6c7fe87a72
* helm: add s3.tlsSecret to allow custom TLS certificate for S3 HTTPS endpoint Allow users to specify an external Kubernetes TLS secret for the S3 HTTPS endpoint instead of using the internal self-signed client certificate. This enables using publicly trusted certificates (e.g. from Let's Encrypt) so S3 clients don't need to trust the internal CA. The new s3.tlsSecret value is supported in the standalone S3 gateway, filer with embedded S3, and all-in-one deployment templates. Closes #8581 * refactor: extract S3 TLS helpers to reduce duplication Move repeated S3 TLS cert/key logic into shared helper templates (seaweedfs.s3.tlsArgs, seaweedfs.s3.tlsVolumeMount, seaweedfs.s3.tlsVolume) in _helpers.tpl, and use them across all three deployment templates. * helm: add allInOne.s3.trafficDistribution support Add the missing allInOne.s3.trafficDistribution branch to the seaweedfs.trafficDistribution helper and wire it into the all-in-one service template, mirroring the existing s3-service.yaml behavior. PreferClose is auto-converted to PreferSameZone on k8s >=1.35. * fix: scope S3 TLS mounts to S3-enabled pods and simplify trafficDistribution helper - Wrap S3 TLS volume/volumeMount includes in allInOne.s3.enabled and filer.s3.enabled guards so the custom TLS secret is only mounted when S3 is actually enabled in that deployment mode. - Refactor seaweedfs.trafficDistribution helper to accept an explicit value+Capabilities dict instead of walking multiple .Values paths, making each call site responsible for passing its own setting.
379 lines
12 KiB
Smarty
379 lines
12 KiB
Smarty
{{/*
|
|
Create a default fully qualified app name.
|
|
We truncate at 63 chars because some Kubernetes name fields are limited to
|
|
this (by the DNS naming spec). If release name contains chart name it will
|
|
be used as a full name.
|
|
*/}}
|
|
{{- define "seaweedfs.fullname" -}}
|
|
{{- if .Values.fullnameOverride -}}
|
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
|
{{- else -}}
|
|
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
|
{{- if contains $name .Release.Name -}}
|
|
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
|
{{- else -}}
|
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Create a truncated component name.
|
|
Usage: {{ include "seaweedfs.componentName" (list . "component-suffix") }}
|
|
*/}}
|
|
{{- define "seaweedfs.componentName" -}}
|
|
{{- $context := index . 0 -}}
|
|
{{- $suffix := index . 1 -}}
|
|
{{- if gt (len $suffix) 61 -}}
|
|
{{- fail (printf "Suffix '%s' is too long for componentName helper. Max length is 61." $suffix) -}}
|
|
{{- end -}}
|
|
{{- $fullname := include "seaweedfs.fullname" $context -}}
|
|
{{- $maxLen := sub 62 (len $suffix) | int -}}
|
|
{{- $truncatedFullname := trunc $maxLen $fullname | trimSuffix "-" -}}
|
|
{{- printf "%s-%s" $truncatedFullname $suffix -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Create chart name and version as used by the chart label.
|
|
*/}}
|
|
{{- define "seaweedfs.chart" -}}
|
|
{{- printf "%s-helm" .Chart.Name | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Expand the name of the chart.
|
|
*/}}
|
|
{{- define "seaweedfs.name" -}}
|
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Inject extra environment vars in the format key:value, if populated
|
|
*/}}
|
|
{{- define "seaweedfs.extraEnvironmentVars" -}}
|
|
{{- if .extraEnvironmentVars -}}
|
|
{{- range $key, $value := .extraEnvironmentVars }}
|
|
- name: {{ $key }}
|
|
value: {{ $value | quote }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{- define "seaweedfs.mergeExtraEnvironmentVars" -}}
|
|
{{- $global := ((.global | default dict).extraEnvironmentVars | default dict) -}}
|
|
{{- $component := ((.component | default dict).extraEnvironmentVars | default dict) -}}
|
|
{{- $target := .target -}}
|
|
{{- range $key, $value := $global }}
|
|
{{- $_ := set $target $key $value }}
|
|
{{- end }}
|
|
{{- range $key, $value := $component }}
|
|
{{- $_ := set $target $key $value }}
|
|
{{- end }}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper filer image */}}
|
|
{{- define "filer.image" -}}
|
|
{{- if .Values.filer.imageOverride -}}
|
|
{{- $imageOverride := .Values.filer.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper master image */}}
|
|
{{- define "master.image" -}}
|
|
{{- if .Values.master.imageOverride -}}
|
|
{{- $imageOverride := .Values.master.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper s3 image */}}
|
|
{{- define "s3.image" -}}
|
|
{{- if .Values.s3.imageOverride -}}
|
|
{{- $imageOverride := .Values.s3.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper sftp image */}}
|
|
{{- define "sftp.image" -}}
|
|
{{- if .Values.sftp.imageOverride -}}
|
|
{{- $imageOverride := .Values.sftp.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper admin image */}}
|
|
{{- define "admin.image" -}}
|
|
{{- if .Values.admin.imageOverride -}}
|
|
{{- $imageOverride := .Values.admin.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper worker image */}}
|
|
{{- define "worker.image" -}}
|
|
{{- if .Values.worker.imageOverride -}}
|
|
{{- $imageOverride := .Values.worker.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper volume image */}}
|
|
{{- define "volume.image" -}}
|
|
{{- if .Values.volume.imageOverride -}}
|
|
{{- $imageOverride := .Values.volume.imageOverride -}}
|
|
{{- printf "%s" $imageOverride -}}
|
|
{{- else -}}
|
|
{{- include "common.image" . }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Computes the container image name for all components (if they are not overridden) */}}
|
|
{{- define "common.image" -}}
|
|
{{- $registryName := default .Values.image.registry .Values.global.registry | toString -}}
|
|
{{- $repositoryName := default .Values.image.repository .Values.global.repository | toString -}}
|
|
{{- $name := .Values.global.imageName | toString -}}
|
|
{{- $tag := default .Chart.AppVersion .Values.image.tag | toString -}}
|
|
{{- if .Values.image.repository -}}
|
|
{{- $name = $repositoryName -}}
|
|
{{- else if $repositoryName -}}
|
|
{{- $name = printf "%s/%s" (trimSuffix "/" $repositoryName) (base $name) -}}
|
|
{{- end -}}
|
|
{{- if $registryName -}}
|
|
{{- printf "%s/%s:%s" $registryName $name $tag -}}
|
|
{{- else -}}
|
|
{{- printf "%s:%s" $name $tag -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* check if any Volume PVC exists */}}
|
|
{{- define "volume.pvc_exists" -}}
|
|
{{- if or (or (eq .Values.volume.data.type "persistentVolumeClaim") (and (eq .Values.volume.idx.type "persistentVolumeClaim") .Values.volume.dir_idx )) (eq .Values.volume.logs.type "persistentVolumeClaim") -}}
|
|
{{- printf "true" -}}
|
|
{{- else -}}
|
|
{{- printf "" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* check if any Filer PVC exists */}}
|
|
{{- define "filer.pvc_exists" -}}
|
|
{{- if or (eq .Values.filer.data.type "persistentVolumeClaim") (eq .Values.filer.logs.type "persistentVolumeClaim") -}}
|
|
{{- printf "true" -}}
|
|
{{- else -}}
|
|
{{- printf "" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* check if any Master PVC exists */}}
|
|
{{- define "master.pvc_exists" -}}
|
|
{{- if or (eq .Values.master.data.type "persistentVolumeClaim") (eq .Values.master.logs.type "persistentVolumeClaim") -}}
|
|
{{- printf "true" -}}
|
|
{{- else -}}
|
|
{{- printf "" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* check if any Admin PVC exists */}}
|
|
{{- define "admin.pvc_exists" -}}
|
|
{{- if or (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.logs.type "persistentVolumeClaim") -}}
|
|
{{- printf "true" -}}
|
|
{{- else -}}
|
|
{{- printf "" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* check if any InitContainers exist for Volumes */}}
|
|
{{- define "volume.initContainers_exists" -}}
|
|
{{- if or (not (empty .Values.volume.idx )) (not (empty .Values.volume.initContainers )) -}}
|
|
{{- printf "true" -}}
|
|
{{- else -}}
|
|
{{- printf "" -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* Return the proper imagePullSecrets */}}
|
|
{{- define "seaweedfs.imagePullSecrets" -}}
|
|
{{- with .Values.global.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- if kindIs "string" . }}
|
|
- name: {{ . }}
|
|
{{- else }}
|
|
{{- range . }}
|
|
{{- if kindIs "string" . }}
|
|
- name: {{ . }}
|
|
{{- else }}
|
|
- {{ toYaml . }}
|
|
{{- end}}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Renders a value that contains template perhaps with scope if the scope is present.
|
|
Usage:
|
|
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
|
|
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
|
|
*/}}
|
|
{{- define "common.tplvalues.render" -}}
|
|
{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
|
|
{{- if contains "{{" (toJson .value) }}
|
|
{{- if .scope }}
|
|
{{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }}
|
|
{{- else }}
|
|
{{- tpl $value .context }}
|
|
{{- end }}
|
|
{{- else }}
|
|
{{- $value }}
|
|
{{- end }}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Converts a Kubernetes quantity like "256Mi" or "2G" to a float64 in base units,
|
|
handling both binary (Ki, Mi, Gi) and decimal (m, k, M) suffixes; numeric inputs
|
|
Usage:
|
|
{{ include "common.resource-quantity" "10Gi" }}
|
|
*/}}
|
|
{{- define "common.resource-quantity" -}}
|
|
{{- $value := . -}}
|
|
{{- $unit := 1.0 -}}
|
|
{{- if typeIs "string" . -}}
|
|
{{- $base2 := dict "Ki" 0x1p10 "Mi" 0x1p20 "Gi" 0x1p30 "Ti" 0x1p40 "Pi" 0x1p50 "Ei" 0x1p60 -}}
|
|
{{- $base10 := dict "m" 1e-3 "k" 1e3 "M" 1e6 "G" 1e9 "T" 1e12 "P" 1e15 "E" 1e18 -}}
|
|
{{- range $k, $v := merge $base2 $base10 -}}
|
|
{{- if hasSuffix $k $ -}}
|
|
{{- $value = trimSuffix $k $ -}}
|
|
{{- $unit = $v -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
{{- mulf (float64 $value) $unit -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
getOrGeneratePassword will check if a password exists in a secret and return it,
|
|
or generate a new random password if it doesn't exist.
|
|
*/}}
|
|
{{- define "getOrGeneratePassword" -}}
|
|
{{- $params := . -}}
|
|
{{- $namespace := $params.namespace -}}
|
|
{{- $secretName := $params.secretName -}}
|
|
{{- $key := $params.key -}}
|
|
{{- $length := default 16 $params.length -}}
|
|
|
|
{{- $existingSecret := default (lookup "v1" "Secret" $namespace $secretName) $params.existingSecret -}}
|
|
{{- if and $existingSecret (index $existingSecret.data $key) -}}
|
|
{{- index $existingSecret.data $key | b64dec -}}
|
|
{{- else -}}
|
|
{{- randAlphaNum $length -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Compute the master service address to be used in cluster env vars.
|
|
If allInOne is enabled, point to the all-in-one service; otherwise, point to the master service.
|
|
*/}}
|
|
{{- define "seaweedfs.cluster.masterAddress" -}}
|
|
{{- $serviceNameSuffix := "-master" -}}
|
|
{{- if .Values.allInOne.enabled -}}
|
|
{{- $serviceNameSuffix = "-all-in-one" -}}
|
|
{{- end -}}
|
|
{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.master.port) -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Compute the filer service address to be used in cluster env vars.
|
|
If allInOne is enabled, point to the all-in-one service; otherwise, point to the filer-client service.
|
|
*/}}
|
|
{{- define "seaweedfs.cluster.filerAddress" -}}
|
|
{{- $serviceNameSuffix := "-filer-client" -}}
|
|
{{- if .Values.allInOne.enabled -}}
|
|
{{- $serviceNameSuffix = "-all-in-one" -}}
|
|
{{- end -}}
|
|
{{- printf "%s.%s:%d" (printf "%s%s" (include "seaweedfs.fullname" .) $serviceNameSuffix | trunc 63 | trimSuffix "-") .Release.Namespace (int .Values.filer.port) -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Generate comma-separated list of master server addresses.
|
|
Usage: {{ include "seaweedfs.masterServers" . }}
|
|
Output example: my-release-master-0.my-release-master.namespace:9333,my-release-master-1...
|
|
*/}}
|
|
{{- define "seaweedfs.masterServers" -}}
|
|
{{- $masterName := include "seaweedfs.componentName" (list . "master") -}}
|
|
{{- range $index := until (.Values.master.replicas | int) -}}
|
|
{{- if $index }},{{ end -}}
|
|
{{ $masterName }}-{{ $index }}.{{ $masterName }}.{{ $.Release.Namespace }}:{{ $.Values.master.port }}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Generate master server argument value, using global.masterServer if set, otherwise the generated list.
|
|
Usage: {{ include "seaweedfs.masterServerArg" . }}
|
|
*/}}
|
|
{{- define "seaweedfs.masterServerArg" -}}
|
|
{{- if .Values.global.masterServer -}}
|
|
{{- .Values.global.masterServer -}}
|
|
{{- else -}}
|
|
{{- include "seaweedfs.masterServers" . -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/*
|
|
Create the name of the service account to use
|
|
*/}}
|
|
{{- define "seaweedfs.serviceAccountName" -}}
|
|
{{- .Values.global.serviceAccountName | default "seaweedfs" -}}
|
|
{{- end -}}
|
|
|
|
{{/* S3 TLS cert/key arguments, using custom secret if s3.tlsSecret is set */}}
|
|
{{- define "seaweedfs.s3.tlsArgs" -}}
|
|
{{- $prefix := .prefix -}}
|
|
{{- $root := .root -}}
|
|
{{- if $root.Values.s3.tlsSecret -}}
|
|
-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/s3/tls.crt \
|
|
-{{ $prefix }}key.file=/usr/local/share/ca-certificates/s3/tls.key \
|
|
{{- else -}}
|
|
-{{ $prefix }}cert.file=/usr/local/share/ca-certificates/client/tls.crt \
|
|
-{{ $prefix }}key.file=/usr/local/share/ca-certificates/client/tls.key \
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{/* S3 custom TLS volume mount */}}
|
|
{{- define "seaweedfs.s3.tlsVolumeMount" -}}
|
|
{{- if .Values.s3.tlsSecret }}
|
|
- name: s3-tls-cert
|
|
readOnly: true
|
|
mountPath: /usr/local/share/ca-certificates/s3/
|
|
{{- end }}
|
|
{{- end -}}
|
|
|
|
{{/* S3 custom TLS volume */}}
|
|
{{- define "seaweedfs.s3.tlsVolume" -}}
|
|
{{- if .Values.s3.tlsSecret }}
|
|
- name: s3-tls-cert
|
|
secret:
|
|
secretName: {{ .Values.s3.tlsSecret }}
|
|
{{- end }}
|
|
{{- end -}}
|
|
|
|
{{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
|
|
Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
|
|
{{- define "seaweedfs.trafficDistribution" -}}
|
|
{{- if .value -}}
|
|
{{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
|
|
{{- end -}}
|
|
{{- end -}}
|