# Other sections and values are omitted for clarity.
tiledb-cloud-rest:
  restConfig:
    SSO:
      Okta:
        Domain: 'springfielduniversity.okta.com'

tiledb-cloud-ui:
  config:
    SSOOkta:
      Domain: 'springfielduniversity.okta.com'
      ClientID: '0oa5ba4rr9cO9dqVW5d7'
      ClientSecret: '4777c36d8b528e07f24cf81be8651162d0f8b278e1ed5c0850b25d6f3583'

# Other sections omitted.
tiledb-cloud-rest:
  restConfig:
    SSO:
      Okta:
        Domain: 'springfielduniversity.okta.com'
        SCIMPasswords:
          - 'a-password-for-okta-to-use'

# Default values for mapproxy
# This is a YAML-formatted file.
replicaCount: 1

serviceAccount:
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: "default"

# REQUIRED: set the TileDB Cloud Configuration. This should be a API token
# created in the TileDB Cloud UI and the hostname where TileDB Cloud REST API
# is exposed
tiledbConfig:
  token: ""
  host: "tiledb-cloud-rest"

# REQUIRED: Configure mapproxy settings, including setting array_uri
mapProxConfig:
  services:
    demo:
    wms:
    wmts:

  layers:
    - name: tiledb_prod
      title: TileDB Production Source
      sources: [tiledb_cache]

  caches:
    tiledb_cache:
      sources: [] 
      grids: [GLOBAL_WEBMERCATOR]
      cache:
          type: tiledb
          # REQUIRED: Set the array_uri here
          array_uri: tiledb_cache

ingress:
  enabled: true
  # Configure any needed annotations. For instance if you are using a different ingress besides nginx set that here
  annotations:
    kubernetes.io/ingress.class: nginx
  # REQUIRED: set the mapproxy hostname
  hosts:
    - mapproxy.tiledb.example.com
  # tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

# By default we set limits to 2 CPUs and 2GB Memory
# resources:
#   limits:
#     cpu: 2000m
#     memory: 2Gi
#   requests:
#     cpu: 2000m
#     memory: 2Gi

helm install \
--namespace tiledb-cloud \
--values values.yaml \
tiledb-cloud-mapproxy \
tiledb/mapproxy

helm repo update tiledb

helm upgrade --install \
--namespace tiledb-cloud \
--values values.yaml \
tiledb-cloud-mapproxy \
tiledb/mapproxy

helm repo update tiledb

helm upgrade --install \
--namespace tiledb-cloud \
--values values.yaml \
tiledb-cloud \
tiledb/tiledb-cloud-enterprise

#########################################
# TileDB Cloud Hosted Notebook Settings #
#########################################
jupyterhub:
  # REQUIRED: Set the private registry credentials, these are the same as the `imageCredentials` above
  imagePullSecret:
    password: ""

singleuser:
  # REQUIRED: Set the private registry credentials, these are the same as the `imageCredentials` above
  imagePullSecret:
    password: ""

auth:
    type: custom
    custom:
      className: 'oauthenticator.tiledb.TileDBCloud'
      config:
        # REQUIRED: Set the oauth2 secret, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex 32`
        client_secret: "Secret"
        # REQUIRED: Set the domain for the jupyterhub and the oauth2 service
        # it is likely you just need to replace `example.com` with your own internal domain
        # This should match the ingress settings above and the hydra settings below
        oauth_callback_url: "https://jupyterhub.tiledb.example.com/hub/oauth_callback"
        token_url: "https://oauth2.tiledb.example.com/oauth2/token"
        auth_url: "https://oauth2.tiledb.example.com/oauth2/auth"
        userdata_url: "https://oauth2.tiledb.example.com/userinfo"
    state:
      # REQUIRED: Set the jupyterhub auth secret for persistence, this should be a secure value
      # We recommend creating a random value with `openssl rand -hex 32`
      cryptoKey: "Secret"

tls:
    # REQUIRED: set the TLS information for hosted notebooks
      - hosts:
        - jupyterhub.tiledb.example.com
        secretName: jupyterhub-tls

    # optional TLS
    tls: []

hub:
  # REQUIRED: Set the private registry credentials, these are the same as the `imageCredentials` above
  imagePullSecret:
    password: ""
    
   
  config:
    CryptKeeper:
      # REQUIRED: Set the jupyterhub auth secret for persistence, this should be a secure value
      # We recommend creating a random value with `openssl rand -hex 32`
      keys:
        - "Secret"
    JupyterHub:
      authenticator_class: oauthenticator.tiledb.TileDBCloud    
    TileDBCloud:
      # REQUIRED: Set the oauth2 secret, this should be a secure value
      # We recommend creating a random value with `openssl rand -hex
      client_secret: "Secret"
      # REQUIRED: Set the domain for the jupyterhub and the oauth2 service
      # it is likely you just need to replace `example.com` with your own internal domain
      # This should match the ingress settings above and the hydra settings below
      oauth_callback_url: "http://jupyterhub.tiledb.example.com/hub/oauth_callback"
      token_url: "http://oauth2.tiledb.example.com/oauth2/token"
      auth_url: "http://oauth2.tiledb.example.com/oauth2/auth"
      userdata_url: "http://oauth2.tiledb.example.com/userinfo"

# tls:
  # allow_termination_from:
    # Set to cluster IP
    # - 172.20.0.0/12 
# serve:
  # tls:
    # allow_termination_from:
      # Set to cluster IP
      # - 172.20.0.0/12 

secrets:
  # REQUIRED: Set the oauth2 secret, this should be a secure value
  # We recommend creating a random value with `openssl rand -hex 32`
  system: secret
  cookie: secret
  system: 
    - "secret"
  cookie:
    - "Secret"

dsn: "mysql://tiledb_user:password@tcp(tiledb-cloud-mariadb.tiledb-cloud.svc.cluster.local:3306)/tiledb_rest"
dsn: "mysql://tiledb_user:password@tcp(tiledb-cloud-mariadb.tiledb-cloud.svc.cluster.local:3306)/tiledb_rest?parseTime=true"
      

# Configure ingress for oauth2 service
  ingress:
    public:
      annotations:
        # Configure any needed annotations. For instance if you are using a different ingress besides nginx set that here
        kubernetes.io/ingress.class: nginx
      hosts:
        # REQUIRED: set the ingress domain for oauth2 service
        - host: "oauth2.tiledb.example.com"
          paths: ["/"]
      tls:
        # REQUIRED: set the TLS information for oauth2 service
        - hosts:
            - "oauth2.tiledb.example.com"
          secretName: hydra-tls
          paths:
           - path: /
              pathType: ImplementationSpecific
      # optional TLS
      tls: []

jupyterhub:
  hub:
    config:
      JupyterHub:
        authenticator_class: oauthenticator.tiledb.Ti

tiledb-cloud-ui:
  config:
    isHttps: false

jupyterhub:
  singleuser:
    profileList:
    - display_name: "Basic Data Science"
      slug: "basic_data_science"
      description: "This image is based on the popular <a href='https://hub.docker.com/r/jupyter/tensorflow-notebook/' target='_blank'>jupyter/tensorflow-notebook</a> docker image with the TileDB libraries included. See the full list of <a href='https://docs.tiledb.com/cloud/concepts/tiledb-cloud-internals/jupyter-notebooks' target='_blank'>installed packages</a>."
      package_list_url: "https://docs.tiledb.com/cloud/concepts/tiledb-cloud-internals/jupyter-notebooks"
      kubespawner_override:
        image: tiledbenterprise/notebook-python-r-julia:3.1.0
      profile_options:
        server:
          display_name: 'Server profile'
          choices:
            small:
              display_name: 'Small server'
              description: Best for when you will be performing serverless operations or moderate analysis.
              kubespawner_override:
                mem_limit: "8G"
                mem_guarantee: "8G"
                memory_display: "8GB"
                cpu_limit: 2
                cpu_guarantee: 2
                environment:
                  JUPYTER_IMAGE_NAME: "basic_data_science"
                  JUPYTER_IMAGE_SIZE: "small"
            large:
              display_name: 'Large server'
              description: Best for when you need to perform large analysis in the notebook itself.
              kubespawner_override:
                mem_limit: "60G"
                mem_guarantee: "60G"
                memory_display: "60GB"
                cpu_limit: 16
                cpu_guarantee: 16
                environment:
                  JUPYTER_IMAGE_NAME: "basic_data_science"
                  JUPYTER_IMAGE_SIZE: "large"

    annotations:
      kubernetes.io/ingress.class: nginx

classname: nginx

 ingress:
    # Following lines have to be removed:
    # annotations:
    #   kubernetes.io/ingress.class: nginx
    paths:
      - /v1
      - /v2
    className: nginx

jupyterhub:
  singleuser:
    profileList:
    - display_name: "Basic Data Science"
      slug: "basic_data_science"
      description: "This image is based on the popular <a href='https://hub.docker.com/r/jupyter/tensorflow-notebook/' target='_blank'>jupyter/tensorflow-notebook</a> docker image with the TileDB libraries included. See the full list of <a href='https://docs.tiledb.com/cloud/concepts/tiledb-cloud-internals/jupyter-notebooks' target='_blank'>installed packages</a>."
      package_list_url: "https://docs.tiledb.com/cloud/concepts/tiledb-cloud-internals/jupyter-notebooks"
      kubespawner_override:
        image: tiledbenterprise/notebook-python-r-julia:3.10.1
      profile_options:
        server:
          display_name: 'Server profile'
          choices:
            small:
              display_name: 'Small server'
              description: Best for when you will be performing serverless operations or moderate analysis.
              kubespawner_override:
                mem_limit: "8G"
                mem_guarantee: "8G"
                memory_display: "8GB"
                cpu_limit: 2
                cpu_guarantee: 2
                environment:
                  JUPYTER_IMAGE_NAME: "basic_data_science"
                  JUPYTER_IMAGE_SIZE: "small"
            large:
              display_name: 'Large server'
              description: Best for when you need to perform large analysis in the notebook itself.
              kubespawner_override:
                mem_limit: "60G"
                mem_guarantee: "60G"
                memory_display: "60GB"
                cpu_limit: 16
                cpu_guarantee: 16
                environment:
                  JUPYTER_IMAGE_NAME: "basic_data_science"
                  JUPYTER_IMAGE_SIZE: "large"
            gpu_p2:
              display_name: 'Nvidia V100 GPU server'
              description: Best for when you need to perform ML or other CUDA enabled jobs in the notebook itself. A GPU instance might take an additional 5-10 minutes to launch.
              kubespawner_override:
                mem_limit: "60G"
                mem_guarantee: "56G"
                memory_display: "60GB"
                cpu_limit: 3.5
                cpu_guarantee: 3.5
                cpu_display: "4"
                extra_resource_limits:
                  nvidia.com/gpu: "1"
                environment:
                  JUPYTER_IMAGE_NAME: "basic_data_science"
                  JUPYTER_IMAGE_SIZE: "gpu_p2_large"

# This configuration contains the necessary values to enable Single Sign-On (SSO) for 
# Company integration with TileDB Cloud. By configuring these settings, the OpenID 
# Connect (OIDC) component of the TileDB Cloud Rest Server is activated, thereby 
# facilitating SSO both in the TileDB Cloud UI and the backend services. Customize 
# the SSO parameters by replacing the placeholder values listed below with your 
# specific SSO details. Pass these values alongside `values.yaml` to enable SSO
tiledb-cloud-rest:
  restConfig:
    SSO: 
      OIDC: []  # List of SSO OIDC configurations. Replace placeholders with SSO details.
      # Example configuration:
      # - Domain: <SSO_Domain>
      #   OIDCIssuer: <SSO_OIDC_Issuer_URL>
      #   OIDCClientID: <SSO_Client_ID>
      #   OIDCClientSecret: <SSO_Client_Secret>

tiledb-cloud-ui:
  config:
    EnableCompanySSO: true  # Enable SSO for the TileDB Cloud UI.

# TileDB Chart is for the TileDB Cloud service itself
helm repo add tiledb https://charts.tiledb.com --username <provided by TileDB>

kubectl create namespace tiledb-cloud

# Default values for tiledb-cloud-enterprise.
# This is a YAML-formatted file.

# Should hosted notebooks be enabled? If you would like to disable them set this to false
notebooks:
  enabled: true

# REQUIRED: Set the docker registry image credentials to pull TileDB Cloud docker images
# The password should be provided to you by your account representative
imageCredentials:
  password: ""

##################################
# TileDB Cloud REST API settings #
##################################
tiledb-cloud-rest:
  # Service Account to run deployment under
  # Change this if you have different RBAC requirements
  serviceAccountName: default

  # The autoscaling of the service can be adjusted if required
  # The following settings are the recommended defaults
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 300
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50
  
  # .spec.volumes
  #volumes:
  #  - name: test
  #    emptyDir: {}
  #  - name: nfs-volume
  #    nfs:
  #      server: nfs.example.com
  #      path: /nfs/

  # .spec.containers[*].volumeMounts
  # A volume with the same name declared here
  # must exist in volumes.
  #volumeMounts:
  #  - name: test
  #    mountPath: /test
  #    readOnly: true
  #  - name: nfs-volume
  #    mountPath: /nfs_data

  # key:value pairs defined below are configured
  # as ENV variables on all rest pod containers
  #extraEnvs:
  #  - KEY1: value1
  #  - KEY2: value2
  
  # Config ingress, be sure to set the url to where you want to expose the api
  ingress:
    url:
      # REQUIRED: Change this to the hostname you'd like the API service to be at
      - api.tiledb.example.com
    # optional TLS
    tls: []
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local

  resources:
    # REQUIRED:
    # Set the resource limits for the REST service.
    # We recommend a minimum of 8 cpus and 24 GB of ram on the worker nodes
    # We set REST to slightly below this to allow for other pods on the same worker node.
    # These setting effect the number of concurrent operations
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
    requests:
      # cpu: 16000m
      # memory: 16Gi
      cpu: 7000m
      memory: 17Gi
  resourcesDind:
    # Set the resources for the Docker-in-Docker pod, this is where the UDFs run
    # The resources here directly effect the number of concurrent UDFs that can be run
    requests:
      memory: 6Gi
  restConfig:
    # REQUIRED: Set the private dockerhub registry credentials, these are the same as the `imageCredentials` above
    ContainerRegistry:
      DockerhubPassword: ""
    
    # REQUIRED: Set the initial passwords for the internal users of Rest
    # Replace "secret" with a strong password
    # This config can be removed after the first run of Rest  
    ComputationUserInitialPassword: "secret"
    PrometheusUserInitialPassword: "secret"
    CronUserInitialPassword: "secret"
    UIUserInitialPassword: "secret"
    DebugUserInitialPassword: "secret"
    
    # REQUIRED: Set the signing secret(s) for api tokens, this should be a secure value
    # We recommend creating a random value with `openssl rand -hex 32`
    # This is a list of token signing secrets. Zero element of the list is used
    # for signing, the rest are used for validation.
    # This mechanism provides a way to rotate signing secrets.
    # In case there are active tokens signed with a key and this key is removed from
    # the list, the tokens are invalidated.
    TokenSigningSecrets:
      - "Secret"
    
    # REQUIRED: This is needed for the TileDB Jupyterlab Prompt User Options extension
    CorsAllowedOrigins:
      - "https://jupyterhub.tiledb.example.com"
    # REQUIRED: Define supported storage types and locations, if you want to use NFS
    # enable "local"
    StorageLocationsSupported:
      - "s3"
      #- "local"
      #- "hdfs"
      #- "azure"
      #- "gcs"
      
    ArraySettings:
      # When enabled, AWS credentials will be auto-discovered
      # from the Environment, config file, EC2 metadata etc.
      AllowS3NoCredentials: false
      # Change to false avoid any region checks for s3 compatible storage.
      CheckS3Region: true
      # A default location can be set so users creating new arays
      # do not need to know the full storage paths.
      # Example usage is with nfs mounted storage
      # DefaultLocation: "/nfs_data/tildb-cloud"
      # Set a whitelist allowed paths. This limits users to writing to specified mount path.
      # LocationWhitelist:
      # - "/nfs_data"
      
    Email:
      # Should users be required to confirm their email addresses
      # By default email confirmation is disabled as this requires a working SMTP setup
      DisableConfirmation: True
      # REQUIRED: The UI Server address is used for sending a link to the reset password email
      UIServerAddress: "https://console.tiledb.example.com"
      # Email Accounts
      Accounts:
        Noreply: "no-reply@example.com"
        Admin: "admin@example.com"
      # SMTP settings are used for sending emails, such as email confirmation,
      # password reset and notifications
      SMTP:
        Enabled: False
        Host: "smtp.example.local"
        Port: 587
        #Username: ""
        #Password: ""
        SSLVerify: True


    # REQUIRED: Configure main database. It is recommended to host a MariaDB or MySQL instance outside of the kubernetes cluster
    Databases:
      # `main` is a required database configuration
      main:
        Driver: mysql
        Host: "{{ .Release.Name }}-mariadb.{{ .Release.Namespace }}.svc.cluster.local"
        Port: 3306
        Schema: tiledb_rest
        Username: tiledb_user
        Password: password

    # Set log level, 1=Panic, 2=Fatal, 3=Error, 4=Warning, 5=Info, 6=Debug
    LogVerbosity: 4
    
    # Configure any default TileDB Open Source settings using key: value mapping
    # Example setting to override s3 endpoint
    # TileDBEmbedded:
    #    Config:
    #      "vfs.s3.endpoint_override": "s3.wasabisys.com"

    # LDAP settings. Enable and configure if you wish to allow LDAP for user account login
    # Ldap:
    #   Enable: false
    #   EnableTLS: false
    #   Hosts:
    #     - ldap.example.com
    #   Port: 389
    #   HostsTLS:
    #     - ldap.example.com
    #   PortTLS: 389
    #   BaseDN: DC=ldaplab,DC=local
    #   UserDN: CN=tiledb,CN=Users,DC=ldaplab,DC=local
    #   UserBaseDN:
    #     - dc=mylab,dc=local,OU=Employees
    #     - dc=mylab,dc=local,OU=Contractors
    #   # can be set via config or env variable (TILEDB_REST_LDAP_PASSWORD)
    #   # Setting via ENV is recommended.
    #   #PASSWORD: ""
    #   CommonNames:
    #     - Users
    #     - IT
    #     - Managers
    #   # OPENLDAP
    #   # Attributes:
    #   #   email: mail
    #   #   name: givenName
    #   #   username: uid
    #   Attributes:
    #     email: mail
    #     name: name
    #     username: userPrincipalName
    
    # Configure TLS settings. If you wish to use TLS inside k8s
    #Certificate:
      # Absolute path to certificate
      #CertFile: ""
      # Absolute path to private key
      #PrivateKey: ""
      # TLS Minimum Version options
      # 0x0301 #VersionTLS10
      # 0x0302 #VersionTLS11
      # 0x0303 #VersionTLS12
      # 0x0304 #VersionTLS13
      #MinVersion: 0x0304
      # TLS 1.0 - 1.2 cipher suites. Leaving empty will enable all
      #TLS10TLS12CipherSuites:
        # - 0x0005 #TLS_RSA_WITH_RC4_128_SHA
        # - 0x000a #TLS_RSA_WITH_3DES_EDE_CBC_SHA
        # - 0x002f #TLS_RSA_WITH_AES_128_CBC_SHA
        # - 0x0035 #TLS_RSA_WITH_AES_256_CBC_SHA
        # - 0x003c #TLS_RSA_WITH_AES_128_CBC_SHA256
        # - 0x009c #TLS_RSA_WITH_AES_128_GCM_SHA256
        # - 0x009d #TLS_RSA_WITH_AES_256_GCM_SHA384
        # - 0xc007 #TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
        # - 0xc009 #TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        # - 0xc00a #TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        # - 0xc011 #TLS_ECDHE_RSA_WITH_RC4_128_SHA
        # - 0xc012 #TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
        # - 0xc013 #TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        # - 0xc014 #TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        # - 0xc023 #TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
        # - 0xc027 #TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        # - 0xc02f #TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        # - 0xc02b #TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        # - 0xc030 #TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        # - 0xc02c #TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        # - 0xcca8 #TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        # - 0xcca9 #TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
      # TLS 1.3 cipher suites. Leaving empty will enable all
      #TLS13CipherSuites:
        # - 0x1301 #TLS_AES_128_GCM_SHA256
        # - 0x1302 #TLS_AES_256_GCM_SHA384
        # - 0x1303 #TLS_CHACHA20_POLY1305_SHA256
      #PreferServerCipherSuites: false
      # CurveID is the type of a TLS identifier for an elliptic curve
      # Leaving empty will enable all
      #CurveID:
        # - 23 #CurveP256 CurveID
        # - 24 #CurveP384 CurveID
        # - 25 #CurveP521 CurveID
        # - 29 #X25519
    # SSO:
      # Okta Service details.
      # The Okta domain is required.
      # If SCIM support is desired, provide a list of passwords accepted by the
      # Okta provider. At least one password is required.
      # Okta:
        # Domain: "domain-name.okta.com"
        # SCIMPasswords:
        #   - abcdef
        #   - ghijkl
        #   - mnopqr

  # It is not recommend to run the database inside k8s for production use, but it is helpful for testing
  mariadb:
    # Set to true if you wish to deploy a database inside k8s for testing
    enabled: false
    image:
      repository: bitnami/mariadb
      tag: 10.5.8
      pullPolicy: IfNotPresent
    auth:
      # Auth parameters much match with the restConfig.Databases.main above
      database: tiledb_rest
      username: tiledb_user
      password: password
      rootPassword: changeme
    primary:
      # Enable persistence if you wish to save the database, again running in k8s is not recommend for production use
      persistence:
        enabled: false
      # Set security context to user id of mysqld user in tiledb-mariadb-server
      podSecurityContext:
        enabled: true
        fsGroup: 999
      containerSecurityContext:
        enabled: true
        runAsUser: 999

####################################
# TileDB Cloud UI Console settings #
####################################
tiledb-cloud-ui:
  # Service Account to run deployment under
  # Change this if you have different RBAC requirements
  serviceAccountName: default

  # The autoscaling of the service can be adjusted if required
  # The following settings are the recommended defaults
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 300
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50

  # REQUIRED: set the url of the jupyterhub server
  config:
    # REQUIRED: Set a secret here with `openssl rand -hex 32`
    SessionKey: "secret"
    RestServer:
      # REQUIRED: This needs to be set to
      # the same value as restConfig.UIUserInitialPassword
      Password: "secret"
    JupyterhubURL: "https://jupyterhub.tiledb.example.com"
    # SSOOkta:
      # Domain: "domain-name.okta.com"
      # ClientID: "client_id"
      # ClientSecret: "secret"

  # REQUIRED: Config ingress, be sure to set the hostname to where you want to expose the UI
  ingress:
    enabled: true
    # REQUIRED: Set URL for web console
    url: 
      - console.tiledb.example.com
    # optional TLS
    tls: []

####################################
# TileDB Cloud Map Server settings #
####################################
tiledb-cloud-mapserver:
  enabled: false

  serviceAccountName: default

  resources:
    requests:
      cpu: 2000m
      memory: 4Gi

  autoscaling:
    enabled: true
    minReplicas: 1
    maxReplicas: 2
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50
    requestsPerSecond: 10k

  # config:
  #   Addr: "0.0.0.0"
  #   Port: 8030
  #   RestServer:
  #     Host: "api.tiledb.example.com"
  #     HostScheme: "http"
  #   Scheme: http

#########################################
# TileDB Cloud Hosted Notebook Settings #
#########################################
jupyterhub:
  # REQUIRED: Set the private registry credentials, these are the same as the `imageCredentials` above
  imagePullSecret:
    password: ""
  
  proxy:
    # REQUIRED: Set a signing secret here with `openssl rand -hex 32`
    secretToken: "Secret"
  # The pre-puller is used to to ensure the docker images for notebooks are prepulled to each node
  # This can improve notebook startup time, but add additional storage requirements to the nodes
  # If you wish to use dedicated k8s node groups for notebooks, see:
  # https://zero-to-jupyterhub.readthedocs.io/en/0.8.2/optimization.html?highlight=labels#using-a-dedicated-node-pool-for-users
  prePuller:
    hook:
      enabled: false
    continuous:
      # NOTE: if used with a Cluster Autoscaler, also add user-placeholders
      enabled: false

  scheduling:
    # You can enable at least one warm instance for users by enabling the userPlaceholder
    userPlaceholder:
      enabled: false
      replicas: 1
    # Disable podPriority, it is only useful if userPlaceholders are enabled
    podPriority:
      enabled: false

  singleuser:
    startTimeout: 900
    # Set the size of the user's persisted disk space in notebooks
    storage:
      capacity: 2G
     # JupyterHub expects the Kubernetes Storage Class to be configured
     # with "volumeBindingMode: Immediate" and "reclaimPolicy: Retain".
     # If your default Storage Class does not support this, you can
     # create a new one and configure it bellow.
     #dynamic:
     #  storageClass: "jupyterhub"

  hub:
    config:
      CryptKeeper:
        # REQUIRED: Set the jupyterhub auth secret for persistence, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex 32`
        keys:
          - "Secret"
      TileDBCloud:
        # REQUIRED: Set the oauth2 secret, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex
        client_secret: "Secret"
        # REQUIRED: Set the domain for the jupyterhub and the oauth2 service
        # it is likely you just need to replace `example.com` with your own internal domain
        # This should match the ingress settings above and the hydra settings below
        oauth_callback_url: "http://jupyterhub.tiledb.example.com/hub/oauth_callback"
        token_url: "http://oauth2.tiledb.example.com/oauth2/token"
        authorize_url: "http://oauth2.tiledb.example.com/oauth2/auth"
        userdata_url: "http://oauth2.tiledb.example.com/userinfo"
 
    # Uncomment for any extra settings
    # extraConfig:
    # Uncomment to disable SSL validation. Useful when testing deployments
    #  ssl_config: |
    #    c.Spawner.env_keep.append("TILEDB_REST_IGNORE_SSL_VALIDATION")
    # Uncomment to modify the securityContext of JupyterHub pods 
    #  securityContext: |
    #    c.Spawner.extra_container_config = {
    #        "securityContext": {
    #            "runAsGroup": 100,
    #            "runAsUser": 1000,
    #            "allowPrivilegeEscalation": False,
    #            "capabilities": {
    #                "drop": ["ALL"]
    #            }
    #        }
    #    }
      
    # REQUIRED: Set the domain for the REST API and the oauth2 service
    # it is likely you just need to replace `example.com` with your own internal domain
    # This should match the tiledb-cloud-rest settings above and the hydra settings below
    extraEnv:
      OAUTH2_AUTHORIZE_URL: "https://oauth2.tiledb.example.com/oauth2/auth"
      OAUTH2_USERDATA_URL: "https://oauth2.tiledb.example.com/userinfo"
      TILEDB_REST_HOST: "https://api.tiledb.example.com"
      # Uncomment to disable SSL validation. Useful when testing deployments
      # TILEDB_REST_IGNORE_SSL_VALIDATION: "true"

  ingress:
    enabled: true
    # REQUIRED: set the ingress domain for hosted notebooks
    hosts:
      - "jupyterhub.tiledb.example.com"
    # optional TLS
    tls: []

########################################
# TileDB Cloud Oauth2 Service Settings #
########################################
hydra:
  hydra:
    # REQUIRED: Set the domain for the jupyterhub
    # it is likely you just need to replace `example.com` with your own internal domain
    # This should match the ingress settings above and the hydra settings below
    dangerousAllowInsecureRedirectUrls:
      - http://jupyterhub.tiledb.example.com/hub/oauth_callback
    config:
      # Optionally set the internal k8s cluster IP address space to allow non-ssl connections from
      # This defaults to all private IP spaces
      # serve:
        # tls:
          # allow_termination_from:
            # Set to cluster IP
            # - 172.20.0.0/12 
      secrets:
        # REQUIRED: Set the oauth2 secret, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex 32`
        system: 
          - "secret"
        cookie:
          - "Secret"
      # REQUIRED: Set MariaDB Database connection, this defaults to the in k8s development settings. 
      # You will need to set this to the same connection parameters as the tiledb-cloud-rest section
      dsn: "mysql://tiledb_user:password@tcp(tiledb-cloud-mariadb.tiledb-cloud.svc.cluster.local:3306)/tiledb_rest?parseTime=true"
      urls:
        self:
          # REQUIRED: Update the domain for the oauth2 service and the web console ui
          # It is likely you can just replace `example.com` with your own internal domain
          issuer: "https://oauth2.tiledb.example.com/"
          public: "https://oauth2.tiledb.example.com/"
        login: "https://console.tiledb.example.com/oauth2/login"
        consent: "https://console.tiledb.example.com/oauth2/consent"

  # Configure ingress for oauth2 service
  ingress:
    public:
      hosts:
        # REQUIRED: set the ingress domain for oauth2 service
        - host: "oauth2.tiledb.example.com"
          paths:
           - path: /
             pathType: ImplementationSpecific
      # optional TLS
      tls: []

######################
# Ingress Controller #
######################
ingress-nginx:
  # This is provided for ease of testing, it is recommend to establish your own ingress which fits your environment
  enabled: false
  ## nginx configuration
  ## Ref: https://github.com/kubernetes/ingress/blob/master/controllers/nginx/configuration.md
  ##
  controller:
    name: controller
    autoscaling:
      enabled: true
      minReplicas: 2

    config:
      use-proxy-protocol: "true"
      log-format-escape-json: "true"
      log-format-upstream: '{ "time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", "x-forward-for": "$proxy_add_x_forwarded_for", "request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time, "method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent" }'
      # Set timeouts to 1 hour
      proxy-send-timeout: "3600"
      proxy-read-timeout: "3600"
      send-timeout: "3600"
      client-max-body-size: "3076m"
      proxy-body-size: "3076m"
      proxy-buffering: "off"
      proxy-request-buffering: "off"
      proxy-http-version: "1.1"

    ingressClass: nginx

    ## Allows customization of the external service
    ## the ingress will be bound to via DNS
    publishService:
      enabled: true

    service:
      annotations:
        # Enable public facing load balancer
        service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
        # Set any needed annotations. The default ones we have set are for aws ELB nginx
        service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'
        # Set aws-load-balancer-internal to allow all traffic from inside
        # the vpc only, the -internal makes it not accessible to the internet
        service.beta.kubernetes.io/aws-load-balancer: '0.0.0.0/0'
        # Set timeout to 1 hour
        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'

      ## Set external traffic policy to: "Local" to preserve source IP on
      ## providers supporting it
      ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
      externalTrafficPolicy: "Local"

      type: LoadBalancer

helm install \
--namespace tiledb-cloud \
--values values.yaml \
--wait \
--timeout 15m \
tiledb-cloud \
tiledb/tiledb-cloud-enterprise

python check_installation.py

{"claim1": "example", "other": "data"}

{"claim1": "example", "other": "data", "target": "template string with data"}

{"email": "{preferred_username}@mycompany.example"}

{"iss": "some_issuer", "sub": "some_sub", "preferred_username": "the-user"}

{
  "iss": "some_issuer",
  "sub": "some_sub",
  "preferred_username": "the-user",
  "email": "the-user@mycompany.example"
}

{"email": "{preferred_username}"}

# The tiledb-cloud-rest.restConfig.SSO.OIDC field contains server-side configuration
# to allow users to log in with SSO.
tiledb-cloud-rest:
  restConfig:
    SSO: 
      # The "OIDC" key is a list of OpenID Connect configurations,
      # one for each email domain.
      OIDC:
        - Domain: mycompany.example
          OIDCIssuer: https://sso.mycompany.example/oidc-issuer
          OIDCClientID: tiledb-client-id
          OIDCClientSecret: tiledb-client-secret
          ClaimMapping:
            {"email": "{preferred_username}@mycompany.example"}
          # If you have users logging in with more than one email domain,
          # you can use multiple OpenID Connect configurations.
          # They may use the same issuer or a different one, as needed.
        - Domain: subsidiary.example
          OIDCIssuer: https://sso.mycompany.example/subsidiary-login
          OIDCClientID: other-client-id
          OIDCClientSecret: other-client-secret
          # If the ClaimMapping entry is missing, the claims are not modified.
          

# Setting tiledb-cloud-ui.config.EnableCompanySSO shows the "Corporate SSO" button
# in the TileDB Cloud web login screen.
tiledb-cloud-ui:
  config:
    EnableCompanySSO: true