mirror of
https://github.com/versity/versitygw.git
synced 2026-08-29 04:06:56 +00:00
niksis02
7b6b816df9
This adds a new iamServer Deployment, split public and private Services, a PersistentVolumeClaim, and cert-manager Certificate resources so the standalone versitygw iam API server can be deployed directly from this chart, independently scalable from the S3 gateway and backed by either internal file storage or HashiCorp Vault, with Vault auth credentials and Vault TLS material kept in separate Kubernetes secrets. The gateway side gains iam.type=standalone client wiring that reaches the IAM service over its private mTLS endpoint, with certificates supplied either through an existing secret or auto-provisioned via cert-manager using a shared CA-type issuer so both peers can verify each other from their own certificate's ca.crt, and the chart auto-targets the in-chart service when no external endpoint is configured. gateway.logLevel and iamServer.logLevel replace the old boolean debug flag with the silent, debug, and unsafe levels the binary now supports, docker-entrypoint.sh gained iam as a recognized VGW_BACKEND value so the new deployment can start through the existing entrypoint, NetworkPolicy resources were corrected to use proper peer lists and to default to deny instead of allow when no ingress rules are configured, pod and Deployment selector labels were separated between the gateway and the IAM server to prevent them from matching each other's Services, and a battery of template time validation guards was added to fail fast on invalid combinations such as multiple replicas against the internal file store or a missing certificate for a TCP private endpoint, together with expanded helm lint coverage in CI for these new configurations.
220 lines
7.2 KiB
Smarty
220 lines
7.2 KiB
Smarty
{{/*
|
|
Expand the name of the chart.
|
|
*/}}
|
|
{{- define "versitygw.name" -}}
|
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create a default fully qualified app name.
|
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
If release name contains chart name it will be used as a full name.
|
|
*/}}
|
|
{{- define "versitygw.fullname" -}}
|
|
{{- if .Values.fullnameOverride }}
|
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
|
{{- else }}
|
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
|
{{- if contains $name .Release.Name }}
|
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
|
{{- else }}
|
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create chart name and version as used by the chart label.
|
|
*/}}
|
|
{{- define "versitygw.chart" -}}
|
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Common labels
|
|
*/}}
|
|
{{- define "versitygw.labels" -}}
|
|
helm.sh/chart: {{ include "versitygw.chart" . }}
|
|
{{ include "versitygw.selectorLabels" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Selector labels
|
|
These are the stable labels used in Service selectors and Deployment matchLabels.
|
|
They intentionally exclude helm.sh/chart (which includes the version) to prevent
|
|
broken selectors during helm upgrades.
|
|
*/}}
|
|
{{- define "versitygw.selectorLabels" -}}
|
|
app.kubernetes.io/name: {{ include "versitygw.name" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create the name of the service account to use
|
|
*/}}
|
|
{{- define "versitygw.serviceAccountName" -}}
|
|
{{- if .Values.serviceAccount.create }}
|
|
{{- default (include "versitygw.fullname" .) .Values.serviceAccount.name }}
|
|
{{- else }}
|
|
{{- default "default" .Values.serviceAccount.name }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the root S3 credentials.
|
|
Uses auth.existingSecret if set, otherwise derives a name from the release fullname.
|
|
*/}}
|
|
{{- define "versitygw.credentialsSecretName" -}}
|
|
{{- if .Values.auth.existingSecret }}
|
|
{{- printf "%s" .Values.auth.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-credentials" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The root credential Secret used by the standalone IAM API server. It defaults
|
|
to the gateway root Secret for backward compatibility, but can be separated so
|
|
the public IAM control plane and S3 gateway do not share administrative keys.
|
|
*/}}
|
|
{{- define "versitygw.iamServerCredentialsSecretName" -}}
|
|
{{- $auth := .Values.iamServer.auth | default dict -}}
|
|
{{- if $auth.existingSecret }}
|
|
{{- $auth.existingSecret }}
|
|
{{- else }}
|
|
{{- include "versitygw.credentialsSecretName" . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the PVC to use for persistence.
|
|
Returns empty string if persistence is disabled.
|
|
*/}}
|
|
{{- define "versitygw.pvcName" -}}
|
|
{{- if .Values.persistence.enabled }}
|
|
{{- if .Values.persistence.claimName }}
|
|
{{- .Values.persistence.claimName }}
|
|
{{- else }}
|
|
{{- printf "%s-data" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the TLS Secret used for HTTPS.
|
|
Uses certificate.secretName if set, otherwise derives a name from the release fullname.
|
|
*/}}
|
|
{{- define "versitygw.certificateSecretName" -}}
|
|
{{- if .Values.certificate.secretName }}
|
|
{{- printf "%s" .Values.certificate.secretName }}
|
|
{{- else }}
|
|
{{- printf "%s-cert" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name label for the standalone IAM API server. It must differ from the
|
|
gateway's name label because the gateway Deployment's immutable selector only
|
|
contains app.kubernetes.io/name and app.kubernetes.io/instance. Reusing that
|
|
pair would make the gateway Deployment, Service, and NetworkPolicy also select
|
|
IAM server pods.
|
|
*/}}
|
|
{{- define "versitygw.iamServerName" -}}
|
|
{{- $base := include "versitygw.name" . | trunc 59 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The fullname of the standalone IAM API server's Deployment/Service.
|
|
*/}}
|
|
{{- define "versitygw.iamServerFullname" -}}
|
|
{{- $base := include "versitygw.fullname" . | trunc 59 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The standalone IAM private Service is always cluster-internal, independently
|
|
of how the public control-plane Service is exposed.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPrivateServiceFullname" -}}
|
|
{{- $base := include "versitygw.fullname" . | trunc 51 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam-private" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Selector labels for the standalone IAM API server. Deliberately separate from
|
|
versitygw.selectorLabels (used by the main gateway Deployment's immutable
|
|
spec.selector) so the two Deployments never collide.
|
|
*/}}
|
|
{{- define "versitygw.iamServerSelectorLabels" -}}
|
|
app.kubernetes.io/name: {{ include "versitygw.iamServerName" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
app.kubernetes.io/component: iam-server
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Common labels for the standalone IAM API server.
|
|
*/}}
|
|
{{- define "versitygw.iamServerLabels" -}}
|
|
helm.sh/chart: {{ include "versitygw.chart" . }}
|
|
{{ include "versitygw.iamServerSelectorLabels" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the PVC used for the standalone IAM API server's file-backed storage.
|
|
Returns empty string if persistence is disabled.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPvcName" -}}
|
|
{{- if .Values.iamServer.persistence.enabled }}
|
|
{{- if .Values.iamServer.persistence.claimName }}
|
|
{{- .Values.iamServer.persistence.claimName }}
|
|
{{- else }}
|
|
{{- $base := include "versitygw.fullname" . | trunc 54 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam-data" $base }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the standalone IAM API server's private-listener
|
|
server certificate (tls.crt/tls.key) and the CA (ca.crt) used to verify gateway
|
|
client certificates. Uses iamServer.private.certificate.existingSecret if set,
|
|
otherwise derives a name for the cert-manager-managed Certificate.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPrivateCertSecretName" -}}
|
|
{{- if .Values.iamServer.private.certificate.existingSecret }}
|
|
{{- .Values.iamServer.private.certificate.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-private-cert" (include "versitygw.iamServerFullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the gateway's mTLS client certificate
|
|
(tls.crt/tls.key) and the CA (ca.crt) used to verify the standalone IAM
|
|
service's server certificate. Uses iam.standalone.certificate.existingSecret
|
|
if set, otherwise derives a name for the cert-manager-managed Certificate.
|
|
*/}}
|
|
{{- define "versitygw.iamClientCertSecretName" -}}
|
|
{{- if .Values.iam.standalone.certificate.existingSecret }}
|
|
{{- .Values.iam.standalone.certificate.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-iam-client-cert" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The gateway's standalone-IAM private endpoint address. Uses
|
|
iam.standalone.endpoint if set, otherwise auto-targets the in-chart iamServer
|
|
Service's private port.
|
|
*/}}
|
|
{{- define "versitygw.standaloneIAMEndpoint" -}}
|
|
{{- if .Values.iam.standalone.endpoint }}
|
|
{{- .Values.iam.standalone.endpoint }}
|
|
{{- else if .Values.iamServer.enabled }}
|
|
{{- printf "%s:%d" (include "versitygw.iamServerPrivateServiceFullname" .) (.Values.iamServer.private.port | int) }}
|
|
{{- end }}
|
|
{{- end }}
|