You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
97 lines
3.0 KiB
97 lines
3.0 KiB
openmetadata:
|
|
config:
|
|
authorizer:
|
|
className: "org.openmetadata.service.security.DefaultAuthorizer"
|
|
containerRequestFilter: "org.openmetadata.service.security.JwtFilter"
|
|
initialAdmins: # john.doe from john.doe@example.com
|
|
- "admin"
|
|
- "paasup"
|
|
principalDomain: "paasup.io" # Update with your Domain,The primary domain for the organization (example.com from john.doe@example.com).
|
|
allowedDomains:
|
|
- "paasup.io"
|
|
|
|
authentication:
|
|
provider: "basic"
|
|
# HTTPS로 변경: 프론트엔드가 외부 HTTPS URL로 JWT 검증
|
|
callbackUrl: "https://open-metadata.example.org/callback"
|
|
authority: "https://open-metadata.example.org"
|
|
publicKeys:
|
|
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
|
|
|
# OIDC 연동 (비활성화)
|
|
clientType: confidential
|
|
provider: "custom-oidc"
|
|
publicKeys:
|
|
- "https://open-metadata.example.org/api/v1/system/config/jwks"
|
|
- "https://keycloak.example.org/realms/paasup/protocol/openid-connect/certs"
|
|
clientId: "open-metadata"
|
|
callbackUrl: "https://open-metadata.example.org/callback"
|
|
jwtPrincipalClaims:
|
|
- "email"
|
|
- "preferred_username"
|
|
- "sub"
|
|
oidcConfiguration:
|
|
enabled: true
|
|
oidcType: "Keycloak"
|
|
clientId:
|
|
secretRef: oidc-secrets
|
|
secretKey: openmetadata-oidc-client-id
|
|
clientSecret:
|
|
secretRef: oidc-secrets
|
|
secretKey: openmetadata-oidc-client-secret
|
|
discoveryUri: "https://keycloak.example.org/realms/paasup/.well-known/openid-configuration"
|
|
serverUrl: "https://open-metadata.example.org"
|
|
callbackUrl: "https://open-metadata.example.org/callback"
|
|
tokenValidity: "3600"
|
|
sessionExpiry: "604800"
|
|
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: "kong"
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: root-ca-issuer
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
# HTTPS 활성화: Kong이 TLS 종료 후 HTTP로 pod에 전달
|
|
konghq.com/protocols: https
|
|
konghq.com/https-redirect-status-code: "301"
|
|
# cookie-secure-modifier 제거: forward-headers-strategy=NATIVE로 Spring Boot가 자동 처리
|
|
# konghq.com/plugins: openmetadata-cors
|
|
hosts:
|
|
- host: open-metadata.example.org
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
tls:
|
|
- secretName: openmetadata-tls
|
|
hosts:
|
|
- open-metadata.example.org
|
|
|
|
extraVolumes:
|
|
- name: java-truststore
|
|
secret:
|
|
secretName: java-truststore
|
|
|
|
extraVolumeMounts:
|
|
- name: java-truststore
|
|
mountPath: /etc/ssl/java
|
|
readOnly: true
|
|
|
|
resources: {}
|
|
# limits:
|
|
# cpu: 1
|
|
# memory: 2048Mi
|
|
# requests:
|
|
# cpu: 500m
|
|
# memory: 1024Mi
|
|
|
|
extraEnvs:
|
|
- name: OPENMETADATA_OPTS
|
|
value: >
|
|
-Djavax.net.ssl.trustStore=/etc/ssl/java/cacerts
|
|
-Djavax.net.ssl.trustStorePassword=changeit
|
|
- name: LOG_LEVEL
|
|
value: "INFO"
|
|
- name: "OPENMETADATA_PUBLIC_URL"
|
|
value: "https://open-metadata.example.org"
|
|
|