# TileDB Chart is for the TileDB Cloud service itself
helm repo add tiledb https://charts.tiledb.com --username <provided by TileDB>

kubectl create namespace tiledb-cloud

# Default values for tiledb-cloud-enterprise.
# This is a YAML-formatted file.

# Should hosted notebooks be enabled? If you would like to disable them set this to false
notebooks:
  enabled: true

# REQUIRED: Set the docker registry image credentials to pull TileDB Cloud docker images
# The password should be provided to you by your account representative
imageCredentials:
  password: ""

##################################
# TileDB Cloud REST API settings #
##################################
tiledb-cloud-rest:
  # Service Account to run deployment under
  # Change this if you have different RBAC requirements
  serviceAccountName: default

  # The autoscaling of the service can be adjusted if required
  # The following settings are the recommended defaults
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 300
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50
  
  # .spec.volumes
  #volumes:
  #  - name: test
  #    emptyDir: {}
  #  - name: nfs-volume
  #    nfs:
  #      server: nfs.example.com
  #      path: /nfs/

  # .spec.containers[*].volumeMounts
  # A volume with the same name declared here
  # must exist in volumes.
  #volumeMounts:
  #  - name: test
  #    mountPath: /test
  #    readOnly: true
  #  - name: nfs-volume
  #    mountPath: /nfs_data

  # key:value pairs defined below are configured
  # as ENV variables on all rest pod containers
  #extraEnvs:
  #  - KEY1: value1
  #  - KEY2: value2
  
  # Config ingress, be sure to set the url to where you want to expose the api
  ingress:
    url:
      # REQUIRED: Change this to the hostname you'd like the API service to be at
      - api.tiledb.example.com
    # optional TLS
    tls: []
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local

  resources:
    # REQUIRED:
    # Set the resource limits for the REST service.
    # We recommend a minimum of 8 cpus and 24 GB of ram on the worker nodes
    # We set REST to slightly below this to allow for other pods on the same worker node.
    # These setting effect the number of concurrent operations
    # limits:
    #  cpu: 100m
    #  memory: 128Mi
    requests:
      # cpu: 16000m
      # memory: 16Gi
      cpu: 7000m
      memory: 17Gi
  resourcesDind:
    # Set the resources for the Docker-in-Docker pod, this is where the UDFs run
    # The resources here directly effect the number of concurrent UDFs that can be run
    requests:
      memory: 6Gi
  restConfig:
    # REQUIRED: Set the private dockerhub registry credentials, these are the same as the `imageCredentials` above
    ContainerRegistry:
      DockerhubPassword: ""
    
    # REQUIRED: Set the initial passwords for the internal users of Rest
    # Replace "secret" with a strong password
    # This config can be removed after the first run of Rest  
    ComputationUserInitialPassword: "secret"
    PrometheusUserInitialPassword: "secret"
    CronUserInitialPassword: "secret"
    UIUserInitialPassword: "secret"
    DebugUserInitialPassword: "secret"
    
    # REQUIRED: Set the signing secret(s) for api tokens, this should be a secure value
    # We recommend creating a random value with `openssl rand -hex 32`
    # This is a list of token signing secrets. Zero element of the list is used
    # for signing, the rest are used for validation.
    # This mechanism provides a way to rotate signing secrets.
    # In case there are active tokens signed with a key and this key is removed from
    # the list, the tokens are invalidated.
    TokenSigningSecrets:
      - "Secret"
    
    # REQUIRED: This is needed for the TileDB Jupyterlab Prompt User Options extension
    CorsAllowedOrigins:
      - "https://jupyterhub.tiledb.example.com"
    # REQUIRED: Define supported storage types and locations, if you want to use NFS
    # enable "local"
    StorageLocationsSupported:
      - "s3"
      #- "local"
      #- "hdfs"
      #- "azure"
      #- "gcs"
      
    ArraySettings:
      # When enabled, AWS credentials will be auto-discovered
      # from the Environment, config file, EC2 metadata etc.
      AllowS3NoCredentials: false
      # Change to false avoid any region checks for s3 compatible storage.
      CheckS3Region: true
      # A default location can be set so users creating new arays
      # do not need to know the full storage paths.
      # Example usage is with nfs mounted storage
      # DefaultLocation: "/nfs_data/tildb-cloud"
      # Set a whitelist allowed paths. This limits users to writing to specified mount path.
      # LocationWhitelist:
      # - "/nfs_data"
      
    Email:
      # Should users be required to confirm their email addresses
      # By default email confirmation is disabled as this requires a working SMTP setup
      DisableConfirmation: True
      # REQUIRED: The UI Server address is used for sending a link to the reset password email
      UIServerAddress: "https://console.tiledb.example.com"
      # Email Accounts
      Accounts:
        Noreply: "no-reply@example.com"
        Admin: "admin@example.com"
      # SMTP settings are used for sending emails, such as email confirmation,
      # password reset and notifications
      SMTP:
        Enabled: False
        Host: "smtp.example.local"
        Port: 587
        #Username: ""
        #Password: ""
        SSLVerify: True


    # REQUIRED: Configure main database. It is recommended to host a MariaDB or MySQL instance outside of the kubernetes cluster
    Databases:
      # `main` is a required database configuration
      main:
        Driver: mysql
        Host: "{{ .Release.Name }}-mariadb.{{ .Release.Namespace }}.svc.cluster.local"
        Port: 3306
        Schema: tiledb_rest
        Username: tiledb_user
        Password: password

    # Set log level, 1=Panic, 2=Fatal, 3=Error, 4=Warning, 5=Info, 6=Debug
    LogVerbosity: 4
    
    # Configure any default TileDB Open Source settings using key: value mapping
    # Example setting to override s3 endpoint
    # TileDBEmbedded:
    #    Config:
    #      "vfs.s3.endpoint_override": "s3.wasabisys.com"

    # LDAP settings. Enable and configure if you wish to allow LDAP for user account login
    # Ldap:
    #   Enable: false
    #   EnableTLS: false
    #   Hosts:
    #     - ldap.example.com
    #   Port: 389
    #   HostsTLS:
    #     - ldap.example.com
    #   PortTLS: 389
    #   BaseDN: DC=ldaplab,DC=local
    #   UserDN: CN=tiledb,CN=Users,DC=ldaplab,DC=local
    #   UserBaseDN:
    #     - dc=mylab,dc=local,OU=Employees
    #     - dc=mylab,dc=local,OU=Contractors
    #   # can be set via config or env variable (TILEDB_REST_LDAP_PASSWORD)
    #   # Setting via ENV is recommended.
    #   #PASSWORD: ""
    #   CommonNames:
    #     - Users
    #     - IT
    #     - Managers
    #   # OPENLDAP
    #   # Attributes:
    #   #   email: mail
    #   #   name: givenName
    #   #   username: uid
    #   Attributes:
    #     email: mail
    #     name: name
    #     username: userPrincipalName
    
    # Configure TLS settings. If you wish to use TLS inside k8s
    #Certificate:
      # Absolute path to certificate
      #CertFile: ""
      # Absolute path to private key
      #PrivateKey: ""
      # TLS Minimum Version options
      # 0x0301 #VersionTLS10
      # 0x0302 #VersionTLS11
      # 0x0303 #VersionTLS12
      # 0x0304 #VersionTLS13
      #MinVersion: 0x0304
      # TLS 1.0 - 1.2 cipher suites. Leaving empty will enable all
      #TLS10TLS12CipherSuites:
        # - 0x0005 #TLS_RSA_WITH_RC4_128_SHA
        # - 0x000a #TLS_RSA_WITH_3DES_EDE_CBC_SHA
        # - 0x002f #TLS_RSA_WITH_AES_128_CBC_SHA
        # - 0x0035 #TLS_RSA_WITH_AES_256_CBC_SHA
        # - 0x003c #TLS_RSA_WITH_AES_128_CBC_SHA256
        # - 0x009c #TLS_RSA_WITH_AES_128_GCM_SHA256
        # - 0x009d #TLS_RSA_WITH_AES_256_GCM_SHA384
        # - 0xc007 #TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
        # - 0xc009 #TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        # - 0xc00a #TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        # - 0xc011 #TLS_ECDHE_RSA_WITH_RC4_128_SHA
        # - 0xc012 #TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
        # - 0xc013 #TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        # - 0xc014 #TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        # - 0xc023 #TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
        # - 0xc027 #TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        # - 0xc02f #TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        # - 0xc02b #TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        # - 0xc030 #TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        # - 0xc02c #TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        # - 0xcca8 #TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        # - 0xcca9 #TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
      # TLS 1.3 cipher suites. Leaving empty will enable all
      #TLS13CipherSuites:
        # - 0x1301 #TLS_AES_128_GCM_SHA256
        # - 0x1302 #TLS_AES_256_GCM_SHA384
        # - 0x1303 #TLS_CHACHA20_POLY1305_SHA256
      #PreferServerCipherSuites: false
      # CurveID is the type of a TLS identifier for an elliptic curve
      # Leaving empty will enable all
      #CurveID:
        # - 23 #CurveP256 CurveID
        # - 24 #CurveP384 CurveID
        # - 25 #CurveP521 CurveID
        # - 29 #X25519
    # SSO:
      # Okta Service details.
      # The Okta domain is required.
      # If SCIM support is desired, provide a list of passwords accepted by the
      # Okta provider. At least one password is required.
      # Okta:
        # Domain: "domain-name.okta.com"
        # SCIMPasswords:
        #   - abcdef
        #   - ghijkl
        #   - mnopqr

  # It is not recommend to run the database inside k8s for production use, but it is helpful for testing
  mariadb:
    # Set to true if you wish to deploy a database inside k8s for testing
    enabled: false
    image:
      repository: bitnami/mariadb
      tag: 10.5.8
      pullPolicy: IfNotPresent
    auth:
      # Auth parameters much match with the restConfig.Databases.main above
      database: tiledb_rest
      username: tiledb_user
      password: password
      rootPassword: changeme
    primary:
      # Enable persistence if you wish to save the database, again running in k8s is not recommend for production use
      persistence:
        enabled: false
      # Set security context to user id of mysqld user in tiledb-mariadb-server
      podSecurityContext:
        enabled: true
        fsGroup: 999
      containerSecurityContext:
        enabled: true
        runAsUser: 999

####################################
# TileDB Cloud UI Console settings #
####################################
tiledb-cloud-ui:
  # Service Account to run deployment under
  # Change this if you have different RBAC requirements
  serviceAccountName: default

  # The autoscaling of the service can be adjusted if required
  # The following settings are the recommended defaults
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 300
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50

  # REQUIRED: set the url of the jupyterhub server
  config:
    # REQUIRED: Set a secret here with `openssl rand -hex 32`
    SessionKey: "secret"
    RestServer:
      # REQUIRED: This needs to be set to
      # the same value as restConfig.UIUserInitialPassword
      Password: "secret"
    JupyterhubURL: "https://jupyterhub.tiledb.example.com"
    # SSOOkta:
      # Domain: "domain-name.okta.com"
      # ClientID: "client_id"
      # ClientSecret: "secret"

  # REQUIRED: Config ingress, be sure to set the hostname to where you want to expose the UI
  ingress:
    enabled: true
    # REQUIRED: Set URL for web console
    url: 
      - console.tiledb.example.com
    # optional TLS
    tls: []

####################################
# TileDB Cloud Map Server settings #
####################################
tiledb-cloud-mapserver:
  enabled: false

  serviceAccountName: default

  resources:
    requests:
      cpu: 2000m
      memory: 4Gi

  autoscaling:
    enabled: true
    minReplicas: 1
    maxReplicas: 2
    targetCPUUtilizationPercentage: 80
    targetMemoryUtilizationPercentage: 50
    requestsPerSecond: 10k

  # config:
  #   Addr: "0.0.0.0"
  #   Port: 8030
  #   RestServer:
  #     Host: "api.tiledb.example.com"
  #     HostScheme: "http"
  #   Scheme: http

#########################################
# TileDB Cloud Hosted Notebook Settings #
#########################################
jupyterhub:
  # REQUIRED: Set the private registry credentials, these are the same as the `imageCredentials` above
  imagePullSecret:
    password: ""
  
  proxy:
    # REQUIRED: Set a signing secret here with `openssl rand -hex 32`
    secretToken: "Secret"
  # The pre-puller is used to to ensure the docker images for notebooks are prepulled to each node
  # This can improve notebook startup time, but add additional storage requirements to the nodes
  # If you wish to use dedicated k8s node groups for notebooks, see:
  # https://zero-to-jupyterhub.readthedocs.io/en/0.8.2/optimization.html?highlight=labels#using-a-dedicated-node-pool-for-users
  prePuller:
    hook:
      enabled: false
    continuous:
      # NOTE: if used with a Cluster Autoscaler, also add user-placeholders
      enabled: false

  scheduling:
    # You can enable at least one warm instance for users by enabling the userPlaceholder
    userPlaceholder:
      enabled: false
      replicas: 1
    # Disable podPriority, it is only useful if userPlaceholders are enabled
    podPriority:
      enabled: false

  singleuser:
    startTimeout: 900
    # Set the size of the user's persisted disk space in notebooks
    storage:
      capacity: 2G
     # JupyterHub expects the Kubernetes Storage Class to be configured
     # with "volumeBindingMode: Immediate" and "reclaimPolicy: Retain".
     # If your default Storage Class does not support this, you can
     # create a new one and configure it bellow.
     #dynamic:
     #  storageClass: "jupyterhub"

  hub:
    config:
      CryptKeeper:
        # REQUIRED: Set the jupyterhub auth secret for persistence, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex 32`
        keys:
          - "Secret"
      TileDBCloud:
        # REQUIRED: Set the oauth2 secret, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex
        client_secret: "Secret"
        # REQUIRED: Set the domain for the jupyterhub and the oauth2 service
        # it is likely you just need to replace `example.com` with your own internal domain
        # This should match the ingress settings above and the hydra settings below
        oauth_callback_url: "http://jupyterhub.tiledb.example.com/hub/oauth_callback"
        token_url: "http://oauth2.tiledb.example.com/oauth2/token"
        authorize_url: "http://oauth2.tiledb.example.com/oauth2/auth"
        userdata_url: "http://oauth2.tiledb.example.com/userinfo"
 
    # Uncomment for any extra settings
    # extraConfig:
    # Uncomment to disable SSL validation. Useful when testing deployments
    #  ssl_config: |
    #    c.Spawner.env_keep.append("TILEDB_REST_IGNORE_SSL_VALIDATION")
    # Uncomment to modify the securityContext of JupyterHub pods 
    #  securityContext: |
    #    c.Spawner.extra_container_config = {
    #        "securityContext": {
    #            "runAsGroup": 100,
    #            "runAsUser": 1000,
    #            "allowPrivilegeEscalation": False,
    #            "capabilities": {
    #                "drop": ["ALL"]
    #            }
    #        }
    #    }
      
    # REQUIRED: Set the domain for the REST API and the oauth2 service
    # it is likely you just need to replace `example.com` with your own internal domain
    # This should match the tiledb-cloud-rest settings above and the hydra settings below
    extraEnv:
      OAUTH2_AUTHORIZE_URL: "https://oauth2.tiledb.example.com/oauth2/auth"
      OAUTH2_USERDATA_URL: "https://oauth2.tiledb.example.com/userinfo"
      TILEDB_REST_HOST: "https://api.tiledb.example.com"
      # Uncomment to disable SSL validation. Useful when testing deployments
      # TILEDB_REST_IGNORE_SSL_VALIDATION: "true"

  ingress:
    enabled: true
    # REQUIRED: set the ingress domain for hosted notebooks
    hosts:
      - "jupyterhub.tiledb.example.com"
    # optional TLS
    tls: []

########################################
# TileDB Cloud Oauth2 Service Settings #
########################################
hydra:
  hydra:
    # REQUIRED: Set the domain for the jupyterhub
    # it is likely you just need to replace `example.com` with your own internal domain
    # This should match the ingress settings above and the hydra settings below
    dangerousAllowInsecureRedirectUrls:
      - http://jupyterhub.tiledb.example.com/hub/oauth_callback
    config:
      # Optionally set the internal k8s cluster IP address space to allow non-ssl connections from
      # This defaults to all private IP spaces
      # serve:
        # tls:
          # allow_termination_from:
            # Set to cluster IP
            # - 172.20.0.0/12 
      secrets:
        # REQUIRED: Set the oauth2 secret, this should be a secure value
        # We recommend creating a random value with `openssl rand -hex 32`
        system: 
          - "secret"
        cookie:
          - "Secret"
      # REQUIRED: Set MariaDB Database connection, this defaults to the in k8s development settings. 
      # You will need to set this to the same connection parameters as the tiledb-cloud-rest section
      dsn: "mysql://tiledb_user:password@tcp(tiledb-cloud-mariadb.tiledb-cloud.svc.cluster.local:3306)/tiledb_rest?parseTime=true"
      urls:
        self:
          # REQUIRED: Update the domain for the oauth2 service and the web console ui
          # It is likely you can just replace `example.com` with your own internal domain
          issuer: "https://oauth2.tiledb.example.com/"
          public: "https://oauth2.tiledb.example.com/"
        login: "https://console.tiledb.example.com/oauth2/login"
        consent: "https://console.tiledb.example.com/oauth2/consent"

  # Configure ingress for oauth2 service
  ingress:
    public:
      hosts:
        # REQUIRED: set the ingress domain for oauth2 service
        - host: "oauth2.tiledb.example.com"
          paths:
           - path: /
             pathType: ImplementationSpecific
      # optional TLS
      tls: []

######################
# Ingress Controller #
######################
ingress-nginx:
  # This is provided for ease of testing, it is recommend to establish your own ingress which fits your environment
  enabled: false
  ## nginx configuration
  ## Ref: https://github.com/kubernetes/ingress/blob/master/controllers/nginx/configuration.md
  ##
  controller:
    name: controller
    autoscaling:
      enabled: true
      minReplicas: 2

    config:
      use-proxy-protocol: "true"
      log-format-escape-json: "true"
      log-format-upstream: '{ "time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", "x-forward-for": "$proxy_add_x_forwarded_for", "request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time, "method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent" }'
      # Set timeouts to 1 hour
      proxy-send-timeout: "3600"
      proxy-read-timeout: "3600"
      send-timeout: "3600"
      client-max-body-size: "3076m"
      proxy-body-size: "3076m"
      proxy-buffering: "off"
      proxy-request-buffering: "off"
      proxy-http-version: "1.1"

    ingressClass: nginx

    ## Allows customization of the external service
    ## the ingress will be bound to via DNS
    publishService:
      enabled: true

    service:
      annotations:
        # Enable public facing load balancer
        service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
        # Set any needed annotations. The default ones we have set are for aws ELB nginx
        service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'
        # Set aws-load-balancer-internal to allow all traffic from inside
        # the vpc only, the -internal makes it not accessible to the internet
        service.beta.kubernetes.io/aws-load-balancer: '0.0.0.0/0'
        # Set timeout to 1 hour
        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'

      ## Set external traffic policy to: "Local" to preserve source IP on
      ## providers supporting it
      ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
      externalTrafficPolicy: "Local"

      type: LoadBalancer

helm install \
--namespace tiledb-cloud \
--values values.yaml \
--wait \
--timeout 15m \
tiledb-cloud \
tiledb/tiledb-cloud-enterprise

python check_installation.py