nameOverride: ""

## Image Pull Credentials
# If enabled, creates an imagePullSecret for accessing the eccenca Docker registry.
# Alternatively, you can create the secret manually using kubectl and disable this.
imageCredentials:
  enabled: true
  secretName: eccenca-docker-registry-credentials
  registry: https://docker-registry.eccenca.com
  # Docker registry credentials (required if enabled: true).
  # Obtain these from your eccenca support contact.
  username: ""
  password: ""

## Image Pull Secrets
# List of imagePullSecrets referenced by all deployment pods.
# Must match the secretName above if imageCredentials.enabled is true.
imagePullSecrets:
  - name: eccenca-docker-registry-credentials

## Ingress Configuration
# Defines the ingress for accessing CMEM components.
# Default: disabled (must be explicitly enabled for external access).
ingress:
  enabled: false
  # Name of the ingress object.
  name: eccenca-cmem
  # Ingress class name (e.g., "nginx", "traefik").
  # Leave empty to use the default ingress class.
  className: ""
  # Ingress annotations.
  # The defaults below are optimized for nginx-ingress with large file uploads and long-running requests.
  annotations:
    # Increase timeouts and buffer sizes for CMEM and Keycloak communication.
    # Assumes nginx-based ingress controller.
    nginx.ingress.kubernetes.io/client-body-buffer-size: "32k"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
    nginx.ingress.kubernetes.io/proxy-body-size: 4096M
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "5"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    # Force SSL redirect (comment out if HTTP access is required).
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/force-ssl-redirect: "true"
    # CORS settings (uncomment if Keycloak is on a different hostname).
    # nginx.ingress.kubernetes.io/enable-cors: "true"
    # nginx.ingress.kubernetes.io/cors-allow-origin: "*"
    # Automatically issue TLS certificates via cert-manager (uncomment if using cert-manager).
    # cert-manager.io/cluster-issuer: "letsencrypt-prod"
  # Ingress host configuration.
  # Define the hostname and paths for accessing CMEM components.
  hosts:
    - host: chart-example.local
      # Expose CMEM components through various URL paths.
      paths:
        # Explore (main UI) at root path.
        - path: /
          pathType: Prefix
          serviceName: explore
          servicePort: 8080
        # DataIntegration at /dataintegration path.
        - path: /dataintegration
          pathType: Prefix
          serviceName: dataintegration
          servicePort: 8080
        # GraphInsights at /graphinsights path (if enabled).
        # - path: /graphinsights
        #  pathType: Prefix
        #  serviceName: graphinsights
        #  servicePort: 8080
  # TLS configuration for HTTPS access.
  # The secret should contain the TLS certificate and key.
  # Can be auto-generated by cert-manager if configured in annotations above.
  tls: []
    # - secretName: chart-example-tls
    #   hosts:
    #     - chart-example.local

## Global Configuration
# Settings shared across all CMEM components.
global:
  # Protocol for accessing CMEM (http or https).
  # Default: https (recommended for production).
  protocol: https

  # CMEM service account OAuth credentials for backend-to-backend communication.
  # These must match the service account configured in your Keycloak realm.
  # See: https://documentation.eccenca.com/latest/deploy-and-configure/configuration/keycloak/
  cmemClientId: cmem-service-account
  cmemClientSecret: changeme  # IMPORTANT: Change this to a secure value!

  # GraphInsights service account OAuth credentials (if using GraphInsights).
  # Can use the same credentials as CMEM or separate ones.
  graphinsightsClientId: graph-insights-service-account
  graphinsightsClientSecret: changeme  # IMPORTANT: Change this to a secure value!

  # External hostname for accessing this CMEM instance.
  # This should match the hostname configured in your ingress.
  hostname: chart-example.local

  # Keycloak base URL (e.g., https://keycloak.example.com/auth).
  # Required for OAuth authentication.
  keycloakBaseUrl: ""

  # Keycloak realm issuer URL (e.g., https://keycloak.example.com/auth/realms/cmem).
  # This is the full URL to your CMEM realm in Keycloak.
  keycloakIssuerUrl: ""
  # Advanced Keycloak logout configuration.
  # Customizes OAuth redirect behavior for DataIntegration logout.
  # Default values work for most deployments - only change if needed.
  keycloakLogoutURL: '{{ print .Values.global.keycloakIssuerUrl "/protocol/openid-connect/logout" | quote }}'

  # BREAKING CHANGE IN 26.1. After a spring boot upgrade this needs to be relative to ROOT ressource now.
  # Otherwise Explore fails to start.
  validPostLogoutRedirectUri: '/'

  # OAuth client IDs for frontend authentication.
  # These are used by Explore UI and DataIntegration for user login.
  # Default: "cmem" (must exist in your Keycloak realm).
  oauthClientId: cmem

  # OAuth client ID for GraphInsights frontend authentication.
  # Default: "graph-insights" (must exist in your Keycloak realm if GraphInsights is enabled).
  oauthClientIdGraphInsights: graph-insights

  # License Configuration
  # Reference to a Kubernetes secret containing the 'license.asc' file.
  # If empty, CMEM uses the free PEDAL license (Personal, Evaluation and Development License).
  # For production use, obtain a commercial license from eccenca.
  # Create the secret: kubectl create secret generic cmem-license --from-file=license.asc
  # See: https://documentation.eccenca.com/latest/deploy-and-configure/configuration/dataplatform/application-full/
  license: ""

  # In case you communicate to keycloak via TLS using a custom CA certificate (chain), this CA cert (chain) needs to be injected/added to the Java TrustStore of DI and EXPLORE.
  # Here you can place your custom CA certificate(s), resp. the full root certificate chain (including intermediate certificates if required) in PEM format.
  # This `customCACerts` is a struct, so for each certificate you want to add, put here a key-value-pair with: 
  #   key = name of the certificate (used as `alias` in the truststore)
  #   value = content of the certificate (PEM format)
  # Example:
  # customCACerts:
  #   myrootcert1: |
  #     -----BEGIN CERTIFICATE-----
  #     ABCD...
  #     -----END CERTIFICATE-----
  #   myrootcert2: |
  #     -----BEGIN CERTIFICATE-----
  #     EFGH...
  #     -----END CERTIFICATE-----
  # It will then deploy an additional initContainer to DI and EXPLORE to append your custom CA to the system-wide TrustStore.
  # You can verify the certificates contained in a TrustStore via: `keytool -list -cacerts -storepass changeit` (run inside the container)
  # Note: Instead of `-cacerts` (which defaults to the default cacerts keystore of the Java runtime environment) we can also write `-keystore /etc/ssl/certs/java/cacerts` (which is where we mount or new cacerts)
  customCACerts: {}
  # If you specified customCACerts, an initContainer is added to DI and EXPLORE to append your custom CA to the system-wide TrustStore.
  # Here you can optionally specify resource requests and limits for that initContainer.

  initContainerResources:
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # Note also: we do recommend not setting cpu limits (see also https://home.robusta.dev/blog/stop-using-cpu-limits)
    limits:
      memory: 128Mi
    requests:
      cpu: 50m
      memory: 64Mi
  # define additional labels that should be appended to all pods
  additionalPodLabels: {}
    # foo: bar

  # Installing Python packages could also allow installing unwanted code. In case of hardening DI this disabled external access to that DI endpoint.
  # Installing Python plugins is then only possible from inside the cluster bypassing the ingress for Dataintegration by adding this ENV variable DI_API_ENDPOINT
  # See cmemc-bootstrap-job.yaml.
  disablePythonInstallFromOutside: false

## ============================================================================
## Bootstrap Job Configuration
## ============================================================================
## Bootstrap job automates initial setup and configuration using cmemc CLI tool
## Documentation: https://documentation.eccenca.com/latest/automate/
##
## Use cases:
## - Initial bootstrap (cmemc admin store bootstrap --import)
## - Creating default Keycloak users
## - Installing Python plugins for DataIntegration
## - Custom initialization scripts
##
bootstrap:
  # Enable bootstrap job
  # Runs once after installation, or on every upgrade if force: true
  # Default: true
  enabled: true

  ## Container image configuration
  image:
    # Only specify repository and tag to override the default image from Chart.yaml
    # IMPORTANT: Image must include cmemc, curl, and jq packages
    # Default: Uses appVersion from Chart.yaml
    # repository: docker-registry.eccenca.com/eccenca-cmemc
    # tag: develop
    pullPolicy: Always

  # Force bootstrap on every deployment/upgrade
  # If false, runs only once after initial installation
  # Default: false
  force: false
  # Override the bootstrap shell script ConfigMap name
  # Use this to provide custom bootstrap scripts
  # Default: cmemc-bootstrap-sh-files
  # configMapName: cmemc-bootstrap-sh-files
  # Job timeout - seconds until the job must complete
  # Default: 600s (10 minutes)
  # activeDeadlineSeconds: 600
  # TTL for completed jobs - seconds until finished jobs are cleaned up
  # Default: 300s (5 minutes)
  # ttlSecondsAfterFinished: 300

  ## SSL/TLS configuration
  # SSL certificate verification for cmemc
  # Set to "False" to trust all certificates (not recommended for production)
  # This also works as a fallback if custom CA certificates are not trusted
  # Default: "True"
  sslVerify: "True"

  ## CPU Architecture Configuration
  # Target CPU architecture for Python certifi paths
  # Options: "amd64" (x86_64) or "arm64" (aarch64/Apple Silicon)
  # Default: "amd64"
  # IMPORTANT: Set to "arm64" when deploying on Apple Silicon or ARM-based clusters
  architecture: "amd64"

  ## CA bundle paths (advanced)
  ## IMPORTANT: These paths are automatically set based on the architecture parameter above
  ## Only modify if you need to override the automatic path selection
  ## These paths are used to concatenate custom CA certificates from global.customCACerts
  # Path to CA bundle for cmemc (Python certifi)
  # Leave empty to use architecture-based automatic path selection
  # Override example: "/custom/path/to/cacert.pem"
  default_ca_bundle_path: ""


  ## Resource limits and requests
  ## Bootstrap job typically requires minimal resources
  ## Note: CPU limits are intentionally not set (see https://home.robusta.dev/blog/stop-using-cpu-limits)
  resources:
    # Resource limits
    limits:
      # Memory limit - sufficient for cmemc operations
      # Default: 256Mi
      memory: 256Mi
    # Resource requests
    requests:
      # CPU request - minimal for short-lived job
      # Default: 50m
      cpu: 50m
      # Memory request
      # Default: 128Mi
      memory: 128Mi
  ## Default user configuration
  ## Creates a default admin user in Keycloak during bootstrap
  ## IMPORTANT: Requires Keycloak to be properly configured
  defaultUser:
    # Enable default user creation
    # By default, does not overwrite existing CMEM admin account
    # Default: false
    enabled: false
    # Username for the default user
    # Default: admin
    name: admin
    # Email address for the default user
    # Default: admin@example.com
    email: admin@example.com
    # Password for the default user
    # IMPORTANT: Change this to a secure password in production!
    # Default: admin123!
    password: admin123!
    # Mark password as temporary (requires change on first login)
    # Default: true
    temporaryPassword: true
    # Send password via email (requires Keycloak email configuration)
    # IMPORTANT: Requires Keycloak to be properly configured with SMTP settings
    # Default: false
    passwordSendMail: false
    # Add user to admin groups with full permissions
    # Default: true
    isAdmin: true

  ## Python plugins installation
  ## Automatically installs/upgrades Python plugins for DataIntegration
  ## Documentation: https://documentation.eccenca.com/latest/develop/python-plugins/
  ## IMPORTANT: Make sure to define plugins under dataintegration.config.pythonPlugins
  pythonPlugins:
    # Enable automatic Python plugin installation
    # When enabled, bootstrap job installs plugins from dataintegration.config.plugins list
    # Default: false
    enabled: false
  ## Pod security context
  ## Security settings at the pod level
  podSecurityContext:
    # Run as non-root user
    runAsNonRoot: true
    # File system group for volume ownership
    # Default: 999
    fsGroup: 999
    # User ID to run the container as
    # Default: 999
    runAsUser: 999
    # Group ID to run the container as
    # Default: 999
    runAsGroup: 999
    # Seccomp profile for enhanced security
    seccompProfile:
      type: RuntimeDefault

  ## Container security context
  ## Security settings at the container level
  ## Follows security best practices
  securityContext:
    # Prevent privilege escalation
    allowPrivilegeEscalation: false
    # Drop all Linux capabilities
    capabilities:
      drop:
      - ALL
    # Mount root filesystem as read-only
    readOnlyRootFilesystem: true

  ## Node selector for pod assignment
  ## Constrain pods to run on specific nodes
  ## Example:
  # nodeSelector:
  #   disktype: ssd
  nodeSelector: {}

  ## Tolerations for pod assignment
  ## Allow pods to schedule on nodes with matching taints
  ## Example:
  # tolerations:
  #   - key: "dedicated"
  #     operator: "Equal"
  #     value: "cmem"
  #     effect: "NoSchedule"
  tolerations: []

  ## Affinity rules for pod assignment
  ## Control pod placement using node/pod affinity
  ## Example:
  # affinity:
  #   nodeAffinity:
  #     requiredDuringSchedulingIgnoredDuringExecution:
  #       nodeSelectorTerms:
  #         - matchExpressions:
  #             - key: node-role.kubernetes.io/worker
  #               operator: In
  #               values:
  #                 - "true"
  affinity: {}

## ============================================================================
## Explore Configuration
## ============================================================================
# Explore is the main UI component for browsing and exploring knowledge graphs.
# It provides a web interface for data exploration, visualization, and management.
explore:
  # Enable or disable Explore deployment.
  # Default: true (required for CMEM to function).
  enabled: true

  # Number of Explore pod replicas.
  # Default: 1 (horizontal scaling not yet supported).
  replicas: 1

  # Container image configuration.
  image:
    # Override the default image repository and tag (defined in Chart.yaml).
    # Only specify if you need a different version or custom build.
    # repository: docker-registry.eccenca.com/eccenca-explore
    # tag: develop
    pullPolicy: Always

  # Kubernetes service configuration.
  service:
    name: explore
    type: ClusterIP
    port: 8080

  # Explore application configuration.
  config:
    # Java JVM options for memory and performance tuning.
    # Note: -Djava.io.tmpdir is automatically added when cache is enabled.
    # Default: 70% of container memory for heap, 256M for direct memory.
    javaToolOptions: " -XX:MaxRAMPercentage=70.0 -XX:MaxDirectMemorySize=256M -XX:+UseContainerSupport"

    # Internal backend API path (do not change unless explicitly instructed).
    backendContextPath: "/dataplatform"

    # External URL context path for Explore UI.
    # Default: "/" (root path, exposed via ingress).
    contextPath: "/"

    # Maximum file upload size.
    # Important for graph imports and large data uploads.
    # Default: 4096MB (4GB).
    maxFileSize: 4096MB
    maxRequestSize: 4096MB

    # Users in this group have full admin rights.
    # Default: "elds-admins".
    authorizationAboxAdminGroup: elds-admins

    # API documentation settings (SpringDoc/Swagger).
    # Default: disabled for security (do not expose in production).
    springdocSwaggerUIEnabled: "true"
    springdocApiDocsEnabled: "true"
    springdocSwaggerUISubmitMethod: "get,put,post,delete,options,head,patch,trace,none"
    openapiServerUrls: "none"

    # SPARQL query logging level.
    # Set to "DEBUG" to log all SPARQL queries (useful for troubleshooting).
    # Options: "DEBUG", "INFO", "WARN", "ERROR".
    logSPARQLQueryLogging: "DEBUG"

    # Allow anonymous (unauthenticated) login.
    # Default: "false" (authentication required via Keycloak).
    anonymousLogin: "false"

    # Additional custom environment variables for Explore.
    # Use this to inject custom configuration without modifying the chart.
    additionalEnvVars: {}
      # FOO: "bar"
    # Prometheus metrics configuration.
    metrics:
      # Enable Prometheus metrics endpoint and ServiceMonitor.
      # Requires Prometheus Operator to be installed in the cluster.
      # Default: false.
      enabled: false
      port: "9100"
      appName: "explore"
      context: "/metrics"

      # ServiceMonitor labels for Prometheus Operator selection.
      # These must match your Prometheus Operator's serviceMonitorSelector.
      ServiceMonitorLabels:
        release: kubestack

      # Additional ServiceMonitor configuration (optional).
      additionalCustomConfig: {}

  # Companion AI Assistant Configuration
  # Companion provides an AI-powered chat interface for graph exploration.
  # Requires an external LLM provider (OpenAI or Google Vertex AI).
  companion:
    # Enable or disable Companion.
    # Default: false (optional feature).
    enabled: false

    # Persistence for Companion chat history.
    # If enabled, a PVC stores chat history across pod restarts.
    # If disabled, an emptyDir is used (data lost on restart).
    # WARNING: Chat history can grow significantly with heavy usage.
    persistence:
      # Enable persistent storage for chat history.
      # Default: true (recommended if Companion is enabled).
      enabled: true

      # EmptyDir size limit (used only if persistence.enabled is false).
      emptyDirSize: 1Gi

      # Use an existing PVC instead of creating a new one (optional).
      existentPvc:
        enabled: false
        name: ""

      # Storage class for the PVC.
      # IMPORTANT: Use "local-path" for k3d, or your cluster's default storage class.
      # Default: "standard" (may not exist in all environments).
      storageClassName: "standard"

      # Storage size for chat history.
      # Adjust based on expected usage (more users = more storage needed).
      storageSize: 2Gi

      # Mount path inside the container.
      mountPath: /companion-data

      # If a subPath is given, it is added to the mount section of companion data volume
      subPath: ""

    # LLM provider selection.
    # Options: "openai" (OpenAI API or compatible) or "vertex" (Google Vertex AI).
    # Default: "openai".
    model: "openai"
    # LLM provider configuration.
    # Uncomment the section for your chosen provider and fill in credentials.
    # IMPORTANT: Keep API keys secure! Consider using Kubernetes secrets instead of hardcoding.
    config:
      # OpenAI Configuration (or OpenAI-compatible APIs like OpenRouter)
      # openai:
      #   base-url: https://openrouter.ai/api/  # Or https://api.openai.com/v1 for OpenAI directly
      #   api-key: <your-api-key-here>  # IMPORTANT: Secure this value!
      #   chat:
      #     options:
      #       model: "openai/gpt-4o-mini"  # Model to use
      #       temperature: 1  # Creativity level (0-2)
      #       response-format:  # Response format: TEXT or JSON_SCHEMA
      #         type: "JSON_SCHEMA"

      # Google Vertex AI Configuration
      # vertex:
      #   ai:
      #     gemini:
      #       project-id: <YOUR-GCP-PROJECT-ID>
      #       location: europe-west4  # GCP region
      #       chat:
      #         options:
      #           model: gemini-2.0-flash-exp  # Gemini model version
      #           temperature: 1
      #           response-mime-type: text/plain

  # Temporary File Cache Configuration
  # Explore needs disk space for temporary files during operations like graph imports and uploads.
  # Enable this to use a dedicated volume instead of the node's local disk.
  cache:
    # Enable dedicated cache volume for temporary files.
    # Default: true (recommended to avoid node disk space issues).
    enabled: true

    # Java temp directory path inside the container.
    # When enabled, -Djava.io.tmpdir=<javaTempPath> is added to JAVA_TOOL_OPTIONS.
    javaTempPath: /tmp/explore

    # Cache volume size.
    # Should be large enough for your largest graph imports/uploads.
    # See: https://documentation.eccenca.com/latest/deploy-and-configure/configuration/dataplatform/application-full/#asynchronous-file-uploads
    # Default: 1G (adjust based on your workload).
    cacheSize: 1G

  # Graph Database Backend Configuration
  # Configure the triple store backend for storing RDF data.
  # Enable ONE of: graphdb or virtuoso (not both).
  store:
    # GraphDB Configuration (OntoText GraphDB)
    graphdb:
      # Enable GraphDB as the backend.
      # Default: false (must be explicitly enabled).
      enabled: false

      # GraphDB repository name where CMEM data is stored.
      # Default: "cmem".
      repository: cmem

      # GraphDB credentials.
      # IMPORTANT: Change the default password!
      user: provisioner
      password: ""  # IMPORTANT: Set a secure password!

      # GraphDB hostname (service name or FQDN).
      # Example: "graphdb.graphdb.svc.cluster.local" or "graphdb.production"
      host: ""

      # GraphDB HTTP port.
      # Default: 7200.
      port: 7200

      # Enable SSL/TLS for GraphDB connection.
      # Default: false (use true for encrypted connections).
      sslEnabled: false

      # Automatically create repository if it doesn't exist.
      # Default: true (convenient for new deployments).
      createRepoOnStartup: true

      # Enable change tracking for the repository.
      # Required for CMEM's change history features.
      # Default: true (recommended).
      changeTrackingActive: true

      # Maximum memory (in quads) for change tracking cache.
      # Default: 1000.
      changeTrackingMaxQuadsMem: 1000

    # Virtuoso Configuration (OpenLink Virtuoso)
    virtuoso:
      # Enable Virtuoso as the backend.
      # Default: false (alternative to GraphDB).
      enabled: false
      host: ""
      password: ""  # IMPORTANT: Set a secure password!
      port: 1111  # Default Virtuoso SQL port
      user: "dba"
  # Kubernetes scheduling constraints (optional).
  nodeSelector: {}
  tolerations: []
  affinity: {}

  # Pod annotations (optional).
  # Use this to add custom metadata to Explore pods.
  podAnnotations: {}

  # Resource requests and limits for Explore pods.
  # Adjust based on your workload and available cluster resources.
  resources:
    # We recommend setting memory limits/requests but avoiding CPU limits.
    # See: https://home.robusta.dev/blog/stop-using-cpu-limits
    limits:
      # Memory limit. Explore's JVM will use up to 70% of this (see javaToolOptions).
      # Default: 2500Mi (2.5GB) - increase for larger knowledge graphs.
      memory: 2500Mi
    requests:
      # Minimum CPU request (not a limit).
      # Default: 100m (0.1 CPU cores).
      cpu: 100m
      # Minimum memory request.
      # Should match limits for guaranteed QoS class.
      memory: 2500Mi

  # Pod update strategy.
  # Default: RollingUpdate (zero-downtime updates).
  updateStrategy:
    type: RollingUpdate

  # Horizontal Pod Autoscaling (HPA) configuration.
  # Note: Explore does not currently support horizontal scaling (replicas > 1).
  # This section is reserved for future use.
  autoscaling:
    enabled: false
    replicaCount: 1
    minReplicas: 1
    maxReplicas: 100
    targetCPUUtilizationPercentage: 80
  probes:
    livenessProbe:
      path: /actuator/health/liveness
      # 15sec + 10sec * 60 tries
      initialDelaySeconds: 15
      periodSeconds: 10
      timeoutSeconds: 10
      failureThreshold: 60
    readinessProbe:
      path: /actuator/health/readiness
      # 15sec + 10sec * 60 tries
      initialDelaySeconds:  15
      periodSeconds: 10
      timeoutSeconds: 10
      failureThreshold: 60
  podSecurityContext:
    runAsNonRoot: true
    fsGroup: 10001
    runAsUser: 10001
    runAsGroup: 10001
  securityContext: 
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true

  ## Sidecar containers (advanced)
  ## Additional containers that run alongside DataIntegration
  ## Useful for log shipping, monitoring, or filesystem permissions helpers
  ## Example:
  # extraContainers:
  #   - name: log-shipper
  #     image: fluent/fluent-bit
  #     volumeMounts:
  #       - name: logs
  #         mountPath: /var/log
  extraContainers: []


## ============================================================================
## DataIntegration Configuration
## ============================================================================
# DataIntegration (DI) is the ETL/data transformation component of CMEM.
# It provides workflows, mappings, and transformations for knowledge graph construction.
dataintegration:
  # Enable or disable DataIntegration deployment.
  # Default: true (required for data integration workflows).
  enabled: true

  # Number of DataIntegration pod replicas.
  # Note: Horizontal scaling is not yet supported.
  # Default: 1 (do not increase).
  replicas: 1

  # Container image configuration.
  image:
    # Override the default image repository and tag (defined in Chart.yaml).
    # Only specify if you need a different version or custom build.
    # repository: docker-registry.eccenca.com/eccenca-dataintegration
    # tag: develop
    pullPolicy: Always

  # DataIntegration application configuration.
  config:
    # URL context path for DataIntegration UI.
    # Default: "/dataintegration" (exposed via ingress).
    contextPath: /dataintegration

    # Java JVM options for memory and performance tuning.
    # Note: -Djava.io.tmpdir is automatically added when cache is enabled.
    # Default: 80% heap, 512M metaspace, 2G direct memory.
    javaToolOptions: " -XX:MaxRAMPercentage=80 -XX:MaxMetaspaceSize=512M -XX:MaxDirectMemorySize=2G -XX:+UseContainerSupport"

    # Maximum upload file size (Play Framework maxDiskBuffer).
    # Affects workflow uploads, dataset imports, etc.
    # Default: 1024MB (1GB).
    maxUploadFileSize: 1024MB

    # Server request timeout (Play Framework akka.requestTimeout).
    # Maximum time for a single HTTP request to complete.
    # Default: 10m (10 minutes).
    requestTimeout: 10m

    # Server idle timeout (Play Framework http.idleTimeout).
    # Time before idle connections are closed.
    # Default: 10m (10 minutes).
    idleTimeout: 10m

    # Explore backend URL for internal communication.
    # Leave empty to use the default internal service name.
    # Only override if Explore is deployed separately.
    # exploreBackEndUrl: ""

    # Workflow execution manager.
    # Default: "LocalExecutionManager" (executes workflows in the DI pod).
    # Alternative: distributed execution (requires additional setup).
    executor: LocalExecutionManager

    # Data Volume Configuration
    # Base directory for storing DI data (plugins, datasets, reports).
    # This directory should be backed by persistent storage (see persistence section).
    home: /data

    # Datalake folder for temporary datasets.
    # Can alternatively be stored in S3 (see workspaceRepository.s3).
    datalakeFolder: /data/datalake

    # Plugin folders for extending DataIntegration functionality.
    # DI-based plugins (JVM plugins).
    pluginFolder: /data/plugins

    # Python-based plugins folder.
    # IMPORTANT: Must be inside `home` directory for proper persistence.
    # See: https://documentation.eccenca.com/latest/develop/python-plugins/setup/#package-path
    pythonPluginFolder: /data/python-packages

    # Python Plugins Configuration
    # List of Python plugins to install via the bootstrap job.
    # Enable bootstrap.pythonPlugins.enabled to activate automatic installation.
    # Format: plugin-name or plugin-name==version
    # See: https://documentation.eccenca.com/latest/develop/python-plugins/
    # WARNING: NFS volumes may cause issues - restart DI if plugins don't load.
    pythonPlugins: []
      # - cmem-plugin-irdi==0.5.0  # IRDI generation plugin
      # - cmem-plugin-kafka==3.1.0  # Kafka integration plugin

    # Python Plugin Configuration File
    # Custom configuration for Python plugins (optional).
    pythonPluginConf:
      # Enable custom plugin configuration.
      # Default: false.
      enabled: false

      # Plugin configuration in HOCON format.
      # Each plugin has a section: plugins.python.<PLUGIN_ID>
      # List plugin IDs: cmemc admin workspace python list-plugins
      configCode: |
        # Example configuration for Python plugins
        # See: https://documentation.eccenca.com/latest/develop/python-plugins

        # Configuration for the random values plugin
        plugins.python.Example-RandomValues = {
          value1 = "test"
        }

    # Execution Report Manager
    # Manages persistence and retention of workflow execution reports.
    # Reports older than retentionTime are automatically deleted.
    # See: https://documentation.eccenca.com/latest/deploy-and-configure/configuration/dataintegration/#execution-report-manager
    executionReportManager:
      # Report storage plugin.
      # Options: "fileExecutionReportManager" (file-based) or "inMemoryExecutionReportManager" (no persistence).
      # Default: "fileExecutionReportManager".
      plugin: fileExecutionReportManager

      # Report storage folder (only relevant for file-based storage).
      # Must be inside `home` directory for persistence.
      folder: /data/reports

      # Report retention time (Java Duration format).
      # Examples: P30D = 30 days, P1Y = 1 year, PT24H = 24 hours.
      # See: https://docs.oracle.com/javase/8/docs/api/java/time/Duration.html
      # Default: P30D (30 days).
      retentionTime: P30D

    # Security Settings
    # Set secure flag on play_session cookie (requires HTTPS).
    # Default: true (recommended for production).
    secureCookie: true

    # Explore URL for external communication (optional).
    # Leave empty to use the default internal service name.
    # Only set if Explore is deployed separately from DataIntegration.
    # exploreUrl: ""

    # Geocoding API URL (optional).
    # Used for address geocoding in workflows.
    # Default: https://photon.komoot.de/api (free Photon geocoder).
    # geoUrl: ""

    # Encryption Keys (IMPORTANT: Set secure random values!)
    # Password encryption key for securing plugin task parameters.
    # Generate: openssl rand -base64 16
    # IMPORTANT: Must be set before first deployment! Changing it will invalidate existing encrypted passwords.
    passwordCryptKey: ""  # IMPORTANT: Set a 16+ character random string!

    # Play Framework HTTP secret for JWT and session encryption.
    # Generate: openssl rand -base64 39
    # IMPORTANT: Must be set before first deployment! Changing it will invalidate all sessions.
    playHTTPSecret: ""  # IMPORTANT: Set a 39+ character random string!

    # Workspace Repository Configuration
    # Defines where DataIntegration stores project files and resources.
    # See: https://documentation.eccenca.com/latest/deploy-and-configure/configuration/dataintegration/#resource-repositories
    workspaceRepository:
      # Repository plugin type.
      # Options:
      #   - "projectFile": File-based storage (local volume, default)
      #   - "sharedFileRepository": Shared file storage
      #   - "projectS3" or "s3": Amazon S3 or S3-compatible storage
      # Note: "file" is no longer supported (use "sharedFileRepository" instead).
      plugin: projectFile

      # S3 Configuration (only for projectS3 or s3 plugins).
      s3:
        # S3 bucket name.
        bucket: ""
        # AWS access key ID (or S3-compatible credentials).
        # IMPORTANT: Consider using Kubernetes secrets for credentials!
        accessKeyId: ""
        # AWS secret access key.
        # IMPORTANT: Keep this secure!
        secretKey: ""
        # AWS region (e.g., "us-east-1", "eu-west-1").
        region: ""
        # Optional: Path prefix within the bucket (e.g., "cmem/workspaces").
        path: ""

    # Additional Environment Variables
    # Custom environment variables injected into the DataIntegration configmap.
    additionalEnvVars: {}
      # FOO: "bar"
      # For offline Python package installation (no PyPI access):
      # PIP_NO_INDEX: "true"
      # PIP_FIND_LINKS: "/data/downloaded-packages"

    # Global Variables
    # Variables accessible in DataIntegration configurations and plugins.
    # Useful for plugin configuration (e.g., cmem-plugin-irdi, cmem-plugin-kafka).
    globalVariables: {}
      # myVar: "value"

    # List of strings to specify user provided JDBC drivers. The second part of the protocol of a JDBC URI (e.g. db2 from
    # jdbc:db2://host:port)  is used to specify the driver. For each protocol on the list a jar classname and optional download
    # location can be provided. Example jdbc.drivers = "db2,mysql"
    #  jdbc.drivers = "db2"
    # Some database systems use licenses that are to loose or restrictive for us to ship the drivers. Therefore a path
    # to a jar file containing the driver and the name of driver can be specified here.
    # An example for db2 would be: jdbc.db2.jar = ${elds.home}"/etc/dataintegration/conf/jdbc/db2jcc-db2jcc4.jar"
    #  jdbc.db2.jar = "/home/chris/Jars/db2jcc-db2jcc4.jar"
    # Name of the actual driver class, e.g.: "jdbc.db2.name = om.ibm.db2.jcc.DB2Driver".
    #  jdbc.db2.name = "com.ibm.db2.jcc.DB2Driver"

    # Snowflake JDBC Configuration
    # Enable if you need to connect to Snowflake data warehouses.
    # Requires Snowflake JDBC driver to be included in the DI image.
    # You can create it with a custom configmap
    # See: https://docs.snowflake.com/en/developer-guide/jdbc/jdbc-download
    # sparksqloption: |
    #    jdbc.drivers = "snowflake"
    #    jdbc.snowflake.jar = ${ELDS_HOME}"/etc/dataintegration/conf/snowflake-jdbc-3.13.30.jar"
    #    jdbc.snowflake.name = "net.snowflake.client.jdbc.SnowflakeDriver"
    # sparksqloption: |
    #    jdbc.drivers = "databricks"
    #    jdbc.databricks.jar = ${ELDS_HOME}"/etc/dataintegration/conf/plugin/DatabricksJDBC.jar"
    #    jdbc.databricks.name = "com.databricks.client.jdbc.Driver"
    sparksqloption: {}

    # Workbench Favicon (optional).
    # Custom favicon for DataIntegration UI.
    # Options: data URI (e.g., "data:image/png;base64,...") or file path.
    # Note: Only PNG format supported. File must be mounted if using file path.
    workbenchFavIcon: ""

    # Additional Custom Configuration
    # Raw HOCON configuration appended to DataIntegration config file.
    # Use for advanced settings not exposed as chart values.
    # Example: GraphStore timeouts, connection pools, etc.
    additionalCustomConfig: ""
      # graphstore.default = {
      #   connection.timeout.ms = 15000
      #   read.timeout.ms = 150000
      #   max.request.size = 300000000
      #   fileUpload.timeout.ms = 1800000
      # }

    # Prometheus Metrics Configuration
    metrics:
      # Enable Prometheus metrics endpoint and ServiceMonitor.
      # Requires Prometheus Operator to be installed in the cluster.
      # Default: false.
      enabled: false
      port: "9100"
      appName: "build"
      prefix: "cmem"

      # ServiceMonitor labels for Prometheus Operator selection.
      ServiceMonitorLabels:
        release: kubestack

      # Additional ServiceMonitor configuration (optional).
      additionalCustomConfig: {}
        # fallbackScrapeProtocol: PrometheusText1.0.0

    # Mapping Creator Configuration
    mappingCreator:
      # Enable Mapping Creator feature.
      # Provides a guided interface for creating RDF mappings.
      # AI assistance is recommended but optional.
      # Default: true.
      enabled: true

      # Makes use of explores endpoint for build.
      # If you still want to configure it independent from explore set it to 'false'
      # If set to 'true' only AiLogQueries is configured in the configuration. .
      # 'AiApiKey', 'AiOrgId', etc are ignored.
      useDataPlatformGateway: true

      # API key for AI-assisted mapping creation (if applicable).
      AiApiKey: ""

      # AI Organization ID (if applicable).
      AiOrgId : ""

      # AI Core URL (e.g., OpenRouter or OpenAI endpoint).
      # OpenAiCoreUrl: "https://api.openai.com/v1"
      # ClaudeAiCoreUrl: "https://api.anthropic.com/v1"
      AiCoreUrl: "https://openrouter.ai/api/v1"

      # The model name. This depends on the AiCoreUrl used.
      AiModel: "openai/gpt-5-mini"

      # The maximum number of tokens to generate in the completion.
      AiReasoningEffort: "low"

      # Enable logging of AI prompt and response data in container logs
      AiLogQueries: false

    ## CPU Architecture Configuration
    # Target CPU architecture for Python certifi paths
    # Options: "amd64" (x86_64) or "arm64" (aarch64/Apple Silicon)
    # Default: "amd64"
    # IMPORTANT: Set to "arm64" when deploying on Apple Silicon or ARM-based clusters
    architecture: "amd64"

    # Path to CA bundle for DataIntegration (Python certifi)
    # Leave empty to use architecture-based automatic path selection
    # Override example: "/custom/path/to/cacert.pem"
    di_ca_bundle_path: ""

  ## Service configuration
  ## Exposes DataIntegration internally within the cluster
  service:
    # Service name
    name: dataintegration
    # Service type - typically ClusterIP for internal access, use LoadBalancer/NodePort for external access
    # Options: ClusterIP, NodePort, LoadBalancer
    type: ClusterIP
    # Port for DataIntegration API and UI
    # Default: "8080"
    port: "8080"
  ## Cache configuration
  ## Used for JAVA_TEMP, DI working cache, boot tests, and boot logs (not persisted)
  ## Logs are written to stdout as well, so cache loss is acceptable
  cache:
    # Base path for cache directory
    # IMPORTANT: Cannot be changed until CMEM-5462 is resolved
    # Default: /opt/cmem/eccenca-DataIntegration/dist/var
    cacheBasePath: /opt/cmem/eccenca-DataIntegration/dist/var
    # Size of cache volume (emptyDir or PVC)
    # Rule of thumb: Base on memory usage or largest file sizes processed by DataIntegration
    # For heavy workloads with large transformations, increase this value
    # Default: 5G
    cacheSize: 5G
    # Maximum number of links cached per forward/backward path
    # Total max links can be 2x this value (forward + backward)
    # Increase for better performance with highly connected data
    # Default: 10000 (DI default is 50)
    maxLinks: 10000
    # Enable PVC instead of emptyDir if node storage is limited
    # Use this when emptyDir runs out of space on the node
    # Default: false
    pvcenabled: false
    # Storage class for cache PVC (only used if pvcenabled: true)
    # Examples: standard, local-path, gp2, fast-ssd
    # Default: standard
    storageClassName: standard
    # Use existing PVC for cache (advanced)
    existentPvc:
      # IMPORTANT: If enabled, .dataintegration.persistence MUST also be enabled
      # You must adjust cacheBasePath to a subfolder of config.home
      # Default: false
      enabled: false
  ## Temporary directory configuration
  ## Used for Python plugins and Silk operators - mounted at /tmp and silkPath
  tmp:
    # Size of temporary volume (emptyDir or PVC)
    # Rule of thumb: Base on memory usage or largest file sizes processed by DataIntegration
    # Increase if Python plugins or Silk operators need more temporary space
    # Default: 500M
    cacheSize: 500M
    # Path for Silk framework files (.silk directory)
    # Adjust based on the user DataIntegration runs as:
    # - Default user 'cmem': /home/cmem/.silk
    # - Different username: /home/<username>/.silk
    # - No home directory (e.g., OpenShift): /.silk
    # Default: /home/cmem/.silk
    silkPath: "/home/cmem/.silk"
    # Enable PVC instead of emptyDir if node storage is limited
    # Use this when emptyDir runs out of space on the node
    # cacheSize is used to define the PVC size
    # Default: false
    pvcenabled: false
    # Storage class for tmp PVC (only used if pvcenabled: true)
    # Examples: standard, local-path, gp2, fast-ssd
    # Default: standard
    storageClassName: standard

  ## Persistence configuration for workspace and plugins
  ## Stores workspace data, installed plugins, and configuration
  ## IMPORTANT: Should be enabled in production to prevent data loss
  persistence:
    # Enable persistent storage for workspace and plugins
    # If disabled, data is stored in emptyDir and lost on pod restart
    # Default: true
    enabled: true
    # Storage class for persistent volume
    # Platform-specific examples:
    # - k3d/k3s: local-path
    # - AWS EKS: gp2, gp3
    # - Azure AKS: default, managed-premium
    # - GCP GKE: standard, standard-rwo
    # Default: standard
    storageClassName: standard
    # Size of persistent volume
    # Adjust based on number of projects, plugins, and data volumes
    # Default: 5G
    storageSize: 5G
    # Use existing PVC (advanced)
    # If enabled, storageClassName and storageSize are ignored
    existentPvc:
      # Use pre-created PVC
      # Default: false
      enabled: false
      # Name of existing PVC
      # Default: eccenca-di-pvc
      name: eccenca-di-pvc

    # MountPath does not exist here. We use .Values.dataintegration.config.home instead.
    # mountPath:
    # If a subPath is given, it is added to the mount section of dataintegration data volume
    subPath: ""

  ## Custom volumes and volume mounts (advanced)
  ## Add additional volumes and mounts if needed for custom integrations
  ## Example:
  # customVolumes:
  #   - name: custom-data
  #     persistentVolumeClaim:
  #       claimName: my-custom-pvc
  # customMounts:
  #   - name: custom-data
  #     mountPath: /mnt/custom
  customMounts: []
  customVolumes: []

  ## Override the default start command (advanced)
  ## Use this to customize the DataIntegration startup process
  ## If specified, should contain at least the default startup script
  ## Example:
  # customCommand:
  #   - bash
  #   - -c
  #   - |
  #     echo "Custom initialization"
  #     /usr/local/bin/dataintegration.sh
  customCommand: []

  ## Init containers configuration
  ## Used to prepare the environment before DataIntegration starts
  initContainer:
    # Security context for init containers
    # Follows security best practices
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
    # Enable init containers
    # Default: true
    enabled: true
    ## Data provisioning init container
    ## Creates necessary folders on the data volume (plugins, reports, etc.)
    provisioningData:
      # Enable data provisioning
      # IMPORTANT: Disable if filesystem permissions require a sidecar container
      # (sidecar containers can't run during init phase)
      # Default: true
      enabled: true
      # Override the default provisioning command (advanced)
      # The default command creates plugin folders and report folders
      # IMPORTANT: If customizing, ensure proper Helm templating is maintained
      # Example default command:
      # command:
      #   - bash
      #   - -c
      #   - |
      #     set -x
      #     echo "create plugin-folder"
      #     mkdir -p {{ .Values.dataintegration.config.pluginFolder }}
      #     echo "create python-plugin-folder"
      #     mkdir -p {{ .Values.dataintegration.config.pythonPluginFolder }}
      #     {{- if eq .Values.dataintegration.config.executionReportManager.plugin "file" }}
      #     echo "create reports-folder"
      #     mkdir -p {{ .Values.dataintegration.config.executionReportManager.folder }}
      #     {{- end }}
      #     ls -la {{ .Values.dataintegration.config.home }}
      command: []

    ## Python plugin installation init container
    ## Copies Python packages from the plugin image to the pythonPluginFolder
    ## Useful for bundling Python plugins with the deployment
    pythonPluginImageInstall:
      # Enable Python plugin installation
      # Default: false
      enabled: false
      # Plugin image configuration
      image:
        # Only specify repository and tag to override the default image from Chart.yaml
        # Default: Uses appVersion from Chart.yaml
        # repository: docker-registry.eccenca.com/eccenca-dataintegration-plugins
        # tag: develop
        pullPolicy: Always
      # Size of temporary emptyDir volume for plugin extraction
      # Version v1.3.0 requires ~420M
      # Default: 500M
      emptyDirSize: 500M
      # Override the default plugin installation command (advanced)
      # The default command copies Python packages to the pythonPluginFolder
      # IMPORTANT: If customizing, ensure proper Helm templating is maintained
      # Example default command:
      # command:
      #   - bash
      #   - -c
      #   - |
      #     echo "Installing Python plugins"
      #     rm -rf /data/python-packages.local/*
      #     cp -Rv /data/python-packages/* /data/python-packages.local/
      command: []

    ## Custom CA certificates init container
    ## Installs custom CA certificates into the Java trust store
    ## Uses certificates defined in global.customCACerts
    customCACerts:
      # Enable custom CA certificate installation
      # Default: true
      enabled: true
      # Override the default CA certificate installation command (advanced)
      # IMPORTANT: If customizing, ensure proper Helm templating is maintained
      command: []

  ## Custom init containers (advanced)
  ## Additional init containers that run after provisioningData and customCACerts
  ## Example:
  # customInitContainers:
  #   - name: custom-setup
  #     image: busybox
  #     command: ['sh', '-c', 'echo "Custom init"']
  customInitContainers: []

  ## Sidecar containers (advanced)
  ## Additional containers that run alongside DataIntegration
  ## Useful for log shipping, monitoring, or filesystem permissions helpers
  ## Example:
  # extraContainers:
  #   - name: log-shipper
  #     image: fluent/fluent-bit
  #     volumeMounts:
  #       - name: logs
  #         mountPath: /var/log
  extraContainers: []

  ## Health check probes
  ## Configure liveness and readiness checks for DataIntegration
  probes:
    ## Liveness probe - restarts container if unhealthy
    ## Maximum startup time: 15sec + (10sec * 60 tries) = ~10 minutes
    livenessProbe:
      # Delay before first check
      # Default: 15
      initialDelaySeconds: 15
      # Check interval
      # Default: 10
      periodSeconds: 10
      # Timeout for each check
      # Default: 10
      timeoutSeconds: 10
      # Number of consecutive failures before restart
      # Default: 60
      failureThreshold: 60
    ## Readiness probe - removes from service endpoints if not ready
    ## Maximum startup time: 15sec + (10sec * 360 tries) = ~60 minutes
    ## Allows for long initialization times (plugin loading, workspace setup)
    readinessProbe:
      # Delay before first check
      # Default: 15
      initialDelaySeconds:  15
      # Check interval
      # Default: 10
      periodSeconds: 10
      # Timeout for each check
      # Default: 10
      timeoutSeconds: 10
      # Number of consecutive failures before marking not ready
      # Default: 360 (allows up to 60 minutes startup time)
      failureThreshold: 360
  ## Pod annotations
  ## Add custom annotations to DataIntegration pods
  ## Example:
  # podAnnotations:
  #   prometheus.io/scrape: "true"
  #   prometheus.io/port: "8080"
  podAnnotations: {}

  ## Pod security context
  ## Security settings at the pod level
  podSecurityContext:
    # Run as non-root user
    runAsNonRoot: true
    # File system group for volume ownership
    # Default: 10001
    fsGroup: 10001
    # User ID to run the container as
    # Default: 1213
    runAsUser: 1213
    # Group ID to run the container as (optional)
    # runAsGroup: 1213

  ## Container security context
  ## Security settings at the container level
  ## Follows security best practices
  securityContext:
    # Prevent privilege escalation
    allowPrivilegeEscalation: false
    # Drop all Linux capabilities
    capabilities:
      drop:
      - ALL
    # Mount root filesystem as read-only
    readOnlyRootFilesystem: true
  ## Resource limits and requests
  ## Configure CPU and memory allocation for DataIntegration
  ## IMPORTANT: Memory should match JVM heap size + overhead (~700Mi for DataIntegration)
  ## Note: CPU limits are intentionally not set (see https://home.robusta.dev/blog/stop-using-cpu-limits)
  resources:
    # Resource limits - maximum resources the container can use
    limits:
      # Memory limit should be: JVM heap (-Xmx) + ~700Mi overhead
      # Example: If -Xmx4000m, set memory: 4700Mi
      # Default: 4700Mi (matches default -Xmx4000m)
      memory: 4700Mi
    # Resource requests - minimum guaranteed resources
    requests:
      # CPU request - consider increasing for heavy workloads
      # Default: 100m
      cpu: 100m
      # Memory request - should match limit for stable performance
      # Default: 4700Mi
      memory: 4700Mi
  ## Extra host entries (advanced)
  ## Add static host-to-IP mappings to /etc/hosts in the pod
  ## Useful for custom DNS resolution or internal network access
  ## Example:
  # extraHosts:
  #   - ip: 192.168.1.1
  #     hostnames:
  #       - internal-api.example.com
  #       - db.example.com

  ## Update strategy for rolling updates
  ## Controls how pods are replaced during updates
  updateStrategy:
    # Type of update strategy
    # Default: RollingUpdate
    type: RollingUpdate

  ## Autoscaling configuration
  ## IMPORTANT: DataIntegration uses StatefulSet, horizontal scaling may not be suitable
  ## Consider vertical scaling (increase resources) for better performance
  autoscaling:
    # Enable horizontal pod autoscaling
    # Default: false (not recommended for DataIntegration)
    enabled: false
    # Number of replicas when autoscaling is disabled
    # Default: 1
    replicaCount: 1
    # Minimum number of replicas
    # Default: 1
    minReplicas: 1
    # Maximum number of replicas
    # Default: 100
    maxReplicas: 100
    # Target CPU utilization percentage for scaling
    # Default: 80
    targetCPUUtilizationPercentage: 80

  ## Automount service account token
  ## Controls whether Kubernetes service account token is mounted into pods
  ## Default: false (recommended for security)
  automountServiceAccountToken: false

  ## Service account configuration
  serviceAccount:
    # Create and use a service account
    # Default: false
    enabled: false
    # Name of the service account to use
    # If not set and enabled is true, a name is generated using the fullname template
    # Default: ""
    name: ""

  ## Node selector for pod assignment
  ## Constrain pods to run on specific nodes
  ## Example:
  # nodeSelector:
  #   disktype: ssd
  #   node-role.kubernetes.io/worker: ""
  nodeSelector: {}

  ## Tolerations for pod assignment
  ## Allow pods to schedule on nodes with matching taints
  ## Example:
  # tolerations:
  #   - key: "dedicated"
  #     operator: "Equal"
  #     value: "cmem"
  #     effect: "NoSchedule"
  tolerations: []

  ## Affinity rules for pod assignment
  ## Control pod placement using node/pod affinity/anti-affinity
  ## Example:
  # affinity:
  #   podAntiAffinity:
  #     preferredDuringSchedulingIgnoredDuringExecution:
  #       - weight: 100
  #         podAffinityTerm:
  #           labelSelector:
  #             matchExpressions:
  #               - key: app.kubernetes.io/name
  #                 operator: In
  #                 values:
  #                   - dataintegration
  #           topologyKey: kubernetes.io/hostname
  affinity: {}


## ============================================================================
## GraphInsights Configuration
## ============================================================================
## GraphInsights is an extension for Explore that provides advanced
## graph analytics and insights capabilities
## Documentation: https://doc.semspect.de/
##
graphinsights:
  # Enable GraphInsights deployment
  # IMPORTANT: Requires a valid license (see license configuration below)
  # Default: false
  enabled: false

  ## Container image configuration
  image:
    # Only specify repository and tag to override the default image from Chart.yaml
    # IMPORTANT: Use multi-architecture images on Apple Silicon (arm64)
    # Default: Uses appVersion from Chart.yaml
    # repository: docker-registry.eccenca.com/eccenca-graphinsights
    # tag: develop
    pullPolicy: Always

  # License configuration
  # IMPORTANT: GraphInsights requires a valid license file to write data
  # Reference to a Kubernetes secret containing the 'license.lic' file
  # The license will be mounted at /opt/license.lic in the pod
  #
  # Create the secret with:
  #   kubectl create secret generic graphinsights-license --from-file=graphinsights.lic=/path/to/license.lic
  #
  # IMPORTANT: The secret must be created BEFORE deploying the chart
  # If license is invalid or missing, GraphInsights will start in read-only mode
  # Default: graphinsights-license
  license: graphinsights-license

  #
  config:
    javaToolOptions:
  ## Service configuration
  ## Exposes GraphInsights internally within the cluster
  service:
    # Service name
    name: graphinsights
    # Service type - typically ClusterIP for internal access
    # Options: ClusterIP, NodePort, LoadBalancer
    type: ClusterIP
    # Port for GraphInsights API
    # Default: 8080
    port: 8080
    # Context path for GraphInsights
    # Must match the path configured in Explore integration
    # Default: /graphinsights
    contextPath: /graphinsights

  ## Persistence configuration for GraphInsights data
  ## Stores GraphInsights data, indexes, and cache
  ## IMPORTANT: Should be enabled in production to prevent data loss
  persistence:
    # Enable persistent storage for GraphInsights data
    # If disabled, data is stored in emptyDir and lost on pod restart
    # Default: true
    enabled: true
    # In case you want to alter the path Graph Insights uses to store it's data. Default's to /data
    mountPath: "/data"
    # if a subPath is given, it is added to the mount section of graph insights data volume
    subPath: ""
    # Use existing PVC (advanced)
    existentPvc:
      # Use pre-created PVC
      # Default: false
      enabled: false
      # Name of existing PVC
      name: ""
    # Storage class for persistent volume
    # Platform-specific examples:
    # - k3d/k3s: local-path
    # - AWS EKS: gp2, gp3
    # - Azure AKS: default, managed-premium
    # - GCP GKE: standard, standard-rwo
    # Default: standard
    storageClassName: "standard"
    # Storage size for persistent volume
    # Adjust based on graph size and analytics workload
    # Default: 5Gi
    resources:
      requests:
        storage: 5Gi
    # Size of emptyDir when persistence is disabled
    # Default: 1Gi
    emptyDirSize: 1Gi
    # Size of temporary directory for processing
    # Default: 512Mi
    tempDirSize: 512Mi

  ## Explore integration persistence
  ## IMPORTANT: When GraphInsights is enabled, Explore needs additional storage
  ## This volume is mounted in Explore pods for GraphInsights data exchange
  explore:
    persistence:
      # Enable persistence for Explore-GraphInsights integration
      # IMPORTANT: Must be enabled when graphinsights.enabled: true
      # Default: true
      enabled: true
      # Use existing PVC (advanced)
      existentPvc:
        # Use pre-created PVC
        # Default: false
        enabled: false
        # Name of existing PVC
        name: ""
      # Storage class for persistent volume
      # Platform-specific examples:
      # - k3d/k3s: local-path
      # - AWS EKS: gp2, gp3
      # - Azure AKS: default, managed-premium
      # - GCP GKE: standard, standard-rwo
      # Default: standard
      storageClassName: "standard"
      # Storage size for integration volume
      # Stores data exchanged between Explore and GraphInsights
      # Default: 1Gi
      storageSize: 1Gi
      # Mount path in Explore pods
      # Default: /graphinsights
      mountPath: /graphinsights
      # If a subPath is given, it is added to the mount section of explore graphinsights integration volume
      subPath: ""

  ## Health check probes
  ## IMPORTANT: Currently disabled - probes are prepared but not yet implemented
  ## Future versions may enable these for health monitoring
  probes:
    # Liveness probe
    # Default: false (disabled)
    livenessProbe:
      enabled: false
    # Readiness probe
    # Default: false (disabled)
    readinessProbe:
      enabled: false

  ## Resource limits and requests
  ## Configure CPU and memory allocation for GraphInsights
  ## For detailed resource recommendations, see:
  ## https://doc.semspect.de/docs/rdf-server/resource-considerations/
  resources:
    # Resource limits - maximum resources the container can use
    limits:
      # CPU limit - uncomment and adjust based on workload
      # cpu: 2000m
      # Memory limit
      # Adjust based on graph size and query complexity
      # Default: 2000Mi
      memory: 2000Mi
    # Resource requests - minimum guaranteed resources
    requests:
      # CPU request
      # Default: 100m
      cpu: 100m
      # Memory request - should match or be close to limit
      # Default: 2000Mi
      memory: 2000Mi

  ## Pod annotations
  ## Add custom annotations to GraphInsights pods
  ## Example:
  # podAnnotations:
  #   prometheus.io/scrape: "true"
  #   prometheus.io/port: "8080"
  podAnnotations: {}

  ## Pod security context
  ## Security settings at the pod level
  podSecurityContext:
    # Run as non-root user
    runAsNonRoot: true
    # File system group for volume ownership
    # Default: 1213
    fsGroup: 1213
    # User ID to run the container as
    # Default: 1213
    runAsUser: 1213
    # Group ID to run the container as (optional)
    # runAsGroup: 1213

  ## Container security context
  ## Security settings at the container level
  ## Follows security best practices
  securityContext:
    # Prevent privilege escalation
    allowPrivilegeEscalation: false
    # Drop all Linux capabilities
    capabilities:
      drop:
      - ALL
    # Mount root filesystem as read-only
    readOnlyRootFilesystem: true
  
  config:
    # Prometheus metrics configuration.
    # This is NOT implemented yet in GraphInsights, but reserved for future use.
    metrics:
      # Enable Prometheus metrics endpoint and ServiceMonitor.
      # Requires Prometheus Operator to be installed in the cluster.
      # Default: false.
      enabled: false
      port: "9100"
      appName: "graphinsights"
      context: "/metrics"

      # ServiceMonitor labels for Prometheus Operator selection.
      # These must match your Prometheus Operator's serviceMonitorSelector.
      ServiceMonitorLabels:
        release: kubestack

      # Additional ServiceMonitor configuration (optional).
      additionalCustomConfig: {}

  ## Sidecar containers (advanced)
  ## Additional containers that run alongside DataIntegration
  ## Useful for log shipping, monitoring, or filesystem permissions helpers
  ## Example:
  # extraContainers:
  #   - name: log-shipper
  #     image: fluent/fluent-bit
  #     volumeMounts:
  #       - name: logs
  #         mountPath: /var/log
  extraContainers: []