rhdh-helm-values.yaml

global:
  auth:
    backend:
      enabled: true
  clusterRouterBase: apps.dancurran-lab2025.opdev.io
  dynamic:
    plugins:
      - disabled: false
        package: oci://quay.io/tkral/backstage-community-plugin-todo:v0.1.1!backstage-community-plugin-todo
    includes:
      - dynamic-plugins.default.yaml
route:
  enabled: true
  host: '{{ .Values.global.host }}'
  path: /
  tls:
    enabled: true
    insecureEdgeTerminationPolicy: Redirect
    termination: edge
  wildcardPolicy: None
upstream:
  backstage:
    appConfig:
      app:
        baseUrl: 'https://{{- include "janus-idp.hostname" . }}'
      backend:
        auth:
          externalAccess:
            - options:
                secret: '${BACKEND_SECRET}'
                subject: legacy-default-config
              type: legacy
        baseUrl: 'https://{{- include "janus-idp.hostname" . }}'
        cors:
          origin: 'https://{{- include "janus-idp.hostname" . }}'
        database:
          connection:
            password: '${POSTGRESQL_ADMIN_PASSWORD}'
            user: postgres
    args:
      - '--config'
      - dynamic-plugins-root/app-config.dynamic-plugins.yaml
    containerPorts:
      backend: 7007
    containerSecurityContext:
      capabilities:
        drop:
          - ALL
      seccompProfile:
        type: RuntimeDefault
      allowPrivilegeEscalation: false
      runAsNonRoot: true
    extraAppConfig:
      - configMapRef: app-config-rhdh
        filename: app-config-rhdh.yaml
    extraEnvVars:
      - name: BACKEND_SECRET
        valueFrom:
          secretKeyRef:
            key: backend-secret
            name: '{{ include "janus-idp.backend-secret-name" $ }}'
      - name: POSTGRESQL_ADMIN_PASSWORD
        valueFrom:
          secretKeyRef:
            key: postgres-password
            name: '{{- include "janus-idp.postgresql.secretName" . }}'
    extraVolumeMounts:
      - mountPath: /opt/app-root/src/dynamic-plugins-root
        name: dynamic-plugins-root
    extraVolumes:
      - name: dynamic-plugins-root
        persistentVolumeClaim:
          claimName: '{{ printf "%s-dynamic-plugins-root" .Release.Name }}'
      - configMap:
          defaultMode: 420
          name: '{{ printf "%s-dynamic-plugins" .Release.Name }}'
          optional: true
        name: dynamic-plugins
      - name: dynamic-plugins-npmrc
        secret:
          defaultMode: 420
          optional: true
          secretName: '{{ printf "%s-dynamic-plugins-npmrc" .Release.Name }}'
      - name: dynamic-plugins-registry-auth
        secret:
          defaultMode: 416
          optional: true
          secretName: '{{ printf "%s-dynamic-plugins-registry-auth" .Release.Name }}'
      - name: npmcacache
    image:
      pullPolicy: Always
      registry: registry.redhat.io
      repository: rhdh/rhdh-hub-rhel9@sha256
      tag: d8268197ba0466643efb818fcad8f0fc29e32463f75b0f7f51d9ce75ec717572
    initContainers:
      - command:
          - ./install-dynamic-plugins.sh
          - /dynamic-plugins-root
        env:
          - name: NPM_CONFIG_USERCONFIG
            value: /opt/app-root/src/.npmrc.dynamic-plugins
        image: '{{ include "backstage.image" . }}'
        imagePullPolicy: Always
        name: install-dynamic-plugins
        resources:
          limits:
            cpu: 1000m
            ephemeral-storage: 5Gi
            memory: 2.5Gi
          requests:
            cpu: 250m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
        volumeMounts:
          - mountPath: /dynamic-plugins-root
            name: dynamic-plugins-root
          - mountPath: /opt/app-root/src/dynamic-plugins.yaml
            name: dynamic-plugins
            readOnly: true
            subPath: dynamic-plugins.yaml
          - mountPath: /opt/app-root/src/.npmrc.dynamic-plugins
            name: dynamic-plugins-npmrc
            readOnly: true
            subPath: .npmrc
          - mountPath: /opt/app-root/src/.config/containers
            name: dynamic-plugins-registry-auth
            readOnly: true
          - mountPath: /opt/app-root/src/.npm/_cacache
            name: npmcacache
        workingDir: /opt/app-root/src
    installDir: /opt/app-root/src
    livenessProbe:
      httpGet:
        path: /.backstage/health/v1/liveness
        port: backend
        scheme: HTTP
      failureThreshold: 3
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 4
    podAnnotations:
      checksum/dynamic-plugins: >-
        {{- include "common.tplvalues.render" ( dict "value"
        .Values.global.dynamic "context" $) | sha256sum }}
    readinessProbe:
      httpGet:
        path: /.backstage/health/v1/readiness
        port: backend
        scheme: HTTP
      failureThreshold: 3
      periodSeconds: 10
      successThreshold: 2
      timeoutSeconds: 4
    replicas: 1
    resources:
      limits:
        cpu: 1000m
        ephemeral-storage: 5Gi
        memory: 2.5Gi
      requests:
        cpu: 250m
        memory: 1Gi
    revisionHistoryLimit: 10
    startupProbe:
      httpGet:
        path: /.backstage/health/v1/liveness
        port: backend
        scheme: HTTP
      failureThreshold: 3
      initialDelaySeconds: 30
      periodSeconds: 20
      successThreshold: 1
      timeoutSeconds: 4
  clusterDomain: cluster.local
  diagnosticMode:
    args:
      - infinity
    command:
      - sleep
    enabled: false
  ingress:
    enabled: false
    host: '{{ .Values.global.host }}'
    path: /
    tls:
      enabled: false
  metrics:
    serviceMonitor:
      enabled: false
      path: /metrics
      port: http-metrics
  nameOverride: developer-hub
  networkPolicy:
    egressRules:
      denyConnectionsToExternal: false
    enabled: false
  postgresql:
    auth:
      secretKeys:
        adminPasswordKey: postgres-password
        userPasswordKey: password
    enabled: true
    image:
      registry: registry.redhat.io
      repository: rhel9/postgresql-15@sha256
      tag: 44a08b83a6c50714b52f4cf1c3476bc16b66faec21dd9a9bc07d1be5f97b8150
    postgresqlDataDir: /var/lib/pgsql/data/userdata
    primary:
      containerSecurityContext:
        enabled: false
      extraEnvVars:
        - name: POSTGRESQL_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              key: postgres-password
              name: '{{- include "postgresql.v1.secretName" . }}'
      persistence:
        enabled: true
        mountPath: /var/lib/pgsql/data
        size: 1Gi
      podSecurityContext:
        enabled: false
      resources:
        limits:
          cpu: 250m
          ephemeral-storage: 20Mi
          memory: 1024Mi
        requests:
          cpu: 250m
          memory: 256Mi
  service:
    externalTrafficPolicy: Cluster
    extraPorts:
      - name: http-metrics
        port: 9464
        targetPort: 9464
    ports:
      backend: 7007
      name: http-backend
      targetPort: backend
    sessionAffinity: None
    type: ClusterIP
  serviceAccount:
    automountServiceAccountToken: true
    create: false
nameOverride: developer-hub