mirror of
https://github.com/nextcloud/all-in-one.git
synced 2026-09-18 09:17:24 +00:00
helm-chart: some adjustments to the harp deployment and docs (#8635)
This commit is contained in:
Simon L.
@@ -40,11 +40,15 @@ And after a while, everything should be set up.
|
||||
|
||||
When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
|
||||
|
||||
> [!NOTE]
|
||||
> HaRP's Kubernetes backend is only available with Nextcloud 34 and later. On earlier Nextcloud versions you cannot use ExApps with this Helm chart.
|
||||
|
||||
HaRP deploys the ExApps into the same namespace in which it runs itself, i.e. the namespace that is configured via `NAMESPACE`.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
|
||||
> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists.
|
||||
> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod.
|
||||
> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
|
||||
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace that is configured via `NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
|
||||
> 1. Create a `ServiceAccount` **in the same namespace in which the HaRP container runs** (the namespace configured via `NAMESPACE`) and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod. A service account from a different namespace cannot be used.
|
||||
> 2. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
|
||||
>
|
||||
> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions.
|
||||
|
||||
@@ -52,11 +56,18 @@ The following values in `values.yaml` allow you to adjust the Kubernetes backend
|
||||
|
||||
| Value | Default | Description |
|
||||
| --- | --- | --- |
|
||||
| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
|
||||
| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
|
||||
| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
|
||||
| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. |
|
||||
| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
|
||||
| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. It must exist in the same namespace in which HaRP runs (see `NAMESPACE`). You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
|
||||
|
||||
### Registering the HaRP daemon in Nextcloud
|
||||
|
||||
The chart does **not** register the HaRP daemon in Nextcloud for you, so you need to do that yourself once all pods are running. `nextcloud-aio-harp:8780` is the HaRP service that this chart creates. Adjust `https://your-nc-domain.com` to your Nextcloud domain (`NC_DOMAIN`) and `<HP_SHARED_KEY>` to the value that you configured in `HP_SHARED_KEY` in your `values.yaml`:
|
||||
|
||||
```
|
||||
kubectl exec deployment/nextcloud-aio-nextcloud -- php occ app_api:daemon:register k8s_harp "Kubernetes HaRP" kubernetes-install http nextcloud-aio-harp:8780 https://your-nc-domain.com --harp --harp_shared_key "<HP_SHARED_KEY>" --k8s --set-default
|
||||
```
|
||||
|
||||
## How to update?
|
||||
Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
|
||||
|
||||
@@ -30,7 +30,7 @@ spec:
|
||||
- name: HP_K8S_ENABLED
|
||||
value: "true"
|
||||
- name: HP_K8S_NAMESPACE
|
||||
value: "{{ .Values.HARP_K8S_NAMESPACE }}"
|
||||
value: "{{ .Values.NAMESPACE }}"
|
||||
- name: HP_K8S_STORAGE_CLASS
|
||||
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
|
||||
- name: HP_K8S_DEFAULT_STORAGE_SIZE
|
||||
|
||||
@@ -352,7 +352,7 @@ cat << EOL > /tmp/additional-harp.config
|
||||
- name: HP_K8S_ENABLED
|
||||
value: "true"
|
||||
- name: HP_K8S_NAMESPACE
|
||||
value: "{{ .Values.HARP_K8S_NAMESPACE }}"
|
||||
value: "{{ .Values.NAMESPACE }}"
|
||||
- name: HP_K8S_STORAGE_CLASS
|
||||
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
|
||||
- name: HP_K8S_DEFAULT_STORAGE_SIZE
|
||||
@@ -364,7 +364,8 @@ EOL
|
||||
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \;
|
||||
# HaRP authenticates against the Kubernetes API with the service account that is
|
||||
# mounted into its pod. Allow the service account name to be set via values.yaml
|
||||
# so that the user can grant it the required RBAC permissions (see the readme).
|
||||
# so that the user can grant it the required RBAC permissions (see the readme). The
|
||||
# service account must exist in the same namespace in which HaRP runs.
|
||||
cat << EOL > /tmp/additional-harp-sa.config
|
||||
{{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
|
||||
serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
|
||||
@@ -474,12 +475,11 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f
|
||||
MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
|
||||
TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb
|
||||
TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb
|
||||
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
|
||||
# HP_SHARED_KEY: # This allows to set the shared key for HaRP which is getting set at the very top of this values.yaml file.
|
||||
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
|
||||
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
|
||||
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
|
||||
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
|
||||
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. It must exist in the same namespace in which HaRP runs (see NAMESPACE) and you need to create it yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in that namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
|
||||
ADDITIONAL_CONFIG
|
||||
|
||||
mv /tmp/sample.conf ../helm-chart/values.yaml
|
||||
|
||||
@@ -81,9 +81,8 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f
|
||||
MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed.
|
||||
TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb
|
||||
TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb
|
||||
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
|
||||
# HP_SHARED_KEY: # This allows to set the shared key for HaRP which is getting set at the very top of this values.yaml file.
|
||||
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
|
||||
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
|
||||
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
|
||||
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
|
||||
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. It must exist in the same namespace in which HaRP runs (see NAMESPACE) and you need to create it yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in that namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
|
||||
|
||||
Reference in New Issue
Block a user