executor: KubernetesExecutor

dags:
  gitSync:
    enabled: true
    repo: git@github.com:idirbfs/dags.git
    branch: main
    rev: HEAD
    depth: 1
    maxFailures: 3
    subPath: ""
    sshKeySecret: airflow-gitsync-ssh
    period: 60s

ingress:
  apiServer:
    enabled: true
    ingressClassName: nginx
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
    hosts:
      - name: airflow.idir-belfares.fr
        tls:
          enabled: true
          secretName: airflow-tls
    path: "/"
    pathType: "Prefix"

apiServer:
  apiServerConfig: |
    from flask_appbuilder.security.manager import AUTH_OAUTH

    AUTH_TYPE = AUTH_OAUTH
    AUTH_USER_REGISTRATION = True
    AUTH_USER_REGISTRATION_ROLE = "Viewer"

    OAUTH_PROVIDERS = [
      {
        "name": "keycloak",
        "token_key": "access_token",
        "icon": "fa-key",
        "remote_app": {
          "client_id": "airflow",
          "client_secret": "AtBq4q8FcHe4tsVWfT0rrJ4RjKdzMnhG",
          "authorize_url": "https://keycloak.idir-belfares.fr/auth/realms/k8s-apps/protocol/openid-connect/auth",
          "access_token_url": "http://keycloak-keycloakx-http.keycloak.svc.cluster.local/auth/realms/k8s-apps/protocol/openid-connect/token",
          "jwks_uri": "http://keycloak-keycloakx-http.keycloak.svc.cluster.local/auth/realms/k8s-apps/protocol/openid-connect/certs",
          "client_kwargs": {
            "scope": "openid email profile",
            "token_endpoint_auth_method": "client_secret_post"
          }
        }
      }
    ]