openfga.tokenEndpoint | toString | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
# User Configs
|
|
{{- range $k, $v := .Values.catalog.config }}
|
|
{{ $k | quote }}: {{ $v | toString | b64enc | quote }}
|
|
{{- end }}
|
|
|