apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: superset
  namespace: superset
spec:
  interval: 5m
  timeout: 20m
  chart:
    spec:
      chart: superset-contour
      version: "0.13.4"
  values:
    global:
      imagePullSecrets:
        - regcred
    fullnameOverride: superset
    serviceAccount:
      create: true
    serviceAccountName: superset
    imagePullSecrets:
      - name: regcred
    image:
      repository: cr.yandex/crp3ccidau046kdj8g9q/contour/superset/superset
      tag: 4.1.1
    initImage:
      repository: cr.yandex/crp3ccidau046kdj8g9q/contour/superset/superset
      tag: dockerize
    vault:
      enabled: true
      role: superset
      authPath: auth/kubernetes
      kvVersion: 2
      secrets:
        - env: SUPERSET_SECRET_KEY
          path: secrets/data/vault/apps/superset
          key: SUPERSET_SECRET_KEY
        - env: DB_PASS
          path: secrets/data/apps/superset/postgres
          key: password
        - env: JWT_SECRET
          path: secrets/data/vault/apps/superset
          key: JWT_SECRET
    stronghold:
      enabled: false
    extraEnv:
      GUNICORN_TIMEOUT: "300"
      SERVER_WORKER_AMOUNT: "4"
      BABEL_DEFAULT_LOCALE: ru
    extraEnvRaw:
      - name: ENABLE_PROXY_FIX
        value: "true"
    supersetNode:
      connections:
        redis_host: superset-redis-headless
        redis_port: "6379"
        redis_user: ""
        redis_cache_db: "1"
        redis_celery_db: "0"
        db_host: 10.222.255.162
        db_port: "5432"
        db_user: superset
        db_name: superset
      resources:
        requests:
          cpu: 500m
          memory: 1Gi
        limits:
          memory: 2Gi
    supersetWorker:
      resources:
        requests:
          cpu: 500m
          memory: 1Gi
        limits:
          memory: 2Gi
    init:
      loadExamples: false
    postgresql:
      enabled: false
    redis:
      enabled: true
      image:
        registry: cr.yandex
        repository: crp3ccidau046kdj8g9q/contour/superset/redis
        tag: 7.0.10-debian-11-r4
      architecture: standalone
      auth:
        enabled: false
        existingSecret: ""
        existingSecretKey: ""
        password: ""
      master:
        persistence:
          enabled: false
    configOverrides:
      feature_flags: |
        FEATURE_FLAGS = {
            "EMBEDDED_SUPERSET": True,
            "ENABLE_TEMPLATE_PROCESSING": True,
        }
        GUEST_ROLE_NAME = "Gamma"
        GUEST_TOKEN_JWT_AUDIENCE = "guest"
        GUEST_TOKEN_JWT_SECRET = os.getenv("JWT_SECRET")
        GUEST_TOKEN_JWT_EXP_SECONDS = 3600
      iframe_config: |
        TALISMAN_ENABLED = True
        TALISMAN_CONFIG = {
            "frame_options": None,
            "content_security_policy": {
                "base-uri": ["'self'"],
                "default-src": ["'self'"],
                "img-src": ["'self'", "blob:", "data:", "https://apachesuperset.gateway.scarf.sh", "https://static.scarf.sh/"],
                "worker-src": ["'self'", "blob:"],
                "connect-src": ["'self'", "https://api.mapbox.com", "https://events.mapbox.com"],
                "object-src": ["'none'"],
                "style-src": ["'self'", "'unsafe-inline'"],
                "script-src": ["'self'", "'strict-dynamic'"],
                "frame-ancestors": ["'self'", "https://sarex.uralmine.com", "https://*.uralmine.com", "https://sarex-bi.uralmine.com"],
            },
            "content_security_policy_nonce_in": ["script-src"],
        }
        X_FRAME_OPTIONS = None
        HTTP_HEADERS = {
            "Content-Security-Policy": "frame-ancestors 'self' https://sarex.uralmine.com https://*.uralmine.com https://sarex-bi.uralmine.com",
        }
      extend_timeout: |
        SQLLAB_ASYNC_TIME_LIMIT_SEC = 300
        SUPERSET_WEBSERVER_TIMEOUT = 300
        SQLLAB_TIMEOUT = 600
      set_locale: |
        BABEL_DEFAULT_LOCALE = "ru"
      enable_oauth: ""
    extraConfigs:
      import_datasources.yaml: |
        databases:
          - database_name: trino
            sqlalchemy_uri: trino://superset@trino.trino.svc.cluster.local:8080
            expose_in_sqllab: true
            allow_ctas: true
            allow_cvas: true
            allow_dml: false