# Example values for Keycloak authentication
# Copy and customize this file for your Keycloak setup
# 🔧 CUSTOMIZE THESE VALUES:
# 1. Replace your-keycloak-server.com with your Keycloak domain
# 2. Replace your-realm with your Keycloak realm name
# 3. Replace YOUR_KEYCLOAK_CLIENT_ID with your Keycloak client ID
# 4. Replace YOUR_KEYCLOAK_CLIENT_SECRET with your Keycloak client secret
# 5. Update your-k8s-domain.com with your ingress domain
# 6. Update Schema Registry URLs for your Kubernetes cluster
replicaCount: 2
image:
repository: aywengo/kafka-schema-reg-mcp
pullPolicy: Always
tag: "2.0.0"
# 🟥 Keycloak Authentication Configuration (OAuth 2.1 Generic)
auth:
enabled: true
oauth2:
issuerUrl: "https://your-keycloak-server.com/realms/your-realm"
audience: "YOUR_KEYCLOAK_CLIENT_ID"
validScopes: "read,write,admin"
defaultScopes: "read"
requiredScopes: "read"
clientRegistrationEnabled: true
revocationEnabled: true
createSecret:
enabled: true
clientId: "YOUR_KEYCLOAK_CLIENT_ID"
clientSecret: "YOUR_KEYCLOAK_CLIENT_SECRET"
# Schema Registry Configuration
schemaRegistry:
multiRegistry:
enabled: true
registries:
- name: "development"
url: "http://schema-registry-dev.kafka.svc.cluster.local:8081"
viewonly: false
- name: "staging"
url: "http://schema-registry-staging.kafka.svc.cluster.local:8081"
viewonly: false
- name: "production"
url: "http://schema-registry-prod.kafka.svc.cluster.local:8081"
viewonly: true
# Service configuration
service:
type: ClusterIP
port: 80
targetPort: 8080
# Ingress configuration
ingress:
enabled: true
className: "nginx"
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/cors-allow-origin: "*"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, OPTIONS"
nginx.ingress.kubernetes.io/cors-allow-headers: "Content-Type, Authorization"
hosts:
- host: mcp-schema-registry.your-k8s-domain.com
paths:
- path: /
pathType: Prefix
tls:
- secretName: mcp-schema-registry-tls
hosts:
- mcp-schema-registry.your-k8s-domain.com
# Resources
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 200m
memory: 512Mi
# Autoscaling
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 5
targetCPUUtilizationPercentage: 70
# App configuration
app:
viewonly: false
logLevel: "INFO"
port: 8080
# Security
podSecurityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: false
runAsNonRoot: true
runAsUser: 1000
# Network policies (allow Keycloak access)
networkPolicy:
enabled: true
ingress:
enabled: true
from:
- namespaceSelector:
matchLabels:
name: ingress-nginx
- namespaceSelector:
matchLabels:
name: kafka
- namespaceSelector:
matchLabels:
name: keycloak # Add Keycloak namespace
egress:
enabled: true
to:
- namespaceSelector:
matchLabels:
name: kafka
- namespaceSelector:
matchLabels:
name: keycloak # Allow access to Keycloak
# Pod disruption budget
podDisruptionBudget:
enabled: true
minAvailable: 1
# Extra environment variables for Keycloak integration
extraEnvVars:
- name: KEYCLOAK_SERVER_URL
value: "https://your-keycloak-server.com"
- name: KEYCLOAK_REALM
value: "your-realm"
