Configuration Guide

AetherLake is primarily configured via Helm values across the two charts (security-stack, core-data-stack).

For the full setting reference of each component — every value, default and gotcha — see the per-component pages under Component Reference in the sidebar. This page covers the cross-cutting configuration.

Component Toggles

Each core-data-stack component can be enabled or disabled in values.yaml:

minio:
  enabled: true

trino:
  enabled: true
  server:
    workers: 2      # Scale Trino workers

polaris:
  enabled: true

kafka:
  enabled: true
  external:
    enabled: true   # TLS + SCRAM-SHA-512 listener for clients outside the cluster

flink:
  enabled: true

spark-operator:
  enabled: true

airflow:
  enabled: true

superset:
  enabled: true

milvus:
  enabled: true

sso:
  enabled: true     # oauth2-proxy SSO gate for the Trino UI and Milvus Attu

Keycloak is toggled in the security-stack chart (keycloak.enabled).

Kafka + Trino coupling

Disabling kafka while keeping the Trino kafka catalog configured leaves the catalog pointing at a missing bootstrap service. Toggle the two together, or drop trino.additionalCatalogs.kafka when Kafka is off.

Security & Secrets Management

All credentials are managed through Kubernetes Secrets (aetherlake-credentials and its identical twin open-lake-credentials), referenced by all components:

global:
  existingSecret: "aetherlake-credentials"

Every value is randomly generated by install.sh per install. Re-running the installer keeps existing values and only backfills keys added by newer releases, so credentials never drift between upgrades.

Frequently needed keys:

Key	What it is
realm-admin-password	Keycloak SSO login for the bootstrap admin user (change forced on first login)
keycloak-admin-password	Keycloak admin console
superset-admin-password	Superset bootstrap admin
oauth2-proxy-oidc-secret / oauth2-proxy-cookie-secret	The SSO gate in front of the Trino UI and Milvus Attu
trino-panel-svc-password	Trino control-panel-svc user (Control Panel server-side admin queries)
trino-superset-password	Trino superset user (Superset datasource)
trino-mcp-password	Trino mcp user (MCP server, read-only)
trino-dev-admin-password / trino-dev-user-password	Trino dev users for the Control Panel's local credentials login
trino-internal-shared-secret	Trino coordinator↔worker shared secret (required once authentication is on)
trino-keystore-password	Password of the PKCS12 keystore cert-manager renders into trino-tls (Trino HTTPS listener)
polaris-client-id / polaris-client-secret / polaris-credential	Polaris bootstrap credential (id:secret combined form for Trino)
minio-root-user / minio-root-password	MinIO root account
<client>-oidc-secret	Per-service Keycloak client secrets (trino, airflow, minio, superset, control-panel…)

The Control Panel can dynamically provision and rotate secrets via the Kubernetes API.

IMPORTANT

DO NOT USE DEFAULT SECRETS IN PRODUCTION. Before exposing your AetherLake cluster to a public or production environment, you MUST:

1. Change all default passwords in your secrets.yaml and values.yaml files.
2. Ensure NEXTAUTH_SECRET is set securely.
3. Use proper TLS certificates on the Ingress Controller.