Orbtrace {{ .Chart.AppVersion }} installed in namespace {{ .Release.Namespace }}.

Topology:
  * orbtrace pods               : {{ .Values.orbtrace.replicaCount }} (HPA: {{ .Values.orbtrace.autoscaling.enabled }})
  * Doris profile               : {{ .Values.doris.profile.activeProfile }} (cold tier S3: {{ .Values.doris.s3.enabled }})
  * Doris FE                    : {{ .Values.doris.fe.replicaCount }} (Raft quorum)
  * Doris BE                    : {{ .Values.doris.be.replicaCount }} (replication={{ .Values.doris.profile.replicationNum | default "profile default" }})
{{- if .Values.doris.allowSingleReplica }}

  ⚠ SINGLE-REPLICA MODE (doris.allowSingleReplica=true): tables are created at
    RF=1. Loss of a single Doris BE is PERMANENT, UNRECOVERABLE data loss. This
    is supported only for single-node / PoC clusters — run >=2 BE with
    doris.profile.replicationNum>=2 for any production or data-durability need.
{{- end }}
  * OTel Collector              : NOT deployed by this chart — bring your own (Pattern A or B, see docs/integration-patterns.md)
{{- if eq .Values.postgres.mode "bundled" }}
  * Postgres                    : in-cluster ({{ .Values.postgres.image.tag }})
{{- end }}
{{- if eq .Values.valkey.mode "bundled" }}
  * Valkey                      : in-cluster ({{ .Values.valkey.image.tag }})
{{- end }}
{{- if eq .Values.doris.mode "external" }}
  * Doris                       : EXTERNAL (operator-managed) → {{ .Values.doris.host }}:{{ .Values.doris.queryPort }}
{{- end }}

{{- if eq .Values.doris.mode "external" }}

⚠ DORIS IS NOT DEPLOYED BY THIS CHART (doris.mode=external, the default).
  This release expects an operator-managed Doris to ALREADY be running and
  Ready at:
       {{ .Values.doris.host }}:{{ .Values.doris.queryPort }}
  If you have not installed the doris-operator and applied a DorisCluster yet,
  the orbtrace pod will start but hang un-Ready (it applies the Doris schema
  before binding the web port) and eventually CrashLoopBackOff. Verify first:
       kubectl -n doris get doriscluster
  Setup: docs/operations/doris-operator.md (and examples/dorisCluster-orbtrace-recommended.yaml).
{{- end }}

{{- if and .Values.doris.s3.enabled (or (not .Values.doris.s3.accessKey) (not .Values.doris.s3.secretKey)) }}

⚠ Cold tier is ON (doris.s3.enabled=true) but doris.s3.accessKey/secretKey are
  blank. The pod will start, but cold-tier data migration cannot run until you
  set them (--set-string doris.s3.accessKey=… doris.s3.secretKey=…).
{{- end }}

{{- if not .Values.openshift.enabled }}

ℹ Running on OpenShift / OKD? Install with the overlay so pods come up under
  the restricted-v2 SCC (no anyuid, no custom SCC) and a Route replaces the
  Ingress:
     helm install ... -f values-medium.yaml -f values-openshift.yaml
  The overlay also makes the bundled pgvector boot under an OpenShift-assigned
  UID. See docs/operations/openshift.md.
{{- end }}

Next steps:

1. Wait for the migration runner to finish:
     kubectl -n {{ .Release.Namespace }} logs deploy/{{ include "orbtrace.fullname" . }}-app -c orbtrace -f
   You should see a line like "[doris-migration] complete — applied=16,
   total=16, profile={{ .Values.doris.profile.activeProfile }}" (the count
   grows as releases add migrations; applied=0 on an already-migrated store).

   ⚠ If the orbtrace pod never turns Ready, it is almost always waiting on a
     datastore — the app applies the Doris schema BEFORE it binds the web port,
     so an unreachable Doris (or Postgres) keeps the pod un-Ready. Check, in
     order:
       kubectl -n {{ .Release.Namespace }} get pods
{{- if eq .Values.postgres.mode "bundled" }}
       kubectl -n {{ .Release.Namespace }} logs sts/{{ include "orbtrace.fullname" . }}-postgres
{{- end }}
{{- if eq .Values.doris.mode "external" }}
       # Doris is operator-managed (doris.mode=external) → verify it is Ready:
       kubectl -n doris get doriscluster
{{- end }}
     then re-read the orbtrace pod log above for the blocking dependency.

2. Point your SDKs at the OpenTelemetry Collector you stand up alongside this
   deploy. See docs/integration-patterns.md for Pattern A (greenfield, use
   our reference config) and Pattern B (BYO Collector, forward to Orbtrace).

3. Open the UI and sign in:
{{- $externalUrl := include "orbtrace.externalUrl" . }}
{{- $publicUrl := .Values.orbtrace.frontendUrl | default $externalUrl }}
{{- if $publicUrl }}
     {{ $publicUrl }}
{{- else }}
{{- if kindIs "slice" .Values.orbtrace.ingress.hosts }}
{{- range .Values.orbtrace.ingress.hosts }}
{{- if kindIs "map" . }}
     https://{{ .host }}
{{- else }}
     https://{{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

   Sign-in needs BOTH of these — set them or you cannot log in:

   a) A public URL for OAuth2. Explicit orbtrace.frontendUrl/backendUrl win;
      otherwise it is derived from your Route/Ingress host (on OpenShift an
      empty openshift.route.host auto-derives from the cluster's apps domain
      when the installer can read it).
{{- if not $publicUrl }}
      ⚠ NONE RESOLVED — login redirects to the in-pod localhost:8080 and the
        browser fails (ERR_CONNECTION_REFUSED at localhost:8080/oauth2/authorize).
{{- if .Values.openshift.enabled }}
        Fix: pin the Route host the Router generated and upgrade —
          HOST=$(oc -n {{ .Release.Namespace }} get route {{ include "orbtrace.fullname" . }} -o jsonpath='{.spec.host}')
          helm upgrade {{ .Release.Name }} <chart> -n {{ .Release.Namespace }} <your -f flags> \
            --set openshift.route.host=$HOST
        (or set orbtrace.frontendUrl/backendUrl = https://$HOST — same effect)
{{- else }}
        Set both to your external URL (same host; the SPA is same-origin):
          orbtrace.frontendUrl / orbtrace.backendUrl = https://<your-host>
{{- end }}
{{- end }}

   b) A login method.
{{- if .Values.orbtrace.bootstrapAdmin.enabled }}
      A break-glass local admin was provisioned for you. Read the credential:

        username: {{ .Values.orbtrace.bootstrapAdmin.username }}
        password: kubectl -n {{ .Release.Namespace }} get secret {{ include "orbtrace.fullname" . }}-bootstrap-admin \
                    -o jsonpath='{.data.password}' | base64 -d

      You will be REQUIRED to set a new password on first login. Recommended:
      wire SSO (orbtrace.oidc.*) for production and keep this as break-glass —
      or set orbtrace.bootstrapAdmin.enabled=false for a pure-SSO login page.
{{- else }}
      Bootstrap admin is DISABLED (orbtrace.bootstrapAdmin.enabled=false) —
      configure SSO via orbtrace.oidc.*, or the sign-in page reads
      "No login providers are configured".
{{- end }}

AI provider: {{ .Values.orbtrace.ai.provider }}
{{- if eq .Values.orbtrace.ai.provider "anthropic" }}{{ if not .Values.orbtrace.ai.anthropic.apiKey }}
  ⚠ ANTHROPIC_API_KEY not set — RCA + Time-Travel will fall back to heuristics.
{{- end }}{{ end }}
{{- if eq .Values.orbtrace.ai.provider "ollama" }}{{ if not .Values.orbtrace.ai.ollama.baseUrl }}
  ⚠ orbtrace.ai.ollama.baseUrl not set — RCA cannot start.
{{- end }}{{ end }}

Capacity guidance:
  * values-small.yaml   ≤ 50 GB/day, no HA  (1 BE, single-node, PoC/pilot)
  * values-medium.yaml  ≤ 5 TB/day, full HA (5 BE + 3 FE, 2× replication)
  * values-large.yaml   50–100 TB/day       (20 BE + 3 FE, 2× replication —
                        raise doris.profile.replicationNum to 3 for extra
                        durability — HPA on orbtrace, S3 cold tier)
  ALWAYS install with an explicit -f values-<size>.yaml. The bare
  values.yaml is a reference baseline, not a tested preset. Tune
  .Values.doris.be.replicaCount up if storage-class IOPS is the
  bottleneck — BE compaction is IOPS-bound.

Pricing reminder: small/medium/large are capacity presets, not pricing
tiers — Orbtrace is a single annual licence regardless of sizing.
{{- with .Values.doris.profile.cardinalityThreshold }}{{- if .endpoints }}

⚠ `doris.profile.cardinalityThreshold.endpoints` was RENAMED to
  `doris.profile.cardinalityThreshold.operations` (chart 0.3.0) and the
  legacy key is no longer read. Your values overlay still sets `.endpoints`
  — it has NO effect. Move the value to `.operations`.
{{- end }}{{- end }}
