docs(data-lab): update architecture spec and add ADR-0069 for Helm chart deployment

- **Configuration keys** (hub): `PIVEAU_HUB_API_KEY`, `PIVEAU_HUB_SEARCH_SERVICE`, `PIVEAU_TRIPLESTORE_CONFIG`, `PIVEAU_SHADOW_TRIPLESTORE_CONFIG`, `PIVEAU_HUB_AUTHORIZATION_PROCESS_DATA` (issuer = platform Keycloak realm URL), `PIVEAU_HUB_CORS_DOMAINS` (platform origin only — not `*`), `PIVEAU_PROFILE` / `PIVEAU_FEATURE_FLAGS`, `PIVEAU_DCATAP_SCHEMA_CONFIG`. Secrets are injected from the environment / Kubernetes Secrets, never committed.

- **UI:** `VITE_*` branding and base URLs set at container start (title "OOP Data Lab", platform logo/palette, hub/search/Keycloak URLs).

- **Volumes:** `virtuoso_db`, `shadow_virtuoso_db`, `elasticsearch`, profile bind mount.

- **Kubernetes:** same seven workloads as a Helm chart in a later step; no requirement for the release beyond Compose.

- **Kubernetes (alternative):** subchart `datalab` of the OOP Helm chart, off by default: one Virtuoso, the UI as the only public entry on a NodePort, hub and search cluster-internal, realm `dataspace` provisioned by the OOP Keycloak chart. The OOP Helm chart has no Nginx, so REQ-DL-13 applies to the compose profile; one Virtuoso instead of the two of §H.1 (ADR-0069).

### H.5 Security

---

type: Decision Record

title: "ADR-0069: The Data Lab can also be deployed with the OOP Helm chart, as a minimal Kubernetes profile"

description: "Subchart datalab of the OOP Helm chart deploys the Data Lab on Kubernetes, off by default, with the UI on a NodePort, one Virtuoso and the hub and search APIs cluster-internal."

tags: [adr, data-lab, platform, deployment]

timestamp: 2026-10-15T00:00:00Z

status: "proposed"

---

# ADR-0069: The Data Lab can also be deployed with the OOP Helm chart, as a minimal Kubernetes profile

**Status:** proposed

**Date:** 2026-10-15

**Affects:** [data-lab/architecture.md](/data-lab/architecture.md) §H.4; OOP Helm chart (`oop-platform-chart/charts/datalab`, realm `dataspace` in `charts/keycloak`)

## Context

ADR-0049 deploys the Data Lab as compose profile `data-lab` behind the platform Nginx (`/data-lab/*`) and

Keycloak. OOP is also deployed with a Helm chart, and that deployment has **no Nginx and no ingress**: every

component (OEG, SRM, portal, Keycloak) is reached on its own NodePort. The Data Lab needs a Helm deployment for the

platforms that run OOP on Kubernetes.

## Decision

Subchart `datalab` of the OOP Helm chart, **off by default** (`datalab.enabled` together with

`keycloak.realms.dataspace.enabled`):

- Workloads: piveau hub-repo and hub-search, **one** Virtuoso (the hub's metrics and history graphs go to the main

  store; no shadow store), single-node Elasticsearch, the Data Lab UI and API, and a Job that creates the two

  catalogues.

- Exposure: the **UI only**, on a NodePort (default 30083), at `/`; it forwards `/api/` to the Data Lab API. Hub,

  search, Virtuoso and Elasticsearch are cluster-internal; there is no SPARQL route.

- Identity: realm `dataspace` on the platform Keycloak, provisioned by the OOP Keycloak chart from the same client

  definitions as the realm export in the Data Lab repo; client secrets are generated by the chart.

- Images: the Data Lab UI and API images published by the Data Lab CI; the API reaches Keycloak at its in-cluster

  address (`KEYCLOAK_INTERNAL_URL`) while tokens are still checked against the public issuer.

REQ-DL-13 (`/data-lab/*` through the platform Nginx) applies where there is a platform Nginx, that is the compose

profile; in the Helm deployment the Data Lab is exposed like the other OOP components. The single Virtuoso differs from

§H.1 for the Helm deployment only. The compose profile of ADR-0049 is unchanged.

## Consequences

What becomes easier:

- The Data Lab deploys with the rest of OOP on Kubernetes, with one command and the same login.

- About 3 GB of memory instead of 4 GB or more, and fewer moving parts.

What becomes harder:

- Machine clients (REQ-DL-11 API keys, contributor scripts) cannot reach the hub or search API from outside the

  cluster; they use `kubectl port-forward` until the hub is exposed.

- The realm definition exists twice (Data Lab repo export, Keycloak chart template) and must be kept in step.

- Records are minted with the Helm deployment's public address in `datalab.baseUri`; it must be set explicitly and

  never changed on a real deployment (MAP §12).

Deferred or excluded:

- `/data-lab/*` routing, external hub and search APIs, the shadow Virtuoso, NetworkPolicies for the stores.

Revisit trigger:

- A platform-wide ingress lands in the Helm chart, machine clients need the hub API from outside the cluster, or the

  metrics and history graphs outgrow the main store.

* [ADR-0048](0048-data-lab-piveau-hub-and-6gdali-map.md) - Data Lab adopts piveau-hub as catalogue engine and the 6G-DALI Metadata Application Profile (DCAT-AP 3.0 + DQV + PROV-O) as normative metadata profile

* [ADR-0049](0049-data-lab-standalone-profile-shared-ingress-and-iam.md) - Data Lab is a standalone compose profile behind the platform Nginx and Keycloak (realm `dataspace`); no DataBus/SRM/OEG coupling in the catalogue release

* [ADR-0050](0050-data-lab-draft-version-not-pinned.md) - data-lab/ specs carry version 0.1 (Draft) and are excluded from the Release 2 pin (extends ADR-0021 exceptions)

* [ADR-0069](0069-data-lab-helm-chart-alternative-to-compose.md) - The Data Lab can also be deployed with the OOP Helm chart: off by default, UI on a NodePort, one Virtuoso, hub and search cluster-internal (proposed)