values.yaml

# Copyright The Linux Foundation and each contributor to LFX.
# SPDX-License-Identifier: MIT
---
# LFX global values
lfx:
  # Domain configuration
  domain: k8s.orb.local

  # Common image settings
  image:
    registry: linuxfoundation
    pullPolicy: IfNotPresent

  generateHeimdallBundle:
    enabled: false
    name: heimdall-trust-bundle
    configKey: ca-certificates.crt

  # Have Helm generate the heimdall-signer-cert secret
  # Recommended to disable for production values and manage separately.
  generateHeimdallSignerCert:
    enabled: true
    name: heimdall-signer-cert
    # algorithm will be passed as the parameter to Sprig's genPrivateKey.
    # If blank or missing, uses genCA (2048-bit RSA key, PS256 JWT alg).
    # If set, uses genCAWithKey with the specified algorithm.
    # Setting "rsa" explicitly will use a 4096-bit key (PS512 JWT alg).
    # algorithm: ecdsa
    # algorithm: rsa

  whoami:
    enabled: true

  swagger_ui:
    enabled: true
    image: swaggerapi/swagger-ui
    tag: latest
    merger:
      image: node
      tag: 24-alpine
    auth:
      enabled: true
      domain: "https://auth.k8s.orb.local"
      authorizationUrl: "https://auth.k8s.orb.local/api/oidc/authorization"
      clientId: "docs"
    server: "http://lfx-api.k8s.orb.local"
    specs:
      - "_projects/openapi3.yaml"
      - "_query/openapi3.yaml"
      - "_committees/openapi3.yaml"
      - "_meetings/openapi3.yaml"
      - "_access-check/openapi3.yaml"
      - "_voting/openapi3.yaml"
      - "_survey/openapi3.yaml"

  # Tells rulesets to use the oidc_contextualizer, needed for
  # local dev with authelia
  use_oidc_contextualizer: true

  # Fallback gateway can be enabled if traefik.enabled is false.
  parentGateway:
    enabled: false
    name: traefik
    sectionName: websecure
    namespace: default

fga-operator:
  enabled: true
  # Non-chart value
  store: "lfx-core"
  controllerManager:
    openFgaUrlEnvVar: 'http://lfx-platform-openfga:8080'
    # This value needs to be set in order for the operator to start, but
    # because no auth is required for the openfga API this value will be
    # ignored by openfga
    openFgaApiTokenEnvVar: "fake"

# Traefik configuration
traefik:
  enabled: true
  tracing:
    otlp:
      enabled: false
      grpc:
        enabled: true
        endpoint: "jaeger-collector.observability:4317"
        insecure: true
  env:
    - name: OTEL_PROPAGATORS
      value: tracecontext,baggage,jaeger
  providers:
    # Enable Kubernetes Gateway provider
    kubernetesGateway:
      enabled: true
    # Enable Kubernetes Ingress provider
    kubernetesIngress:
      enabled: true
    # Enable Kubernetes IngressRoute provider
    kubernetesCRD:
      enabled: true
  gateway:
    # Disable Traefik's default gateway since we manage it explicitly
    enabled: false
  logs:
    # Enable access logs
    access:
      enabled: true

# Gateway configuration
gateway:
  enabled: true

  # Gateway listeners
  listeners:
    traefik:
      port: 8080
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    web:
      port: 8000
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same

# OpenFGA configuration
openfga:
  enabled: true

  # Disable playground by default
  playground:
    enabled: false

  # Use PostgreSQL
  datastore:
    engine: postgres
    # Must override uriSecret if setting postgresql.enabled to false.
    uriSecret: openfga-postgresql-client
    migrationType: initContainer

  # PostgreSQL subchart configuration
  postgresql:
    enabled: true
    auth:
      username: openfga
      database: openfga
      existingSecret: openfga-postgresql-server

  # Tracing configuration
  telemetry:
    trace:
      enabled: false
      otlp:
        endpoint: "jaeger-collector.observability:4317"
        tls:
          enabled: false
      sampleRatio: 1.0

  # Additional OpenFGA configuration
  replicaCount: 1

  resources:
    limits:
      cpu: 1000m
      memory: 512Mi
    requests:
      cpu: 500m
      memory: 256Mi
# Heimdall configuration
heimdall:
  enabled: true

  image:
    tag: 0.17.6


  deployment:
    replicaCount: 1
    resources:
      limits:
        cpu: 100m
        memory: 128Mi
      requests:
        cpu: 100m
        memory: 128Mi
    autoscaling:
      enabled: false
    labels:
      openfga-store: "lfx-core"
    volumes:
      - name: heimdall-signer-cert
        secret:
          secretName: heimdall-signer-cert
    volumeMounts:
      - name: heimdall-signer-cert
        mountPath: "/heimdall/cert/"

  env:
    # Tracing Configuration
    HEIMDALLCFG_TRACING_ENABLED: "false"
    HEIMDALLCFG_SECRETS__RELOAD__ENABLED: "true"
    OTEL_PROPAGATORS: jaeger
    OTEL_TRACES_EXPORTER: otlp
    OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: grpc
    OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "http://jaeger-collector.observability:4317"
    CLIENT_SECRET:
      secretKeyRef:
        name: authelia-clients
        key: heimdall

  log:
    format: gelf
    level: info

  providers:
    kubernetes: {}

  serve:
    trusted_proxies:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"

  mechanisms:
    authenticators:
      - id: anonymous_authenticator
        type: anonymous
        config:
          subject: "_anonymous"
      - id: oidc
        type: oauth2_introspection
        config:
          metadata_endpoint:
            url: http://auth.k8s.orb.local/.well-known/oauth-authorization-server
            resolved_endpoints:
              introspection_endpoint:
                auth:
                  type: basic_auth
                  config:
                    user: heimdall
                    password: ${CLIENT_SECRET}
          assertions:
            audience:
              - "http://lfx-api.k8s.orb.local/"
          subject:
            # Authelia doesn't provide a "sub" claim for client_credentials token
            # introspection. Use a GJSON query to extract either the username or
            # the client_id. Client IDs can collide with usernames (and GJSON
            # doesn't let us do array concatenation to add a literal prefix), so
            # the `sub` claim should NOT be used downstream.
            id: '[username,client_id].0'
    contextualizers:
      - id: oidc_contextualizer
        type: generic
        config:
          endpoint:
            url: http://auth.k8s.orb.local/api/oidc/userinfo
            method: GET
          forward_headers:
            - Authorization
          # Continuing on error is needed if this contextualizer is used in any
          # rulesets that support anonymous access.
          continue_pipeline_on_error: true
    authorizers:
      - id: allow_all
        type: allow
      - id: deny_all
        type: deny
      - id: json_content_type
        type: cel
        config:
          expressions:
            - expression: |
                Request.Header("Content-Type") == "application/json"
              message: "Content-Type must be application/json"
      - id: openfga_check
        type: remote
        config:
          endpoint: "http://lfx-platform-openfga:8080/stores/${OPENFGA_STORE_ID}/check"
          values:
            model_id: ${OPENFGA_AUTH_MODEL_ID}
          payload: |
            {
              "authorization_model_id": "{{ .Values.model_id }}",
              "tuple_key": {
                "user": {{
                  list
                    "user:"
                    (
                      eq .Subject.ID "_anonymous"
                      | ternary
                        "_anonymous"
                        (or
                          .Subject.Attributes.username
                          (list .Subject.Attributes.client_id "@clients" | join ""))
                    )
                  | join "" | quote
                }},
                "relation": "{{ .Values.relation }}",
                "object": "{{ .Values.object }}"
              }
            }
          expressions:
            - expression: |
                Payload.allowed == true
    finalizers:
      - id: create_jwt
        type: jwt
        config:
          signer:
            key_store:
              path: /heimdall/cert/signer.pem
          claims: |
            {
              "principal": {{
                eq .Subject.ID "_anonymous"
                | ternary
                  "_anonymous"
                  (or
                    .Subject.Attributes.username
                    (list .Subject.Attributes.client_id "@clients" | join ""))
                | quote
              }}
              {{ if .Outputs.oidc_contextualizer.email -}},
              "email": {{ quote .Outputs.oidc_contextualizer.email }}
              {{ end -}}
              {{ if .Values.aud -}},
              "aud": {{ quote .Values.aud }}
              {{ end -}}
            }

  default_rule:
    execute:
      - authenticator: oidc
      - contextualizer: oidc_contextualizer
      - authorizer: deny_all
      - finalizer: create_jwt

  extraArgs:
    - "--insecure"

# NATS configuration
nats:
  enabled: true
  config:
    cluster:
      enabled: true
      replicas: 3

    # NATS Box for management operations
    natsBox:
      enabled: true

    # JetStream configuration
    jetstream:
      enabled: true
      fileStore:
        enabled: true
        size: 1Gi
  container:
    env:
      # Different from k8s units, suffix must be B, KiB, MiB, GiB, or TiB
      # Should be ~80% of memory limit
      GOMEMLIMIT: 2GiB
    merge:
      # Recommended minimum: at least 2 CPU cores and 8Gi memory for production JetStream clusters
      resources:
        requests:
          cpu: "500m"
          memory: 1Gi
        limits:
          cpu: "1000m"
          memory: 2Gi

# OpenSearch configuration
opensearch:
  enabled: true
  singleNode: true
  extraEnvs:
    - name: DISABLE_INSTALL_DEMO_CONFIG
      value: "true"
    - name: DISABLE_SECURITY_PLUGIN
      value: "true"
  resources:
    requests:
      cpu: 500m
      memory: 0.5Gi
    limits:
      cpu: 1000m
      memory: 1Gi

# Mailpit configuration
mailpit:
  enabled: true

# Authelia configuration
authelia:
  enabled: true
  ingress:
    enabled: true
  secret:
    additionalSecrets:
      authelia-jwks-keys: {}
      authelia-clients-hashed: {}
  persistence:
    enabled: true
  pod:
    extraVolumes:
      - name: authelia-users
        configMap:
          name: authelia-users
          items:
            - key: users_database.yml
              path: users_database.yml
    extraVolumeMounts:
      - name: authelia-users
        mountPath: /config-users
  configMap:
    log:
      format: json
    session:
      cookies:
        - domain: k8s.orb.local
          subdomain: auth
    totp:
      disable: true
    webauthn:
      disable: true
    authentication_backend:
      file:
        enabled: true
        path: /config-users/users_database.yml
    access_control:
      default_policy: one_factor
    storage:
      local:
        enabled: true
    notifier:
      smtp:
        enabled: true
        address: "smtp://lfx-platform-mailpit-smtp:25"
        username: ""
        password:
          disabled: true
        disable_require_tls: true
    identity_providers:
      oidc:
        lifespans: {}
        cors: {}
        enabled: true
        jwks:
          - key_id: "1"
            algorithm: "RS256"
            key:
              path: /secrets/authelia-jwks-keys/jwks-key-1.pem
        claims_policies:
          default:
            id_token:
              - email
              - email_verified
              - name
              - preferred_username
        clients:
          - client_id: heimdall
            client_name: Heimdall backend
            client_secret:
              path: /secrets/authelia-clients-hashed/heimdall
            public: false
            scopes:
              - none
            grant_types:
              - client_credentials
            authorization_policy: one_factor
            token_endpoint_auth_method: client_secret_basic
          - client_id: m2m_test
            client_name: M2M Test Client
            client_secret:
              path: /secrets/authelia-clients-hashed/m2m_test
            public: false
            scopes:
              - none
            audience:
              - "http://lfx-api.k8s.orb.local"
            grant_types:
              - client_credentials
            authorization_policy: one_factor
            token_endpoint_auth_method: client_secret_basic
          - client_id: token_helper
            client_name: Token Helper CLI
            public: true
            redirect_uris:
              - "http://localhost:55001/callback"
            scopes:
              - openid
              - email
              - profile
              - offline_access
            audience:
              - "http://lfx-api.k8s.orb.local"
            grant_types:
              - authorization_code
              - refresh_token
            authorization_policy: one_factor
          - client_id: lfx
            client_name: LFX Client Credentials
            client_secret:
              path: /secrets/authelia-clients-hashed/lfx
            public: false
            redirect_uris:
              - "http://localhost:4200/callback"
            scopes:
              - openid
              - email
              - profile
              - offline_access
              - access:api
            audience:
              - "http://lfx-api.k8s.orb.local"
            grant_types:
              - authorization_code
              - refresh_token
            claims_policy: default
            authorization_policy: one_factor
            token_endpoint_auth_method: client_secret_basic
          - client_id: docs
            client_name: LFX Swagger UI Docs
            public: true
            redirect_uris:
              - "http://lfx-api.k8s.orb.local/docs/oauth2-redirect.html"
              - "https://lfx-api.k8s.orb.local/docs/oauth2-redirect.html"
            scopes:
              - openid
              - email
              - profile
              - api:access
            audience:
              - "http://lfx-api.k8s.orb.local"
            grant_types:
              - implicit
            authorization_policy: one_factor
            response_types:
              - code
              - id_token
              - token

authelia_generate_jwks:
  enabled: true

authelia_client_generation:
  enabled: true
  clients:
    - heimdall
    - m2m_test
    - lfx

authelia_user_generation:
  enabled: true
  users:
    - project_super_admin
    - project_admin_1
    - project_admin_2
    - committee_member_1
    - committee_member_2

nack:
  enabled: true
  jetstream:
    nats:
      url: nats://lfx-platform-nats:4222
    additionalArgs: [--control-loop]

external-secrets:
  enabled: false
  installCRDs: true

cert-manager:
  enabled: false
  crds:
    enabled: true
trustManagerEnabled: false
trust-manager:
  crds:
    enabled: true
  namespace: cert-manager

lfx-v2-fga-sync:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

lfx-v2-access-check:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

lfx-v2-indexer-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

lfx-v2-query-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local
  authelia:
    enabled: true
  heimdall:
    enabled: true
  app:
    environment:
      # Organization search is configured to use a mock implementation.
      # To use Clearbit instead, change ORG_SEARCH_SOURCE to 'clearbit' and
      # set your actual Clearbit API credential in CLEARBIT_CREDENTIAL.
      ORG_SEARCH_SOURCE:
        value: mock
      CLEARBIT_CREDENTIAL:
        value: ""

lfx-v2-project-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

lfx-v2-committee-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

lfx-v2-voting-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

  # External Secrets Operator is disabled because we can't get secrets from AWS Secrets Manager in local development.
  # Instead, create the Kubernetes secret manually. See the chart README for instructions.
  externalSecretsOperator:
    enabled: false

  # Enable reloader to restart pods when ConfigMap or Secrets change
  annotations:
    reloader.stakater.com/auto: "true"

lfx-v2-survey-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

  # External Secrets Operator is disabled because we can't get secrets from AWS Secrets Manager in local development.
  # Instead, create the Kubernetes secret manually. See the chart README for instructions.
  externalSecretsOperator:
    enabled: false

  # Enable reloader to restart pods when ConfigMap or Secrets change
  annotations:
    reloader.stakater.com/auto: "true"

lfx-v2-meeting-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

  # External Secrets Operator is disabled because we can't get secrets from AWS Secrets Manager in local development.
  # Instead, create the Kubernetes secret manually. See the chart README for instructions.
  externalSecretsOperator:
    enabled: false

  # Enable reloader to restart pods when ConfigMap or Secrets change
  annotations:
    reloader.stakater.com/auto: "true"

lfx-v2-mailing-list-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local

  # External Secrets Operator is disabled because we can't get secrets from AWS Secrets Manager in local development.
  # Instead, create the Kubernetes secret manually. See the chart README for instructions.
  externalSecretsOperator:
    enabled: false

lfx-v2-auth-service:
  replicaCount: 1
  enabled: true
  lfx:
    domain: k8s.orb.local
  app:
    environment:
      # Repository type for user management
      # It can be authelia, auth0 or mock
      # In case of auth0, please refer to the following documentation
      ## https://github.com/linuxfoundation/lfx-v2-auth-service?tab=readme-ov-file#auth0-configuration
      USER_REPOSITORY_TYPE:
        value: authelia
      # Authelia configuration
      ## Required when using "authelia" repository type
      ## For more information, see the [Local Development Support documentation](https://github.com/linuxfoundation/lfx-v2-auth-service/blob/main/README.md#local-development-support)
      AUTHELIA_CONFIGMAP_NAME:
        value: authelia-users
      AUTHELIA_CONFIGMAP_NAMESPACE:
        value: lfx
      AUTHELIA_DAEMONSET_NAME:
        value: lfx-platform-authelia
      AUTHELIA_SECRET_NAME:
        value: authelia-users