daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-18 09:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

harp helm: drop redundant token file, add service account, fix host aliases docs

Browse Source 
- Remove HARP_K8S_BEARER_TOKEN_FILE: HaRP already defaults it to the
  in-cluster service account token path, so templating it added nothing.
- Add HARP_SERVICE_ACCOUNT_NAME so the harp pod can run under a service
  account the user grants the required RBAC to, and document the setup.
- Correct the HARP_K8S_HOST_ALIASES docs: it is a comma-separated list of
  hostname:ip pairs, not JSON.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon L. <szaimen@e.mail.de>
This commit is contained in:
Simon L.
2026-06-24 13:17:48 +02:00
co-authored by Claude Opus 4.8
parent 45297ac60e
commit cea187d6cb
2 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nextcloud-aio-helm-chart/readme.md
+8 -3
View File
@@ -41,7 +41,12 @@ And after a while, everything should be set up.
When `HARP_ENABLED` is set to `"yes"`, the chart deploys the [HaRP](https://github.com/nextcloud/HaRP) container that AppAPI uses to run external apps (ExApps). Unlike the docker-based AIO installation, HaRP cannot use the docker backend inside Kubernetes, so the chart automatically enables HaRP's Kubernetes backend (`HP_K8S_ENABLED=true`) and lets HaRP create the ExApp deployments via the Kubernetes API.
> [!IMPORTANT]
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. You need to make sure that the service account that is mounted into the HaRP pod is allowed to do so (e.g. via a `Role`/`RoleBinding`) and that the namespace exists. See the [HaRP Kubernetes documentation](https://github.com/nextcloud/HaRP) for the required RBAC setup.
> HaRP needs permission to manage resources (deployments, services, persistent volume claims, …) in the namespace configured via `HARP_K8S_NAMESPACE`. The chart does **not** create this RBAC for you. You need to:
> 1. Make sure the namespace configured via `HARP_K8S_NAMESPACE` exists.
> 2. Create a `ServiceAccount` in that namespace and set its name in `HARP_SERVICE_ACCOUNT_NAME` so that it is mounted into the HaRP pod.
> 3. Grant that service account permission to manage resources in the namespace via a `Role`/`RoleBinding`.
>
> See the [HaRP repository](https://github.com/nextcloud/HaRP) for the required RBAC setup. If `HARP_SERVICE_ACCOUNT_NAME` is left empty, the namespace's `default` service account is used, which usually does not have the required permissions.
The following values in `values.yaml` allow you to adjust the Kubernetes backend of HaRP:
@@ -50,8 +55,8 @@ The following values in `values.yaml` allow you to adjust the Kubernetes backend
| `HARP_K8S_NAMESPACE` | `nextcloud-exapps` | The namespace that HaRP deploys ExApps into. It must already exist and the HaRP service account must be allowed to manage resources in it. |
| `HARP_K8S_STORAGE_CLASS` | _(empty)_ | The storage class used for ExApp persistent volume claims. Leave empty to use the cluster's default storage class. |
| `HARP_K8S_DEFAULT_STORAGE_SIZE` | `10Gi` | The default size of the persistent volume claims that HaRP creates for ExApps. |
| `HARP_K8S_BEARER_TOKEN_FILE` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path inside the HaRP container to the bearer token used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically. |
| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases. |
| `HARP_K8S_HOST_ALIASES` | _(empty)_ | Optional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames, e.g. when your Nextcloud domain is not resolvable by the cluster's DNS. Use a comma-separated list of `hostname:ip` pairs, e.g. `nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6`. Leave empty to not set any host aliases. |
| `HARP_SERVICE_ACCOUNT_NAME` | _(empty)_ | The service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You must create it yourself and grant it the RBAC permissions described above. Leave empty to use the namespace's `default` service account. |
## How to update?
Since the values of this helm chart may change in the future, it is highly recommended to strictly follow the following procedure whenever you want to upgrade it.
nextcloud-aio-helm-chart/update-helm.sh
+12 -4
View File
@@ -356,13 +356,21 @@ cat << EOL > /tmp/additional-harp.config
value: "{{ .Values.HARP_K8S_STORAGE_CLASS }}"
- name: HP_K8S_DEFAULT_STORAGE_SIZE
value: "{{ .Values.HARP_K8S_DEFAULT_STORAGE_SIZE }}"
- name: HP_K8S_BEARER_TOKEN_FILE
value: "{{ .Values.HARP_K8S_BEARER_TOKEN_FILE }}"
- name: HP_K8S_HOST_ALIASES
value: "{{ .Values.HARP_K8S_HOST_ALIASES }}"
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^.*\- env:/r /tmp/additional-harp.config" \{} \;
# HaRP authenticates against the Kubernetes API with the service account that is
# mounted into its pod. Allow the service account name to be set via values.yaml
# so that the user can grant it the required RBAC permissions (see the readme).
cat << EOL > /tmp/additional-harp-sa.config
{{- if .Values.HARP_SERVICE_ACCOUNT_NAME }}
serviceAccountName: "{{ .Values.HARP_SERVICE_ACCOUNT_NAME }}"
{{- end }}
EOL
# shellcheck disable=SC1083
find ./ -name '*harp-deployment.yaml' -exec sed -i "/^ spec:$/r /tmp/additional-harp-sa.config" \{} \;
cat << EOL > templates/nextcloud-aio-networkpolicy.yaml
{{- if eq .Values.NETWORK_POLICY_ENABLED "yes" }}
@@ -467,8 +475,8 @@ TALK_MAX_SCREEN_BITRATE: "2097152" # This allows to adjust the max strea
HARP_K8S_NAMESPACE: nextcloud-exapps # The Kubernetes namespace that HaRP deploys ExApps (AppAPI apps) into. The namespace must already exist and the HaRP service account must be allowed to manage resources in it.
HARP_K8S_STORAGE_CLASS: # The storage class that HaRP uses for ExApp persistent volume claims. Leave empty to use the cluster's default storage class.
HARP_K8S_DEFAULT_STORAGE_SIZE: 10Gi # The default size of the persistent volume claims that HaRP creates for ExApps.
HARP_K8S_BEARER_TOKEN_FILE: /var/run/secrets/kubernetes.io/serviceaccount/token # Path inside the HaRP container to the bearer token that is used to authenticate against the Kubernetes API. The default is the service account token that Kubernetes mounts automatically.
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases (in JSON format) that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Leave empty to not set any host aliases.
HARP_K8S_HOST_ALIASES: # Optional. Additional host aliases that HaRP sets on the ExApp pods so that they can resolve the configured hostnames. Use a comma-separated list of hostname:ip pairs, e.g. 'nextcloud.example.com:10.0.0.5,collabora.example.com:10.0.0.6'. Leave empty to not set any host aliases.
HARP_SERVICE_ACCOUNT_NAME: # The name of the Kubernetes service account that is mounted into the HaRP pod and used to authenticate against the Kubernetes API. You need to create this service account yourself and grant it permission to manage resources (deployments, services, persistent volume claims, …) in the HARP_K8S_NAMESPACE namespace via a Role/RoleBinding. Leave empty to use the namespace's "default" service account.
ADDITIONAL_CONFIG
mv /tmp/sample.conf ../helm-chart/values.yaml