6c7fe87a72
* helm: add s3.tlsSecret to allow custom TLS certificate for S3 HTTPS endpoint Allow users to specify an external Kubernetes TLS secret for the S3 HTTPS endpoint instead of using the internal self-signed client certificate. This enables using publicly trusted certificates (e.g. from Let's Encrypt) so S3 clients don't need to trust the internal CA. The new s3.tlsSecret value is supported in the standalone S3 gateway, filer with embedded S3, and all-in-one deployment templates. Closes #8581 * refactor: extract S3 TLS helpers to reduce duplication Move repeated S3 TLS cert/key logic into shared helper templates (seaweedfs.s3.tlsArgs, seaweedfs.s3.tlsVolumeMount, seaweedfs.s3.tlsVolume) in _helpers.tpl, and use them across all three deployment templates. * helm: add allInOne.s3.trafficDistribution support Add the missing allInOne.s3.trafficDistribution branch to the seaweedfs.trafficDistribution helper and wire it into the all-in-one service template, mirroring the existing s3-service.yaml behavior. PreferClose is auto-converted to PreferSameZone on k8s >=1.35. * fix: scope S3 TLS mounts to S3-enabled pods and simplify trafficDistribution helper - Wrap S3 TLS volume/volumeMount includes in allInOne.s3.enabled and filer.s3.enabled guards so the custom TLS secret is only mounted when S3 is actually enabled in that deployment mode. - Refactor seaweedfs.trafficDistribution helper to accept an explicit value+Capabilities dict instead of walking multiple .Values paths, making each call site responsible for passing its own setting.
51 lines
2.0 KiB
YAML
51 lines
2.0 KiB
YAML
{{- if or .Values.s3.enabled .Values.filer.s3.enabled }}
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ printf "%s-s3" (include "seaweedfs.fullname" .) | trunc 63 | trimSuffix "-" }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
|
|
app.kubernetes.io/component: s3
|
|
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
{{- if .Values.s3.annotations }}
|
|
annotations:
|
|
{{- toYaml .Values.s3.annotations | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
|
|
{{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
|
|
{{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
|
|
trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" $td "Capabilities" .Capabilities) }}
|
|
{{- end }}
|
|
ports:
|
|
- name: "swfs-s3"
|
|
port: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
|
|
targetPort: {{ if .Values.s3.enabled }}{{ .Values.s3.port }}{{ else }}{{ .Values.filer.s3.port }}{{ end }}
|
|
protocol: TCP
|
|
{{- if and .Values.s3.enabled .Values.s3.icebergPort }}
|
|
- name: "swfs-iceberg"
|
|
port: {{ .Values.s3.icebergPort }}
|
|
targetPort: {{ .Values.s3.icebergPort }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if and .Values.s3.enabled .Values.s3.httpsPort }}
|
|
- name: "swfs-s3-tls"
|
|
port: {{ .Values.s3.httpsPort }}
|
|
targetPort: {{ .Values.s3.httpsPort }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- if and .Values.s3.enabled .Values.s3.metricsPort }}
|
|
- name: "metrics"
|
|
port: {{ .Values.s3.metricsPort }}
|
|
targetPort: {{ .Values.s3.metricsPort }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
selector:
|
|
app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
app.kubernetes.io/component: {{ if .Values.s3.enabled }}s3{{ else }}filer{{ end }}
|
|
{{- end }}
|