Deuxfleurs
/
garage
43
37
Fork 55
Code Issues 69 Pull Requests 4 Releases 29 Wiki Activity

Add helm chart #331

Merged
lx merged 10 commits from chemicstry/garage:helm_chart into main 2022-10-02 14:40:55 +00:00
Conversation 6 Commits 10 Files Changed 13 +709
chemicstry commented 2022-06-20 12:57:58 +00:00
Contributor
Copy Link

This PR adds helm3 chart for deploying garage on k8s clusters.

This is based on template created by helm create, so it has a lot of configuration options. It makes the charts a bit complicated to read, but might be useful for more advanced deployments, so I kept it.

This PR adds helm3 chart for deploying garage on k8s clusters. This is based on template created by `helm create`, so it has a lot of configuration options. It makes the charts a bit complicated to read, but might be useful for more advanced deployments, so I kept it.
👍 2 😕 1
chemicstry changed title from WIP: Add helm chart to Add helm chart 2022-06-20 13:16:54 +00:00
quentin reviewed 2022-06-20 13:35:00 +00:00
script/helm/garage/values.yaml Outdated
@ -0,0 +8,4 @@
dataDir: "/mnt/data"
replicationMode: "3"
rpcBindAddr: "[::]:3901"
rpcSecret: "1799bccfd7411eddcf9ebd316bc1f5287ad12a68094e1c6ac6abde7e6feae1ec"
quentin commented 2022-06-20 13:35:00 +00:00
Owner
Copy Link

Does it mean that if people deploy this helm chart without overriding this value,
they will have a working but vulnerable cluster?

We have some discussions about adding some defense in depth mechanisms to Garage (here: #310) in case this secret leaks but for now, an attack knowing this secret could join the clusteras long as the RPC port is accessible.

I think it could be better to replace this field by something that will make the cluster crashes if not overriden, like "CHANGE ME!!!!"

Does it mean that if people deploy this helm chart without overriding this value, they will have a working but vulnerable cluster? We have some discussions about adding some defense in depth mechanisms to Garage (here: https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/310) in case this secret leaks but for now, an attack knowing this secret could join the clusteras long as the RPC port is accessible. I think it could be better to replace this field by something that will make the cluster crashes if not overriden, like "CHANGE ME!!!!"
chemicstry commented 2022-06-20 14:02:15 +00:00
Author
Contributor
Copy Link

Good point. I think it would be best to store rcpSecret as a kubernetes Secret object, which is randomly generated if not provided, but then there is a problem how to inject that into container configuration. It would be easier if garage accepted configuration through env vars. Otherwise I think the only option is to fire up an init container and patch up configuration toml.

Good point. I think it would be best to store rcpSecret as a kubernetes Secret object, which is randomly generated if not provided, but then there is a problem how to inject that into container configuration. It would be easier if garage accepted configuration through env vars. Otherwise I think the only option is to fire up an init container and patch up configuration toml.
maximilien marked this conversation as resolved
quentin reviewed 2022-06-20 13:39:04 +00:00
script/helm/README.md Outdated
@ -0,0 +1,73 @@
# Garage helm3 chart
quentin commented 2022-06-20 13:39:04 +00:00
Owner
Copy Link

Could you put this file in the /doc/book/cookbook folder renamed as kubernetes.md, so it will be part of Garage's documentation.

Then add some headers at its top, eg.:

+++
title = "Deploying on Kubernetes"
weight = 32
+++

<the content of your README.md>

You can keep this README.md file to inform people that the doc on K8S is located at /doc/book/cookbook/kubernetes.md
or https://garagehq.deuxfleurs.fr/documentation/cookbook/kubernetes/ (the URL does not work yet of course)

Could you put this file in the `/doc/book/cookbook` folder renamed as `kubernetes.md`, so it will be part of Garage's documentation. Then add some headers at its top, eg.: ``` +++ title = "Deploying on Kubernetes" weight = 32 +++ <the content of your README.md> ``` You can keep this `README.md` file to inform people that the doc on K8S is located at `/doc/book/cookbook/kubernetes.md` or https://garagehq.deuxfleurs.fr/documentation/cookbook/kubernetes/ (the URL does not work yet of course)
maximilien marked this conversation as resolved
quentin requested review from maximilien 2022-06-20 13:41:28 +00:00
chemicstry commented 2022-06-20 15:56:08 +00:00
Author
Contributor
Copy Link

Moved documentation to book and implemented an automatic secret generation if one is not provided.

I'm not sure if it is okay to delete secret object when helm chart is deleted. If I understand it correctly, the RPC secret is only used for authenticating peers, but data is not encrypted? In that case it is okay to delete it and cluster can still be recreated if volumes remain intact.

Moved documentation to book and implemented an automatic secret generation if one is not provided. I'm not sure if it is okay to delete secret object when helm chart is deleted. If I understand it correctly, the RPC secret is only used for authenticating peers, but data is not encrypted? In that case it is okay to delete it and cluster can still be recreated if volumes remain intact.
lx commented 2022-06-20 16:14:30 +00:00
Owner
Copy Link

Yes the RPC secret can be regenerated at any time, it's only used for live communication between nodes and doesn't impact data on disk.

Yes the RPC secret can be regenerated at any time, it's only used for live communication between nodes and doesn't impact data on disk.
maximilien added the
Improvement
 label 2022-06-20 18:56:39 +00:00
quentin commented 2022-06-20 20:51:28 +00:00
Owner
Copy Link

Thanks a lot for your contribution @chemicstry and your quick response to my suggestions, I am sure your work will ease the life of K8S operators :-)

For the rest of your PR, I will let Maximilien review it: he knows K8S way better than me.

Thanks a lot for your contribution @chemicstry and your quick response to my suggestions, I am sure your work will ease the life of K8S operators :-) For the rest of your PR, I will let Maximilien review it: he knows K8S way better than me.
👍 1
maximilien commented 2022-06-23 04:43:19 +00:00
Owner
Copy Link

I'm still validating a couple of things related to the ingress default values.

I'm still validating a couple of things related to the ingress default values.
👍 1
chemicstry commented 2022-06-23 17:03:32 +00:00
Author
Contributor
Copy Link

I'm still validating a couple of things related to the ingress default values.

I wasn't sure if two ingress rules are the way to go. This way you get more flexibility to configure each separately, but you lose the ability to have them both on the same domain with different path prefixes (correct me if I'm wrong).

> I'm still validating a couple of things related to the ingress default values. I wasn't sure if two ingress rules are the way to go. This way you get more flexibility to configure each separately, but you lose the ability to have them both on the same domain with different path prefixes (correct me if I'm wrong).
lx added this to the v0.8 milestone 2022-09-14 11:40:46 +00:00
maximilien force-pushed helm_chart from 889d196944 to db0c8b3980 2022-09-30 16:47:06 +00:00 Compare
maximilien commented 2022-10-01 21:34:16 +00:00
Owner
Copy Link

Good for merge

Good for merge
maximilien self-assigned this 2022-10-01 21:34:41 +00:00
maximilien approved these changes 2022-10-01 21:35:19 +00:00
maximilien left a comment
Owner
Copy Link

LGTM, for a first try at least

LGTM, for a first try at least
lx merged commit e21b672c96 into main 2022-10-02 14:40:55 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
maximilien
Labels
Clear labels   
AdminAPI

Issues concerning the administration API

  
Bug

   
Check AWS

The behaviour should be checked against AWS S3

  
CI

Issues with Nix, Drone, Rust Compiler, etc.

  
Correctness

Issues of theoretical correctness that may impact edge-case scenarios

  
Critical

   
Documentation

   
Ideas

For abstract ideas/proposal to make Garage better, to better communicate our not yet achieved aims

  
Improvement

   
Low priority

For issues that we don't want to spend time on until made absolutely necessary

  
Newcomer

A bug that should be newcomer friendly.

  
Performance

   
S3 Compatibility

   
Testing

   
Usability

Propositions to make Garage easier to operate, by improving error reporting, CLI, etc.

No Label
AdminAPI
Bug
Check AWS
CI
Correctness
Critical
Documentation
Ideas
Improvement
Low priority
Newcomer
Performance
S3 Compatibility
Testing
Usability
Milestone
Clear milestone
No items
No Milestone
v0.8
Assignees
Clear assignees
No Assignees
maximilien
4 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Deuxfleurs/garage#331
No description provided.
Delete Branch "chemicstry/garage:helm_chart"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?