mirror of
https://github.com/versity/versitygw.git
synced 2026-08-28 03:46:17 +00:00
niksis02
abb3b27149
Gates bucket listing behind an identity policy, lets browsers reach the standalone IAM API, and turns the WebUI into a dashboard for S3, IAM, or both.
**Bucket listing.** `ListBuckets` is now gated by the new `s3:ListAllMyBuckets` action, evaluated against `arn:aws:s3:::*`. The request names no bucket, so only identity policies apply — there is no resource policy to combine with, which is the same shape `CreateBucket` already had, so both now share one identity-only evaluation path. Root and admin bypass it, and backends with no identity-policy layer keep listing as before since their listing is already narrowed to the caller's own buckets. The action is IAM-only and is deliberately absent from the bucket-policy action list.
**Fixed bucket ownership.** The standalone IAM client has no per-user ownership to express — accounts are all plain users, cannot be enumerated, and access is decided by policy rather than ACL — so it now implements `auth.FixedBucketOwner` and every bucket is owned by root. Bucket creation stops resolving an owner, `ListBuckets` returns every bucket to every caller (what they may then do with one stays a per-request policy decision), and the admin `ChangeBucketOwner` reports method-not-supported. Other IAM backends are untouched.
**IAM service CORS.** `--cors-allow-origin` now applies to the `iam` command: it answers preflights and stamps the CORS headers, mirroring back the requested method and headers rather than enumerating the SigV4 header set. Without it no browser can reach the IAM API at all, so setting `--webui` without it falls back to `*` with a warning. The chart gets `iamServer.corsAllowOrigin`.
**WebUI.** New IAM pages for users, roles and OIDC providers, signing IAM/STS query-form requests directly from the browser. Navigation is capability-gated rather than role-gated: on sign-in the session probes the S3, admin and IAM endpoints independently and each page shows only what those credentials actually reach, so one build serves an IAM-only dashboard, an S3-only dashboard, and a combined one. The login page takes an optional IAM endpoint, seeded from the new `--webui-iam-gateways` (chart: `webui.iamGateways`) — never auto-detected, since the IAM service is a separate process. The WebUI can also be hosted by `versitygw iam` itself, for deployments with no S3 gateway behind it.
**The admin API is ignored once an IAM endpoint is in play.** The IAM service is then the user directory and bucket ownership is fixed, which leaves the admin API no job: the session is given no admin endpoint at all, its login field is hidden, `users.html` redirects to its IAM counterpart, and every admin-only surface stays off screen. Dashboard and Buckets remain available to any S3 session in such a deployment, running on the S3 and IAM APIs alone and surfacing each denial per action instead of redirecting.
Also fixes two WebUI bugs: embedded assets went out with a zero modification time and no `Cache-Control`, so browsers treated them as fresh for centuries and an upgraded gateway served new HTML against stale JS — they now revalidate against an ETag; and the login page's advanced-options section clipped its last field, since it animated to a height named in the stylesheet rather than the one it measures now.
**Usage**
IAM-only dashboard, served by the IAM service:
versitygw iam --port :7076 --webui :8080 --cors-allow-origin http://localhost:8080/
IAM + S3, dashboard served by the IAM service — point it at the gateway with `--webui-gateways`, and let the gateway accept the dashboard's origin:
versitygw iam --port :7076 --webui :8080 --webui-gateways http://localhost:7070/ --cors-allow-origin http://localhost:8080/
versitygw --port :7070 --cors-allow-origin http://localhost:8080/ posix /data
IAM + S3, dashboard served by the S3 gateway — point it at the IAM service with `--webui-iam-gateways`, and let the IAM service accept the dashboard's origin:
versitygw --port :7070 --webui :8080 --webui-iam-gateways http://localhost:7076/ posix /data
versitygw iam --port :7076 --cors-allow-origin http://localhost:8080/
601 lines
23 KiB
YAML
601 lines
23 KiB
YAML
# Default values for versitygw.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
# Standard Helm chart settings
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
# Number of pod replicas for the deployment
|
|
# Note that when using the "posix" backend with a PVC,
|
|
# you can only increase the number of replicas if you have a "ReadWriteMany" volume!
|
|
replicaCount: 1
|
|
|
|
# Specifies the strategy used to replace old Pods by new ones. strategy.type can be
|
|
# "Recreate" or "RollingUpdate". "RollingUpdate" is the default value.
|
|
# Using "Recreate" is often useful when using a "ReadWriteOnce" volume.
|
|
strategy: {}
|
|
|
|
# This section defines which image to use and how to pull it.
|
|
# Find all available tags / releases at: https://github.com/versity/versitygw/pkgs/container/versitygw
|
|
image:
|
|
repository: ghcr.io/versity/versitygw
|
|
tag: "latest"
|
|
pullPolicy: IfNotPresent
|
|
pullSecrets: []
|
|
|
|
serviceAccount:
|
|
# Specifies whether a service account should be created
|
|
create: true
|
|
# Annotations to add to the service account (e.g. for IRSA / Workload Identity)
|
|
annotations: {}
|
|
# Name of the service account to use. If empty, a name is generated using the fullname template.
|
|
name: ""
|
|
|
|
# Additional annotations for the pod
|
|
podAnnotations: {}
|
|
# Additional annotations for the Deployment object (for example, a Secret
|
|
# reloader controller that restarts pods after credential/certificate rotation).
|
|
deploymentAnnotations: {}
|
|
# Additional labels for the pod
|
|
podLabels: {}
|
|
|
|
# Security settings for the Deployment Pod and its containers.
|
|
# The settings below are the recommended, least-privilege values.
|
|
# For more details refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
|
|
# The Kubernetes Service that exposes the versitygw server.
|
|
# To make the server available outside the cluster, the type should be changed to `NodePort` or `LoadBalancer`.
|
|
service:
|
|
type: ClusterIP
|
|
|
|
# --- Ingress ---
|
|
# Expose the S3 API via a Kubernetes Ingress resource.
|
|
# Requires an ingress controller (e.g. nginx, traefik) to be installed in the cluster.
|
|
ingress:
|
|
enabled: false
|
|
# IngressClass to use (maps to spec.ingressClassName).
|
|
# Leave empty to use the cluster default.
|
|
className: ""
|
|
# Annotations applied to the Ingress resource.
|
|
# Use these to configure controller-specific behaviour, e.g.:
|
|
# nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
# nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
annotations: {}
|
|
# List of host rules. Each host can expose one or more paths.
|
|
# The `servicePort` field on each path selects which named Service port to route to.
|
|
# Supported values: s3-api (default), admin, webui.
|
|
hosts:
|
|
- host: s3.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
# servicePort: s3-api # default — routes to the S3 API port
|
|
# TLS configuration. Each entry maps a secret name to one or more hosts.
|
|
# The secret must contain tls.crt and tls.key.
|
|
# Example:
|
|
# tls:
|
|
# - secretName: versitygw-tls
|
|
# hosts:
|
|
# - s3.example.com
|
|
tls: []
|
|
|
|
# --- HTTPRoute ---
|
|
# Expose the S3 API via a Gateway API HTTPRoute resource.
|
|
# Requires Gateway API CRDs and a Gateway API implementation (Envoy Gateway, Istio, Kgateway, etc.) in the cluster.
|
|
httpRoute:
|
|
enabled: false
|
|
annotations: {}
|
|
# The parent Gateway(s) this route attaches to.
|
|
parentRefs:
|
|
- name: my-gateway
|
|
# namespace: gateway-system
|
|
# sectionName: https
|
|
# Hostnames for the route.
|
|
hostnames:
|
|
- s3.example.com
|
|
# Rules that define how requests are matched and routed to the service.
|
|
# See https://gateway-api.sigs.k8s.io/api-types/httproute/#rules
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
|
|
# --- Root credentials ---
|
|
# The root S3 access credentials. These are required for the gateway to start.
|
|
# IMPORTANT: For production use, set auth.existingSecret instead of storing
|
|
# credentials in this values file.
|
|
auth:
|
|
# If set, use this existing Kubernetes Secret for credentials instead of creating one.
|
|
# The secret must contain the keys: rootAccessKeyId and rootSecretAccessKey
|
|
existingSecret: ""
|
|
# Root access key ID (used when existingSecret is empty)
|
|
accessKey: ""
|
|
# Root secret access key (used when existingSecret is empty)
|
|
secretKey: ""
|
|
|
|
# --- Versity Gateway server configuration ---
|
|
gateway:
|
|
# -- Backend configuration --
|
|
backend:
|
|
# The storage backend to use. Supported values: posix, scoutfs, s3, azure, plugin
|
|
# This maps to the VGW_BACKEND environment variable used by the container entrypoint.
|
|
type: posix
|
|
# Additional arguments passed to the backend
|
|
args: "/mnt/data"
|
|
# Optional directory for POSIX sidecar metadata storage. When set, the chart
|
|
# mounts this path from persistent storage and exports VGW_META_SIDECAR.
|
|
sidecarDir: ""
|
|
# Optional directory for POSIX or ScoutFS object version storage. When set,
|
|
# the chart mounts this path from persistent storage and exports VGW_VERSIONING_DIR.
|
|
versioningDir: ""
|
|
# for s3 backend:
|
|
# args: "--access 0123456 --secret 0xdeadbeef --endpoint http://s3.example.com"
|
|
# for azure backend:
|
|
# args: ""--account 0123456 --access-key 0xdeadbeef"
|
|
# for posix backend with sidecar metadata:
|
|
# sidecarDir: "/mnt/metadata"
|
|
# for posix or scoutfs backend with object versioning:
|
|
# versioningDir: "/mnt/versioning"
|
|
|
|
# The port versitygw listens on for S3 API requests.
|
|
port: 7070
|
|
# The AWS region string returned to clients.
|
|
region: us-east-1
|
|
# Enable virtual-host-style bucket addressing (e.g. bucket.example.com).
|
|
# Set to your domain (e.g. "example.com") to enable.
|
|
virtualDomain: ""
|
|
# Allow only read (GET/HEAD) operations. Prevents any writes.
|
|
readOnly: false
|
|
# Silence stdout request logging (useful when using a dedicated access log).
|
|
quiet: false
|
|
# Debug logger verbosity: "silent" (default, no debug output), "debug" (full
|
|
# request/response logging with secrets and tokens masked), or "unsafe"
|
|
# (full logging with NO masking -- prints access keys, secrets, session
|
|
# tokens, and signatures in the clear; only use for local troubleshooting,
|
|
# never in production).
|
|
logLevel: silent
|
|
# Deprecated: use logLevel: debug instead. Kept for backwards compatibility;
|
|
# only takes effect when logLevel is left at "silent".
|
|
debug: false
|
|
# Access log file path for S3 requests (AWS log format). Empty = disabled.
|
|
accessLog: ""
|
|
# Default CORS allowed origin. Empty = CORS disabled.
|
|
# Must include the scheme prefix, e.g. "https://example.com" or "http://example.com".
|
|
corsAllowOrigin: ""
|
|
# Disable strict S3 bucket naming validation.
|
|
disableStrictBucketNames: false
|
|
|
|
# --- Admin API server ---
|
|
admin:
|
|
# Enable a separate admin API server on a dedicated port.
|
|
enabled: false
|
|
# The port for the admin API server. Must differ from gateway.port.
|
|
port: 7071
|
|
# Maximum concurrent connections for the admin server.
|
|
maxConnections: 250000
|
|
# Maximum in-flight requests for the admin server.
|
|
maxRequests: 100000
|
|
# --- Ingress ---
|
|
# Expose the Admin API via a Kubernetes Ingress resource.
|
|
# Requires an ingress controller (e.g. nginx, traefik) to be installed in the cluster.
|
|
ingress:
|
|
enabled: false
|
|
# IngressClass to use (maps to spec.ingressClassName).
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: s3-admin.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
# --- HTTPRoute ---
|
|
# Expose the Admin API via a Gateway API HTTPRoute resource.
|
|
# Requires Gateway API CRDs and a Gateway API implementation (Envoy Gateway, Istio, Kgateway, etc.) in the cluster.
|
|
httpRoute:
|
|
enabled: false
|
|
annotations: {}
|
|
# The parent Gateway(s) this route attaches to.
|
|
parentRefs:
|
|
- name: my-gateway
|
|
# namespace: gateway-system
|
|
# sectionName: https
|
|
# Hostnames for the route.
|
|
hostnames:
|
|
- s3-admin.example.com
|
|
# Rules that define how requests are matched and routed to the service.
|
|
# See https://gateway-api.sigs.k8s.io/api-types/httproute/#rules
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
|
|
# --- WebUI ---
|
|
webui:
|
|
# Enable the built-in browser-based management WebUI.
|
|
enabled: false
|
|
# The port the WebUI listens on.
|
|
port: 8080
|
|
# Disable TLS for the WebUI even when gateway TLS is enabled.
|
|
noTls: false
|
|
# List of S3 endpoints used by the Versity Web UI
|
|
# The list that is auto-generated by Versity GW is wrong in the case of
|
|
# Kubernetes because it uses the internal pod IP addresses.
|
|
apiGateways: []
|
|
# - s3.example.com
|
|
# List of Versity Admin endpoints used by the Versity Web UI
|
|
# The list that is auto-generated by Versity GW is wrong in the case of
|
|
# Kubernetes because it uses the internal pod IP addresses.
|
|
adminGateways: []
|
|
# - s3-admin.example.com
|
|
# List of standalone IAM service endpoints offered on the WebUI login page.
|
|
# Unlike the two lists above there is nothing to auto-generate: the IAM
|
|
# service is a separate process, so the gateway cannot discover its address.
|
|
# Setting this also tells the WebUI that the standalone IAM service, not the
|
|
# admin API, manages this deployment: the admin endpoint is ignored entirely
|
|
# (hidden from the login page along with the Users tab and every other
|
|
# admin-API surface), and bucket management runs over the S3 API instead.
|
|
# Point it at iamServer.service (see the iamServer section) or its ingress.
|
|
iamGateways: []
|
|
# - https://iam.example.com
|
|
# --- Ingress ---
|
|
# Expose the WebUI via a Kubernetes Ingress resource.
|
|
# Requires an ingress controller (e.g. nginx, traefik) to be installed in the cluster.
|
|
ingress:
|
|
enabled: false
|
|
# IngressClass to use (maps to spec.ingressClassName).
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: versitygw.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
# --- HTTPRoute ---
|
|
# Expose the WebUI via a Gateway API HTTPRoute resource.
|
|
# Requires Gateway API CRDs and a Gateway API implementation (Envoy Gateway, Istio, Kgateway, etc.) in the cluster.
|
|
httpRoute:
|
|
enabled: false
|
|
annotations: {}
|
|
# The parent Gateway(s) this route attaches to.
|
|
parentRefs:
|
|
- name: my-gateway
|
|
# namespace: gateway-system
|
|
# sectionName: https
|
|
# Hostnames for the route.
|
|
hostnames:
|
|
- versitygw.example.com
|
|
# Rules that define how requests are matched and routed to the service.
|
|
# See https://gateway-api.sigs.k8s.io/api-types/httproute/#rules
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
|
|
# --- Website Hosting ---
|
|
website:
|
|
# Enable the static website hosting endpoint.
|
|
# Serves S3 buckets as static websites with index documents, custom error
|
|
# pages, and routing rules via a separate HTTP endpoint.
|
|
enabled: false
|
|
# The port the website endpoint listens on.
|
|
port: 8090
|
|
# Base domain for virtual-host routing. Optional.
|
|
# Host "blog.<domain>" serves bucket "blog"; host "<domain>" serves
|
|
# bucket "<domain>" (apex domain support).
|
|
# When empty, catch-all mode is used: the full hostname is the bucket
|
|
# name (name buckets as FQDNs, e.g. "blog.example.com").
|
|
domain: ""
|
|
# - example: domain: "example.com"
|
|
# Disable TLS for the website endpoint even when gateway TLS is enabled.
|
|
noTls: false
|
|
|
|
# --- IAM (Identity and Access Management) client, consumed by the S3 gateway ---
|
|
iam:
|
|
enabled: false
|
|
# TODO: implement other IAM backend (LDAP, Vault-direct, FreeIPA)
|
|
# - internal: flat-file IAM stored alongside backend data, inside the gateway pod.
|
|
# - standalone: delegate to a separate standalone IAM API service (an
|
|
# AWS-compatible IAM Query API server), reached over its private mTLS
|
|
# endpoint. See `iamServer` below to optionally deploy that service from
|
|
# this same chart, or point `iam.standalone.endpoint` at an externally
|
|
# managed one.
|
|
# Other values remain available for IAM backends configured through extraEnv.
|
|
type: internal
|
|
# Disable IAM result caching.
|
|
cacheDisable: false
|
|
# IAM cache entry TTL in seconds.
|
|
cacheTtl: 120
|
|
# IAM cache cleanup interval in seconds.
|
|
cachePrune: 3600
|
|
# Enable IAM-specific debug output (independent of gateway.logLevel).
|
|
debug: false
|
|
|
|
# --- standalone (iam.type: standalone) ---
|
|
standalone:
|
|
# Private endpoint of the standalone IAM service: a "host:port" TCP
|
|
# address (mTLS required -- see `certificate` below). Leave empty to
|
|
# auto-target the in-chart private `iamServer` Service
|
|
# (requires iamServer.enabled=true and iamServer.private.enabled=true).
|
|
endpoint: ""
|
|
# Identity this gateway signs its private-endpoint calls with. Both
|
|
# default to auth.accessKey/secretKey (root) when left empty. Literal
|
|
# values are retained for compatibility but are stored in Helm release
|
|
# history; prefer credentials.existingSecret for production.
|
|
access: ""
|
|
secret: ""
|
|
credentials:
|
|
# Optional Secret containing a distinct IAM client identity. Point this
|
|
# at iamServer.auth.existingSecret to use that server's root identity.
|
|
existingSecret: ""
|
|
accessKeyKey: rootAccessKeyId
|
|
secretKeyKey: rootSecretAccessKey
|
|
# POSIX uid/gid/project-id assigned to every account resolved through
|
|
# this backend (the standalone IAM service has no per-user POSIX
|
|
# identity concept of its own).
|
|
defaultUid: 0
|
|
defaultGid: 0
|
|
defaultProjectId: 0
|
|
# mTLS client identity presented to the standalone IAM service's private
|
|
# endpoint. Required together with the peer trusting this certificate.
|
|
certificate:
|
|
# Auto-provision this client certificate via cert-manager. issuerRef
|
|
# must be a CA-type issuer (Issuer/ClusterIssuer of kind CA, or Vault) --
|
|
# one that populates ca.crt in the resulting Secret -- and MUST be the
|
|
# same issuer used for iamServer.private.certificate, so each side's
|
|
# ca.crt can verify the other's certificate.
|
|
create: false
|
|
# Use an existing Secret instead (or as well as -- existingSecret wins
|
|
# when both are set). Must contain tls.crt, tls.key, and ca.crt (the CA
|
|
# that signed iamServer's private-listener server certificate).
|
|
existingSecret: ""
|
|
issuerRef: {}
|
|
# group: cert-manager.io
|
|
# kind: ClusterIssuer
|
|
# name: internal-ca
|
|
|
|
# --- Standalone IAM API Server ---
|
|
# Deploys a separate `versitygw iam` server as its own Deployment and public/
|
|
# private Services --
|
|
# an AWS-compatible IAM Query API, independently scalable and centralized
|
|
# (unlike iam.type: internal, which runs file-backed IAM inside each gateway
|
|
# pod). Manage users/roles/policies against its public control-plane API
|
|
# (reusing the gateway root Secret by default, or `iamServer.auth`); point
|
|
# gateways at it via iam.type: standalone.
|
|
iamServer:
|
|
enabled: false
|
|
replicaCount: 1
|
|
# Deployment strategy override for Vault storage. Internal file storage
|
|
# always uses Recreate to prevent concurrent writers and ReadWriteOnce
|
|
# multi-attach failures. Empty uses Kubernetes' default RollingUpdate for Vault.
|
|
strategy: {}
|
|
auth:
|
|
# Optional Secret containing rootAccessKeyId and rootSecretAccessKey.
|
|
# Empty reuses the top-level auth Secret for backward compatibility.
|
|
existingSecret: ""
|
|
# Optional image override; defaults to the top-level `image` values when unset.
|
|
image:
|
|
repository: ""
|
|
tag: ""
|
|
pullPolicy: ""
|
|
# Public control-plane API port (aws iam create-user, list-roles, etc.).
|
|
port: 7070
|
|
maxConnections: 250000
|
|
maxRequests: 100000
|
|
# Silence stdout request logging.
|
|
quiet: false
|
|
# Debug logger verbosity: "silent" (default), "debug", or "unsafe" -- see
|
|
# gateway.logLevel for details.
|
|
logLevel: silent
|
|
# Reject CreateOpenIDConnectProvider requests that omit ThumbprintList
|
|
# instead of auto-fetching it over an outbound TLS connection to the
|
|
# caller-supplied URL. Recommended for restricted/air-gapped clusters.
|
|
disableOidcThumbprintAutofetch: false
|
|
# Access-Control-Allow-Origin for the control-plane API. Required before a
|
|
# browser can reach this service: the WebUI is served from another origin, so
|
|
# every call it makes is cross-origin and is blocked without this. Set it to
|
|
# the WebUI's own origin (see webui.ingress) when webui.iamGateways points
|
|
# here. Empty leaves the API usable by CLI and SDK clients only.
|
|
corsAllowOrigin: ""
|
|
# Optional TLS for the public control-plane API. No cert-manager automation
|
|
# here -- bring your own Secret (must contain tls.crt / tls.key).
|
|
tls:
|
|
enabled: false
|
|
secretName: ""
|
|
|
|
# -- Storage backend --
|
|
storage:
|
|
# internal (file-backed, requires persistence below) | vault
|
|
type: internal
|
|
vault:
|
|
endpointUrl: ""
|
|
namespace: ""
|
|
secretStoragePath: ""
|
|
secretStorageNamespace: ""
|
|
authMethod: ""
|
|
authNamespace: ""
|
|
mountPath: ""
|
|
roleId: ""
|
|
# Secret containing sensitive Vault auth material. Recognized keys
|
|
# (provide whichever your vault-auth-method needs):
|
|
# roleSecret -- AppRole secret ID (VGW_IAM_VAULT_ROLE_SECRET)
|
|
# rootToken -- Vault root token (VGW_IAM_VAULT_ROOT_TOKEN)
|
|
existingSecret: ""
|
|
# Separate Secret for Vault's TLS material -- kept distinct from
|
|
# `existingSecret` above (auth credentials) since these are a different
|
|
# security concern (transport trust vs. identity). Recognized keys
|
|
# (provide whichever your vault-endpoint-url/mTLS setup needs):
|
|
# serverCert -- CA cert verifying Vault's server certificate (VGW_IAM_VAULT_SERVER_CERT)
|
|
# clientCert -- client cert for mTLS to Vault (VGW_IAM_VAULT_CLIENT_CERT)
|
|
# clientCertKey -- private key for clientCert (VGW_IAM_VAULT_CLIENT_CERT_KEY)
|
|
# Ignored for any of the three that has a literal value below.
|
|
tlsExistingSecret: ""
|
|
# PEM-encoded certificate content (literal text, not a file path).
|
|
# Prefer tlsExistingSecret above for production; these are stored in
|
|
# Helm release history in plaintext.
|
|
serverCert: ""
|
|
clientCert: ""
|
|
clientCertKey: ""
|
|
|
|
# -- Private mTLS endpoint --
|
|
# Serves the derive-signing-key/evaluate-policy/resolve-identity calls that
|
|
# gateways configured with iam.type: standalone use internally. Required
|
|
# for any such gateway to reach this service over TCP.
|
|
private:
|
|
enabled: true
|
|
port: 7443
|
|
certificate:
|
|
# Auto-provision the server certificate for this listener via
|
|
# cert-manager. issuerRef must be a CA-type issuer -- see
|
|
# iam.standalone.certificate for the matching client-side requirement.
|
|
create: false
|
|
# Use an existing Secret instead (or as well as -- existingSecret wins
|
|
# when both are set). Must contain tls.crt, tls.key, and ca.crt (the CA
|
|
# that signs gateway client certificates).
|
|
existingSecret: ""
|
|
issuerRef: {}
|
|
# group: cert-manager.io
|
|
# kind: ClusterIssuer
|
|
# name: internal-ca
|
|
# DNS names for the certificate. Defaults to the in-chart Service's
|
|
# names when left empty.
|
|
dnsNames: []
|
|
|
|
service:
|
|
# Type of the public control-plane Service. The private Service is always
|
|
# ClusterIP and is not exposed when this is NodePort or LoadBalancer.
|
|
type: ClusterIP
|
|
|
|
# Storage for the standalone IAM service's own file-backed data (storage.type: internal).
|
|
persistence:
|
|
enabled: true
|
|
create: true
|
|
claimName: ""
|
|
size: 1Gi
|
|
storageClassName: ""
|
|
accessMode: ReadWriteOnce
|
|
|
|
resources: {}
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
deploymentAnnotations: {}
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
# Extra environment variables to pass to the container.
|
|
# Use this to configure advanced options not covered above (e.g. event notifications,
|
|
# LDAP IAM, S3 proxy backend credentials, StatsD metrics, etc.).
|
|
# Refer to https://github.com/versity/versitygw#configuration for the full list.
|
|
# Example:
|
|
# extraEnv:
|
|
# - name: VGW_EVENT_KAFKA_URL
|
|
# value: "kafka:9092"
|
|
# - name: VGW_IAM_LDAP_URL
|
|
# value: "ldap://ldap.example.com"
|
|
extraEnv: []
|
|
|
|
# --- TLS ---
|
|
# Enable HTTPS for the S3 API (and admin/webui if not separately configured).
|
|
tls:
|
|
# Set to true to enable TLS. Requires certificate.secretName or certificate.create.
|
|
enabled: false
|
|
|
|
# --- cert-manager Certificate ---
|
|
certificate:
|
|
# Set to the name of an existing TLS Secret to use for HTTPS.
|
|
# If empty and certificate.create is false, defaults to <fullname>-cert.
|
|
secretName: ""
|
|
# Create a cert-manager Certificate resource to automatically provision TLS.
|
|
# Requires cert-manager to be installed in the cluster.
|
|
create: false
|
|
# DNS names to include in the certificate. Required when certificate.create is true.
|
|
dnsNames: []
|
|
# - versitygw.example.com
|
|
# cert-manager issuer reference. Required when certificate.create is true.
|
|
# issuerRef:
|
|
# group: cert-manager.io
|
|
# kind: ClusterIssuer
|
|
# name: "letsencrypt-production"
|
|
|
|
# --- Persistence ---
|
|
# Storage for the S3 gateway backend data (required for posix/scoutfs backends).
|
|
# By default, an emptyDir (ephemeral) volume is used.
|
|
persistence:
|
|
# If disabled, an emptyDir (ephemeral!) will be used instead of a PVC.
|
|
# NOTE: Data will be lost on pod restart if persistence is disabled.
|
|
enabled: true
|
|
# Whether to create a new PVC. If false, persistence.claimName must be provided.
|
|
create: true
|
|
# The name of the PVC that should be created or used (if persistence.create=false)
|
|
claimName: ""
|
|
size: 10Gi
|
|
storageClassName: ""
|
|
# If set then use a hostPath volume, needs `persistence.create=false`
|
|
hostPath: ""
|
|
# Access mode for the PVC. Use ReadWriteMany for multi-replica deployments.
|
|
accessMode: ReadWriteOnce
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 500m
|
|
# memory: 512Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
# Topology spread constraints to control how pods are distributed across
|
|
# topology domains (e.g. nodes, zones). Useful for spreading replicas for
|
|
# high availability. See:
|
|
# https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
|
|
# Example:
|
|
# topologySpreadConstraints:
|
|
# - maxSkew: 1
|
|
# topologyKey: topology.kubernetes.io/zone
|
|
# whenUnsatisfiable: ScheduleAnyway
|
|
# labelSelector:
|
|
# matchLabels:
|
|
# app.kubernetes.io/name: versitygw
|
|
topologySpreadConstraints: []
|
|
|
|
networkPolicy:
|
|
enabled: false
|
|
# Label maps used as matchLabels selectors. When both are set, a source pod
|
|
# must match both selectors. A pod-only selector applies to this release's
|
|
# namespace; an empty pair denies ingress to the gateway. The IAM policy
|
|
# always permits this release's gateway pods to reach its private mTLS port.
|
|
allowIngressFromNamespaces: {}
|
|
# kubernetes.io/metadata.name: kube-system
|
|
allowIngressFromPods: {}
|
|
# svccontroller.k3s.cattle.io/svcname: versitygw
|