From f6843d6017916784692d440cacc2681d81772fe0 Mon Sep 17 00:00:00 2001 From: "M. Rehan" Date: Wed, 16 Feb 2022 20:22:27 +0500 Subject: [PATCH] Configure MinIO ACLs (i.e. user:minio uid:473 gid:473) - migration strategy to chown minIO data directory following the validations - preinstall hook to chown minIO data directory mount path on fresh install --- test/minio/1.5.0/.helmignore | 23 ++ test/minio/1.5.0/CHANGELOG.md | 8 + test/minio/1.5.0/Chart.yaml | 19 ++ test/minio/1.5.0/README.md | 52 ++++ test/minio/1.5.0/app-readme.md | 5 + test/minio/1.5.0/charts/common-2112.0.0.tgz | Bin 0 -> 4467 bytes test/minio/1.5.0/default_values.yaml | 22 ++ test/minio/1.5.0/ix_values.yaml | 9 + .../minio/1.5.0/migrations/migrate_from_1.0.0 | 28 ++ .../1.5.0/migrations/migrate_from_1.4.24 | 111 ++++++++ test/minio/1.5.0/questions.yaml | 252 ++++++++++++++++++ test/minio/1.5.0/requirements.lock | 6 + test/minio/1.5.0/templates/NOTES.txt | 2 + test/minio/1.5.0/templates/_cert.tpl | 33 +++ test/minio/1.5.0/templates/_helpers.tpl | 77 ++++++ test/minio/1.5.0/templates/configmap.yaml | 6 + test/minio/1.5.0/templates/deployment.yaml | 69 +++++ .../1.5.0/templates/pre-install-job.yaml | 27 ++ test/minio/1.5.0/templates/secrets.yaml | 13 + test/minio/1.5.0/templates/service.yaml | 11 + .../minio/1.5.0/templates/serviceaccount.yaml | 1 + test/minio/1.5.0/test_values.yaml | 23 ++ test/minio/1.5.0/values.yaml | 0 23 files changed, 797 insertions(+) create mode 100644 test/minio/1.5.0/.helmignore create mode 100644 test/minio/1.5.0/CHANGELOG.md create mode 100644 test/minio/1.5.0/Chart.yaml create mode 100755 test/minio/1.5.0/README.md create mode 100644 test/minio/1.5.0/app-readme.md create mode 100644 test/minio/1.5.0/charts/common-2112.0.0.tgz create mode 100644 test/minio/1.5.0/default_values.yaml create mode 100644 test/minio/1.5.0/ix_values.yaml create mode 100755 test/minio/1.5.0/migrations/migrate_from_1.0.0 create mode 100755 test/minio/1.5.0/migrations/migrate_from_1.4.24 create mode 100644 test/minio/1.5.0/questions.yaml create mode 100644 test/minio/1.5.0/requirements.lock create mode 100644 test/minio/1.5.0/templates/NOTES.txt create mode 100644 test/minio/1.5.0/templates/_cert.tpl create mode 100644 test/minio/1.5.0/templates/_helpers.tpl create mode 100644 test/minio/1.5.0/templates/configmap.yaml create mode 100644 test/minio/1.5.0/templates/deployment.yaml create mode 100644 test/minio/1.5.0/templates/pre-install-job.yaml create mode 100644 test/minio/1.5.0/templates/secrets.yaml create mode 100644 test/minio/1.5.0/templates/service.yaml create mode 100644 test/minio/1.5.0/templates/serviceaccount.yaml create mode 100644 test/minio/1.5.0/test_values.yaml create mode 100644 test/minio/1.5.0/values.yaml diff --git a/test/minio/1.5.0/.helmignore b/test/minio/1.5.0/.helmignore new file mode 100644 index 0000000000..a9fe727881 --- /dev/null +++ b/test/minio/1.5.0/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# OWNERS file for Kubernetes +OWNERS \ No newline at end of file diff --git a/test/minio/1.5.0/CHANGELOG.md b/test/minio/1.5.0/CHANGELOG.md new file mode 100644 index 0000000000..37ca0ee73d --- /dev/null +++ b/test/minio/1.5.0/CHANGELOG.md @@ -0,0 +1,8 @@ +# Change Log + +This contains all the notable changes to the MinIO application. + +## [1.5.0] + +1. On fresh installation, minIO data directory's ownership will be updated to minio:minio. +2. For existing installations that are exhibiting the upgrade, the minIO data directory's ownership will be migrated to minio:minio. diff --git a/test/minio/1.5.0/Chart.yaml b/test/minio/1.5.0/Chart.yaml new file mode 100644 index 0000000000..bccedddbdb --- /dev/null +++ b/test/minio/1.5.0/Chart.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +appVersion: '2022-01-28' +dependencies: +- name: common + repository: file://../../../library/common/2112.0.0 + version: 2112.0.0 +description: High Performance, Kubernetes Native Object Storage +home: https://min.io +icon: https://min.io/resources/img/logo/MINIO_wordmark.png +keywords: +- storage +- object-storage +- S3 +name: minio +sources: +- https://github.com/minio/minio +- https://github.com/minio/charts +upstream_version: 8.0.5 +version: 1.5.0 diff --git a/test/minio/1.5.0/README.md b/test/minio/1.5.0/README.md new file mode 100755 index 0000000000..d21b8c0107 --- /dev/null +++ b/test/minio/1.5.0/README.md @@ -0,0 +1,52 @@ +MinIO +===== + +[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. + +MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. + +For more detailed documentation please visit [here](https://docs.minio.io/) + +Introduction +------------ + +This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + + +Configuration +------------- + +The following table lists the configurable parameters of the MinIO chart and their default values. + +| Parameter | Description | Default | +|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| +| `image.repository` | Image repository | `minio/minio` | +| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | +| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | +| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | +| `persistence.enabled` | Use persistent volume to store data | `true` | +| `persistence.size` | Size of persistent volume claim | `500Gi` | +| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | +| `persistence.storageClass` | Storage class name of PVC | `nil` | +| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | +| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | +| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | + +Some parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). + +Pass environment variables to MinIO containers +---------------------------------------------- + +To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format + +```bash +$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio +``` + +You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. + +**NOTE** +- On fresh installation, minIO data directory's ownership will be updated to minio:minio. +- For existing installations that are exhibiting the upgrade to >=1.5.0, the minIO data directory's ownership will be migrated to minio:minio. diff --git a/test/minio/1.5.0/app-readme.md b/test/minio/1.5.0/app-readme.md new file mode 100644 index 0000000000..648ed287e4 --- /dev/null +++ b/test/minio/1.5.0/app-readme.md @@ -0,0 +1,5 @@ +[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. + +**NOTE** +- On installation, minIO data directory's ownership will be updated to minio:minio. +- For existing installations that are exhibiting the upgrade to >=1.5.0, the minIO data directory's ownership will be migrated to minio:minio. diff --git a/test/minio/1.5.0/charts/common-2112.0.0.tgz b/test/minio/1.5.0/charts/common-2112.0.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..62c214e1c86f187b4288c35d834eba8b277fc364 GIT binary patch literal 4467 zcmV-(5sdC1iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH<$Z`-(*^Vz@RtlGhiyA$~lCs_m-V6#c?OwdjmG}+!eSS$is zqHQ)ZsgjgaZzlWOFZhzEhaYJgx1BLRw3b939g^pza}G};Hk~rsIhi0X!#SEJKYaPt z?RL8dgMt3P+wE5W@AkXhA9{n{{@!43zdJbmq1)>Z_78u6?la(0YnhOU|ImH%yQ-7> zP8v$dd&~u4^ay7C7E06Nve$~Sh&V~5zCMP83_0R+h!nNJh;bnQgtwy+i3m#I1WA;z zaf_lUJ_18nEjdr|ksH{WIoSPPuOD{9ZtH8$|F7OG|4Teg6C|{a;xV6eC4|BbZ!`_8M@i6#QDI}dj2Tdz6~53T$AU5N3BPz-?~mat4A z0qj0Jv`TWM*SaM%K7uRL@z}zfVu@lT(NPP)2#Nc9AT&y{xB#vm2=@v*@&Zk903rMV zA2TK~JUmzkB1Mq_6TZUVZt)%ZV3kPx06_yPi81^@R4{Xv!g_j_CZ-$>K^e?1`r90_PKfCV4{ z2!=_9Q%yRnCrAR~7$T05#BuA6$O)k!C)nBmPWy)o1&XCP$Mr$Z zY%gah$*_Q}hnf0YW__y5v5EbWny}OcR`WS;y&Ju zqY5q!v#228Ux^e)M+H(ljKdE8SZq*ml4L?+etsFWVFyoBInN)q+XkMoar2J#DMs#* z>7QSk{c7%Xe~)QgEM6k8f>=WBg2nifaT)k%XbP}B%ER-k5h4i$Z)q|wkOo9!Z~&bp zAT(o(EKM1gI0ix;OY1LyVA1AQ=&Qosp@Jp?*ojFbA+X2>-o(s`1UX~2;SZ3UOue1$ zo7Xv=y^6S3D0fe{|9MpVT5YBNztOw(Br9Nr{_k}M2NnH)csSVK>i$W1@sCN-p(1Z3I+IfVI`S<9koDdg|T&^d1^CJPm1X?3R>>e^38*!ki;I z#_;k+12DaGr(NC6d^4zDPD4n<$5>wG&x&hbDNm$K12-h)OtOe27MQ*AyI-GN=Dl+T zt&M|)K%F8|%da(2SeN&0*r7~1bre#2zwHzffV*X1=;V5#xJv@tnI`3{zo=(BI1cjWpl?bI15?!cgp6*9(Qa*T;x-&XUARIF4w1 zoTL+UkxgOWcf|Y&Jt*IITgLwpO3{!cL=yZY0kF#c>-TH?f7m)T!eBiU=cqNgo z<9K&CFUK04Bcwdu$k{84{F7F-wgkJ4_^k-0y2wZ4SVDzFG+H*Eo9SK@U{u#Ud=kF5 z;S>Bxa&%R}*z~sE7&jg5@iD`~hEaA<9%vCq@S_Nd;o&Wwdso^$1Vxmk@@wnGSkjis zf3y3~9{(Nm`qliegS~@o{C6Ww%c`?aDWb8q3AJyMjZFAf%gco#$`>vT0oxrLvGqKi zF^Ocm=u2(PcE>%p5?V(top?~4-p(-RB*r=nl+g$d_H0DR#8@HN4chSNxGr4~(4~)v zFNGbO;YWEfFX`hCNKy# z#qc_p-e#{x1Shcx)Fos}B#uEckP{+cXE@jUczSWA`Vu+@k>aQww$4Xjg}MO}F)9(E z!e;jAdqlz=NfH=h$b`aE0Mf`?Y?qTo5pn+<(ohQC?!N<+(}3-=@c9xN$@PH^hnA>t zZ6Yji%$LmoDdixQ;j1~9o~}d5bu@iq6}w6&mZ83+Yr`(I<2S=Fi+IN)N+qVOO{WM_ z6Q-qd(@Wb;tBBK@pCy#MCG`ow{4NYej?)B17=nKfAh-$EqBeg@r&wY>RVY=m?JPGl z4zcIO;NXAtub5U-(p&>a)w?a?ttCAl$z|RWTcEpn`rytwR%iQ>YhQILlpG<|t?*@` zNruvr55+Mc5C*6gs^zX~Q44AZB0%89S(6R3`b^Qd9=BGQv?3^K%v!9H+O`Uq%IF5R z-a2o-&(>`J8@-0P=-gmBBb-s~8~w~rffe@uUbojT+yDLU!QtN4{@+CN^FO?;h8f}n z4HLZB>6_C?=#6`Chk3FM)0w-gKl=+wRuTImn&2r?U-KkJ62HdtB1tUI2=k!@(F8}g zwqHVoG@>wQm!zdX#JCFn&e`+|M;yy%#YN~>7)ft0UgNpLZr97$^f9y+oR_+u<7|@L za!Bv+$lQSipb7-a09Cui^F;%cZmD|4oKASIwbK1Qb7|@wjYDWb*tsbrvXJ~2$G?}; zzi7^3e%cy3eP3U`MhrYQu@^fY4k!&SMh!6B}I;9cezEjavu~YryL8s@afa$FH(8@~sbBOslv&;72Yipuy`xtAI!H8zhljwt_cBMP zbo8UZa^pF2EBQZV{Hce4SH=Iky;}bNUT>TKxsg`pf0HNwME-Zfb;`LYyC92neVeTB zS*OZM`Sg=X*4J{P==|BjLc?kh6)ssnP~a@)CbeFB$al-R{TfV>;BO9b`NOXv_Vy2|{=eSAHve}ctt|h4x%_W9@umMd@_w9Vr7=s5KL4Y)I#5X|M{fEYmkwy# zq79Xk#I}Y4B^E7vE zM2aJO=E;K7_~vO$y*z;Ko@=Ahz4FLEtDg@F-eFTgBgjW*sWNP@>@YAuyaVr3B%{fj z=Up(5B2pIrO+1P&QWk$>v{9}c(FCbn0MfKp>zrfJ z>t{-b6h~y560aM1IxM;Iw;J_N)f)9b#qy5vTSCX3oA`-`f7h}92etEmy+LoQ|2NT0 zCe+2%nr44N8DUIC#q7@weD$pGXXY2?@I>iZDP!M`G*InGb76`)owxe=3ssA@E!d0vb*1;K zmyfZ0>{!1#TMgqh8zv+wx|`vlzjO7(DBCIJWQHWZ#kE-8H|cb5l>dfYzJ%*Xw^j1L zw^ytGyTA4SY^IrW7K-n6iWLIQ_iO~Wcy3M=S(&YbKGM19gi*xji>m`S$(rTTYNXF~ z>{Mg!Rx-8gPYOZhNuwzdg3z(Lt>Ej4R1)AE$GhP^3ixC7J+3BM2yHM*vGH9$!!#4} zI87Bpm!5=6`QC{ke}ucQOEl)^Y<@F6;74IJMzIS4?3Bj;0UsEl5c~wbpf0`LpNFXg zdF%nyJ5izm$w04{o+S(wL9iK#alHJH#n&e6ZCk4~%YVr@8sp9lO4BRz`x)#14EAdE zpAQcQTlv3{W=}$C369eAJxj7F{*7hSR(o8X`C*BrNc%W0gE^-s4o2|h4b%$GCG)g8 zAEk7v_k2Oz{LJYNWu5;7FVSqObEm7F3plw;UwuvK0U@T!z>nL05LDgISGRr&FF$R$ zvZHl#_*wHbul+n#*j*wyF%J~1{Fa|nqMwLtSlqW4#kkVbdRB_=!!e3=VPXBiT@^6O z&le@9tV&tQ5AbP1)VVSWF?XsE9?&cBPm+DTNvxIJ!@^amVWI}iU%pjB3R&}Ju@yCpC z9NUyBwa=7E5LgDK@qTU7yxMhhN$4l0nUYVATI^mv={;!H^o|%wB<$g#%3EH}SaPah z9Q_Oimfu;giFdtk*_c99xPhxHfjYui-cQ(JETlTVh&pSAw){-9sa|JmmMZKRcb(@L3YU10nSyU;Z5{`G0S}`u86X4!8BcHqu_eC6W?zsvUiX0^n|f zDGW1`#DtC^MbRx9V-dDqfG&<={~(M2F~La!jl_qmG4ikASPV2 z!ZDE@{jWj46%PN8cl5vR#$?=4|F}yrqn!fK5Jk6H3L~PAdxzpKZM_PI=(hDLlvDMa zaWZbb`v2Aoc#k+?nSk@tGtmlD&OYEswn7qP)G^&T`_Kw!B4RP_eB-RIo8|v^XUC_% zorTl*Io`1{{?o1Te|KB|do%3?ys>}O^<>!}byfFthgR#=tA8B7yEwo2pJ zUyt8i!}%3lyuF6s&W9|U=F^fb;vXn&HG*w-1bonmPd7=8WLpYaz6Od*+WkTmEs40v& z%Tgu0+@GLhV-mp-%R7us@$1|F5dS%0Q(HGogwSeT5gK7YkT4znFb`nFl7!vqF+!OK zPB`fjd+smd-XWm{rc_dt<2Z{jOc9|HQ>1`KOvg@&*IVHFujge#SKHGi82KDfG||Qw zf-ysh!eofmR8HUh9=2L9Ucfn(oW+?A+1Ld&#m{VHMz~q$$)XdSq?il1n~-P%5u$lj zKgl4*Gn}v#D86%OWjfrXH>kEHZKn{xl*Q%Y_aNuCZQHhO+qSLT{uKZK|NkRSd{h8{ F0054o)rkNA literal 0 HcmV?d00001 diff --git a/test/minio/1.5.0/default_values.yaml b/test/minio/1.5.0/default_values.yaml new file mode 100644 index 0000000000..7afa31dc0d --- /dev/null +++ b/test/minio/1.5.0/default_values.yaml @@ -0,0 +1,22 @@ +## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the +## +image: + repository: minio/minio + tag: RELEASE.2020-11-19T23-48-16Z + pullPolicy: IfNotPresent + +## Additional arguments to pass to minio binary +extraArgs: [] + +updateStrategy: RollingUpdate + +service: + nodePort: 9000 + +environment: + ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html + +appVolumeMounts: + export: + emptyDir: true + mountPath: "/export" diff --git a/test/minio/1.5.0/ix_values.yaml b/test/minio/1.5.0/ix_values.yaml new file mode 100644 index 0000000000..7cbe3779c5 --- /dev/null +++ b/test/minio/1.5.0/ix_values.yaml @@ -0,0 +1,9 @@ +image: + pullPolicy: IfNotPresent + repository: minio/minio + tag: RELEASE.2022-01-28T02-28-16Z + +# uid=473(minio) +runAsUser: 473 +# gid=473(minio) +runAsGroup: 473 diff --git a/test/minio/1.5.0/migrations/migrate_from_1.0.0 b/test/minio/1.5.0/migrations/migrate_from_1.0.0 new file mode 100755 index 0000000000..d9772faa1d --- /dev/null +++ b/test/minio/1.5.0/migrations/migrate_from_1.0.0 @@ -0,0 +1,28 @@ +#!/usr/bin/python3 +import json +import os +import sys + + +def migrate(values): + if values.get('appVolumeMounts'): + return values + + values.update({ + 'appVolumeMounts': { + 'export': { + 'hostPathEnabled': values['minioHostPathEnabled'], + **({'hostPath': values['minioHostPath']} if values.get('minioHostPath') else {}) + }, + }, + }) + return values + + +if __name__ == '__main__': + if len(sys.argv) != 2: + exit(1) + + if os.path.exists(sys.argv[1]): + with open(sys.argv[1], 'r') as f: + print(json.dumps(migrate(json.loads(f.read())))) diff --git a/test/minio/1.5.0/migrations/migrate_from_1.4.24 b/test/minio/1.5.0/migrations/migrate_from_1.4.24 new file mode 100755 index 0000000000..7171454a73 --- /dev/null +++ b/test/minio/1.5.0/migrations/migrate_from_1.4.24 @@ -0,0 +1,111 @@ +#!/usr/bin/python3 +import json +import os +import sys +import subprocess +from pathlib import Path + +from middlewared.client import Client +from middlewared.service import ValidationErrors, CallError + + +def path_in_locked_datasets(path: str) -> bool: + with Client() as c: + return c.call('pool.dataset.path_in_locked_datasets', path) + + +def get_host_path_attachments(path: str) -> set: + with Client() as c: + return { + attachment['type'] + for attachment in c.call('pool.dataset.attachments_with_path', path) + if attachment['type'].lower() not in ['kubernetes', 'chart releases'] + } + + +def get_kubernetes_config() -> dict: + with Client() as c: + return c.call('kubernetes.config') + + +def validate_host_path(path: str, schema_name: str, verrors: ValidationErrors) -> None: + """ + These validations are taken from `FilesystemService._common_perm_path_validate`. + Including an additional validation that makes sure all the children under + a path are on same device. + """ + schema_name += ".migration.chown" + p = Path(path) + if not p.is_absolute(): + verrors.add(schema_name, f"Must be an absolute path: {path}") + + if p.is_file(): + verrors.add(schema_name, f"Recursive operations on a file are invalid: {path}") + + if not p.absolute().as_posix().startswith("/mnt/"): + verrors.add( + schema_name, + f"Changes to permissions on paths that are not beneath the directory /mnt are not permitted: {path}" + ) + elif len(p.resolve().parents) == 2: + verrors.add(schema_name, f"The specified path is a ZFS pool mountpoint: {path}") + + # Make sure that dataset is not locked + if path_in_locked_datasets(path): + verrors.add(schema_name, f"Dataset is locked at path: {path}.") + + # Validate attachments + if attachments := get_host_path_attachments(path): + verrors.add(schema_name, f"The path '{path}' is already attached to service(s): {', '.join(attachments)}.") + + # Make sure all the minio's data directory children are on same device. + device_id = os.stat(path).st_dev + for root, dirs, files in os.walk(path): + for child in dirs + files: + abs_path = os.path.join(root, child) + if os.stat(abs_path).st_dev != device_id: + verrors.add( + schema_name, + (f"All the children of MinIO data directory should be on " + f"same device as root: path={abs_path} device={os.stat(abs_path).st_dev}") + ) + break + + +def migrate(values: dict) -> dict: + # minio user / group ID + uid = gid = 473 + verrors = ValidationErrors() + k8s_config = get_kubernetes_config() + if values["appVolumeMounts"]["export"]["hostPathEnabled"]: + host_path = values["appVolumeMounts"]["export"]["hostPath"] + else: + app_dataset = values["appVolumeMounts"]["export"]["datasetName"] + host_path = os.path.join( + "/mnt", k8s_config['dataset'], "releases", values["release_name"], app_dataset + ) + + validate_host_path(host_path, values['release_name'], verrors) + verrors.check() + # chown the host path + acltool = subprocess.run([ + "/usr/bin/nfs4xdr_winacl", + "-a", "chown", + "-O", str(uid), "-G", str(gid), + "-r", + "-c", host_path, + "-p", host_path], check=False, capture_output=True + ) + if acltool.returncode != 0: + raise CallError(f"acltool [chown] on path {host_path} failed with error: [{acltool.stderr.decode().strip()}]") + + return values + + +if __name__ == "__main__": + if len(sys.argv) != 2: + exit(1) + + if os.path.exists(sys.argv[1]): + with open(sys.argv[1], "r") as f: + print(json.dumps(migrate(json.loads(f.read())))) diff --git a/test/minio/1.5.0/questions.yaml b/test/minio/1.5.0/questions.yaml new file mode 100644 index 0000000000..de5d504673 --- /dev/null +++ b/test/minio/1.5.0/questions.yaml @@ -0,0 +1,252 @@ +groups: + - name: "Container Images" + description: "Image to be used for container" + - name: "Workload Configuration" + description: "Configure workload deployment" + - name: "Minio Configuration" + description: "Configure Minio credentials" + - name: "Storage" + description: "Configure Storage for Nextcloud" + - name: "Advanced DNS Settings" + description: "Configure DNS settings" + +portals: + web_portal: + protocols: + - "$kubernetes-resource_configmap_minio-config_protocol" + host: + - "$node_ip" + ports: + - "$variable-service.consolePort" + +questions: + + - variable: dnsConfig + label: "DNS Configuration" + group: "Advanced DNS Settings" + schema: + type: dict + attrs: + - variable: options + label: "DNS Options" + schema: + type: list + items: + - variable: optionsEntry + label: "Option Entry Configuration" + schema: + type: dict + attrs: + - variable: name + label: "Option Name" + schema: + type: string + required: true + - variable: value + label: "Option Value" + schema: + type: string + required: true + + - variable: updateStrategy + label: "Minio update strategy" + group: "Workload Configuration" + schema: + type: string + default: "RollingUpdate" + enum: + - value: "RollingUpdate" + description: "Create new pods and then kill old ones" + - value: "Recreate" + description: "Kill existing pods before creating new ones" + + - variable: distributedMode + label: "Enable Distributed Mode" + description: "Run Minio instance to connect to a distributed minio cluster" + group: "Minio Configuration" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: distributedIps + label: "Distributed Minio Instance URI(s)" + schema: + type: list + required: true + default: [] + items: + - variable: ip + label: "Distributed Minio Instance URI" + schema: + type: string + empty: false + + + - variable: extraArgs + label: "Minio Extra Arguments" + group: "Minio Configuration" + schema: + type: list + default: [] + items: + - variable: arg + label: "Argument" + schema: + type: string + + - variable: accessKey + label: "Root User" + group: "Minio Configuration" + description: "Enter the S3 Root User" + schema: + type: string + private: true + required: true + min_length: 5 + max_length: 20 + + - variable: secretKey + label: "Root Password" + group: "Minio Configuration" + description: "Enter the S3 Root Password" + schema: + type: string + private: true + required: true + min_length: 8 + max_length: 40 + + - variable: environmentVariables + label: "Minio image environment" + group: "Minio Configuration" + schema: + type: list + default: [] + items: + - variable: environmentVariable + label: "Environment Variable" + schema: + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: service + description: "Minio Service Configuration" + label: "Minio Service Configuration" + group: "Minio Configuration" + schema: + type: dict + required: true + attrs: + - variable: nodePort + label: "Node Port to use for Minio API" + schema: + type: int + min: 9000 + max: 65535 + default: 9000 + required: true + - variable: consolePort + label: "Node Port to use for Minio UI Access" + schema: + type: int + min: 9000 + max: 65535 + default: 9002 + required: true + + - variable: minioDomain + label: "Minio Domain Name" + description: "This is only required if TLS is configured for Minio" + group: "Minio Configuration" + schema: + type: string + default: null + "null": true + show_if: [["certificate", "!=", null]] + + - variable: certificate + description: "Minio Certificate" + label: "Minio Certificate" + group: "Minio Configuration" + schema: + type: int + $ref: + - "definitions/certificate" + + - variable: appVolumeMounts + label: "Minio Storage" + group: "Storage" + schema: + type: dict + show_if: [["distributedMode", "=", false]] + attrs: + - variable: export + label: "Data Volume" + schema: + type: dict + attrs: + - variable: datasetName + label: "Minio Data Volume Name" + schema: + type: string + hidden: true + $ref: + - "normalize/ixVolume" + show_if: [["hostPathEnabled", "=", false]] + default: "ix-minio" + editable: false + - variable: mountPath + label: "Minio Data Mount Path" + description: "Path where the volume will be mounted inside the pod" + schema: + type: path + hidden: true + editable: false + default: "/export" + - variable: hostPathEnabled + label: "Enable Host Path for Minio Data Volume" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostPath + label: "Host Path for Minio Data Volume" + schema: + type: hostpath + required: true + immutable: true + + - variable: extraAppVolumeMounts + label: "Extra Host Path Volumes" + group: "Storage" + schema: + type: list + items: + - variable: extraAppVolume + label: "Host Path Volume" + description: "Add an extra host path volume for Minio application" + schema: + type: dict + attrs: + - variable: mountPath + label: "Mount Path in Pod" + description: "Path where the volume will be mounted inside the pod" + schema: + type: path + required: true + - variable: hostPath + label: "Host Path" + description: "Host path" + schema: + type: hostpath + required: true diff --git a/test/minio/1.5.0/requirements.lock b/test/minio/1.5.0/requirements.lock new file mode 100644 index 0000000000..7d9c01b810 --- /dev/null +++ b/test/minio/1.5.0/requirements.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: file://../../../library/common/2112.0.0 + version: 2112.0.0 +digest: sha256:47115d9b91afe42c8537dcf0fd8224f2f7d1c775f9ff860efa68a6b57d17d1c0 +generated: "2021-12-06T21:24:36.62541+05:00" diff --git a/test/minio/1.5.0/templates/NOTES.txt b/test/minio/1.5.0/templates/NOTES.txt new file mode 100644 index 0000000000..88e8e93ef8 --- /dev/null +++ b/test/minio/1.5.0/templates/NOTES.txt @@ -0,0 +1,2 @@ +Minio can be accessed from the following URL: +http://$node_ip:{{ .Values.service.nodePort }}/ diff --git a/test/minio/1.5.0/templates/_cert.tpl b/test/minio/1.5.0/templates/_cert.tpl new file mode 100644 index 0000000000..f34777f65a --- /dev/null +++ b/test/minio/1.5.0/templates/_cert.tpl @@ -0,0 +1,33 @@ +{{/* +Formats volumeMount for Minio tls keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolumeMount" -}} +{{- if eq (include "minio.certAvailable" .) "true" -}} +- name: cert-secret-volume + mountPath: "/etc/minio/certs" +- name: trusted-cert-secret-volume + mountPath: "/etc/minio/certs/CAs" +{{- end }} +{{- end -}} + +{{/* +Formats volume for Minio tls keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolume" -}} +{{- if eq (include "minio.certAvailable" .) "true" -}} +- name: cert-secret-volume + secret: + secretName: {{ include "minio.secretName" . }} + items: + - key: certPublicKey + path: public.crt + - key: certPrivateKey + path: private.key +- name: trusted-cert-secret-volume + secret: + secretName: {{ include "minio.secretName" . }} + items: + - key: certPublicKey + path: public.crt +{{- end }} +{{- end -}} diff --git a/test/minio/1.5.0/templates/_helpers.tpl b/test/minio/1.5.0/templates/_helpers.tpl new file mode 100644 index 0000000000..55b50755aa --- /dev/null +++ b/test/minio/1.5.0/templates/_helpers.tpl @@ -0,0 +1,77 @@ +{{/* +Determine secret name. +*/}} +{{- define "minio.secretName" -}} +{{- include "common.names.fullname" . -}} +{{- end -}} + + +{{/* +Retrieve true/false if minio certificate is configured +*/}} +{{- define "minio.certAvailable" -}} +{{- if .Values.certificate -}} +{{- $values := (. | mustDeepCopy) -}} +{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}} +{{- template "common.resources.cert_present" $values -}} +{{- else -}} +{{- false -}} +{{- end -}} +{{- end -}} + + +{{/* +Retrieve public key of minio certificate +*/}} +{{- define "minio.cert.publicKey" -}} +{{- $values := (. | mustDeepCopy) -}} +{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate "publicKey" true) -}} +{{ include "common.resources.cert" $values }} +{{- end -}} + + +{{/* +Retrieve private key of minio certificate +*/}} +{{- define "minio.cert.privateKey" -}} +{{- $values := (. | mustDeepCopy) -}} +{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}} +{{ include "common.resources.cert" $values }} +{{- end -}} + + +{{/* +Retrieve scheme/protocol for minio +*/}} +{{- define "minio.scheme" -}} +{{- if eq (include "minio.certAvailable" .) "true" -}} +{{- print "https" -}} +{{- else -}} +{{- print "http" -}} +{{- end -}} +{{- end -}} + + +{{/* +Retrieve command for minio application +*/}} +{{- define "minio.commandArgs" -}} +{{- $arg := "/usr/bin/docker-entrypoint.sh minio -S /etc/minio/certs server --console-address=':9001'" -}} +{{- if .Values.distributedMode -}} +{{- cat $arg (join " " (concat (.Values.distributedIps | default list) (.Values.extraArgs | default list))) -}} +{{- else -}} +{{- cat $arg ((concat (list "/export") (.Values.extraArgs | default list)) | join " ") -}} +{{- end -}} +{{- end -}} + + +{{/* +Enable host networking +*/}} +{{- define "minio.hostNetworking" -}} +{{- if .Values.distributedMode -}} +{{- print "true" -}} +{{- else -}} +{{- print "false" -}} +{{- end -}} +{{- end -}} diff --git a/test/minio/1.5.0/templates/configmap.yaml b/test/minio/1.5.0/templates/configmap.yaml new file mode 100644 index 0000000000..98a62a3890 --- /dev/null +++ b/test/minio/1.5.0/templates/configmap.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: minio-config +data: + protocol: {{ include "minio.scheme" . }} diff --git a/test/minio/1.5.0/templates/deployment.yaml b/test/minio/1.5.0/templates/deployment.yaml new file mode 100644 index 0000000000..fa6f2ead47 --- /dev/null +++ b/test/minio/1.5.0/templates/deployment.yaml @@ -0,0 +1,69 @@ +apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "common.names.fullname" . }} + labels: + app: {{ template "common.names.name" . }} + chart: {{ template "common.names.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + rollme: {{ randAlphaNum 5 | quote }} +spec: + replicas: {{ (default 1 .Values.replicas) }} + strategy: + type: {{ (default "Recreate" .Values.updateStrategy ) }} + selector: + matchLabels: + app: {{ template "common.names.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "common.names.fullname" . }} + labels: + app: {{ template "common.names.name" . }} + release: {{ .Release.Name }} + {{- include "common.labels.selectorLabels" . | nindent 8 }} + annotations: {{ include "common.annotations" . | nindent 8 }} + spec: + securityContext: + runAsUser: {{ .Values.runAsUser }} + runAsGroup: {{ .Values.runAsGroup }} + serviceAccountName: {{ include "common.names.serviceAccountName" . | quote }} + hostNetwork: {{ include "minio.hostNetworking" . }} + containers: + - name: {{ .Chart.Name }} + {{ include "common.containers.imageConfig" .Values.image | nindent 10 }} + volumeMounts: {{ include "common.storage.configureAppVolumeMountsInContainer" .Values | nindent 12 }} + {{- include "minio.tlsKeysVolumeMount" . | nindent 12 }} + {{ range $index, $hostPathConfiguration := .Values.extraAppVolumeMounts }} + - name: extrappvolume-{{ $index }} + mountPath: {{ $hostPathConfiguration.mountPath }} + {{ end }} + command: + - "/bin/sh" + - "-ce" + - {{ include "minio.commandArgs" . }} + ports: + - name: api + containerPort: 9000 + - name: console + containerPort: 9001 + env: + {{ $secretName := (include "minio.secretName" .) }} + {{ $envList := (default list .Values.environmentVariables) }} + {{ if and (eq (include "minio.certAvailable" .) "true") .Values.minioDomain }} + {{ $envList = mustAppend $envList (dict "name" "MINIO_BROWSER_REDIRECT_URL" "value" (printf "%s://%s:%d" (include "minio.scheme" .) .Values.minioDomain (.Values.service.consolePort | int))) }} + {{ $envList = mustAppend $envList (dict "name" "MINIO_SERVER_URL" "value" (printf "%s://%s:%d" (include "minio.scheme" .) .Values.minioDomain (.Values.service.nodePort | int))) }} + {{ end }} + {{ $envList = mustAppend $envList (dict "name" "MINIO_ROOT_USER" "valueFromSecret" true "secretName" $secretName "secretKey" "accesskey") }} + {{ $envList = mustAppend $envList (dict "name" "MINIO_ROOT_PASSWORD" "valueFromSecret" true "secretName" $secretName "secretKey" "secretkey") }} + {{ include "common.containers.environmentVariables" (dict "environmentVariables" $envList) | nindent 12 }} +{{ include "common.networking.dnsConfiguration" .Values | nindent 6 }} + volumes: {{ include "common.storage.configureAppVolumes" .Values | nindent 8 }} + {{- include "minio.tlsKeysVolume" . | nindent 8 }} + {{ range $index, $hostPathConfiguration := .Values.extraAppVolumeMounts }} + - name: extrappvolume-{{ $index }} + hostPath: + path: {{ $hostPathConfiguration.hostPath }} + {{ end }} diff --git a/test/minio/1.5.0/templates/pre-install-job.yaml b/test/minio/1.5.0/templates/pre-install-job.yaml new file mode 100644 index 0000000000..009017286c --- /dev/null +++ b/test/minio/1.5.0/templates/pre-install-job.yaml @@ -0,0 +1,27 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: "{{ template "common.names.fullname" . }}-preinstall-job" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: {{ template "common.names.chart" . }} + annotations: + "helm.sh/hook": pre-install +spec: + template: + metadata: + name: "{{ template "common.names.fullname" . }}-preinstall-hook" + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + helm.sh/chart: {{ template "common.names.chart" . }} + spec: + restartPolicy: Never + containers: + - name: pre-install-job + image: "alpine:latest" + command: ["chown", "-R", "{{ .Values.runAsUser }}:{{ .Values.runAsGroup }}", "{{ .Values.appVolumeMounts.export.mountPath }}"] + volumeMounts: {{ include "common.storage.configureAppVolumeMountsInContainer" .Values | nindent 12 }} + volumes: {{ include "common.storage.configureAppVolumes" .Values | nindent 8 }} diff --git a/test/minio/1.5.0/templates/secrets.yaml b/test/minio/1.5.0/templates/secrets.yaml new file mode 100644 index 0000000000..4085fd585b --- /dev/null +++ b/test/minio/1.5.0/templates/secrets.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "minio.secretName" . }} + labels: {{ include "common.labels" . | nindent 4 }} +type: Opaque +data: + accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} + secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} + {{ if eq (include "minio.certAvailable" .) "true" }} + certPublicKey: {{ (include "minio.cert.publicKey" .) | toString | b64enc | quote }} + certPrivateKey: {{ (include "minio.cert.privateKey" .) | toString | b64enc | quote }} + {{ end }} diff --git a/test/minio/1.5.0/templates/service.yaml b/test/minio/1.5.0/templates/service.yaml new file mode 100644 index 0000000000..fd2e6ba676 --- /dev/null +++ b/test/minio/1.5.0/templates/service.yaml @@ -0,0 +1,11 @@ +{{ $svc := .Values.service }} +{{ $selectors := list }} +{{ $selectors = mustAppend $selectors (dict "key" "app" "value" (include "common.names.name" .) ) }} +{{ $selectors = mustAppend $selectors (dict "key" "release" "value" .Release.Name ) }} +{{ $ports := list }} +{{ $ports = mustAppend $ports (dict "name" "api" "port" $svc.nodePort "nodePort" $svc.nodePort "targetPort" 9000) }} +{{ $ports = mustAppend $ports (dict "name" "console" "port" $svc.consolePort "nodePort" $svc.consolePort "targetPort" 9001) }} +{{ $params := . }} +{{ $_ := set $params "commonService" (dict "type" "NodePort" "ports" $ports ) }} +{{ $_1 := set .Values "extraSelectorLabels" $selectors }} +{{ include "common.classes.service" $params }} diff --git a/test/minio/1.5.0/templates/serviceaccount.yaml b/test/minio/1.5.0/templates/serviceaccount.yaml new file mode 100644 index 0000000000..12bd3f4a39 --- /dev/null +++ b/test/minio/1.5.0/templates/serviceaccount.yaml @@ -0,0 +1 @@ +{{ include "common.serviceaccount" . }} diff --git a/test/minio/1.5.0/test_values.yaml b/test/minio/1.5.0/test_values.yaml new file mode 100644 index 0000000000..1c026bcece --- /dev/null +++ b/test/minio/1.5.0/test_values.yaml @@ -0,0 +1,23 @@ +appVolumeMounts: + export: + emptyDir: true + mountPath: /export +distributedIps: [] +distributedMode: false +dnsConfig: + options: [] +emptyDirVolumes: true +environmentVariables: [] +extraAppVolumeMounts: [] +extraArgs: [] +image: + pullPolicy: IfNotPresent + repository: minio/minio + tag: RELEASE.2022-01-28T02-28-16Z +minioDomain: null +service: + consolePort: 32325 + nodePort: 32324 +updateStrategy: RollingUpdate +runAsUser: 473 +runAsGroup: 473 diff --git a/test/minio/1.5.0/values.yaml b/test/minio/1.5.0/values.yaml new file mode 100644 index 0000000000..e69de29bb2