diff --git a/seafile/Chart.yaml b/seafile/Chart.yaml index 842b79e..3a45e5d 100644 --- a/seafile/Chart.yaml +++ b/seafile/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: seafile description: A Helm chart for Seafile Server type: application -version: 0.5.2 -appVersion: 8.0.5 +version: 1.0.0 +appVersion: 11.0.2 icon: https://www.seafile.com/media/img/seafile-logo.png home: https://github.com/300481/seafile-server description: Seafile Server, Reliable and Performant File Sync and Share Solution on Kubernetes @@ -23,15 +23,15 @@ annotations: - add option to disable subchart memcached artifacthub.io/images: | - name: Seafile - image: 300481/seafile:8.0.5-20210627 + image: seafileltd/seafile-mc:11.0.2 artifacthub.io/maintainers: | - name: 300481 email: 300481@300481.de dependencies: - name: mariadb - version: 9.3.16 + version: 14.1.2 repository: https://charts.bitnami.com/bitnami - name: memcached - version: 5.13.1 + version: 6.7.0 repository: https://charts.bitnami.com/bitnami condition: memcached.enabled \ No newline at end of file diff --git a/seafile/templates/_helpers.tpl b/seafile/templates/_helpers.tpl index 97dd7c3..85471fa 100644 --- a/seafile/templates/_helpers.tpl +++ b/seafile/templates/_helpers.tpl @@ -20,6 +20,27 @@ If release name contains chart name it will be used as a full name. {{- end -}} {{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "seafile.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + + +{{/* +Selector labels +*/}} +{{- define "seafile.selectorLabels" -}} +app.kubernetes.io/name: {{ include "seafile.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + {{/* Create chart name and version as used by the chart label. */}} @@ -39,3 +60,41 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} {{- end -}} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "seafile.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "seafile.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Looks if there's an existing secret and reuse its password. If not it generates +new password and use it. +*/}} +{{- define "seafile.adminPassword" -}} +{{- $secret := (lookup "v1" "Secret" (include "seafile.namespace" .) (include "seafile.fullname" .) ) -}} + {{- if $secret -}} + {{- index $secret "data" "admin-password" -}} + {{- else if .Values.seafile.adminPassword -}} + {{- .Values.seafile.auth.adminPassword -}} + {{- else -}} + {{- (randAlphaNum 40) | b64enc | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Defines default user. +*/}} +{{- define "seafile.adminMail" -}} + {{- if .Values.seafile.adminMail -}} + {{- .Values.seafile.auth.adminMail -}} + {{- else -}} + {{- "seafileadmin@example.com" | b64enc | quote -}} + {{- end -}} +{{- end -}} diff --git a/seafile/templates/helper_service_memcached.yml b/seafile/templates/helper_service_memcached.yml new file mode 100644 index 0000000..afe3343 --- /dev/null +++ b/seafile/templates/helper_service_memcached.yml @@ -0,0 +1,19 @@ +{{- if .Values.memcached.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: memcached +spec: + type: ExternalName + externalName: "{{ .Release.Name }}-memcached.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" +{{- else if ne .Values.memcached.serviceFqdn "memcached" }} +--- +apiVersion: v1 +kind: Service +metadata: + name: memcached +spec: + type: ExternalName + externalName: "{{ .Values.memcached.serviceFqdn }}" +{{- end }} diff --git a/seafile/templates/ingress.yaml b/seafile/templates/ingress.yaml index 3d16906..9d1202d 100644 --- a/seafile/templates/ingress.yaml +++ b/seafile/templates/ingress.yaml @@ -7,8 +7,13 @@ metadata: # https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#custom-max-body-size # http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size nginx.ingress.kubernetes.io/proxy-body-size: "0" - {{- toYaml .Values.ingress.annotations | nindent 4 }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} {{- if .Values.ingress.tls }} tls: - hosts: @@ -23,6 +28,6 @@ spec: pathType: Prefix backend: service: - name: {{ include "seafile.fullname" . }} + name: {{ include "seafile.fullname" . }}-web port: - number: 80 + name: http diff --git a/seafile/templates/secret.yaml b/seafile/templates/secret.yaml new file mode 100644 index 0000000..ec57507 --- /dev/null +++ b/seafile/templates/secret.yaml @@ -0,0 +1,16 @@ +{{- if not .Values.existingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "seafile.fullname" . }} + labels: + {{- include "seafile.labels" . | nindent 4 }} +{{- with .Values.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +type: Opaque +data: + admin-username: {{ template "seafile.adminMail" . }} + admin-password: {{ template "seafile.adminPassword" . }} +{{- end }} diff --git a/seafile/templates/service.yaml b/seafile/templates/service.yaml index 08d9f0b..053ff47 100644 --- a/seafile/templates/service.yaml +++ b/seafile/templates/service.yaml @@ -1,37 +1,15 @@ ---- apiVersion: v1 kind: Service metadata: - name: {{ include "seafile.fullname" . }} + name: {{ include "seafile.fullname" . }}-web labels: -{{ include "seafile.labels" . | indent 4 }} + {{- include "seafile.labels" . | nindent 4 }} spec: type: ClusterIP - clusterIP: "None" ports: - - port: 80 - targetPort: http - protocol: TCP - name: http + - port: 80 + targetPort: http + protocol: TCP + name: http selector: - app.kubernetes.io/name: {{ include "seafile.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Values.memcached.enabled }} ---- -apiVersion: v1 -kind: Service -metadata: - name: memcached -spec: - type: ExternalName - externalName: "{{ .Release.Name }}-memcached.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" -{{- else if ne .Values.memcached.serviceFqdn "memcached" }} ---- -apiVersion: v1 -kind: Service -metadata: - name: memcached -spec: - type: ExternalName - externalName: "{{ .Values.memcached.serviceFqdn }}" -{{- end }} \ No newline at end of file + {{- include "seafile.selectorLabels" . | nindent 4 }} diff --git a/seafile/templates/serviceaccount.yaml b/seafile/templates/serviceaccount.yaml new file mode 100644 index 0000000..1c7bb84 --- /dev/null +++ b/seafile/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "seafile.serviceAccountName" . }} + labels: + {{- include "seafile.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/seafile/templates/statefulset.yaml b/seafile/templates/statefulset.yaml index 87e0b36..61ebfc9 100644 --- a/seafile/templates/statefulset.yaml +++ b/seafile/templates/statefulset.yaml @@ -3,43 +3,69 @@ kind: StatefulSet metadata: name: {{ include "seafile.fullname" . }} labels: -{{ include "seafile.labels" . | indent 4 }} + {{- include "seafile.labels" . | nindent 4 }} spec: serviceName: {{ include "seafile.fullname" . }} - replicas: {{ if .Values.seafile.pause }}{{ 0 }}{{ else }}{{ 1 }}{{ end }} + replicas: {{ .Values.seafile.replicas }} selector: matchLabels: - app.kubernetes.io/name: {{ include "seafile.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + {{- include "seafile.selectorLabels" . | nindent 6 }} updateStrategy: type: RollingUpdate template: metadata: labels: - app.kubernetes.io/name: {{ include "seafile.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + {{- include "seafile.selectorLabels" . | nindent 8 }} spec: - {{- if .Values.seafile.extraVolumes }} - volumes: - {{- with .Values.seafile.extraVolumes }} - {{- toYaml . | nindent 6 }} - {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} {{- end }} + serviceAccountName: {{ include "seafile.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: seafile - image: {{ .Values.seafile.image }} - imagePullPolicy: Always + image: "{{ .Values.seafile.image.repository }}:{{ .Values.seafile.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.seafile.image.pullPolicy }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} env: - - name: DB_HOST - value: "{{ .Release.Name }}-mariadb.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - name: DB_ROOT_PASSWD - valueFrom: - secretKeyRef: - name: "{{ .Release.Name }}-mariadb" - key: mariadb-root-password - - name: SEAFILE_SERVER_LETSENCRYPT - value: "false" -{{ toYaml .Values.seafile.environment | indent 8 }} + - name: DB_HOST + value: "{{ .Release.Name }}-mariadb.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + - name: DB_ROOT_PASSWD + valueFrom: + secretKeyRef: + name: "{{ .Release.Name }}-mariadb" + key: mariadb-root-password + - name: SEAFILE_SERVER_LETSENCRYPT + value: "false" + - name: SEAFILE_SERVER_HOSTNAME + value: {{ .Values.ingress.host }} + - name: SEAFILE_ADMIN_EMAIL + valueFrom: + secretKeyRef: + {{- if .Values.seafile.existingSecret }} + name: {{ .Values.seafile.existingSecret }} + {{- else }} + name: {{ template "seafile.fullname" . }} + {{- end }} + key: admin-username + - name: SEAFILE_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + {{- if .Values.seafile.existingSecret }} + name: {{ .Values.seafile.existingSecret }} + {{- else }} + name: {{ template "seafile.fullname" . }} + {{- end }} + key: admin-password + {{- with .Values.seafile.env }} + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.seafile.probes }} + {{- toYaml . | nindent 8 }} + {{- end }} ports: - name: http containerPort: 80 @@ -48,8 +74,28 @@ spec: - name: seafile-data mountPath: /shared {{- with .Values.seafile.extraVolumeMounts }} - {{- toYaml . | nindent 8 }} + {{- toYaml . | nindent 12 }} {{- end }} + resources: + {{- toYaml .Values.seafile.resources | nindent 12 }} + {{- if .Values.seafile.extraVolumes }} + volumes: + {{- with .Values.seafile.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} volumeClaimTemplates: - metadata: name: seafile-data @@ -57,4 +103,4 @@ spec: accessModes: [ "ReadWriteOnce" ] resources: requests: - storage: {{ .Values.seafile.persistence.size }} \ No newline at end of file + storage: {{ .Values.seafile.persistence.size }} diff --git a/seafile/values.yaml b/seafile/values.yaml index 04fc907..8d7c5d1 100644 --- a/seafile/values.yaml +++ b/seafile/values.yaml @@ -1,9 +1,3 @@ -# Default values for seafile-server. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -clusterDomain: cluster.local - # see Bitnami MariaDB Chart Values # https://artifacthub.io/packages/helm/bitnami/mariadb # mariadb: @@ -24,25 +18,43 @@ clusterDomain: cluster.local # see Bitnami Memcached Chart Values # https://artifacthub.io/packages/helm/bitnami/memcached + +clusterDomain: cluster.local + memcached: enabled: true serviceFqdn: memcached +imagePullSecret: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + seafile: - image: docker.io/300481/seafile:8.0.5-20210627 - pause: false + replicas: 1 + image: + repository: seafileltd/seafile-mc + tag: "" + pullPolicy: IfNotPresent + existingSecret: "" + auth: + adminMail: "" + adminPassword: "" persistence: size: 10Gi - environment: - - name: TIME_ZONE - value: "Etc/UTC" - - name: SEAFILE_ADMIN_EMAIL - value: "seafileadmin@example.com" - - name: SEAFILE_ADMIN_PASSWORD - value: "secretpassword" - # !!! update the service and seahub URL to https in the Web-UI !!! - - name: SEAFILE_SERVER_HOSTNAME - value: "seafile.example.com" + env: + - name: TIME_ZONE + value: "Etc/UTC" # extraVolumes: # - name: mnt-data-seafile # persistentVolumeClaim: @@ -50,15 +62,69 @@ seafile: # extraVolumeMounts: # - mountPath: "/mnt/data/seafile" # name: mnt-data-seafile + resources: {} + probes: + # livenessProbe: + # httpGet: + # path: / + # port: http + # failureThreshold: 3 + # timeoutSeconds: 40 + # periodSeconds: 20 + # initialDelaySeconds: 40 + # readinessProbe: + # httpGet: + # path: / + # port: http + # failureThreshold: 3 + # timeoutSeconds: 40 + # periodSeconds: 20 + # initialDelaySeconds: 40 + startupProbe: + tcpSocket: + port: http + failureThreshold: 60 + timeoutSeconds: 20 + periodSeconds: 5 + initialDelaySeconds: 60 ingress: + className: "" annotations: - # use NGINX Ingress Controller - kubernetes.io/ingress.class: "nginx" # use Cert-Manager for LetsEncrypt Certificates # cert-manager.io/issuer: "letsencrypt-prod" # cert-manager.io/cluster-issuer: "letsencrypt-prod" + # !!! update the service and seahub URL to https in the Web-UI !!! host: "seafile.example.com" # tls: # host: "seafile.example.com" # secretName: seafile-tls + + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: + capabilities: + drop: + - ALL + add: + - CHOWN + - NET_BIND_SERVICE + - DAC_OVERRIDE + - SETUID + - SETGID + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + privileged: false + seccompProfile: + type: RuntimeDefault + +nodeSelector: {} + +tolerations: [] + +affinity: {}