# Example values for Azure AD / Entra ID authentication
# Copy and customize this file for your Azure AD setup
# 🔧 CUSTOMIZE THESE VALUES:
# 1. Replace YOUR_TENANT_ID with your Azure AD tenant ID
# 2. Replace YOUR_AZURE_CLIENT_ID with your app registration client ID
# 3. Replace YOUR_AZURE_CLIENT_SECRET with your app registration secret
# 4. Update your-k8s-domain.com with your ingress domain
# 5. Update Schema Registry URLs for your Kubernetes cluster
replicaCount: 2
image:
repository: aywengo/kafka-schema-reg-mcp
pullPolicy: Always
tag: "2.0.0"
# 🟦 Azure AD Authentication Configuration (OAuth 2.1 Generic)
auth:
enabled: true
oauth2:
issuerUrl: "https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0"
audience: "YOUR_AZURE_CLIENT_ID"
validScopes: "read,write,admin"
defaultScopes: "read"
requiredScopes: "read"
clientRegistrationEnabled: true
revocationEnabled: true
createSecret:
enabled: true
clientId: "YOUR_AZURE_CLIENT_ID"
clientSecret: "YOUR_AZURE_CLIENT_SECRET"
# Schema Registry Configuration
schemaRegistry:
multiRegistry:
enabled: true
registries:
- name: "development"
url: "http://schema-registry-dev.kafka.svc.cluster.local:8081"
viewonly: false
user: ""
password: ""
- name: "staging"
url: "http://schema-registry-staging.kafka.svc.cluster.local:8081"
viewonly: false
user: ""
password: ""
- name: "production"
url: "http://schema-registry-prod.kafka.svc.cluster.local:8081"
viewonly: true
user: ""
password: ""
# Service configuration
service:
type: ClusterIP
port: 80
targetPort: 8080
# Ingress configuration
ingress:
enabled: true
className: "nginx"
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
nginx.ingress.kubernetes.io/cors-allow-origin: "*"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, OPTIONS"
nginx.ingress.kubernetes.io/cors-allow-headers: "Content-Type, Authorization"
hosts:
- host: mcp-schema-registry.your-k8s-domain.com
paths:
- path: /
pathType: Prefix
tls:
- secretName: mcp-schema-registry-tls
hosts:
- mcp-schema-registry.your-k8s-domain.com
# Resources
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 200m
memory: 512Mi
# Autoscaling
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 5
targetCPUUtilizationPercentage: 70
# App configuration
app:
viewonly: false
logLevel: "INFO"
port: 8080
# Security contexts
podSecurityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: false
runAsNonRoot: true
runAsUser: 1000
# Network policies
networkPolicy:
enabled: true
ingress:
enabled: true
from:
- namespaceSelector:
matchLabels:
name: ingress-nginx
- namespaceSelector:
matchLabels:
name: kafka
egress:
enabled: true
to:
- namespaceSelector:
matchLabels:
name: kafka
# Pod disruption budget
podDisruptionBudget:
enabled: true
minAvailable: 1
