From 45297ac60ea43df4a10a580911b0a324968c935a Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Wed, 24 Jun 2026 13:05:44 +0200 Subject: [PATCH] Make harp Kubernetes backend configurable in helm chart When harp syncs over from the manual-install to the helm chart it needs the Kubernetes backend (HP_K8S_*) instead of the docker backend. The update-helm script now injects these env vars into the harp deployment, templated to values.yaml, and the chart readme documents them. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Simon L. --- nextcloud-aio-helm-chart/readme.md | 17 ++++++++++++++++ nextcloud-aio-helm-chart/update-helm.sh | 26 +++++++++++++++++++++++++ 2 files changed, 43 insertions(+) diff --git a/nextcloud-aio-helm-chart/readme.md b/nextcloud-aio-helm-chart/readme.md index cb31e601..0fdc4f01 100755 --- a/nextcloud-aio-helm-chart/readme.md +++ b/nextcloud-aio-helm-chart/readme.md @@ -36,6 +36,23 @@ helm install nextcloud-aio nextcloud-aio/nextcloud-aio-helm-chart -f values.yaml And after a while, everything should be set up. +## HaRP / AppAPI (ExApps) configuration + +When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API. + +> [!IMPORTANT] +> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup. + +The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP: + +| Value | Default | Description | +| --- | --- | --- | +| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. | +| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. | +| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. | +| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. | +| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. | + ## How to update? Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it. 1. Stop all running pods diff --git a/nextcloud-aio-helm-chart/update-helm.sh b/nextcloud-aio-helm-chart/update-helm.sh index 8c99fc21..ecb86564 100755 --- a/nextcloud-aio-helm-chart/update-helm.sh +++ b/nextcloud-aio-helm-chart/update-helm.sh @@ -343,6 +343,27 @@ EOL # shellcheck disable=SC1083 find ./ -name '*talk-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-talk.config" \{} \; +# Additional config for HaRP +# The manual-install (docker) only configures HaRP with the docker backend. In the +# helm chart HaRP needs to talk to the Kubernetes API instead, so we enable the +# Kubernetes backend here and expose its settings via values.yaml. +cat << EOL > /tmp/additional-harp.config + - name: HP_K8S_ENABLED + value: "true" + - name: HP_K8S_NAMESPACE + value: "{{ .Values.HARP_K8S_NAMESPACE }}" + - name: HP_K8S_STORAGE_CLASS + value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}" + - name: HP_K8S_DEFAULT_STORAGE_SIZE + value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}" + - name: HP_K8S_BEARER_TOKEN_FILE + value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}" + - name: HP_K8S_HOST_ALIASES + value: "{{ .Values.HARP_K8S_HOST_ALIASES }}" +EOL +# shellcheck disable=SC1083 +find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \; + cat << EOL > templates/nextcloud-aio-networkpolicy.yaml {{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }} # https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md @@ -443,6 +464,11 @@ MAIL_FROM_ADDRESS: # (not set by default): Set the local-part for the 'f MAIL_DOMAIN: # (not set by default): Set a different domain for the emails than the domain where Nextcloud is installed. TALK_MAX_STREAM_BITRATE: "1048576" # This allows to adjust the max stream bitrate of the talk hpb TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max stream bitrate of the talk hpb +HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it. +HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. +HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps. +HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. +HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. ADDITIONAL_CONFIG mv /tmp/sample.conf ../helm-chart/values.yaml