prole/archive/2026-04-cnpg-and-gitlab-cleanup/supabase-render-check/manifests/supabase-helm.yaml

---
# Source: knoe-supabase/templates/analytics/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-analytics
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/auth/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-auth
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/functions/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoe-supabase-knoe-supabase-functions
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/imgproxy/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoe-supabase-knoe-supabase-imgproxy
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/kong/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoe-supabase-knoe-supabase-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/meta/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-meta
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/realtime/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-realtime
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/rest/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-rest
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/storage/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoe-supabase-knoe-supabase-storage
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/studio/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: supabase-studio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/vector/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knoe-supabase-knoe-supabase-vector
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
---
# Source: knoe-supabase/templates/secrets/analytics.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-analytics
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  privateAccessToken: eW91ci1zdXBlci1zZWNyZXQtYW5kLWxvbmctbG9nZmxhcmUta2V5LXByaXZhdGU=
  publicAccessToken: eW91ci1zdXBlci1zZWNyZXQtYW5kLWxvbmctbG9nZmxhcmUta2V5LXB1YmxpYw==
---
# Source: knoe-supabase/templates/secrets/dashboard.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-dashboard
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  openAiApiKey: a2V5X3N1cGVyX3NlY3JldA==
  password: dGhpc19wYXNzd29yZF9pc19pbnNlY3VyZV9hbmRfc2hvdWxkX2JlX3VwZGF0ZWQ=
  username: c3VwYWJhc2U=
---
# Source: knoe-supabase/templates/secrets/db.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-db
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  database: cG9zdGdyZXM=
  password: ZnIzc3R5bDM=
  password_encoded: ZnIzc3R5bDM=
---
# Source: knoe-supabase/templates/secrets/jwt.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-jwt
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  anonKey: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaVlXNXZiaUlzSW1semN5STZJbkJ5YjJ4bExYTjFjR0ZpWVhObElpd2lhV0YwSWpveE56YzBPVFE1TkRreExDSmxlSEFpT2pJd09UQXpNRGswT1RGOS5KTDNRdFd6cmEtR3RhcWF4bXpYU2JNbnc1WTc4alpSWjNqVXVuNlVDNFFr
  secret: MWM3YjU5Y2MxMzM3YzY1YmMyZWRjMmU1OGQzZmZiZTU4NGI5ZjllZjY2MzA1NzA1ZmNhNjMzNjgyOTU0Zjk2NQ==
  serviceKey: ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaWMyVnlkbWxqWlY5eWIyeGxJaXdpYVhOeklqb2ljSEp2YkdVdGMzVndZV0poYzJVaUxDSnBZWFFpT2pFM056UTVORGswT1RFc0ltVjRjQ0k2TWpBNU1ETXdPVFE1TVgwLjFfeE1oQkMwVnNGWnhUSlYyQUR1RGphZjA0UkZUQlpjWDVhaGRUUWRWMWM=
---
# Source: knoe-supabase/templates/secrets/meta.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-meta
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  cryptoKey: eW91ci1lbmNyeXB0aW9uLWtleS0zMi1jaGFycy1taW4=
---
# Source: knoe-supabase/templates/secrets/minio.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-minio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  password: c2VjcmV0MTIzNA==
  user: c3VwYS1zdG9yYWdl
---
# Source: knoe-supabase/templates/secrets/realtime.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-realtime
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  secretKeyBase: VXBOVm50bjNjRHhISnBxOTlZTWMxVDFBUWdRcGM4a2ZZVHVSZ0JpWWExNUJMcng4ZXRRb1h6M2dadjEvdTJvcQ==
---
# Source: knoe-supabase/templates/secrets/s3.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-s3
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  accessKey: ZHVtbXktc2VjcmV0
  keyId: ZHVtbXkta2V5
---
# Source: knoe-supabase/templates/secrets/smtp.yaml
apiVersion: v1
kind: Secret
metadata:
  name: supabase-smtp
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
type: Opaque
data:
  password: ZmFrZV9tYWlsX3Bhc3N3b3Jk
  username: ZmFrZV9tYWlsX3VzZXI=
---
# Source: knoe-supabase/templates/functions/functions.config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-supabase-knoe-supabase-functions-main
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
data:
  index.ts: |
    import * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'

    console.log('main function started')

    const JWT_SECRET = Deno.env.get('JWT_SECRET')
    const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'

    function getAuthToken(req: Request) {
    const authHeader = req.headers.get('authorization')
    if (!authHeader) {
        throw new Error('Missing authorization header')
    }
    const [bearer, token] = authHeader.split(' ')
    if (bearer !== 'Bearer') {
        throw new Error(`Auth header is not 'Bearer {token}'`)
    }
    return token
    }

    async function verifyJWT(jwt: string): Promise<boolean> {
    const encoder = new TextEncoder()
    const secretKey = encoder.encode(JWT_SECRET)
    try {
        await jose.jwtVerify(jwt, secretKey)
    } catch (err) {
        console.error(err)
        return false
    }
    return true
    }

    Deno.serve(async (req: Request) => {
    if (req.method !== 'OPTIONS' && VERIFY_JWT) {
        try {
        const token = getAuthToken(req)
        const isValidJWT = await verifyJWT(token)

        if (!isValidJWT) {
            return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {
            status: 401,
            headers: { 'Content-Type': 'application/json' },
            })
        }
        } catch (e) {
        console.error(e)
        return new Response(JSON.stringify({ msg: e.toString() }), {
            status: 401,
            headers: { 'Content-Type': 'application/json' },
        })
        }
    }

    const url = new URL(req.url)
    const { pathname } = url
    const path_parts = pathname.split('/')
    const service_name = path_parts[1]

    if (!service_name || service_name === '') {
        const error = { msg: 'missing function name in request' }
        return new Response(JSON.stringify(error), {
        status: 400,
        headers: { 'Content-Type': 'application/json' },
        })
    }

    const servicePath = `/home/deno/functions/${service_name}`
    console.error(`serving the request with ${servicePath}`)

    const memoryLimitMb = 150
    const workerTimeoutMs = 1 * 60 * 1000
    const noModuleCache = false
    const importMapPath = null
    const envVarsObj = Deno.env.toObject()
    const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])

    try {
        const worker = await EdgeRuntime.userWorkers.create({
        servicePath,
        memoryLimitMb,
        workerTimeoutMs,
        noModuleCache,
        importMapPath,
        envVars,
        })
        return await worker.fetch(req)
    } catch (e) {
        const error = { msg: e.toString() }
        return new Response(JSON.stringify(error), {
        status: 500,
        headers: { 'Content-Type': 'application/json' },
        })
    }
    })    
---
# Source: knoe-supabase/templates/kong/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-supabase-knoe-supabase-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
data:
  wrapper.sh: |
    #!/bin/bash

    set -euo pipefail

    echo "Replacing env placeholders of /usr/local/kong/kong.yml"

    sed \
    -e "s|\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|" \
    -e "s|\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|" \
    -e "s|\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|" \
    -e "s|\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|" \
    /usr/local/kong/template.yml \
    > /usr/local/kong/kong.yml

    exec /docker-entrypoint.sh kong docker-start    
  template.yml: |
    _format_version: '2.1'
    _transform: true

    consumers:
      - username: DASHBOARD
      - username: anon
        keyauth_credentials:
            - key: ${SUPABASE_ANON_KEY}
      - username: service_role
        keyauth_credentials:
            - key: ${SUPABASE_SERVICE_KEY}
    acls:
      - consumer: anon
        group: anon
      - consumer: service_role
        group: admin
    basicauth_credentials:
      - consumer: DASHBOARD
        username: ${DASHBOARD_USERNAME}
        password: ${DASHBOARD_PASSWORD}
    services:
      - name: auth-v1-open
        url: http://supabase-auth:9999/verify
        routes:
          - name: auth-v1-open
            strip_path: true
            paths:
              - /auth/v1/verify
        plugins:
          - name: cors
      - name: auth-v1-open-callback
        url: http://supabase-auth:9999/callback
        routes:
          - name: auth-v1-open-callback
            strip_path: true
            paths:
              - /auth/v1/callback
        plugins:
          - name: cors
      - name: auth-v1-open-authorize
        url: http://supabase-auth:9999/authorize
        routes:
          - name: auth-v1-open-authorize
            strip_path: true
            paths:
              - /auth/v1/authorize
        plugins:
          - name: cors
      - name: auth-v1
        _comment: "GoTrue: /auth/v1/* -> http://supabase-auth:9999/*"
        url: http://supabase-auth:9999
        routes:
          - name: auth-v1-all
            strip_path: true
            paths:
              - /auth/v1/
        plugins:
          - name: cors
          - name: key-auth
            config:
              hide_credentials: false
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
                - anon
      - name: rest-v1
        _comment: "PostgREST: /rest/v1/* -> http://supabase-rest:3000/*"
        url: http://supabase-rest:3000/
        routes:
          - name: rest-v1-all
            strip_path: true
            paths:
              - /rest/v1/
        plugins:
          - name: cors
          - name: key-auth
            config:
              hide_credentials: true
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
                - anon
      - name: graphql-v1
        _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'
        url: http://supabase-rest:3000/rpc/graphql
        routes:
          - name: graphql-v1-all
            strip_path: true
            paths:
              - /graphql/v1
        plugins:
          - name: cors
          - name: key-auth
            config:
              hide_credentials: true
          - name: request-transformer
            config:
              add:
                headers:
                  - Content-Profile:graphql_public
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
                - anon
      - name: realtime-v1-ws
        _comment: "Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*"
        url: http://supabase-realtime:4000/socket
        protocol: ws
        routes:
          - name: realtime-v1-ws
            strip_path: true
            paths:
              - /realtime/v1/
        plugins:
          - name: cors
          - name: key-auth
            config:
              hide_credentials: false
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
                - anon
      - name: realtime-v1-rest
        _comment: 'Realtime: /realtime/v1/* -> http://supabase-realtime:4000/api/*'
        url: http://supabase-realtime:4000/api
        protocol: http
        routes:
          - name: realtime-v1-rest
            strip_path: true
            paths:
              - /realtime/v1/api
        plugins:
          - name: cors
          - name: key-auth
            config:
              hide_credentials: false
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
                - anon
      - name: storage-v1
        _comment: "Storage: /storage/v1/* -> http://knoe-supabase-knoe-supabase-storage:5000/*"
        url: http://knoe-supabase-knoe-supabase-storage:5000/
        routes:
          - name: storage-v1-all
            strip_path: true
            paths:
              - /storage/v1/
        plugins:
          - name: cors
      - name: functions-v1
        _comment: 'Edge Functions: /functions/v1/* -> http://knoe-supabase-knoe-supabase-functions:9000/*'
        url: http://knoe-supabase-knoe-supabase-functions:9000/
        routes:
          - name: functions-v1-all
            strip_path: true
            paths:
              - /functions/v1/
        plugins:
          - name: cors
    
    
    
    
      - name: meta
        _comment: "pg-meta: /pg/* -> http://supabase-meta:8080/*"
        url: http://supabase-meta:8080/
        routes:
          - name: meta-all
            strip_path: true
            paths:
              - /pg/
        plugins:
          - name: key-auth
            config:
              hide_credentials: false
          - name: acl
            config:
              hide_groups_header: true
              allow:
                - admin
      - name: dashboard
        _comment: 'Studio: /* -> http://supabase-studio:3000/*'
        url: http://supabase-studio:3000/
        routes:
          - name: dashboard-all
            strip_path: true
            paths:
              - /
        plugins:
          - name: cors
          - name: basic-auth
            config:
              hide_credentials: true    
---
# Source: knoe-supabase/templates/vector/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-supabase-knoe-supabase-vector-config
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
data:
  vector.yml: |
    api:
      enabled: true
      address: 0.0.0.0:9001

    sources:
      kubernetes_host:
        type: kubernetes_logs
        extra_label_selector: app.kubernetes.io/instance=knoe-supabase,app.kubernetes.io/name!=knoe-supabase-vector

    transforms:
      project_logs:
        type: remap
        inputs:
          - kubernetes_host
        source: |-
          .project = "default"
          .event_message = del(.message)
          .appname = del(.kubernetes.container_name)
          del(.file)
          del(.kubernetes)
          del(.source_type)
          del(.stream)
      router:
        type: route
        inputs:
          - project_logs
        route:
          kong: '.appname == "knoe-supabase-kong"'
          auth: '.appname == "knoe-supabase-auth"'
          rest: '.appname == "knoe-supabase-rest"'
          realtime: '.appname == "knoe-supabase-realtime"'
          storage: '.appname == "knoe-supabase-storage"'
          functions: '.appname == "knoe-supabase-functions"'
          db: '.appname == "knoe-supabase-db"'
      # Ignores non nginx errors since they are related with kong booting up
      kong_logs:
        type: remap
        inputs:
          - router.kong
        source: |-
          req, err = parse_nginx_log(.event_message, "combined")
          if err == null {
              .timestamp = req.timestamp
              .metadata.request.headers.referer = req.referer
              .metadata.request.headers.user_agent = req.agent
              .metadata.request.headers.cf_connecting_ip = req.client
              .metadata.response.status_code = req.status
              url, split_err = split(req.request, " ")
              if split_err == null {
                  .metadata.request.method = url[0]
                  .metadata.request.path = url[1]
                  .metadata.request.protocol = url[2]
              }
          }
          if err != null {
            abort
          }
      # Ignores non nginx errors since they are related with kong booting up
      kong_err:
        type: remap
        inputs:
          - router.kong
        source: |-
          .metadata.request.method = "GET"
          .metadata.response.status_code = 200
          parsed, err = parse_nginx_log(.event_message, "error")
          if err == null {
              .timestamp = parsed.timestamp
              .severity = parsed.severity
              .metadata.request.host = parsed.host
              .metadata.request.headers.cf_connecting_ip = parsed.client
              url, err = split(parsed.request, " ")
              if err == null {
                  .metadata.request.method = url[0]
                  .metadata.request.path = url[1]
                  .metadata.request.protocol = url[2]
              }
          }
          if err != null {
            abort
          }
      # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.
      auth_logs:
        type: remap
        inputs:
          - router.auth
        source: |-
          parsed, err = parse_json(.event_message)
          if err == null {
              .metadata.timestamp = parsed.time
              .metadata = merge!(.metadata, parsed)
          }
      # PostgREST logs are structured so we separate timestamp from message using regex
      rest_logs:
        type: remap
        inputs:
          - router.rest
        source: |-
          parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')
          if err == null {
              .event_message = parsed.msg
              .timestamp = parse_timestamp!(value: parsed.time,format: "%d/%b/%Y:%H:%M:%S %z")
              .metadata.host = .project
          }
      # Filter out healthcheck logs from Realtime
      realtime_logs_filtered:
        type: filter
        inputs:
          - router.realtime
        condition: '!contains(string!(.event_message), "/health")' 
      # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)
      realtime_logs:
        type: remap
        inputs:
          - realtime_logs_filtered
        source: |-
          .metadata.project = del(.project)
          .metadata.external_id = .metadata.project
          parsed, err = parse_regex(.event_message, r'^(?P<time>\d+:\d+:\d+\.\d+) \[(?P<level>\w+)\] (?P<msg>.*)$')
          if err == null {
              .event_message = parsed.msg
              .metadata.level = parsed.level
          }
      # Function logs are unstructured messages on stderr
      functions_logs:
        type: remap
        inputs:
          - router.functions
        source: |-
          .metadata.project_ref = del(.project)
      # Storage logs may contain json objects so we parse them for completeness
      storage_logs:
        type: remap
        inputs:
          - router.storage
        source: |-
          .metadata.project = del(.project)
          .metadata.tenantId = .metadata.project
          parsed, err = parse_json(.event_message)
          if err == null {
              .event_message = parsed.msg
              .metadata.level = parsed.level
              .metadata.timestamp = parsed.time
              .metadata.context[0].host = parsed.hostname
              .metadata.context[0].pid = parsed.pid
          }
      # Postgres logs some messages to stderr which we map to warning severity level
      db_logs:
        type: remap
        inputs:
          - router.db
        source: |-
          .metadata.host = "db-default"
          .metadata.parsed.timestamp = .timestamp
          
          parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)

          if err != null || parsed == null {
            .metadata.parsed.error_severity = "info"
          }
          if parsed.level != null {
          .metadata.parsed.error_severity = parsed.level
          }
          if .metadata.parsed.error_severity == "info" {
              .metadata.parsed.error_severity = "log"
          }
          .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
    sinks:
      logflare_auth:
        type: 'http'
        inputs:
          - auth_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=gotrue.logs.prod'
      logflare_realtime:
        type: 'http'
        inputs:
          - realtime_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=realtime.logs.prod'
      logflare_rest:
        type: 'http'
        inputs:
          - rest_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=postgREST.logs.prod'
      logflare_db:
        type: 'http'
        inputs:
          - db_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        # We must route the sink through kong because ingesting logs before logflare is fully initialised will
        # lead to broken queries from studio. This works by the assumption that containers are started in the
        # following order: vector > db > logflare > kong
        uri: 'http://supabase-analytics:4000/api/logs?source_name=postgres.logs'
      logflare_functions:
        type: 'http'
        inputs:
          - functions_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=deno-relay-logs'
      logflare_storage:
        type: 'http'
        inputs:
          - storage_logs
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=storage.logs.prod.2'
      logflare_kong:
        type: 'http'
        inputs:
          - kong_logs
          - kong_err
        encoding:
          codec: 'json'
        method: 'post'
        request:
          retry_max_duration_secs: 30
          headers:
            x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
        uri: 'http://supabase-analytics:4000/api/logs?source_name=cloudflare.logs.prod'    
---
# Source: knoe-supabase/templates/persistence.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: supabase-functions
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    synology.storage/pvc: "supabase-functions"
spec:
  storageClassName: synology-iscsi
  selector:
    matchLabels:
      synology.storage/pvc: "supabase-functions"
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "1Gi"
---
# Source: knoe-supabase/templates/persistence.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: supabase-imgproxy
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    synology.storage/pvc: "supabase-imgproxy"
spec:
  storageClassName: synology-iscsi
  selector:
    matchLabels:
      synology.storage/pvc: "supabase-imgproxy"
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "1Gi"
---
# Source: knoe-supabase/templates/persistence.yaml
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: supabase-snippets
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    synology.storage/pvc: "supabase-snippets"
spec:
  storageClassName: synology-iscsi
  selector:
    matchLabels:
      synology.storage/pvc: "supabase-snippets"
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "1Gi"
---
# Source: knoe-supabase/templates/persistence.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: supabase-storage
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    synology.storage/pvc: "supabase-storage"
spec:
  storageClassName: synology-iscsi
  selector:
    matchLabels:
      synology.storage/pvc: "supabase-storage"
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "1Gi"
---
# Source: knoe-supabase/templates/persistence.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: supabase-deno
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    synology.storage/pvc: "supabase-deno"
spec:
  storageClassName: synology-iscsi
  selector:
    matchLabels:
      synology.storage/pvc: "supabase-deno"
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "1Gi"
---
# Source: knoe-supabase/templates/vector/serviceaccount.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: supabase-reader
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "pods"]
    verbs: ["list", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    resourceNames:
      - supabase-*
    verbs: ["get"]
---
# Source: knoe-supabase/templates/vector/serviceaccount.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: supabase-view
subjects:
  - kind: ServiceAccount
    name: knoe-supabase-knoe-supabase-vector
    namespace: supabase
roleRef:
  kind: ClusterRole
  name: supabase-reader
  apiGroup: rbac.authorization.k8s.io
---
# Source: knoe-supabase/templates/analytics/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-analytics
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 4000
      targetPort: 4000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-analytics
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/auth/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-auth
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 9999
      targetPort: 9999
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-auth
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/db/external-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: db
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ExternalName
  externalName: "knoe-db-rw.knoe-db.svc.cluster.local"
  ports:
    - name: postgres
      port: 5432
      protocol: TCP
---
# Source: knoe-supabase/templates/functions/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: knoe-supabase-knoe-supabase-functions
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 9000
      targetPort: 9000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-functions
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/imgproxy/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: knoe-supabase-knoe-supabase-imgproxy
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 5001
      targetPort: 5001
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-imgproxy
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/kong/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: knoe-supabase-knoe-supabase-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 8000
      targetPort: 8000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-kong
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/meta/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-meta
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-meta
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/realtime/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-realtime
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 4000
      targetPort: 4000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-realtime
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/rest/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-rest
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 3000
      targetPort: 3000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-rest
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/storage/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: knoe-supabase-knoe-supabase-storage
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 5000
      targetPort: 5000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-storage
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/studio/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: supabase-studio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 3000
      targetPort: 3000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-studio
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/vector/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: knoe-supabase-knoe-supabase-vector
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 9001
      targetPort: 9001
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: knoe-supabase-vector
    app.kubernetes.io/instance: knoe-supabase
---
# Source: knoe-supabase/templates/analytics/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-analytics
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-analytics
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-analytics
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-analytics
      securityContext:
        null
      initContainers:
        - name: init-db
          image: postgres:15-alpine
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_HOST
              value: "db"
            - name: DB_USER
              value: $(DB_USERNAME)
            - name: DB_PORT
              value: "5432"
          command: ["/bin/sh", "-c"]
          args:
            - |
              until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do
              echo "Waiting for database to start..."
              sleep 2
              done              
            - echo "Database is ready"
      containers:
        - name: knoe-supabase-analytics
          securityContext:
            {}
          image: "supabase/logflare:1.31.2"
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_DATABASE
              value: "_supabase"
            - name: DB_DRIVER
              value: "postgresql"
            - name: DB_SCHEMA
              value: "_analytics"
            - name: DB_USERNAME
              value: "supabase_admin"
            - name: LOGFLARE_FEATURE_FLAG_OVERRIDE
              value: "multibackend=true"
            - name: LOGFLARE_NODE_HOST
              value: "127.0.0.1"
            - name: LOGFLARE_SINGLE_TENANT
              value: "true"
            - name: LOGFLARE_SUPABASE_MODE
              value: "true"
            - name: POSTGRES_BACKEND_SCHEMA
              value: "_analytics"
            - name: DB_HOSTNAME
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_PASSWORD_ENC
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password_encoded
            - name:  LOGFLARE_PUBLIC_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: publicAccessToken
            - name: LOGFLARE_PRIVATE_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: privateAccessToken
            - name: POSTGRES_BACKEND_URL
              value: $(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@$(DB_HOSTNAME):$(DB_PORT)/$(DB_DATABASE)
          ports:
            - containerPort: 4000
              protocol: TCP
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/auth/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-auth
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-auth
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-auth
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-auth
      securityContext:
        null
      initContainers:
        - name: init-db
          image: postgres:15-alpine
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
          command: ["/bin/sh", "-c"]
          args:
            - |
              until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do
              echo "Waiting for database to start..."
              sleep 2
              done              
            - echo "Database is ready"
      containers:
        - name: knoe-supabase-auth
          securityContext:
            {}
          image: "supabase/gotrue:v2.186.0"
          imagePullPolicy: IfNotPresent
          env:
            - name: API_EXTERNAL_URL
              value: "https://db.knoe.org"
            - name: DB_DRIVER
              value: "postgres"
            - name: DB_USER
              value: "supabase_auth_admin"
            - name: GOTRUE_API_HOST
              value: "0.0.0.0"
            - name: GOTRUE_API_PORT
              value: "9999"
            - name: GOTRUE_DISABLE_SIGNUP
              value: "false"
            - name: GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED
              value: "false"
            - name: GOTRUE_EXTERNAL_EMAIL_ENABLED
              value: "true"
            - name: GOTRUE_EXTERNAL_PHONE_ENABLED
              value: "false"
            - name: GOTRUE_JWT_ADMIN_ROLES
              value: "service_role"
            - name: GOTRUE_JWT_AUD
              value: "authenticated"
            - name: GOTRUE_JWT_DEFAULT_GROUP_NAME
              value: "authenticated"
            - name: GOTRUE_JWT_EXP
              value: "3600"
            - name: GOTRUE_MAILER_AUTOCONFIRM
              value: "true"
            - name: GOTRUE_MAILER_URLPATHS_CONFIRMATION
              value: "/auth/v1/verify"
            - name: GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE
              value: "/auth/v1/verify"
            - name: GOTRUE_MAILER_URLPATHS_INVITE
              value: "/auth/v1/verify"
            - name: GOTRUE_MAILER_URLPATHS_RECOVERY
              value: "/auth/v1/verify"
            - name: GOTRUE_SITE_URL
              value: "https://db.knoe.org"
            - name: GOTRUE_SMS_AUTOCONFIRM
              value: "false"
            - name: GOTRUE_SMTP_ADMIN_EMAIL
              value: "SMTP_ADMIN_MAIL"
            - name: GOTRUE_SMTP_HOST
              value: "SMTP_HOST"
            - name: GOTRUE_SMTP_PORT
              value: "123"
            - name: GOTRUE_SMTP_SENDER_NAME
              value: "SMTP_SENDER_NAME"
            - name: GOTRUE_URI_ALLOW_LIST
              value: "*"
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "disable"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_PASSWORD_ENC
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password_encoded
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: GOTRUE_DB_DATABASE_URL
              value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=auth&sslmode=disable
            - name: GOTRUE_DB_DRIVER
              value: $(DB_DRIVER)
            - name: GOTRUE_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: GOTRUE_SMTP_USER
              valueFrom:
                secretKeyRef:
                  name: supabase-smtp
                  key: username
            - name: GOTRUE_SMTP_PASS
              valueFrom:
                secretKeyRef:
                  name: supabase-smtp
                  key: password
          ports:
            - name: http
              containerPort: 9999
              protocol: TCP
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/functions/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-supabase-knoe-supabase-functions
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-functions
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-functions
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: knoe-supabase-knoe-supabase-functions
      securityContext:
        null
      containers:
        - args:
            - start
            - --main-service
            - /home/deno/functions/main
          name: knoe-supabase-functions
          securityContext:
            {}
          image: "supabase/edge-runtime:v1.70.3"
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_DRIVER
              value: "postgresql"
            - name: DB_USERNAME
              value: "postgres"
            - name: VERIFY_JWT
              value: "false"
            - name: SUPABASE_URL
              value: "http://knoe-supabase-knoe-supabase-kong:8000"

            - name: DB_HOSTNAME
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "disable"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_PASSWORD_ENC
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password_encoded
            - name: DB_DATABASE
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: SUPABASE_ANON_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: anonKey
            - name: SUPABASE_SERVICE_ROLE_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: serviceKey
            - name: SUPABASE_DB_URL
              value: $(DB_DRIVER)://$(DB_USERNAME):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=auth&sslmode=disable
          volumeMounts:
            - name: functions-storage
              mountPath: /home/deno/functions
            - name: deno-cache
              mountPath: /root/.cache/deno
            - mountPath: /home/deno/functions/main/index.ts
              name: functions-main
              subPath: index.ts
      volumes:
        - name: functions-storage
          persistentVolumeClaim:
            claimName: supabase-functions
        - name: deno-cache
          persistentVolumeClaim:
            claimName: supabase-deno
        - name: functions-main
          configMap:
            name: knoe-supabase-knoe-supabase-functions-main
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/imgproxy/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-supabase-knoe-supabase-imgproxy
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-imgproxy
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-imgproxy
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: knoe-supabase-knoe-supabase-imgproxy
      securityContext:
        null
      containers:
        - name: knoe-supabase-imgproxy
          securityContext:
            {}
          image: "darthsim/imgproxy:v3.30.1"
          imagePullPolicy: IfNotPresent
          env:
            - name: IMGPROXY_BIND
              value: ":5001"
            - name: IMGPROXY_ENABLE_WEBP_DETECTION
              value: "true"
            - name: IMGPROXY_LOCAL_FILESYSTEM_ROOT
              value: "/"
            - name: IMGPROXY_USE_ETAG
              value: "true"
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - mountPath: /var/lib/storage
              name: imgproxy-volume
      volumes:
        - name: imgproxy-volume
          persistentVolumeClaim:
            claimName: supabase-imgproxy
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/kong/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-supabase-knoe-supabase-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-kong
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-kong
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: knoe-supabase-knoe-supabase-kong
      securityContext:
        null
      containers:
        - name: knoe-supabase-kong
          securityContext:
            {}
          image: "kong:2.8.1"
          imagePullPolicy: IfNotPresent
          command: ["/bin/bash"]
          args: ["/scripts/wrapper.sh"]
          env:
            - name: KONG_DATABASE
              value: "off"
            - name: KONG_DECLARATIVE_CONFIG
              value: "/usr/local/kong/kong.yml"
            - name: KONG_DNS_ORDER
              value: "LAST,A,CNAME"
            - name: KONG_LOG_LEVEL
              value: "warn"
            - name: KONG_NGINX_PROXY_PROXY_BUFFERS
              value: "64 160k"
            - name: KONG_NGINX_PROXY_PROXY_BUFFER_SIZE
              value: "160k"
            - name: KONG_PLUGINS
              value: "request-transformer,cors,key-auth,acl,basic-auth"
            - name: SUPABASE_ANON_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: anonKey
            - name: SUPABASE_SERVICE_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: serviceKey
            - name: DASHBOARD_USERNAME
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: username
            - name: DASHBOARD_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: password
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          volumeMounts:
            - mountPath: /usr/local/kong/template.yml
              name: config
              subPath: template.yml
            - mountPath: /scripts
              name: wrapper
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
      volumes:
        - name: config
          configMap:
            name: knoe-supabase-knoe-supabase-kong
            defaultMode: 0777
            items:
            - key: template.yml
              path: template.yml
        - name: wrapper
          configMap:
            name: knoe-supabase-knoe-supabase-kong
            defaultMode: 0777
            items:
            - key: wrapper.sh
              path: wrapper.sh
---
# Source: knoe-supabase/templates/meta/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-meta
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-meta
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-meta
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-meta
      securityContext:
        null
      containers:
        - name: knoe-supabase-meta
          securityContext:
            {}
          image: "supabase/postgres-meta:v0.95.2"
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_DRIVER
              value: "postgres"
            - name: DB_USER
              value: "supabase_admin"
            - name: PG_META_PORT
              value: "8080"
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "disable"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: PG_META_DB_HOST
              value: "db"
            - name: PG_META_DB_PORT
              value: "5432"
            - name: PG_META_DB_NAME
              value: "postgres"
            - name: PG_META_DB_USER
              value: $(DB_USER)
            - name: PG_META_DB_PASSWORD
              value: $(DB_PASSWORD)
            - name: PG_META_DB_SSL_MODE
              value: "disable"
            - name: CRYPTO_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-meta
                  key: cryptoKey
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/realtime/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-realtime
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-realtime
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-realtime
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-realtime
      securityContext:
        null
      initContainers:
        - name: init-db
          image: postgres:15-alpine
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
          command: ["/bin/sh", "-c"]
          args:
            - |
              until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do
              echo "Waiting for database to start..."
              sleep 2
              done              
            - echo "Database is ready"
      containers:
        - name: knoe-supabase-realtime
          securityContext:
            {}
          image: "supabase/realtime:v2.76.5"
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh"]
          args: ["-c", "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"]
          env:
            - name: APP_NAME
              value: "realtime"
            - name: DB_AFTER_CONNECT_QUERY
              value: "SET search_path TO _realtime"
            - name: DB_ENC_KEY
              value: "supabaserealtime"
            - name: DB_USER
              value: "supabase_admin"
            - name: DNS_NODES
              value: "''"
            - name: ENABLE_TAILSCALE
              value: "false"
            - name: ERL_AFLAGS
              value: "-proto_dist inet_tcp"
            - name: FLY_ALLOC_ID
              value: "fly123"
            - name: FLY_APP_NAME
              value: "realtime"
            - name: PORT
              value: "4000"
            - name: RLIMIT_NOFILE
              value: "10000"
            - name: RUN_JANITOR
              value: "true"
            - name: SEED_SELF_HOST
              value: "true"
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "false"
            - name: SELF_HOST_TENANT_NAME
              value: supabase-realtime
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: API_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret

            - name: SECRET_KEY_BASE
              valueFrom:
                secretKeyRef:
                  name: supabase-realtime
                  key: secretKeyBase
          ports:
            - name: http
              containerPort: 4000
              protocol: TCP
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/rest/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-rest
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-rest
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-rest
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-rest
      securityContext:
        null
      initContainers:
        - name: init-db
          image: postgres:15-alpine
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
          command: ["/bin/sh", "-c"]
          args:
            - |
              until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do
              echo "Waiting for database to start..."
              sleep 2
              done              
            - echo "Database is ready"
      containers:
        - name: knoe-supabase-rest
          securityContext:
            {}
          image: "postgrest/postgrest:v14.5"
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_DRIVER
              value: "postgres"
            - name: DB_USER
              value: "authenticator"
            - name: PGRST_APP_SETTINGS_JWT_EXP
              value: "3600"
            - name: PGRST_DB_ANON_ROLE
              value: "anon"
            - name: PGRST_DB_SCHEMAS
              value: "public,storage,graphql_public"
            - name: PGRST_DB_USE_LEGACY_GUCS
              value: "false"
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "disable"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_PASSWORD_ENC
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password_encoded
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: PGRST_DB_URI
              value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?sslmode=disable
            - name: PGRST_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: PGRST_APP_SETTINGS_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
          ports:
            - name: http
              containerPort: 3000
              protocol: TCP
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/storage/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-supabase-knoe-supabase-storage
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-storage
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-storage
        app.kubernetes.io/instance: knoe-supabase
    spec:
      restartPolicy: Always
      serviceAccountName: knoe-supabase-knoe-supabase-storage
      securityContext:
        null
      initContainers:
        - name: init-db
          image: postgres:15-alpine
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
          command: ["/bin/sh", "-c"]
          args:
            - |
              until pg_isready -h $(DB_HOST) -p $(DB_PORT) -U postgres; do
              echo "Waiting for database to start..."
              sleep 2
              done              
            - echo "Database is ready"
      containers:
        - name: knoe-supabase-storage
          securityContext:
            {}
          image: "supabase/storage-api:v1.37.8"
          imagePullPolicy: IfNotPresent
          env:
            - name: DB_DRIVER
              value: "postgres"
            - name: DB_USER
              value: "supabase_storage_admin"
            - name: ENABLE_IMAGE_TRANSFORMATION
              value: "true"
            - name: FILE_SIZE_LIMIT
              value: "52428800"
            - name: GLOBAL_S3_BUCKET
              value: "supabase-storage"
            - name: GLOBAL_S3_ENDPOINT
              value: "http://garage.knoe-system.svc.cluster.local:3900"
            - name: GLOBAL_S3_FORCE_PATH_STYLE
              value: "true"
            - name: GLOBAL_S3_PROTOCOL
              value: "http"
            - name: REGION
              value: "garage"
            - name: REQUEST_ALLOW_X_FORWARDED_PATH
              value: "true"
            - name: STORAGE_BACKEND
              value: "s3"
            - name: TENANT_ID
              value: "stub"
            - name: DB_HOST
              value: "db"
            - name: DB_PORT
              value: "5432"
            - name: DB_SSL
              value: "disable"
            - name: POSTGREST_URL
              value: "http://supabase-rest:3000"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password
            - name: DB_PASSWORD_ENC
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password_encoded
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database
            - name: DATABASE_URL
              value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD_ENC)@db:5432/postgres?search_path=storage,public&sslmode=disable
            - name: PGRST_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: ANON_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: anonKey
            - name: SERVICE_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: serviceKey
            - name: S3_PROTOCOL_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: supabase-s3
                  key: keyId
            - name: S3_PROTOCOL_ACCESS_KEY_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-s3
                  key: accessKey
            - name: IMGPROXY_URL
              value: "http://knoe-supabase-knoe-supabase-imgproxy:5001"
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: supabase-s3
                  key: keyId
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-s3
                  key: accessKey
          ports:
            - name: http
              containerPort: 5000
              protocol: TCP
          volumeMounts:
            - mountPath: /var/lib/storage
              name: storage-data
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
      volumes:
        - name: storage-data
          persistentVolumeClaim:
            claimName: supabase-storage
---
# Source: knoe-supabase/templates/studio/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: supabase-studio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-studio
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      labels:
        app.kubernetes.io/name: knoe-supabase-studio
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: supabase-studio
      securityContext:
        null
      containers:
        - name: knoe-supabase-studio
          securityContext:
            {}
          image: "supabase/studio:2026.02.16-sha-26c615c"
          imagePullPolicy: IfNotPresent
          env:
            - name: DEFAULT_ORGANIZATION_NAME
              value: "Default Organization"
            - name: DEFAULT_PROJECT_NAME
              value: "Default Project"
            - name: HOSTNAME
              value: "::"
            - name: NEXT_ANALYTICS_BACKEND_PROVIDER
              value: "postgres"
            - name: NEXT_PUBLIC_ENABLE_LOGS
              value: "true"
            - name: STUDIO_PORT
              value: "3000"
            - name: SUPABASE_PUBLIC_URL
              value: "https://db.knoe.org"
            - name: SUPABASE_URL
              value: "http://knoe-supabase-knoe-supabase-kong:8000"
            - name: STUDIO_PG_META_URL
              value: "http://supabase-meta:8080"

            - name: POSTGRES_HOST
              value: "db"
            - name: POSTGRES_PORT
              value: "5432"

            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: database

            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-db
                  key: password

            - name: PG_META_CRYPTO_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-meta
                  key: cryptoKey


            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: openAiApiKey

            - name: SUPABASE_ANON_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: anonKey

            - name: SUPABASE_SERVICE_KEY
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: serviceKey

            - name: AUTH_JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: supabase-jwt
                  key: secret
            - name: LOGFLARE_URL
              value: "http://supabase-analytics:4000"
            - name:  LOGFLARE_PUBLIC_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: publicAccessToken
            - name: LOGFLARE_PRIVATE_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: privateAccessToken
            - name: EDGE_FUNCTIONS_MANAGEMENT_FOLDER
              value: /home/deno/functions
            - name: SNIPPETS_MANAGEMENT_FOLDER
              value: /app/snippets
          ports:
            - name: http
              containerPort: 3000
              protocol: TCP
          volumeMounts:
            - name: functions-storage
              mountPath: /home/deno/functions
            - name: snippets-storage
              mountPath: /app/snippets
      volumes:
        - name: functions-storage
          persistentVolumeClaim:
            claimName: supabase-functions
        - name: snippets-storage
          persistentVolumeClaim:
            claimName: supabase-snippets
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/vector/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: knoe-supabase-knoe-supabase-vector
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
    vector.dev/exclude: "true"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: knoe-supabase-vector
      app.kubernetes.io/instance: knoe-supabase
  template:
    metadata:
      annotations:
        checksum/config: 9d7838a09b41cdcff2d2026f14697ae515b282dd4571fee1a0d902876df712ca
      labels:
        app.kubernetes.io/name: knoe-supabase-vector
        app.kubernetes.io/instance: knoe-supabase
    spec:
      serviceAccountName: knoe-supabase-knoe-supabase-vector
      securityContext:
        null
      containers:
        - args:
            - --config
            - /etc/vector/vector.yml
          name: knoe-supabase-vector
          securityContext:
            {}
          image: "timberio/vector:0.53.0-alpine"
          imagePullPolicy: IfNotPresent
          env:
            - name: VECTOR_SELF_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name:  LOGFLARE_PUBLIC_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: supabase-analytics
                  key: publicAccessToken
          ports:
            - containerPort: 9001
              protocol: TCP
          volumeMounts:
            - mountPath: /etc/vector/vector.yml
              name: vector-config
              subPath: vector.yml
            - name: varlog
              mountPath: /var/log
              readOnly: true
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
      volumes:
        - name: vector-config
          configMap:
            name:  knoe-supabase-knoe-supabase-vector-config
            defaultMode: 0777
        - name: varlog
          hostPath:
            path: /var/log
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
      nodeSelector:
        kubernetes.io/hostname: gandalf.knoe.org
        knoe.org/node-role: general
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: knoe.org/node-role
                    operator: In
                    values:
                      - general
---
# Source: knoe-supabase/templates/kong/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: knoe-supabase-knoe-supabase-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: traefik
  rules:
    - host: "db.knoe.org"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: knoe-supabase-knoe-supabase-kong
                port:
                  number: 8000
---
# Source: knoe-supabase/templates/studio/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: supabase-studio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: traefik
  rules:
    - host: "db.knoe.org"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: supabase-studio
                port:
                  number: 3000
---
# Source: knoe-supabase/templates/test/analytics.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-analytics
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-analytics
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-analytics:4000/health
              echo "Sevice supabase-analytics is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/auth.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-auth
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-auth
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-auth:9999/health
              echo "Sevice supabase-auth is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/imgproxy.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-imgproxy
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-imgproxy
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://knoe-supabase-knoe-supabase-imgproxy:5001/health
              echo "Sevice knoe-supabase-knoe-supabase-imgproxy is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/kong.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-kong
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - env:
            - name: DASHBOARD_USERNAME
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: username
            - name: DASHBOARD_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: supabase-dashboard
                  key: password
          name: test-kong
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              echo "Attempting to access dashboard with provided credentials..."
              curl -sL --fail \
                -o /dev/null \
                "http://${DASHBOARD_USERNAME}:${DASHBOARD_PASSWORD}@knoe-supabase-knoe-supabase-kong:8000" \
                || ( echo -e "\e[0;31mFailed to get a valid response." && exit 1 )
              echo "Successfully connected."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/meta.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-meta
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-meta
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-meta:8080/health
              echo "Sevice supabase-meta is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/realtime.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-realtime
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-realtime
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-realtime:4000
              echo "Sevice supabase-realtime is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/rest.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-rest
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-rest
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-rest:3000
              echo "Sevice supabase-rest is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/storage.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-storage
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-storage
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://knoe-supabase-knoe-supabase-storage:5000/status
              echo "Sevice knoe-supabase-knoe-supabase-storage is healthy."              
      restartPolicy: Never
---
# Source: knoe-supabase/templates/test/studio.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: supabase-test-studio
  labels:
    helm.sh/chart: knoe-supabase-0.5.0-knoe.1
    app.kubernetes.io/name: supabase
    app.kubernetes.io/instance: knoe-supabase
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
spec:
  ttlSecondsAfterFinished: 100
  template:
    spec:
      containers:
        - name: test-studio
          image: kdevup/curljq
          imagePullPolicy: IfNotPresent
          command:
            - /bin/bash
            - -c
            - |
              curl -sfo /dev/null \
                http://supabase-studio:3000/api/profile
              echo "Sevice supabase-studio is healthy."              
      restartPolicy: Never