mirror of
https://github.com/versity/versitygw.git
synced 2026-08-24 16:16:38 +00:00
niksis02
8b6c0649d3
This adds a new iamServer Deployment, split public and private Services, a PersistentVolumeClaim, and cert-manager Certificate resources so the standalone versitygw iam API server can be deployed directly from this chart, independently scalable from the S3 gateway and backed by either internal file storage or HashiCorp Vault, with Vault auth credentials and Vault TLS material kept in separate Kubernetes secrets. The gateway side gains iam.type=standalone client wiring that reaches the IAM service over its private mTLS endpoint, with certificates supplied either through an existing secret or auto-provisioned via cert-manager using a shared CA-type issuer so both peers can verify each other from their own certificate's ca.crt, and the chart auto-targets the in-chart service when no external endpoint is configured. gateway.logLevel and iamServer.logLevel replace the old boolean debug flag with the silent, debug, and unsafe levels the binary now supports, docker-entrypoint.sh gained iam as a recognized VGW_BACKEND value so the new deployment can start through the existing entrypoint, NetworkPolicy resources were corrected to use proper peer lists and to default to deny instead of allow when no ingress rules are configured, pod and Deployment selector labels were separated between the gateway and the IAM server to prevent them from matching each other's Services, and a battery of template time validation guards was added to fail fast on invalid combinations such as multiple replicas against the internal file store or a missing certificate for a TCP private endpoint, together with expanded helm lint coverage in CI for these new configurations.
55 lines
1.1 KiB
Bash
55 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
BIN="${VGW_BINARY:-/usr/local/bin/versitygw}"
|
|
|
|
if [ ! -x "$BIN" ]; then
|
|
echo "Entrypoint error: versitygw binary not found at $BIN" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# If arguments were provided, run them directly for backward compatibility.
|
|
if [ "$#" -gt 0 ]; then
|
|
exec "$BIN" "$@"
|
|
fi
|
|
|
|
backend="${VGW_BACKEND:-}"
|
|
if [ -z "$backend" ]; then
|
|
cat >&2 <<'EOF'
|
|
No command arguments were provided and VGW_BACKEND is unset.
|
|
Set VGW_BACKEND to one of: posix, scoutfs, s3, azure, plugin, iam
|
|
or pass explicit arguments to the container to run the versitygw command directly.
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
case "$backend" in
|
|
posix|scoutfs|s3|azure|plugin|iam)
|
|
;;
|
|
*)
|
|
echo "VGW_BACKEND invalid backend (was '$backend')." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# Global flags must precede the backend subcommand.
|
|
if [ -n "${VGW_ARGS:-}" ]; then
|
|
# shellcheck disable=SC2086
|
|
set -- ${VGW_ARGS}
|
|
else
|
|
set --
|
|
fi
|
|
|
|
set -- "$@" "$backend"
|
|
|
|
if [ -n "${VGW_BACKEND_ARG:-}" ]; then
|
|
set -- "$@" "$VGW_BACKEND_ARG"
|
|
fi
|
|
|
|
if [ -n "${VGW_BACKEND_ARGS:-}" ]; then
|
|
# shellcheck disable=SC2086
|
|
set -- "$@" ${VGW_BACKEND_ARGS}
|
|
fi
|
|
|
|
exec "$BIN" "$@"
|