global: # -- Managed-cloud topology preset: aws | gcp | azure (unset = bundled # in-cluster infra, plaintext). Sets the TOPOLOGY defaults (tls/scheme/ports/ # ssl/object-storage path-style) for the masks below — see # lerian-common.cloud.table. Only ENDPOINTS (host/port/user) stay # client-supplied via global.datastores; a cloud can't know your RDS host. # Precedence: native configmap key > dedicated > shared (global.*) > this # cloud preset > hardcoded default. # Example: cloud: "aws" cloud: "" # -- Env-wide SHARED datastore masks (set once per environment; a dedicated # .datastores or a native {auth,identity}.configmap. overrides these). # Fields: postgres.{host,port,user,ssl}, redis.{host,port,user,tls,caCert}. # Example: # datastores: # postgres: { host: "my-rds.example.com", user: "access_manager" } # redis: { host: "my-elasticache.example.com", port: "6379", tls: "true" } datastores: {} # -- Env-wide environment name. Consumed by lerian-common.globalValue (block "env"). # Fields: name. (configmap.ENV_NAME overrides.) # Example: env: { name: "production" } env: {} # -- Env-wide multi-tenancy gate. Consumed by lerian-common.globalValue (block # "multiTenant"). Fields: enabled. (configmap.MULTI_TENANT_ENABLED overrides.) # Example: multiTenant: { enabled: true } multiTenant: {} # -- Env-wide service discovery (Consul) tuning, consumed by # lerian-common.serviceDiscovery.env. Per-component activation stays with # {auth,identity}.configmap.SD_ENABLED; every derived SD_* sibling (address, # tls, internal/external endpoint) comes from here unless a legacy # configmap.SD_* key is set. Fields: address, tls, tlsSkipVerify, workload, # preferView, internalScheme, externalPort. # Example: serviceDiscovery: { address: "consul.internal:8500", tls: "true" } serviceDiscovery: {} # -- Env-wide telemetry gate. Consumed by lerian-common.globalValue (block # "observability"). Fields: enabled. (configmap.ENABLE_TELEMETRY overrides.) # Example: observability: { enabled: true } observability: {} # -- Env-wide pod scheduling. `spread` is the topologySpreadConstraints preset # (lerian-common.topologySpreadConstraints) applied to every Deployment of this # chart (auth, identity, caradhras, and caradhras.ui when enabled). Each # constraint counts only the component's own pods (labelSelector = its selector # labels) of the same ReplicaSet (matchLabelKeys: [pod-template-hash]), so # rolling updates never deadlock. A # component's `spread` overrides these fields one by one; a component's raw # `topologySpreadConstraints` list replaces the preset entirely. scheduling: spread: # -- Master switch for the spread preset. enabled: true # -- Spread across nodes (kubernetes.io/hostname): ScheduleAnyway (soft) | DoNotSchedule (hard) | "" (off). hostname: ScheduleAnyway # -- Spread across zones (topology.kubernetes.io/zone): ScheduleAnyway | DoNotSchedule | "" (off). # Off by default: the scheduler skips nodes without the zone label when scoring a # soft spread, so on clusters missing it (bare-metal, k3s) a zone constraint # silently cancels the hostname spread. Enable it where every node has zone labels (EKS, GKE, AKS). zone: "" # -- Max allowed pod-count difference between topology domains (integer >= 1). maxSkew: 1 # -- Minimum eligible domains for DoNotSchedule constraints (0 = off). With # fewer domains the scheduler treats the global minimum as 0, so a hard # hostname spread never stacks replicas on a single node; the extra replica # waits for a new node (Karpenter launches it). Use on autoscaled clusters. minDomains: 0 # -- Honor | Ignore | "" (omitted = Kubernetes default Ignore). Honor counts # only nodes whose taints the pod tolerates (e.g. skips a node Karpenter is # draining, tainted karpenter.sh/disrupted). nodeTaintsPolicy: "" # Common configuration shared between components common: # Common secrets and configurations authorizer: # -- Caradhras application client id, shared by the identity and auth components. # Consumed by templates/{identity,auth}/configmap.yaml — values.yaml is NOT # templated by Helm, so components must never self-reference this with `{{ }}`. # Per-component override: {identity,auth}.configmap.AUTHORIZER_CLIENT_ID. clientId: "ac56c81d4d6d95c0ac12" sso: # -- Base the console is served from: scheme + host, plus a path prefix when # the console is mounted under one. The DOMAIN IS YOURS — the chart cannot # know or derive it. The CALLBACK PATH IS OURS: the chart appends # "/signin/sso/callback", which is the console route the identity provider # returns the browser to, and it must not be changed here. # baseUrl: "https://console.example.com" # -> https://console.example.com/signin/sso/callback # baseUrl: "https://apps.example.com/console" # -> https://apps.example.com/console/signin/sso/callback # Setting this (or callbackUrl below) is REQUIRED to configure any SSO # provider: identity refuses to save a provider without it, so the provider # would look configurable while no login through it could ever complete. # Empty (the default) omits PLUGIN_AUTH_SSO_CALLBACK_URL from both ConfigMaps. # One value feeds identity AND auth, which MUST agree: identity registers the # URL in the provider's redirect allow-list and auth sends it as the # redirect_uri. The chart refuses to render when the two resolve differently. # Not derivable from PLUGIN_AUTH_ADDRESS — that is the in-cluster address. baseUrl: "" # -- Literal full callback URL, replacing the composition above — set this OR # baseUrl, never both. Must be an absolute http(s) URL AND must still end in # "/signin/sso/callback": the host is yours, the path is ours. The chart # refuses to render otherwise, because a near-miss (/sso/callback, # /signin/callback) deploys cleanly and is then rejected by Caradhras at the # first login as an unlisted redirect_uri, without saying what was wrong. # Per-component override: {identity,auth}.configmap.PLUGIN_AUTH_SSO_CALLBACK_URL. callbackUrl: "" # -- Lift the path check above. ONLY for a deployment that genuinely answers # SSO on another path — a console mounted on a custom route, or a proxy that # rewrites it. You are leaving the supported contract: the path must then # match whatever actually serves the console SSO callback, and getting it # wrong surfaces only as a failed login. The absolute-http(s)-with-a-path # requirement still applies; it is the binary's, not the chart's. allowCustomCallbackPath: false identity: # -- Readiness probe configuration. All fields override chart defaults. readinessProbe: {} # -- Liveness probe configuration. All fields override chart defaults. livenessProbe: {} # -- Startup probe configuration. Disabled by default; enable to give slow-starting # pods more time before liveness/readiness probes take over. All fields override chart defaults. startupProbe: enabled: false failureThreshold: 5 periodSeconds: 10 timeoutSeconds: 10 # Default values # This is a YAML-formatted file. # Declare variables to be passed into your templates. replicaCount: 1 revisionHistoryLimit: 10 # -- Component name. Empty derives it from the release name (-identity), # which is what the cross-component DNS defaults resolve to. Set it only to pin a # legacy name, and remember every other component reference must then be pinned too. name: "" description: "Identity plugin for Midaz" image: # -- Repository for the container image repository: ghcr.io/lerianstudio/plugin-identity # -- Image pull policy pullPolicy: Always # -- Image tag used for deployment tag: "3.14.0" # -- Secrets for pulling images from a private registry imagePullSecrets: [] # -- Overrides the default generated name by Helm nameOverride: "" # -- Overrides the full name generated by Helm fullnameOverride: "" ingress: # -- Enable or disable ingress enabled: false # -- Ingress class name className: "" # -- Additional ingress annotations annotations: {} hosts: - host: "" paths: - path: / pathType: Prefix # -- TLS configuration for ingress tls: [] # - secretName: chart-example-tls # hosts: # - chart-example.local service: # -- Kubernetes service type type: ClusterIP # -- Service port port: 4001 deploymentStrategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 1 podSecurityContext: {} # fsGroup: 2000 securityContext: # -- Defines the group ID for the user running the process inside the container runAsGroup: 1000 # -- Defines the user ID for the process running inside the container runAsUser: 1000 # -- Ensures the process does not run as root runAsNonRoot: true capabilities: drop: - ALL # -- Defines the root filesystem as read-only readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault pdb: # -- Enable or disable PodDisruptionBudget enabled: true # -- Maximum number of unavailable pods maxUnavailable: 1 # -- Minimum number of available pods minAvailable: 0 # -- Annotations for PodDisruptionBudget annotations: {} resources: # -- CPU and memory limits for pods limits: cpu: 200m memory: 256Mi # -- Minimum CPU and memory requests requests: cpu: 100m memory: 128Mi autoscaling: # -- Enable or disable horizontal pod autoscaling enabled: true # -- Minimum number of replicas minReplicas: 1 # -- Maximum number of replicas maxReplicas: 3 # -- Target CPU utilization percentage for autoscaling targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 # -- Per-component override of global.scheduling.spread (same fields: enabled, # hostname, zone, maxSkew, minDomains, nodeTaintsPolicy); each field set here wins over the global one. # Example: spread: { hostname: DoNotSchedule } spread: {} # -- Raw Kubernetes topologySpreadConstraints. Non-empty = replaces the spread preset # entirely; an entry without labelSelector gets the component's selector labels. topologySpreadConstraints: [] # -- Node selector for scheduling pods on specific nodes nodeSelector: {} # -- Tolerations for scheduling on tainted nodes tolerations: {} # -- Affinity rules for pod scheduling affinity: {} # nodeAffinity: # requiredDuringSchedulingIgnoredDuringExecution: # nodeSelectorTerms: # - matchExpressions: # - key: midaz.io/owner # operator: In # values: # - midaz # podAffinity: # requiredDuringSchedulingIgnoredDuringExecution: # - labelSelector: # matchExpressions: [] # topologyKey: kubernetes.io/hostname # -- ConfigMap for environment variables and configurations # -- All environment variables are declared in the templates/configmap.yaml # @default -- templates/identity/configmap.yaml configmap: ALLOW_INSECURE_TLS: "true" # SSO probe and self-service flags (default "false" in templates/identity/configmap.yaml): # PLUGIN_AUTH_SSO_PREFLIGHT_ALLOW_INSECURE: "false" # only for an IdP with no TLS # PLUGIN_AUTH_SSO_ALLOW_PRIVATE_NETWORKS: "false" # BYOC/on-prem IdP on RFC1918 only # ENABLE_FORGOT_PASSWORD: "false" # needs an email provider linked to the app # Optional keys, omitted from the ConfigMap unless set: # AUTH_M2M_JWKS_URL: "" # empty derives it from the Casdoor address # AUTH_M2M_JWKS_REFRESH_INTERVAL: "5m" # Environment name is resolved via the global mask (global.env.name) — same # rule as the datastore masks: do NOT pin ENV_NAME here, it WINS over the # mask and defeats it. The default ("development") lives in # templates/identity/configmap.yaml. OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT # derives from the same resolved value unless explicitly overridden here. # AUTH_ENABLED/AUTH_PORT are NOT pinned here — the chart already defaults # them ("true"/"4000") in templates/identity/configmap.yaml; no mask reads # them, so duplicating the value here was pure noise. # AUTH_ADDRESS defaults to http://:4000 (templates/identity/configmap.yaml). # Set it only to point identity at an auth outside this release. # Google Workspace directory (identity 3.12.0+). Each key is omitted from the # ConfigMap unless set. With GOOGLE_DIRECTORY_ENABLED "true", identity needs # all four GOOGLE_DIRECTORY_* values (these two plus the two in secrets below) # and the chart refuses to render without them. # GOOGLE_DIRECTORY_ENABLED: "" # "true" turns on the Google Workspace directory connection # GOOGLE_DIRECTORY_CLIENT_ID: "" # client id of Lerian's Google OAuth client # GOOGLE_DIRECTORY_REDIRECT_URL: "" # OAuth redirect URL registered on that client; https # -- Extra environment variables extraEnvVars: {} # -- Secrets for storing sensitive data # -- All secrets are declared in the templates/secrets.yaml # @default -- templates/identity/secrets.yaml secrets: AUTHORIZER_CLIENT_SECRET: "" LICENSE_KEY: "" ORGANIZATION_IDS: "" # -- Consul ACL token for service discovery (empty = no ACL) SD_TOKEN: "" # -- Client secret of Lerian's Google OAuth client (Google Workspace # directory). Empty = key not rendered. GOOGLE_DIRECTORY_CLIENT_SECRET: "" # -- Key that encrypts each organization's stored Google refresh token; at # least 32 bytes. Empty = key not rendered. Changing it makes the stored # tokens unreadable and every connected organization must reconnect. GOOGLE_DIRECTORY_ENCRYPTION_KEY: "" # -- With useExistingSecret=true the chart renders no identity Secret: to turn # on the Google Workspace directory, add GOOGLE_DIRECTORY_CLIENT_SECRET and # GOOGLE_DIRECTORY_ENCRYPTION_KEY to your own Secret (existingSecretName). useExistingSecret: false existingSecretName: "" auth: # -- Readiness probe configuration. All fields override chart defaults. readinessProbe: {} # -- Liveness probe configuration. All fields override chart defaults. livenessProbe: {} # -- Startup probe configuration. Disabled by default; enable to give slow-starting # pods more time before liveness/readiness probes take over. All fields override chart defaults. startupProbe: enabled: false failureThreshold: 5 periodSeconds: 10 timeoutSeconds: 10 # Default values # This is a YAML-formatted file. # Declare variables to be passed into your templates. replicaCount: 3 revisionHistoryLimit: 10 # -- Component name. Empty derives it from the release name (-auth). name: "" image: # -- Repository for the console service container image repository: ghcr.io/lerianstudio/plugin-auth # -- Image pull policy pullPolicy: Always # -- Image tag used for deployment tag: "3.14.0" # -- Secrets for pulling images from a private registry imagePullSecrets: [] # -- Overrides the default generated name by Helm nameOverride: "" # -- Overrides the full name generated by Helm fullnameOverride: "" # -- Overrides the full name generated by Helm namespaceOverride: "" ingress: # -- Enable or disable ingress enabled: false # -- Ingress class name className: "" # -- Additional ingress annotations annotations: {} hosts: - host: "" paths: - path: / pathType: Prefix # -- TLS configuration for ingress tls: [] # - secretName: chart-example-tls # hosts: # - chart-example.local service: # -- Kubernetes service type type: ClusterIP # -- Service port port: 4000 deploymentStrategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 1 podSecurityContext: {} # fsGroup: 2000 securityContext: runAsGroup: 1000 runAsUser: 1000 runAsNonRoot: true capabilities: drop: - ALL readOnlyRootFilesystem: true allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault pdb: # -- Enable or disable PodDisruptionBudget enabled: true # -- Maximum number of unavailable pods maxUnavailable: 1 # -- Minimum number of available pods minAvailable: 0 # -- Annotations for PodDisruptionBudget annotations: {} resources: # -- CPU and memory limits for pods limits: cpu: 1 memory: 756Mi # -- Minimum CPU and memory requests requests: cpu: 500m memory: 256Mi autoscaling: # -- Enable or disable horizontal pod autoscaling enabled: true # -- Minimum number of replicas minReplicas: 3 # -- Maximum number of replicas maxReplicas: 9 # -- Target CPU utilization percentage for autoscaling targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 # -- Per-component override of global.scheduling.spread (same fields: enabled, # hostname, zone, maxSkew, minDomains, nodeTaintsPolicy); each field set here wins over the global one. # Example: spread: { hostname: DoNotSchedule } spread: {} # -- Raw Kubernetes topologySpreadConstraints. Non-empty = replaces the spread preset # entirely; an entry without labelSelector gets the component's selector labels. topologySpreadConstraints: [] # -- Node selector for scheduling pods on specific nodes nodeSelector: {} # -- Tolerations for scheduling on tainted nodes tolerations: {} # -- Affinity rules for pod scheduling affinity: {} # nodeAffinity: # requiredDuringSchedulingIgnoredDuringExecution: # nodeSelectorTerms: # - matchExpressions: # - key: midaz.io/owner # operator: In # values: # - midaz # podAffinity: # requiredDuringSchedulingIgnoredDuringExecution: # - labelSelector: # matchExpressions: [] # topologyKey: kubernetes.io/hostname # -- ConfigMap for environment variables and configurations # @default -- templates/auth/configmap.yaml configmap: ALLOW_INSECURE_TLS: "true" # DB connection (host/port/user/ssl) is resolved via the postgres datastore mask # (global.datastores.postgres / dedicated .Values.datastores). Defaults live in # templates/auth/configmap.yaml so a shared/managed profile can override them — # do NOT pin them here (a native configmap. WINS over the mask and defeats it). # DB_NAME is NOT pinned either — it has no mask (deliberately native/per-module), # and the chart already defaults it ("casdoor") in templates/auth/configmap.yaml. # Redis connection (host/port/user/tls/caCert) is resolved via the redis datastore # mask (global.datastores.redis) — same rule: do NOT pin the connection keys here. # ENV_NAME is resolved via the global mask (global.env.name) — same rule: # do NOT pin it here, it WINS over the mask and defeats it. The default # ("development") lives in templates/auth/configmap.yaml. # OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT derives from the same resolved value # unless explicitly overridden here. # -- Multi-factor authentication gate. Unset (the default) omits MFA_ENABLED # from the ConfigMap, leaving the application's own default in force. # MFA_ENABLED: "false" # Optional keys, omitted from the ConfigMap unless set: # PLUGIN_AUTH_SSO_STATIC_ORGANIZATION: "" # BYOC single-tenant SSO org; refused when MULTI_TENANT_ENABLED=true # AUTH_JWKS_CACHE_TTL: "5m" # -- Extra environment variables extraEnvVars: {} # -- Secrets for storing sensitive data # @default -- templates/auth/secrets.yaml secrets: # DB_PASSWORD is single-sourced from the auth-database Secret this chart keeps # (-auth-database, key "password"), read via secretKeyRef. Leave empty with # the bundled subchart. Only set this for an EXTERNAL database (auth-database.external=true) # without auth-database.auth.existingSecret. See docs/helm-chart-standard.md. DB_PASSWORD: "" AUTHORIZER_CLIENT_SECRET: "" REDIS_PASSWORD: "" LICENSE_KEY: "" ORGANIZATION_IDS: "" # -- TOTP/MFA signing secret (empty = feature dormant) MFA_SECRET: "" # -- Consul ACL token for service discovery (empty = no ACL) SD_TOKEN: "" useExistingSecret: false existingSecretName: "" # -- Init User Job: creates the admin user on FIRST INSTALL ONLY (not on # -- upgrades; if deleted by the customer, it is NOT recreated). Disabled # -- by default and intentionally not advertised here — no environment # -- across benedita/anacleto/AWS staging+production relies on the # -- implicit default, every one of them sets this explicitly either way. # -- All defaults (image, adminEmail/adminDisplayName, timeouts, resources) # -- live in templates/auth/init_user.yaml — set initUser.enabled=true and # -- adminPassword (or useExistingSecret + adminPasswordSecretName) to turn # -- it on. initUser: enabled: false # -- Caradhras: the auth backend/authorization service, promoted to a # top-level component sibling of `identity`/`auth` (formerly nested as # `auth.backend`, which ran the legacy Casdoor image). Lerian's Caradhras # product replaces Casdoor; the image family is renamed accordingly # (casdoor -> caradhras, casdoor-migrations -> caradhras-migrations). # # Backward-compat: helpers resolve image fields, service.port and replicaCount # using the precedence below. Server image defaults are explicit; migrations # image fields stay empty to preserve legacy overrides. # 1. caradhras. (this block, if set) # 2. auth.backend. (legacy path — only relevant for installs that # still set it in THEIR OWN values overrides; # this chart's own values.yaml no longer ships # a real `auth.backend` block) # 3. hardcoded chart default (see the helper in _helpers.tpl) caradhras: # -- Readiness probe configuration. All fields override chart defaults. readinessProbe: {} # -- Liveness probe configuration. All fields override chart defaults. livenessProbe: {} # -- See "Backward-compat" note above — resolved via caradhras.replicaCount. replicaCount: "" revisionHistoryLimit: 10 # -- Component name. Empty derives it from the release name (-caradhras). name: "" # -- Whether to create database on startup (requires CREATEDB permission). # Defaults to false: most DB users granted to caradhras have no CREATEDB # privilege, and the target database/schema is typically provisioned ahead # of time (see benedita sandbox permission-denied incident, 2026-08-25). createDatabase: false # -- Caradhras (beego) config keys. Names are the beego literals, camelCase: # caradhras reads them with conf.GetConfigString, which looks up the exact # key in the environment. The auth/identity REDIS_* names are NOT read here. configmap: # -- Shared session store for a Redis that needs NO AUTH, `host:port` with # no space. Empty (the default) keeps login sessions in a file on each pod's # own filesystem, which only works with a single pod: above one replica a # login started on one pod and finished on another fails with "unknown # authentication type". REQUIRED whenever caradhras runs more than one # replica — the chart refuses to render when replicas are pinned above 1 # without a session store on either channel. # This value is rendered into a ConfigMap, so it must NOT carry a password: # beego's endpoint is positional (host:port,poolsize,password,dbnum) and the # chart refuses to render a third field here. For a Redis with AUTH use # caradhras.secrets.redisEndpoint below. redisEndpoint: "" # -- Whether to reach the session store over TLS ("true"/"false"). Only # emitted when an endpoint is configured on either channel. Also resolvable # once for every component via the datastore mask # (global.datastores.redis.tls). redisTls: "" # -- Sensitive caradhras configuration. # @default -- templates/caradhras/secrets.yaml secrets: # -- Session store connection string for a Redis that requires AUTH, in # beego's positional form `host:port,poolsize,password[,dbnum]`. Written to # the caradhras Secret and injected with secretKeyRef, so the password never # reaches a ConfigMap. Mutually exclusive with # caradhras.configmap.redisEndpoint. redisEndpoint: "" # -- Caradhras license key, injected as env LICENSE_KEY by secretKeyRef. # Required by images that carry the license gate (they refuse to boot # without it). Issued for product `caradhras`; not the auth/identity key. LICENSE_KEY: "" # -- Set true to manage the caradhras Secret yourself: the chart creates none # and reads `LICENSE_KEY` from existingSecretName, plus `redisEndpoint` unless # configmap.redisEndpoint is set. useExistingSecret: false existingSecretName: "" # -- Redis/Valkey AUTH password, injected as the beego config key # `redisPassword` by secretKeyRef — the same delivery DB_PASSWORD already uses # on this workload. Caradhras hands it to both redis consumers (the session # store and the rate limiter), so the endpoint above stays a bare `host:port` # and the password never has to be spliced into a connection string. redisPassword: # -- Opt-in. Off by default: a Redis without AUTH needs nothing here. enabled: false # -- Secret holding the password. Empty uses the auth Secret, which already # carries REDIS_PASSWORD (auth.secrets.REDIS_PASSWORD) and is where the # caradhras DB_PASSWORD already reads from. secretName: "" # -- Key inside that Secret. secretKey: REDIS_PASSWORD service: # -- Kubernetes service type for the caradhras component type: ClusterIP # -- See "Backward-compat" note above — resolved via caradhras.servicePort. port: "" annotations: {} # -- Ingress for the caradhras component itself (admin panel/API, port # -- 8000). Disabled by default. Set caradhras.ingress.enabled=true plus # -- className/annotations/hosts/tls (same shape as auth.ingress/ # -- identity.ingress) to turn it on — do not confuse with caradhras.ui.ingress, # -- which fronts the separate SPA console. ingress: enabled: false pdb: # -- Enable or disable PodDisruptionBudget for the caradhras component. # -- Own toggle: caradhras is now an independent top-level component, so # -- it no longer shares (or is affected by) auth.pdb. enabled: true # -- Maximum number of unavailable pods maxUnavailable: 1 # -- Minimum number of available pods minAvailable: 0 # -- Annotations for PodDisruptionBudget annotations: {} image: # -- NOTE: explicit (non-empty) on purpose, unlike migrations.image.* below. # -- This means an install that only overrides the legacy # -- auth.backend.image.repository/.tag path (and never sets # -- caradhras.image.*) will NOT fall through to that legacy value anymore # -- — this explicit default always wins. Set caradhras.image.* directly # -- to override. repository: ghcr.io/lerianstudio/caradhras pullPolicy: Always tag: "1.8.6" resources: # -- CPU and memory limits for pods limits: cpu: 1 memory: 1024Mi # -- Minimum CPU and memory requests requests: cpu: 500m memory: 256Mi autoscaling: # -- Enable or disable horizontal pod autoscaling enabled: true # -- Minimum number of replicas minReplicas: 1 # -- Maximum number of replicas maxReplicas: 3 # -- Target CPU utilization percentage for autoscaling targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 # -- Per-component override of global.scheduling.spread (same fields: enabled, # hostname, zone, maxSkew, minDomains, nodeTaintsPolicy); each field set here wins over the global one. # nodeSelector / affinity / tolerations for caradhras still come from auth.*. # Example: spread: { hostname: DoNotSchedule } spread: {} # -- Raw Kubernetes topologySpreadConstraints. Non-empty = replaces the spread preset # entirely; an entry without labelSelector gets the component's selector labels. topologySpreadConstraints: [] migrations: image: # -- Empty preserves auth.backend.migrations.image.repository overrides; # -- otherwise defaults to ghcr.io/lerianstudio/caradhras-migrations. # -- Use the Caradhras release line, not the legacy PAM/Casdoor applier. repository: "" # -- See "Backward-compat" note above — resolved via caradhras.migrationsImagePullPolicy. pullPolicy: "" # -- Empty preserves auth.backend.migrations.image.tag overrides; # -- otherwise defaults to 1.8.6 in templates/_helpers.tpl. # -- Independent of caradhras.image.tag: override both when changing versions. tag: "" # -- Skip the migrations-rbac chain (Lerian product permissions/roles/groups under owner 'lerian') in the migrate init container and in the caradhras boot schema check. For installs whose permissions arrive only via RI manifests (e.g. cross). Requires caradhras and caradhras-migrations images that understand MIGRATIONS_SKIP_RBAC_CHAIN. skipRBACChain: false # -- Extra env vars for the migrate init container only, as a NAME: value map # -- (rendered as name/value pairs, values quoted). Chart-owned names (POSTGRES_HOST/PORT/DB/ # -- USER/PASSWORD/SSLMODE, MIGRATIONS_SKIP_RBAC_CHAIN) are refused. Not for secrets: values land in the pod spec. extraEnvVars: {} # -- Caradhras UI (SPA console): nginx serving the SPA, reverse-proxying # -- same-origin to the caradhras backend Service. Disabled by default. # -- Caradhras console (SPA), disabled by default and intentionally not # -- advertised here. All defaults (image, service port, resources, probes, # -- ingress shape) live in templates/caradhras/ui-*.yaml — set # -- caradhras.ui.enabled=true and any of the fields those templates read # -- (image, service, ingress, resources, autoscaling, ...) to turn it on. # -- Pod spreading for the console follows global.scheduling.spread; override # -- per component with caradhras.ui.spread / caradhras.ui.topologySpreadConstraints. ui: enabled: false auth-database: # Database dependency for identity and access management. # For more details, refer to the documentation: # https://docs.lerian.studio/docs/midaz-security#identity-management-with-casdoor enabled: true global: security: allowInsecureImages: true image: repository: bitnamisecure/postgresql tag: "latest" # latest (PostgreSQL 18.6.0), pinned: PostgreSQL refuses a data directory of another major. digest: "sha256:7045d816bdf7e704f0f662fabf243f3c0a975aa380e73e4e881ee94740f60d4f" auth: enabled: true enablePostgresUser: false username: "auth" password: "" database: "casdoor" # -- Secret with the password. The default points the subchart at the one this chart keeps across # uninstall (templates/auth-database/secrets.yaml); this chart's own templates read it as empty. existingSecret: '{{ if eq .Chart.Name "auth-database" }}{{ include "common.names.fullname" . }}{{ end }}' primary: persistence: size: 8Gi resourcesPreset: large extendedConfiguration: | shared_buffers = 2GB max_wal_senders = 20 wal_keep_size = 512MB max_replication_slots = 20 extraEnvVars: - name: POSTGRESQL_WAL_LEVEL value: "logical" - name: POSTGRESQL_HOST_STANDBY value: "on" - name: POSTGRESQL_MAX_CONNECTIONS value: "500" - name: POSTGRESQL_TCP_KEEPALIVES_IDLE value: "30" - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL value: "10" - name: POSTGRESQL_TCP_KEEPALIVES_COUNT value: "5" valkey: # Redis is used to handle scenarios where real-time performance and fast data retrieval are essential. # This component is responsible for providing an in-memory data store # For more details, refer to the documentation: # https://docs.lerian.studio/docs/midaz-components#why-redis enabled: true global: security: allowInsecureImages: true image: repository: bitnamisecure/valkey tag: "latest" # latest (Valkey 9.1.2), pinned so the version opening this volume changes only on upgrade. digest: "sha256:26e25932c8e8026708cff3360032efc1978588da5ea680e151b3315913a3a38d" architecture: standalone auth: enabled: false otel-collector-lerian: enabled: true