values.yaml

###############################################################
# Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
###############################################################

keycloak:
  image:
    tag: 16.1.1-debian-10-r103
  auth:
    adminUser: admin
    # -- Secret containing the passwords for admin username 'admin' and management username 'manager'.
    existingSecret: "centralidp-keycloak"
  proxyAddressForwarding: true
  serviceDiscovery:
    enabled: true
  extraEnvVars:
    - name: KEYCLOAK_USER
      value: "admin"
    - name: KEYCLOAK_PASSWORD
      valueFrom:
        secretKeyRef:
          name: centralidp-keycloak
          key: admin-password
    - name: CACHE_OWNERS_COUNT
      value: "3"
    - name: CACHE_OWNERS_AUTH_SESSIONS_COUNT
      value: "3"
    - name: KEYCLOAK_EXTRA_ARGS
      value: "-Dkeycloak.migration.action=import -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=/realms/CX-Central-realm.json -Dkeycloak.migration.strategy=IGNORE_EXISTING"
  replicaCount: 3
  extraVolumes:
    - name: themes
      emptyDir: {}
    - name: realms
      emptyDir: {}
  extraVolumeMounts:
    - name: themes
      mountPath: "/opt/bitnami/keycloak/themes/catenax-central"
    - name: realms
      mountPath: "/realms"
  initContainers:
    - name: import
      image: tractusx/portal-iam:v1.2.0
      imagePullPolicy: Always
      command:
        - sh
      args:
        - -c
        - |
          echo "Copying themes..."
          cp -R /import/themes/catenax-central/* /themes
          echo "Copying realms..."
          cp -R /import/catenax-central/realms/* /realms
      volumeMounts:
      - name: themes
        mountPath: "/themes"
      - name: realms
        mountPath: "/realms"
  service:
    type: ClusterIP
    sessionAffinity: ClientIP
  ingress:
    enabled: false
    ingressClassName: "nginx"
    # -- Provide default path for the ingress record.
    hostname: "centralidp.example.org"
    annotations:
      # -- Enable TLS configuration for the host defined at `ingress.hostname` parameter;
      # TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`;
      # Provide the name of ClusterIssuer to acquire the certificate required for this Ingress
      cert-manager.io/cluster-issuer: ""
      nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
      nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
      nginx.ingress.kubernetes.io/cors-allow-origin: "https://centralidp.example.org"
      nginx.ingress.kubernetes.io/enable-cors: "true"
      nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
      nginx.ingress.kubernetes.io/proxy-buffering: "on"
      nginx.ingress.kubernetes.io/proxy-buffers-number: "20"
      nginx.ingress.kubernetes.io/use-regex: "true"
    tls: true
  rbac:
    create: true
    rules:
      - apiGroups:
          - ""
        resources:
          - pods
        verbs:
          - get
          - list
  postgresql:
  # -- PostgreSQL chart configuration;
  # default configurations:
  # host: "centralidp-postgresql-primary",
  # port: 5432;
    # Switch to enable or disable the PostgreSQL helm chart.
    enabled: true
    auth:
      # -- Non-root username.
      username: kccentral
      # -- Database name.
      database: iamcentralidp
      # -- Secret containing the passwords for root usernames postgres and non-root username kccentral.
      existingSecret: "centralidp-postgres"
    architecture: replication
  externalDatabase:
  # -- External PostgreSQL configuration
  # IMPORTANT: non-root db user needs needs to be created beforehand on external database.
    # Database host ('-primary' is added as postfix).
    host: "centralidp-postgresql-external-db"
    # -- Database port number.
    port: 5432
    # -- Non-root username for centralidp.
    user: "kccentral"
    # -- Database name.
    database: "iamcentralidp"
    # -- Password for the non-root username (default 'kccentral'). Secret-key 'password'.
    password: ""
    # -- Secret containing the password non-root username, (default 'kccentral').
    existingSecret: "centralidp-keycloak-external-db"
    # -- Name of an existing secret key containing the database credentials.
    existingSecretPasswordKey: "password"

secrets:
  auth:
    existingSecret:
      # -- Password for the admin username 'admin'. Secret-key 'admin-password'.
      adminpassword: ""
      # -- Password Wildfly management username 'manager'. Secret-key 'management-password'.
      managementpassword: ""
  postgresql:
    auth:
      existingSecret:
        # -- Password for the root username 'postgres'. Secret-key 'postgres-password'.
        postgrespassword: ""
        # -- Password for the non-root username 'kccentral'. Secret-key 'password'.
        password: ""
        # -- Password for the non-root username 'repl_user'. Secret-key 'replication-password'.
        replicationPassword: ""

seeding:
# -- Seeding job to upgrade CX_Central realm:
# enable to upgrade the configuration of the CX-Central realm from v1.1.0 to v1.2.0;
# Please also refer to the 'Post-Upgrade Configuration' section in the README.md
# for configuration possibly not covered by the seeding job
  enabled: false
  name: "cx-central-realm-upgrade"
  image: "tractusx/portal-iam-seeding:v1.2.0-iam"
  portContainer: 8080
  authRealm: "master"
  dataPaths:
    dataPath0: "realms/CX-Central-realm.json"
  instanceName: "central"
  # -- We recommend not to specify default resources and to leave this as a conscious choice for the user.
  # If you do want to specify resources, uncomment the following lines,
  # adjust them as necessary, and remove the curly braces after 'resources:'.
  resources: {}
    # limits:
    #   cpu: 250m
    #   memory: 256Mi
    # requests:
    #   cpu: 250m
    #   memory: 256Mi
  extraVolumes:
    - name: realms
      emptyDir: {}
  extraVolumeMounts:
    - name: realms
      mountPath: "app/realms"
  initContainers:
    - name: init-cx-central
      image: tractusx/portal-iam:v1.2.0
      imagePullPolicy: Always
      command:
        - sh
      args:
        - -c
        - |
          echo "Copying CX Central realm..."
          cp -R /import/catenax-central/realms/* /app/realms
      volumeMounts:
      - name: realms
        mountPath: "app/realms"