values.yaml

###############################################################
# Copyright (c) 2021, 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
###############################################################

portal:
  enabled: true
  # -- Set your local frontend to integrate into local development.
  portalAddress: "https://portal.example.org"
  # -- Set your local backend service to integrate into local development.
  # Start port forwarding tunnel for database access, e.g.:
  # 'kubectl port-forward service/portal-backend-postgresql-primary 5432:5432'
  portalBackendAddress: "https://portal-backend.example.org"
  replicaCount: 1
  frontend:
    ingress:
      enabled: true
      annotations:
        cert-manager.io/cluster-issuer: "my-ca-issuer"
        nginx.ingress.kubernetes.io/rewrite-target: "/$1"
        nginx.ingress.kubernetes.io/use-regex: "true"
        nginx.ingress.kubernetes.io/enable-cors: "true"
        nginx.ingress.kubernetes.io/cors-allow-origin: "https://*.example.org"
      tls:
        # -- Provide tls secret.
        - secretName: "portal.example.org-tls"
          # -- Provide host for tls secret.
          hosts:
            - "portal.example.org"
      hosts:
        - host: "portal.example.org"
          paths:
            - path: "/(.*)"
              pathType: "ImplementationSpecific"
              backend:
                service: "portal"
                port: 8080
            - path: "/registration/(.*)"
              pathType: "ImplementationSpecific"
              backend:
                service: "registration"
                port: 8080
            - path: "/((assets|documentation)/.*)"
              pathType: "ImplementationSpecific"
              backend:
                service: "assets"
                port: 8080
  backend:
    ingress:
      enabled: true
      name: "portal-backend"
      annotations:
        cert-manager.io/cluster-issuer: "my-ca-issuer"
        nginx.ingress.kubernetes.io/use-regex: "true"
        nginx.ingress.kubernetes.io/enable-cors: "true"
        nginx.ingress.kubernetes.io/proxy-body-size: "8m"
        nginx.ingress.kubernetes.io/cors-allow-origin: "http://localhost:3000, https://*.example.org"
      tls:
        # -- Provide tls secret.
        - secretName: "portal-backend.example.org-tls"
          # -- Provide host for tls secret.
          hosts:
            - "portal-backend.example.org"
      hosts:
        - host: "portal-backend.example.org"
          paths:
            - path: "/api/registration"
              pathType: "Prefix"
              backend:
                service: "registration-service"
                port: 8080
            - path: "/api/administration"
              pathType: "Prefix"
              backend:
                service: "administration-service"
                port: 8080
            - path: "/api/notification"
              pathType: "Prefix"
              backend:
                service: "notification-service"
                port: 8080
            - path: "/api/provisioning"
              pathType: "Prefix"
              backend:
                service: "provisioning-service"
                port: 8080
            - path: "/api/apps"
              pathType: "Prefix"
              backend:
                service: "marketplace-app-service"
                port: 8080
            - path: "/api/services"
              pathType: "Prefix"
              backend:
                service: "services-service"
                port: 8080
    dotnetEnvironment: "Development"
    keycloak:
      central:
        clientId: "central-client-id"
        clientSecret: ""
        jwtBearerOptions:
          requireHttpsMetadata: "false"
        # -- Password for the user 'kccentral', defined at centralidp.secrets.postgresql.auth.existingSecret.password
        dbConnection:
          password: ""
      shared:
        clientId: "shared-client-id"
        clientSecret: ""
    mailing:
      host: "smtp.example.org"
      port: "587"
      user: "smtp-user"
      password: ""
    provisioning:
      sharedRealm:
        smtpServer:
          host: "smtp.example.org"
          port: "587"
          user: "smtp-user"
          password: ""
          from: "smtp@example.org"
          replyTo: "smtp@example.org"
  postgresql:
    auth:
      # -- Password for the root username 'postgres'. Secret-key 'postgres-password'.
      password: ""
      # -- Password for the non-root username 'portal'. Secret-key 'portal-password'.
      portalPassword: ""
      # -- Password for the non-root username 'provisioning'. Secret-key 'provisioning-password'.
      provisioningPassword: ""

centralidp:
  enabled: true
  keycloak:
    proxy: edge
    nameOverride: "centralidp"
    replicaCount: 1
    extraEnvVars:
      - name: KEYCLOAK_SPI_TRUSTSTORE_FILE
        value: "/opt/bitnami/keycloak/certs/keycloak.truststore.jks"
      - name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
        valueFrom:
          secretKeyRef:
            name: centralidp-spi
            key: spi-truststore-password
      - name: KEYCLOAK_EXTRA_ARGS
        value: "-Dkeycloak.migration.action=import -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=/realms/CX-Central-realm.json -Dkeycloak.migration.strategy=IGNORE_EXISTING"
    extraVolumes:
      - name: certificates
        secret:
          secretName: root-secret
          defaultMode: 420
      - name: shared-certs
        emptyDir: {}
      - name: themes
        emptyDir: {}
      - name: realms
        emptyDir: {}
    extraVolumeMounts:
      - name: certificates
        mountPath: /certs
      - name: shared-certs
        mountPath: "/opt/bitnami/keycloak/certs"
      - name: themes
        mountPath: "/opt/bitnami/keycloak/themes/catenax-central"
      - name: realms
        mountPath: "/realms"
    initContainers:
      - name: init-certs
        image: docker.io/bitnami/keycloak:22.0.3-debian-11-r14
        imagePullPolicy: Always
        command: ["/bin/bash"]
        args:
          - -ec
          - |-
            keytool -import -file "/certs/tls.crt" \
                    -keystore "/opt/bitnami/keycloak/certs/keycloak.truststore.jks" \
                    -storepass "${KEYCLOAK_SPI_TRUSTSTORE_PASSWORD}" \
                    -noprompt
        env:
          - name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
            valueFrom:
              secretKeyRef:
                name: centralidp-spi
                key: spi-truststore-password
        volumeMounts:
          - name: certificates
            mountPath: /certs
          - name: shared-certs
            mountPath: "/opt/bitnami/keycloak/certs"
      - name: import
        image: tractusx/portal-iam:v1.2.0
        imagePullPolicy: Always
        command:
          - sh
        args:
          - -c
          - |
            echo "Copying themes..."
            cp -R /import/themes/catenax-central/* /themes
            echo "Copying realms..."
            cp -R /import/catenax-central/realms/* /realms
        volumeMounts:
        - name: themes
          mountPath: "/themes"
        - name: realms
          mountPath: "/realms"
    postgresql:
      nameOverride: "centralidp-postgresql"
    ingress:
      enabled: true
      ingressClassName: "nginx"
      hostname: "centralidp.example.org"
      annotations:
        cert-manager.io/cluster-issuer: "my-ca-issuer"
        nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
        nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
        nginx.ingress.kubernetes.io/cors-allow-origin: "https://centralidp.example.org"
        nginx.ingress.kubernetes.io/enable-cors: "true"
        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
        nginx.ingress.kubernetes.io/proxy-buffering: "on"
        nginx.ingress.kubernetes.io/proxy-buffers-number: "20"
        nginx.ingress.kubernetes.io/use-regex: "true"
      tls: true
  secrets:
    auth:
      existingSecret:
        # -- Password for the admin username 'admin'. Secret-key 'admin-password'.
        adminpassword: ""
      spi:
        truststorePassword: ""

sharedidp:
  enabled: true
  keycloak:
    proxy: edge
    nameOverride: "sharedidp"
    replicaCount: 1
    extraEnvVars:
      - name: KEYCLOAK_SPI_TRUSTSTORE_FILE
        value: "/opt/bitnami/keycloak/certs/keycloak.truststore.jks"
      - name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
        valueFrom:
          secretKeyRef:
            name: sharedidp-spi
            key: spi-truststore-password
      - name: KEYCLOAK_EXTRA_ARGS
        value: "-Dkeycloak.migration.action=import -Dkeycloak.migration.provider=dir -Dkeycloak.migration.dir=/realms -Dkeycloak.migration.strategy=IGNORE_EXISTING"
    extraVolumes:
      - name: certificates
        secret:
          secretName: root-secret
          defaultMode: 420
      - name: shared-certs
        emptyDir: {}
      - name: themes-catenax-shared
        emptyDir: {}
      - name: themes-catenax-shared-portal
        emptyDir: {}
      - name: realms
        emptyDir: {}
      - name: realm-secrets
        secret:
          secretName: secret-sharedidp-example-realm
    extraVolumeMounts:
      - name: certificates
        mountPath: /certs
      - name: shared-certs
        mountPath: "/opt/bitnami/keycloak/certs"
      - name: themes-catenax-shared
        mountPath: "/opt/bitnami/keycloak/themes/catenax-shared"
      - name: themes-catenax-shared-portal
        mountPath: "/opt/bitnami/keycloak/themes/catenax-shared-portal"
      - name: realms
        mountPath: "/realms"
      - name: realm-secrets
        mountPath: "/secrets"
    initContainers:
      - name: init-certs
        image: docker.io/bitnami/keycloak:22.0.3-debian-11-r14
        imagePullPolicy: Always
        command: ["/bin/bash"]
        args:
          - -ec
          - |-
            keytool -import -file "/certs/tls.crt" \
                    -keystore "/opt/bitnami/keycloak/certs/keycloak.truststore.jks" \
                    -storepass "${KEYCLOAK_SPI_TRUSTSTORE_PASSWORD}" \
                    -noprompt
        env:
          - name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
            valueFrom:
              secretKeyRef:
                name: sharedidp-spi
                key: spi-truststore-password
        volumeMounts:
          - name: certificates
            mountPath: /certs
          - name: shared-certs
            mountPath: "/opt/bitnami/keycloak/certs"
      - name: import
        image: tractusx/portal-iam:v1.2.0
        imagePullPolicy: Always
        command:
          - sh
        args:
          - -c
          - |
            echo "Copying themes-catenax-shared..."
            cp -R /import/themes/catenax-shared/* /themes-catenax-shared
            echo "Copying themes-catenax-shared-portal..."
            cp -R /import/themes/catenax-shared-portal/* /themes-catenax-shared-portal
            echo "Copying realm..."
            cp -R /import/catenax-shared/realms/CX-Operator-realm.json /realms
            cp -R /import/catenax-shared/realms/master-realm.json /realms
            echo "Copying realm-secret..."
            cp /secrets/CX-Operator-users-0.json /realms
        volumeMounts:
        - name: themes-catenax-shared
          mountPath: "/themes-catenax-shared"
        - name: themes-catenax-shared-portal
          mountPath: "/themes-catenax-shared-portal"
        - name: realms
          mountPath: "/realms"
        - name: realm-secrets
          mountPath: "/secrets"
    postgresql:
      nameOverride: "sharedidp-postgresql"
    ingress:
      enabled: true
      ingressClassName: "nginx"
      hostname: "sharedidp.example.org"
      annotations:
        cert-manager.io/cluster-issuer: "my-ca-issuer"
        nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
        nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
        nginx.ingress.kubernetes.io/cors-allow-origin: "https://sharedidp.example.org"
        nginx.ingress.kubernetes.io/enable-cors: "true"
        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
        nginx.ingress.kubernetes.io/proxy-buffering: "on"
        nginx.ingress.kubernetes.io/proxy-buffers-number: "20"
        nginx.ingress.kubernetes.io/use-regex: "true"
      tls: true
  secrets:
    auth:
      existingSecret:
        # -- Password for the admin username 'admin'. Secret-key 'admin-password'.
        adminpassword: ""
      spi:
        truststorePassword: ""

postgresportal:
# -- Additional PostgreSQL for backend development;
  # start port forwarding tunnel for database access, e.g.:
  # 'kubectl port-forward local-portal-postgresql-primary-0 5432:5432'
  enabled: true
  nameOverride: "portal-postgresql"
  auth:
    database: "postgres"
    port: 5432
    existingSecret: "secret-postgres-init-localdev"
    password: ""
    replicationPassword: ""
    portalUser: "portal"
    provisioningUser: "provisioning"
    provisioningPassword: ""
  architecture: "replication"
  audit:
    pgAuditLog: "write, ddl"
    logLinePrefix: "%m %u %d "
  primary:
    initdb:
      scriptsConfigMap: "configmap-postgres-init-localdev"
    extraEnvVars:
      - name: "PORTAL_PASSWORD"
        valueFrom:
          secretKeyRef:
            name: "{{ .Values.auth.existingSecret }}"
            key: "portal-password"
      - name: "PROVISIONING_PASSWORD"
        valueFrom:
          secretKeyRef:
            name: "{{ .Values.auth.existingSecret }}"
            key: "provisioning-password"

pgadmin4:
  enabled: true
#   secret:
#     password: ""
  env:
    email: local@example.org
#   existingSecret: secret-pgadmin4
  ingress:
    enabled: true
    ingressClassName: "nginx"
    annotations:
      cert-manager.io/cluster-issuer: "my-ca-issuer"
    hosts:
      - host: pgadmin4.example.org
        paths:
        - path: /
          pathType: Prefix
    tls:
      - hosts:
        - pgadmin4.example.org
        secretName: pgadmin4.example.org-tls