mirror of
https://github.com/versity/versitygw.git
synced 2026-09-22 07:54:14 +00:00
niksis02
966a6a8650
Closes #2322 The admin API could not be served under a path prefix. Admin requests are SigV4-signed over the full path, so a reverse proxy or Gateway API route cannot strip a prefix before forwarding. That made it impossible to serve the WebUI and the admin API under one hostname. The new `--admin-path-prefix` (`VGW_ADMIN_PATH_PREFIX`) option mounts the admin routes under a single-segment prefix such as `/admin`, on `--admin-port` or, when that is unset, on the S3 port. Admin clients include the prefix in their endpoint URL, which the admin CLI and the WebUI already support. The prefix is limited to unreserved characters, because clients and the gateway encode other characters differently when signing. When the admin API shares the S3 port, the prefix must also differ from `--webui-s3-prefix`, otherwise the WebUI mount answers the admin requests. Auto-detected WebUI admin gateway URLs and the startup banner now include the prefix. The admin routes served on the S3 port now reuse `S3AdminRouter` instead of a duplicated route list. This also stops the standalone admin server from recording bucket creation under the `ActionAdminListBuckets` action. The Helm chart now exposes `webui.pathPrefix`, `webui.s3Prefix` and `admin.pathPrefix`. The WebUI gateway lists are also passed when only `webui.s3Prefix` is set, since the WebUI hosted on the S3 port does not require `webui.enabled`. Internal IAM data can now live on its own volume. `iam.dir` sets the IAM directory, and `iam.persistence` creates or references a dedicated PVC when `iam.enabled` is true and `iam.type` is `internal`. Otherwise IAM data stays in the `iam` subdirectory of the backend data volume, so existing releases are unaffected. The chart now rejects overlapping storage directories. `iam.dir` must be an absolute path outside `/mnt/data`, `gateway.backend.sidecarDir` and `gateway.backend.versioningDir`, and those three directories must not overlap each other. Deleting a bucket removes `<dir>/<bucket>` from the sidecar and versioning directories, so with nested directories, deleting a suitably named bucket could wipe IAM accounts, object versions or the entire backend data directory.
246 lines
8.0 KiB
Smarty
246 lines
8.0 KiB
Smarty
{{/*
|
|
Expand the name of the chart.
|
|
*/}}
|
|
{{- define "versitygw.name" -}}
|
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create a default fully qualified app name.
|
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
If release name contains chart name it will be used as a full name.
|
|
*/}}
|
|
{{- define "versitygw.fullname" -}}
|
|
{{- if .Values.fullnameOverride }}
|
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
|
{{- else }}
|
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
|
{{- if contains $name .Release.Name }}
|
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
|
{{- else }}
|
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create chart name and version as used by the chart label.
|
|
*/}}
|
|
{{- define "versitygw.chart" -}}
|
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Common labels
|
|
*/}}
|
|
{{- define "versitygw.labels" -}}
|
|
helm.sh/chart: {{ include "versitygw.chart" . }}
|
|
{{ include "versitygw.selectorLabels" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Selector labels
|
|
These are the stable labels used in Service selectors and Deployment matchLabels.
|
|
They intentionally exclude helm.sh/chart (which includes the version) to prevent
|
|
broken selectors during helm upgrades.
|
|
*/}}
|
|
{{- define "versitygw.selectorLabels" -}}
|
|
app.kubernetes.io/name: {{ include "versitygw.name" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Create the name of the service account to use
|
|
*/}}
|
|
{{- define "versitygw.serviceAccountName" -}}
|
|
{{- if .Values.serviceAccount.create }}
|
|
{{- default (include "versitygw.fullname" .) .Values.serviceAccount.name }}
|
|
{{- else }}
|
|
{{- default "default" .Values.serviceAccount.name }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the root S3 credentials.
|
|
Uses auth.existingSecret if set, otherwise derives a name from the release fullname.
|
|
*/}}
|
|
{{- define "versitygw.credentialsSecretName" -}}
|
|
{{- if .Values.auth.existingSecret }}
|
|
{{- printf "%s" .Values.auth.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-credentials" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The root credential Secret used by the standalone IAM API server. It defaults
|
|
to the gateway root Secret for backward compatibility, but can be separated so
|
|
the public IAM control plane and S3 gateway do not share administrative keys.
|
|
*/}}
|
|
{{- define "versitygw.iamServerCredentialsSecretName" -}}
|
|
{{- $auth := .Values.iamServer.auth | default dict -}}
|
|
{{- if $auth.existingSecret }}
|
|
{{- $auth.existingSecret }}
|
|
{{- else }}
|
|
{{- include "versitygw.credentialsSecretName" . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the PVC to use for persistence.
|
|
Returns empty string if persistence is disabled.
|
|
*/}}
|
|
{{- define "versitygw.pvcName" -}}
|
|
{{- if .Values.persistence.enabled }}
|
|
{{- if .Values.persistence.claimName }}
|
|
{{- .Values.persistence.claimName }}
|
|
{{- else }}
|
|
{{- printf "%s-data" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the PVC holding the gateway's internal IAM data when
|
|
iam.persistence.enabled is set.
|
|
*/}}
|
|
{{- define "versitygw.iamPvcName" -}}
|
|
{{- $iamPersistence := .Values.iam.persistence | default dict -}}
|
|
{{- if $iamPersistence.claimName }}
|
|
{{- $iamPersistence.claimName }}
|
|
{{- else }}
|
|
{{- $base := include "versitygw.fullname" . | trunc 51 | trimSuffix "-" -}}
|
|
{{- printf "%s-gateway-iam" $base }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Returns "true" when two absolute paths are equal or one contains the other.
|
|
Takes a list of two paths.
|
|
*/}}
|
|
{{- define "versitygw.pathsOverlap" -}}
|
|
{{- $a := clean (index . 0) -}}
|
|
{{- $b := clean (index . 1) -}}
|
|
{{- if or (eq $a $b) (eq $a "/") (eq $b "/") (hasPrefix (printf "%s/" $a) $b) (hasPrefix (printf "%s/" $b) $a) -}}
|
|
true
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the TLS Secret used for HTTPS.
|
|
Uses certificate.secretName if set, otherwise derives a name from the release fullname.
|
|
*/}}
|
|
{{- define "versitygw.certificateSecretName" -}}
|
|
{{- if .Values.certificate.secretName }}
|
|
{{- printf "%s" .Values.certificate.secretName }}
|
|
{{- else }}
|
|
{{- printf "%s-cert" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name label for the standalone IAM API server. It must differ from the
|
|
gateway's name label because the gateway Deployment's immutable selector only
|
|
contains app.kubernetes.io/name and app.kubernetes.io/instance. Reusing that
|
|
pair would make the gateway Deployment, Service, and NetworkPolicy also select
|
|
IAM server pods.
|
|
*/}}
|
|
{{- define "versitygw.iamServerName" -}}
|
|
{{- $base := include "versitygw.name" . | trunc 59 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The fullname of the standalone IAM API server's Deployment/Service.
|
|
*/}}
|
|
{{- define "versitygw.iamServerFullname" -}}
|
|
{{- $base := include "versitygw.fullname" . | trunc 59 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The standalone IAM private Service is always cluster-internal, independently
|
|
of how the public control-plane Service is exposed.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPrivateServiceFullname" -}}
|
|
{{- $base := include "versitygw.fullname" . | trunc 51 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam-private" $base }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Selector labels for the standalone IAM API server. Deliberately separate from
|
|
versitygw.selectorLabels (used by the main gateway Deployment's immutable
|
|
spec.selector) so the two Deployments never collide.
|
|
*/}}
|
|
{{- define "versitygw.iamServerSelectorLabels" -}}
|
|
app.kubernetes.io/name: {{ include "versitygw.iamServerName" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
app.kubernetes.io/component: iam-server
|
|
{{- end }}
|
|
|
|
{{/*
|
|
Common labels for the standalone IAM API server.
|
|
*/}}
|
|
{{- define "versitygw.iamServerLabels" -}}
|
|
helm.sh/chart: {{ include "versitygw.chart" . }}
|
|
{{ include "versitygw.iamServerSelectorLabels" . }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the PVC used for the standalone IAM API server's file-backed storage.
|
|
Returns empty string if persistence is disabled.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPvcName" -}}
|
|
{{- if .Values.iamServer.persistence.enabled }}
|
|
{{- if .Values.iamServer.persistence.claimName }}
|
|
{{- .Values.iamServer.persistence.claimName }}
|
|
{{- else }}
|
|
{{- $base := include "versitygw.fullname" . | trunc 54 | trimSuffix "-" -}}
|
|
{{- printf "%s-iam-data" $base }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the standalone IAM API server's private-listener
|
|
server certificate (tls.crt/tls.key) and the CA (ca.crt) used to verify gateway
|
|
client certificates. Uses iamServer.private.certificate.existingSecret if set,
|
|
otherwise derives a name for the cert-manager-managed Certificate.
|
|
*/}}
|
|
{{- define "versitygw.iamServerPrivateCertSecretName" -}}
|
|
{{- if .Values.iamServer.private.certificate.existingSecret }}
|
|
{{- .Values.iamServer.private.certificate.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-private-cert" (include "versitygw.iamServerFullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The name of the Secret holding the gateway's mTLS client certificate
|
|
(tls.crt/tls.key) and the CA (ca.crt) used to verify the standalone IAM
|
|
service's server certificate. Uses iam.standalone.certificate.existingSecret
|
|
if set, otherwise derives a name for the cert-manager-managed Certificate.
|
|
*/}}
|
|
{{- define "versitygw.iamClientCertSecretName" -}}
|
|
{{- if .Values.iam.standalone.certificate.existingSecret }}
|
|
{{- .Values.iam.standalone.certificate.existingSecret }}
|
|
{{- else }}
|
|
{{- printf "%s-iam-client-cert" (include "versitygw.fullname" .) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The gateway's standalone-IAM private endpoint address. Uses
|
|
iam.standalone.endpoint if set, otherwise auto-targets the in-chart iamServer
|
|
Service's private port.
|
|
*/}}
|
|
{{- define "versitygw.standaloneIAMEndpoint" -}}
|
|
{{- if .Values.iam.standalone.endpoint }}
|
|
{{- .Values.iam.standalone.endpoint }}
|
|
{{- else if .Values.iamServer.enabled }}
|
|
{{- printf "%s:%d" (include "versitygw.iamServerPrivateServiceFullname" .) (.Values.iamServer.private.port | int) }}
|
|
{{- end }}
|
|
{{- end }}
|