values.yaml

# Default values for workbench.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

### Kubernetes deployment options

# Populate this should be set if config.frontend.live_reload is true (--set workingDirectory="${PWD}")
workingDirectory: ""

# Need to define a custom role and binding to wait-for-keycloak
extraDeploy: []

controller:
  kind: Deployment   # default: Deployment
  images:
    webui: "ndslabs/webui:2.1.2"
    apiserver: "ndslabs/apiserver:2.1.2"
  extraInitContainers: []

  # Note: labels are immutable - changing labels will require you to uninstall and then reinstall the chart
  extraLabels: {}

  extraVolumes: []

  # Create service account or use an existing one
  serviceAccount:
    # defaults to release name
    # name: workbench
    create: true

  extraVolumeMounts:
    webui: []
    apiserver: []

  extraEnv:
    webui: []
    apiserver: []

  strategy_type: "RollingUpdate"  # default: RollingUpdate

  # Set DNS aliases within this container
  hostAliases: []

ingress:
  host: "kubernetes.docker.internal"
  tls:
    - hosts:
      - "kubernetes.docker.internal"
  api:
    extraRules: []
    annotations: {}
      #cert-manager.io/issuer: "acmedns-staging"
  webui:
    extraRules: []
    annotations: {}


### Workbench config and cutomization

config:
  frontend:
    live_reload: false
    support_email: ""
    analytics_tracking_id: ""
    signin_url: "https://kubernetes.docker.internal/oauth2/start?rd=https%3A%2F%2Fkubernetes.docker.internal%2Fmy-apps"
    signout_url: "https://kubernetes.docker.internal/oauth2/sign_out?rd=https%3A%2F%2Fkubernetes.docker.internal%2F"
    customization:
      org_name: "NCSA"
      product_name: "Workbench"
      landing_html: "<p>Labs Workbench is an environment where developers can prototype tools and capabilities</p><p>that help build out the NDS framework and services. In particular, it is a place that can</p><p>host the development activities of <a style='text-decoration:none;' href='http://www.nationaldataservice.org/projects/pilots.html'>NDS pilot projects</a></p>"
      favicon_path: "/favicon.svg"
      brand_logo_path: "/favicon.svg"
      learn_more_url: "http://www.nationaldataservice.org/platform/workbench.html"
      landing_header_1: "Find the tools you need"
      landing_section_1: "Search our catalog of web-based research and software tools. We offer over 30 different software tools that fit many common scenarios encountered in research software development.  Find a set of tools to help you build out a new software product or extend an existing one."
      landing_header_2: "Run the tools on our cloud service"
      landing_section_2: "Once you've narrowed down your choices, launch your desired tool set on our cloud resources. Access your running applications using our web interface, and start integrating the tools and shaping your software product."
    
      help_links:
        - icon: "fa-info-circle"
          name: "Feature Overview"
          url: "https://nationaldataservice.atlassian.net/wiki/display/NDSC/Feature+Overview"
        - icon: "fa-question-circle"
          name: "FAQ"
          url: "https://nationaldataservice.atlassian.net/wiki/display/NDSC/Frequently+Asked+Questions"
        - icon: "fa-book"
          name: "User's Guide"
          url: "https://nationaldataservice.atlassian.net/wiki/display/NDSC/User%27s+Guide"
        - icon: "fa-code-fork"
          name: "Developer's Guide"
          url: "https://nationaldataservice.atlassian.net/wiki/display/NDSC/Developer%27s+Guide"
        - icon: "fa-gavel"
          name: "Acceptable Use Policy"
          url: "https://nationaldataservice.atlassian.net/wiki/display/NDSC/Acceptable+Use+Policy"
  
  backend:
    oauth:
      userinfoUrl: https://kubernetes.docker.internal/oauth2/userinfo

    # Point at internal mongodb
    mongo:
      uri: "mongodb://workbench:workbench@workbench-mongodb-svc.workbench.svc.cluster.local:27017/ndslabs?authSource=admin"
      db: ndslabs

    # Point at internal Keycloak instance + imported realm
    keycloak:
      hostname: "https://kubernetes.docker.internal/auth"
      realmName: "changeme"
      clientId: "changeme"
      clientSecret: ""

    # Define our own domain and config params
    domain: "kubernetes.docker.internal"
    insecure_ssl_verify: "false"   # for production, use true
    swagger_url: openapi/swagger-v1.yml
    namespace: "workbench"


    # Define parameters about the created userapp
    userapps:
      singlepod: false
      service_account_name: workbench
      home_storage:
        enabled: true
        claim_suffix: "home-data"
      shared_storage:
        enabled: false
        read_only: false
        mount_path: "/shared"
        claim_name: "workbench-shared-storage"
      ingress:
        enabled: true   # TODO: currently ignored
        tls:
          hosts:
           - kubernetes.docker.internal
           - '*.kubernetes.docker.internal'
        annotations:
          ingress.kubernetes.io/ssl-redirect: "true"
          ingress.kubernetes.io/force-ssl-redirect: "true"
          #ingress.kubernetes.io/signin-url: "https://$host/oauth2/start?rd=https%3A%2F%2F$host%2Fmy-apps"
          #ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
          #ingress.kubernetes.io/auth-response-headers: "x-auth-request-user, x-auth-request-email, x-auth-request-access-token, x-auth-request-redirect, x-auth-request-preferred-username"
  
    # TODO: Legacy config options (currently ignored)
    timeout: 30
    inactivity_timeout: 480

### Optional dependency subcharts

# Enable this to run an NGINX ingress controller (if you aren't running another ingress controller)
ingress-nginx:
  enabled: false
  controller:
    # If you have an existing TLS secret, you can uncomment this to specify it here
    # Otherwise NGINX will generate a self-signed and use that instead
    #extraArgs:
    #  default-ssl-certificate: workbench/ndslabs-tls
    hostPort:
      enabled: true
    kind: Deployment


# Enable this to use an external NFS server to provision user volumes (e.g. nfs-condo)
nfs-subdir-external-provisioner:
  enabled: false   # WARNING: experimental
  nfs:
    server: "workbench-nfs-server-provisioner.workbench.svc.cluster.local"
    path: "/export"
    mountOptions:
    - tcp
    - nfsvers=3

    
# Enable this to run a local NFS server (development only)      
nfs-server-provisioner:
  enabled: true
  persistence:
    enabled: true
    storageClass: "hostpath"


# Enable this to run a local Keycloak instance (development only)
keycloak:
  enabled: false
  image:
    registry: docker.io
    repository: bitnamilegacy/keycloak
  httpRelativePath: "/auth/"
  auth:
    adminUser: "admin"
    adminPassword: "workbench"
  proxyAddressForwarding: true
  # To automatically import a Keycloak realm for development, uncomment this and create a new configmap:
  #   kubectl create configmap keycloak-realm -n workbench --from-file=realm.json
  extraEnvVars:
    - name: KEYCLOAK_EXTRA_ARGS
      value: "-Dkeycloak.import=/config/realm.json"
  extraVolumeMounts:
    - name: config
      mountPath: "/config"
      readOnly: true
  extraVolumes:
    - name: config
      configMap:
        name: keycloak-realm
        items:
        - key: "realm.json"
          path: "realm.json"
  global:
    storageClass: "hostpath"
    postgresql:
      auth:
        postgresPassword: workbench
        password: workbench
  postgresql:
    enabled: true
    image:
      registry: docker.io
      repository: bitnamilegacy/postgresql
  service:
    type: ClusterIP
  ingress:
    enabled: true
    hostname: "kubernetes.docker.internal"
    tls: true
    path: /auth/
    annotations:
      # without this, signups (and other large proxy bodies) will fail with a 502
      ingress.kubernetes.io/proxy-buffer-size: "128k"
    extraTls:
      - hosts:
        - kubernetes.docker.internal


oauth2-proxy:
  image:
    registry: docker.io
    repository: bitnamilegacy/oauth2-proxy
  redis:
    image:
      registry: docker.io
      repository: bitnamilegacy/redis
  initContainers: []
  extraArgs:
    # Github OIDC config:
    - --provider=github  # "oidc" works as well, but this gives us roles too
    - --client-id=changeme
    - --client-secret=changeme

    # Authorization config:
    - --email-domain=*
    - --whitelist-domain=.docker.internal     # needed to use the "rd" query string parameter
    - --cookie-domain=.docker.internal        # forward your cookie automatically to subdomains
    - --scope=email profile openid

    # Local development only
    - --insecure-oidc-allow-unverified-email=true
  ingress:
    enabled: true
    path: /oauth2/
    pathtype: Prefix
    hostname: kubernetes.docker.internal
    tls:
      - hosts:
          - kubernetes.docker.internal
  

mongodb:
  enabled: true
  image:
    registry: docker.io
#    repository: bitnamilegacy/mongodb
    repository: mongo
    tag: latest
  autoimport:
    enabled: true
    annotations:
      "helm.sh/hook": "post-install,post-upgrade"
      "helm.sh/hook-delete-policy": before-hook-creation
    env:
      - name: MONGO_URI
        value: "mongodb://workbench:workbench@workbench-mongodb-svc.workbench.svc.cluster.local:27017/ndslabs?authSource=admin"
      - name: MONGO_DB
        value: "ndslabs"
      - name: GIT_REPO
        value: "https://github.com/nds-org/ndslabs-specs"
      - name: GIT_BRANCH
        value: "main"
  architecture: standalone   # WARNING: experimental
  #replicaCount: 3
  auth:
    rootUser: workbench
    rootPassword: workbench

  # TODO: Test AWS + GKE PVs
  persistent:
    # Values can be "false" for no persistent storage, "aws" for awsElasticBlockStore,
    # or "gce" for gcePersistentDisk
    type: false
    # If using awsElasticBlockStore enter the EBS volume id, if using gcePersistentDisk
    # enter the persistent disk name
    volume_id:

  persistence:
    resourcePolicy: keep
  storage_class: "hostpath"
  access_mode: "ReadWriteOnce"   # default: ReadWriteOnce
  size: "1Gi"


resources:
  webui: {}
  api: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}