helm/values.yaml

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Default values for fluss.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

image:
  registry: ""
  repository: apache/fluss
  tag: "1.0.0"
  pullPolicy: IfNotPresent
  pullSecrets: []

# Fluss server configuration options
configurationOverrides:
  default.bucket.number: 3
  default.replication.factor: 3
  zookeeper.path.root: /fluss
  zookeeper.address: zk-zookeeper.{{ .Release.Namespace }}.svc.cluster.local:2181
  remote.data.dir: /tmp/fluss/remote-data
  data.dir: /tmp/fluss/data
  internal.listener.name: INTERNAL

tablet:
  numberOfReplicas: 3
  storage:
    enabled: false
    size: 1Gi
    storageClass:
  # Readiness probe configuration for rolling upgrade gate.
  # The probe talks to the LOCAL tablet server (127.0.0.1:client-port) and
  # asks it to forward a getClusterHealth RPC to the Coordinator over the
  # internal listener. Pod is marked Ready only when the cluster is GREEN.
  # If the server does not support the API (older version), the probe
  # immediately falls back to TCP-only port readiness.
  readinessProbe:
    # Timeout in ms for the RPC call.
    rpcTimeoutMs: 5000
    # Standard Kubernetes probe parameters (tuned for recovery checks).
    #
    # The total time Kubernetes will wait before flipping the pod to NotReady is
    #     initialDelaySeconds + failureThreshold * periodSeconds
    #   = 15 + 360 * 5 = 1815s (~30 minutes) by default.
    # IMPORTANT: this window MUST be larger than healthCheckTimeoutSeconds
    # below, otherwise Kubernetes will mark the pod NotReady BEFORE the
    # in-script health-check fallback has a chance to latch the TCP fast path,
    # which would still wedge the rolling upgrade. If you tune
    # healthCheckTimeoutSeconds upward, raise failureThreshold accordingly so
    # the inequality (failureThreshold * periodSeconds > healthCheckTimeoutSeconds)
    # always holds.
    failureThreshold: 360
    timeoutSeconds: 10
    initialDelaySeconds: 15
    periodSeconds: 5
    # Maximum wall-clock seconds the cluster health gate is allowed to keep a
    # freshly-created tablet pod NotReady on its first boot. After this budget
    # is exhausted the probe latches the TCP-only fast path so a permanently-
    # unrecoverable cluster cannot wedge a rolling upgrade indefinitely.
    # Default: 1200 (20 minutes).
    healthCheckTimeoutSeconds: 1200
    # Optional client auth configuration passed to the probe's RpcClient as a
    # single-line string of semicolon-separated `key:value` pairs (no quoting
    # or escaping needed). Required only when the local client listener
    # enforces SASL. Example:
    #   healthCheckAuth: "client.security.protocol:SASL;client.sasl.mechanism:PLAIN;client.security.sasl.username:admin;client.security.sasl.password:admin-pass"
    healthCheckAuth: ""
  extraVolumes: []
  extraVolumeMounts: []
  initContainers: []
  extraEnv: []
  envFrom: []
  annotations: {}
  service:
    annotations: {}
  podAnnotations: {}
  podLabels: {}
  podDisruptionBudget:
    enabled: false
    # minAvailable: 1
    # maxUnavailable: 1
  # Pod scheduling configuration
  affinity: {}
  # Example: spread tablet server pods across availability zones and nodes.
  # Replace `<release-name>` below with your Helm release name (the value
  # passed to `helm install <release-name>`) before uncommenting.
  # affinity:
  #   podAntiAffinity:
  #     preferredDuringSchedulingIgnoredDuringExecution:
  #       - weight: 100
  #         podAffinityTerm:
  #           topologyKey: topology.kubernetes.io/zone
  #           labelSelector:
  #             matchLabels:
  #               app.kubernetes.io/instance: <release-name>
  #               app.kubernetes.io/component: tablet
  #       - weight: 50
  #         podAffinityTerm:
  #           topologyKey: kubernetes.io/hostname
  #           labelSelector:
  #             matchLabels:
  #               app.kubernetes.io/instance: <release-name>
  #               app.kubernetes.io/component: tablet
  nodeSelector: {}
  tolerations: []
  topologySpreadConstraints: []

coordinator:
  numberOfReplicas: 1
  storage:
    enabled: false
    size: 1Gi
    storageClass:
  extraVolumes: []
  extraVolumeMounts: []
  initContainers: []
  extraEnv: []
  envFrom: []
  annotations: {}
  service:
    annotations: {}
  podAnnotations: {}
  podLabels: {}
  podDisruptionBudget:
    enabled: false
    # minAvailable: 1
    # maxUnavailable: 1
  affinity: {}
  nodeSelector: {}
  tolerations: []
  topologySpreadConstraints: []

# Fluss listener configurations
listeners:
  internal:
    port: 9123
  client:
    port: 9124

# Secrets referenced from configurationOverrides via config provider markers:
# mounts are read with ${directory:<basePath>/<name>:<key>}, env entries with
# ${env:<NAME>}. The chart generates the matching config.providers lines.
secrets:
  basePath: /etc/fluss/secrets
  # - name: paimon-creds
  #   secretName: fluss-paimon-creds
  mounts: []
  # - name: PAIMON_S3_ACCESS_KEY
  #   secretName: fluss-paimon-creds
  #   key: access-key
  env: []

# Fluss security configurations
security:
  client:
    sasl:
      # "" | plain
      mechanism: ""
      plain:
        # Each entry is either a literal {username, password} pair or an
        # `existingSecret` reference that sources both from a Secret (same shape
        # as internal/zookeeper). Mixing within one entry is not allowed.
        users: []
        # - username: alice
        #   password: alice-pass
        # - existingSecret:
        #     name: fluss-client-sasl-bob
        #     usernameKey: username
        #     passwordKey: password

  internal:
    sasl:
      # "" | plain
      mechanism: ""
      plain:
        username: ""
        password: ""
        # When set, overrides literal username/password above.
        existingSecret: {}
        # existingSecret:
        #   name: fluss-internal-sasl
        #   usernameKey: username
        #   passwordKey: password

  zookeeper:
    sasl:
      # "" | plain
      mechanism: ""
      plain:
        username: ""
        password: ""
        loginModuleClass: "org.apache.fluss.shaded.zookeeper3.org.apache.zookeeper.server.auth.DigestLoginModule"
        # When set, overrides literal username/password above.
        existingSecret: {}
        # existingSecret:
        #   name: fluss-zk-sasl
        #   usernameKey: username
        #   passwordKey: password

  # JAAS config is rendered at pod startup by an init container that reads a
  # template ConfigMap and substitutes credentials from env. The init container
  # reuses the main Fluss image (already available on the node).

metrics:
  reporters: ""
  prometheus:
    port: 9249
    service:
      portName: metrics
      labels: {}
      annotations: {}
  jmx:
    port: 9250

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # coordinatorServer:
  #   limits:
  #     cpu: 100m
  #     memory: 128Mi
  #   requests:
  #     cpu: 100m
  #     memory: 128Mi
  # tabletServer:
  #   requests:
  #     cpu: 100m
  #     memory: 128Mi
  #   limits:
  #     cpu: 100m
  #     memory: 128Mi

serviceAccount:
  create: false
  # If not set and create is true, a name is generated using the fullname template
  name: ""
  # Additional annotations to apply to the ServiceAccount.
  # These can be useful, for example, to support integrations like workload identity.
  annotations: {}