wbsong111
f4d287abef
- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2) - deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62 - ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer) - openfga.playground 비활성화 (preshared 인증 패닉 방지) - breaking=false, custom-values 키 전부 호환 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
1.6 KiB
YAML
72 lines
1.6 KiB
YAML
catalog:
|
|
resources: {}
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: "apisix"
|
|
host: "lakekeeper.example.org"
|
|
path: "/.*"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: root-ca-issuer
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
k8s.apisix.apache.org/use-regex: "true"
|
|
k8s.apisix.apache.org/ssl-redirect: "true"
|
|
tls:
|
|
enabled: true
|
|
secretName: "lakekeeper-tls"
|
|
|
|
# keycloak 사설 인증서 사용 시 설정
|
|
extraEnv:
|
|
- name: SSL_CERT_FILE
|
|
value: "/tmp/ca.crt"
|
|
extraVolumeMounts:
|
|
- name: keycloak-tls
|
|
mountPath: "/tmp/ca.crt"
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
extraVolumes:
|
|
- name: keycloak-tls
|
|
secret:
|
|
secretName: root-ca-secret
|
|
|
|
# lakekeeper DB
|
|
postgresql:
|
|
enabled: true
|
|
storage:
|
|
className:
|
|
requestedSize: 5Gi
|
|
resources: {}
|
|
|
|
|
|
# OIDC 인증
|
|
auth:
|
|
oauth2:
|
|
providerUri: "https://keycloak.example.org/realms/paasup"
|
|
audience: "lakekeeper"
|
|
ui:
|
|
clientID: "lakekeeper"
|
|
scopes: "lakekeeper"
|
|
authz:
|
|
backend: "openfga"
|
|
openfga:
|
|
apiKey: "your-api-key" # openfga.authn.preshared.key에 정의된 값가 동일하게 설정.
|
|
|
|
internalOpenFGA: true
|
|
openfga:
|
|
resources: {}
|
|
# 테스트 환경 비활성화, authn을 oidc 타입으로 실행하기 위해서는 playground에서는 불가.
|
|
playground:
|
|
enabled: false
|
|
authn:
|
|
method: "preshared"
|
|
preshared:
|
|
# openssl rand -base64 32
|
|
keys: ["your-api-key"]
|
|
postgresql:
|
|
primary:
|
|
resources: {}
|
|
persistence:
|
|
storageClass: ""
|
|
size: 8Gi
|
|
|