From bcc81487854c98794b8b796cbaac4ce5fb82a4f0 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Tue, 8 Dec 2020 23:23:50 +0500 Subject: [PATCH 01/29] Add initial minio helm chart --- test/minio/8.0.5/.helmignore | 23 ++ test/minio/8.0.5/Chart.yaml | 16 + test/minio/8.0.5/README.md | 1 + test/minio/8.0.5/ci/distributed-values.yaml | 1 + test/minio/8.0.5/templates/NOTES.txt | 47 +++ .../8.0.5/templates/_helper_create_bucket.txt | 111 ++++++ test/minio/8.0.5/templates/_helpers.tpl | 182 +++++++++ test/minio/8.0.5/templates/clusterroles.yaml | 20 + test/minio/8.0.5/templates/configmap.yaml | 12 + test/minio/8.0.5/templates/deployment.yaml | 203 +++++++++++ test/minio/8.0.5/templates/ingress.yaml | 45 +++ test/minio/8.0.5/templates/networkpolicy.yaml | 25 ++ .../8.0.5/templates/poddisruptionbudget.yaml | 13 + .../post-install-create-bucket-job.yaml | 87 +++++ .../post-install-prometheus-metrics-job.yaml | 135 +++++++ .../post-install-prometheus-metrics-role.yaml | 38 ++ ...nstall-prometheus-metrics-rolebinding.yaml | 20 + ...all-prometheus-metrics-serviceaccount.yaml | 12 + test/minio/8.0.5/templates/pvc.yaml | 35 ++ test/minio/8.0.5/templates/rolebindings.yaml | 20 + test/minio/8.0.5/templates/secrets.yaml | 32 ++ .../templates/securitycontextconstraints.yaml | 46 +++ test/minio/8.0.5/templates/service.yaml | 47 +++ .../minio/8.0.5/templates/serviceaccount.yaml | 11 + .../minio/8.0.5/templates/servicemonitor.yaml | 41 +++ test/minio/8.0.5/templates/statefulset.yaml | 174 +++++++++ test/minio/8.0.5/values.yaml | 344 ++++++++++++++++++ 27 files changed, 1741 insertions(+) create mode 100644 test/minio/8.0.5/.helmignore create mode 100644 test/minio/8.0.5/Chart.yaml create mode 120000 test/minio/8.0.5/README.md create mode 100644 test/minio/8.0.5/ci/distributed-values.yaml create mode 100644 test/minio/8.0.5/templates/NOTES.txt create mode 100644 test/minio/8.0.5/templates/_helper_create_bucket.txt create mode 100644 test/minio/8.0.5/templates/_helpers.tpl create mode 100644 test/minio/8.0.5/templates/clusterroles.yaml create mode 100644 test/minio/8.0.5/templates/configmap.yaml create mode 100644 test/minio/8.0.5/templates/deployment.yaml create mode 100644 test/minio/8.0.5/templates/ingress.yaml create mode 100644 test/minio/8.0.5/templates/networkpolicy.yaml create mode 100644 test/minio/8.0.5/templates/poddisruptionbudget.yaml create mode 100644 test/minio/8.0.5/templates/post-install-create-bucket-job.yaml create mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml create mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml create mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml create mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml create mode 100644 test/minio/8.0.5/templates/pvc.yaml create mode 100644 test/minio/8.0.5/templates/rolebindings.yaml create mode 100644 test/minio/8.0.5/templates/secrets.yaml create mode 100644 test/minio/8.0.5/templates/securitycontextconstraints.yaml create mode 100644 test/minio/8.0.5/templates/service.yaml create mode 100644 test/minio/8.0.5/templates/serviceaccount.yaml create mode 100644 test/minio/8.0.5/templates/servicemonitor.yaml create mode 100644 test/minio/8.0.5/templates/statefulset.yaml create mode 100644 test/minio/8.0.5/values.yaml diff --git a/test/minio/8.0.5/.helmignore b/test/minio/8.0.5/.helmignore new file mode 100644 index 00000000000..a9fe7278811 --- /dev/null +++ b/test/minio/8.0.5/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +# OWNERS file for Kubernetes +OWNERS \ No newline at end of file diff --git a/test/minio/8.0.5/Chart.yaml b/test/minio/8.0.5/Chart.yaml new file mode 100644 index 00000000000..dae38ea07d0 --- /dev/null +++ b/test/minio/8.0.5/Chart.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +description: High Performance, Kubernetes Native Object Storage +name: minio +version: 8.0.5 +appVersion: master +keywords: +- storage +- object-storage +- S3 +home: https://min.io +icon: https://min.io/resources/img/logo/MINIO_wordmark.png +sources: +- https://github.com/minio/minio +maintainers: +- name: MinIO, Inc + email: dev@minio.io diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md new file mode 120000 index 00000000000..32d46ee883b --- /dev/null +++ b/test/minio/8.0.5/README.md @@ -0,0 +1 @@ +../README.md \ No newline at end of file diff --git a/test/minio/8.0.5/ci/distributed-values.yaml b/test/minio/8.0.5/ci/distributed-values.yaml new file mode 100644 index 00000000000..e6c46738087 --- /dev/null +++ b/test/minio/8.0.5/ci/distributed-values.yaml @@ -0,0 +1 @@ +mode: distributed diff --git a/test/minio/8.0.5/templates/NOTES.txt b/test/minio/8.0.5/templates/NOTES.txt new file mode 100644 index 00000000000..77efd37ff67 --- /dev/null +++ b/test/minio/8.0.5/templates/NOTES.txt @@ -0,0 +1,47 @@ +{{- if eq .Values.service.type "ClusterIP" "NodePort" }} +Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: +{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local + +To access Minio from localhost, run the below commands: + + 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + + 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} + +Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ + +You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: + + 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide + + 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) + + 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 + + 4. mc ls {{ template "minio.fullname" . }}-local + +Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 +{{- end }} +{{- if eq .Values.service.type "LoadBalancer" }} +Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: +kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} + +Note that the public IP may take a couple of minutes to be available. + +You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: + + 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide + + 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) + 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 + + 4. mc ls {{ template "minio.fullname" . }} + +Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 +{{- end }} + +{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} +Note: Since NetworkPolicy is enabled, only pods with label +{{ template "minio.fullname" . }}-client=true" +will be able to connect to this minio cluster. +{{- end }} diff --git a/test/minio/8.0.5/templates/_helper_create_bucket.txt b/test/minio/8.0.5/templates/_helper_create_bucket.txt new file mode 100644 index 00000000000..ad2f546b758 --- /dev/null +++ b/test/minio/8.0.5/templates/_helper_create_bucket.txt @@ -0,0 +1,111 @@ +#!/bin/sh +set -e ; # Have script exit in the event of a failed command. + +{{- if .Values.configPathmc }} +MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" +{{- else }} +MC="/usr/bin/mc --insecure" +{{- end }} + +# connectToMinio +# Use a check-sleep-check loop to wait for Minio service to be available +connectToMinio() { + SCHEME=$1 + ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts + set -e ; # fail if we can't read the keys. + ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; + set +e ; # The connections to minio are allowed to fail. + echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; + MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; + $MC_COMMAND ; + STATUS=$? ; + until [ $STATUS = 0 ] + do + ATTEMPTS=`expr $ATTEMPTS + 1` ; + echo \"Failed attempts: $ATTEMPTS\" ; + if [ $ATTEMPTS -gt $LIMIT ]; then + exit 1 ; + fi ; + sleep 2 ; # 1 second intervals between attempts + $MC_COMMAND ; + STATUS=$? ; + done ; + set -e ; # reset `e` as active + return 0 +} + +# checkBucketExists ($bucket) +# Check if the bucket exists, by using the exit code of `mc ls` +checkBucketExists() { + BUCKET=$1 + CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) + return $? +} + +# createBucket ($bucket, $policy, $purge) +# Ensure bucket exists, purging if asked to +createBucket() { + BUCKET=$1 + POLICY=$2 + PURGE=$3 + VERSIONING=$4 + + # Purge the bucket, if set & exists + # Since PURGE is user input, check explicitly for `true` + if [ $PURGE = true ]; then + if checkBucketExists $BUCKET ; then + echo "Purging bucket '$BUCKET'." + set +e ; # don't exit if this fails + ${MC} rm -r --force myminio/$BUCKET + set -e ; # reset `e` as active + else + echo "Bucket '$BUCKET' does not exist, skipping purge." + fi + fi + + # Create the bucket if it does not exist + if ! checkBucketExists $BUCKET ; then + echo "Creating bucket '$BUCKET'" + ${MC} mb myminio/$BUCKET + else + echo "Bucket '$BUCKET' already exists." + fi + + + # set versioning for bucket + if [ ! -z $VERSIONING ] ; then + if [ $VERSIONING = true ] ; then + echo "Enabling versioning for '$BUCKET'" + ${MC} version enable myminio/$BUCKET + elif [ $VERSIONING = false ] ; then + echo "Suspending versioning for '$BUCKET'" + ${MC} version suspend myminio/$BUCKET + fi + else + echo "Bucket '$BUCKET' versioning unchanged." + fi + + # At this point, the bucket should exist, skip checking for existence + # Set policy on the bucket + echo "Setting policy of bucket '$BUCKET' to '$POLICY'." + ${MC} policy set $POLICY myminio/$BUCKET +} + +# Try connecting to Minio instance +{{- if .Values.tls.enabled }} +scheme=https +{{- else }} +scheme=http +{{- end }} +connectToMinio $scheme + +{{- if or .Values.defaultBucket.enabled }} +# Create the bucket +createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} +{{ else if .Values.buckets }} +# Create the buckets +{{- range .Values.buckets }} +createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} +{{- end }} +{{- end }} diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl new file mode 100644 index 00000000000..227762b13e6 --- /dev/null +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -0,0 +1,182 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "minio.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "minio.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "minio.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "minio.networkPolicy.apiVersion" -}} +{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "minio.deployment.apiVersion" -}} +{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} +{{- print "apps/v1beta2" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "minio.statefulset.apiVersion" -}} +{{- if semverCompare "<1.17-0" .Capabilities.KubeVersion.Version -}} +{{- print "apps/v1beta2" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "minio.ingress.apiVersion" -}} +{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- end -}} +{{- end -}} + +{{/* +Determine secret name. +*/}} +{{- define "minio.secretName" -}} +{{- if .Values.existingSecret -}} +{{- .Values.existingSecret }} +{{- else -}} +{{- include "minio.fullname" . -}} +{{- end -}} +{{- end -}} + +{{/* +Determine service account name for deployment or statefulset. +*/}} +{{- define "minio.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- default "default" .Values.serviceAccount.name -}} +{{- end -}} +{{- end -}} + +{{/* +Determine name for scc role and rolebinding +*/}} +{{- define "minio.sccRoleName" -}} +{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Properly format optional additional arguments to Minio binary +*/}} +{{- define "minio.extraArgs" -}} +{{- range .Values.extraArgs -}} +{{ " " }}{{ . }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "minio.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + - name: {{ . }} +{{- end }} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- else if .Values.imagePullSecrets }} +imagePullSecrets: + {{ toYaml .Values.imagePullSecrets }} +{{- end -}} +{{- end -}} + +{{/* +Formats volumeMount for Minio tls keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolumeMount" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + mountPath: {{ .Values.certsPath }} +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} +- name: trusted-cert-secret-volume + mountPath: {{ $casPath }} +{{- end }} +{{- end -}} + +{{/* +Formats volume for Minio tls keys and trusted certs +*/}} +{{- define "minio.tlsKeysVolume" -}} +{{- if .Values.tls.enabled }} +- name: cert-secret-volume + secret: + secretName: {{ .Values.tls.certSecret }} + items: + - key: {{ .Values.tls.publicCrt }} + path: public.crt + - key: {{ .Values.tls.privateKey }} + path: private.key +{{- end }} +{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} +{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} +{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} +- name: trusted-cert-secret-volume + secret: + secretName: {{ $certSecret }} + {{- if ne $publicCrt "" }} + items: + - key: {{ $publicCrt }} + path: public.crt + {{- end }} +{{- end }} +{{- end -}} diff --git a/test/minio/8.0.5/templates/clusterroles.yaml b/test/minio/8.0.5/templates/clusterroles.yaml new file mode 100644 index 00000000000..c4d9a9371b5 --- /dev/null +++ b/test/minio/8.0.5/templates/clusterroles.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "minio.serviceAccountName" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +- apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - {{ template "minio.fullname" . }} + verbs: + - use +{{- end }} diff --git a/test/minio/8.0.5/templates/configmap.yaml b/test/minio/8.0.5/templates/configmap.yaml new file mode 100644 index 00000000000..cb11fcd7dda --- /dev/null +++ b/test/minio/8.0.5/templates/configmap.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + initialize: |- +{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml new file mode 100644 index 00000000000..2fa9edf173e --- /dev/null +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -0,0 +1,203 @@ +{{- if eq .Values.mode "standalone" }} +{{ $scheme := "http" }} +{{- if .Values.tls.enabled }} +{{ $scheme = "https" }} +{{ end }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +apiVersion: {{ template "minio.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + strategy: + type: {{ .Values.DeploymentUpdate.type }} + {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} + maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} + {{- end}} + {{- if .Values.nasgateway.enabled }} + replicas: {{ .Values.nasgateway.replicas }} + {{- end }} + {{- if .Values.s3gateway.enabled }} + replicas: {{ .Values.s3gateway.replicas }} + {{- end }} + {{- if .Values.azuregateway.enabled }} + replicas: {{ .Values.azuregateway.replicas }} + {{- end }} + {{- if .Values.gcsgateway.enabled }} + replicas: {{ .Values.gcsgateway.replicas }} + {{- end }} + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} +{{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} +{{- end }} + annotations: + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} +{{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} +{{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} +{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} +{{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.s3gateway.enabled }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" + {{- else }} + {{- if .Values.azuregateway.enabled }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" + {{- else }} + {{- if .Values.gcsgateway.enabled }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" + {{- else }} + {{- if .Values.nasgateway.enabled }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" + {{- else }} + command: + - "/bin/sh" + - "-ce" + - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" + {{- end }} + {{- end }} + {{- end }} + {{- end }} + volumeMounts: + {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} + - name: export + mountPath: {{ .Values.mountPath }} + {{- if .Values.persistence.subPath }} + subPath: "{{ .Values.persistence.subPath }}" + {{- end }} + {{- end }} + {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} + - name: minio-user + mountPath: "/etc/credentials" + readOnly: true + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + ports: + - name: {{ $scheme }} + containerPort: 9000 + env: + - name: MINIO_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: accesskey + - name: MINIO_SECRET_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: secretkey + {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} + - name: GOOGLE_APPLICATION_CREDENTIALS + value: "/etc/credentials/gcs_key.json" + {{- end }} + {{- if .Values.etcd.endpoints }} + - name: MINIO_ETCD_ENDPOINTS + value: {{ join "," .Values.etcd.endpoints | quote }} + {{- if .Values.etcd.clientCert }} + - name: MINIO_ETCD_CLIENT_CERT + value: "/etc/credentials/etcd_client_cert.pem" + {{- end }} + {{- if .Values.etcd.clientCertKey }} + - name: MINIO_ETCD_CLIENT_CERT_KEY + value: "/etc/credentials/etcd_client_cert_key.pem" + {{- end }} + {{- if .Values.etcd.pathPrefix }} + - name: MINIO_ETCD_PATH_PREFIX + value: {{ .Values.etcd.pathPrefix }} + {{- end }} + {{- if .Values.etcd.corednsPathPrefix }} + - name: MINIO_ETCD_COREDNS_PATH + value: {{ .Values.etcd.corednsPathPrefix }} + {{- end }} + {{- end }} + {{- if .Values.s3gateway.enabled -}} + {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: awsAccessKeyId + {{- end }} + {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: awsSecretAccessKey + {{- end }} + {{- end }} + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ $val | quote }} + {{- end}} + resources: +{{ toYaml .Values.resources | indent 12 }} +{{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} +{{- end }} +{{- include "minio.imagePullSecrets" . | indent 6 }} +{{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} +{{- end }} +{{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} +{{- end }} + volumes: + {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} + - name: export + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- end }} + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} +{{- end }} diff --git a/test/minio/8.0.5/templates/ingress.yaml b/test/minio/8.0.5/templates/ingress.yaml new file mode 100644 index 00000000000..2d9bbda0559 --- /dev/null +++ b/test/minio/8.0.5/templates/ingress.yaml @@ -0,0 +1,45 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "minio.fullname" . -}} +{{- $servicePort := .Values.service.port -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: {{ template "minio.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- with .Values.ingress.labels }} +{{ toYaml . | indent 4 }} +{{- end }} + +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + - http: + paths: + - path: {{ $ingressPath }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $servicePort }} + {{- if . }} + host: {{ . | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/test/minio/8.0.5/templates/networkpolicy.yaml b/test/minio/8.0.5/templates/networkpolicy.yaml new file mode 100644 index 00000000000..de57f485fee --- /dev/null +++ b/test/minio/8.0.5/templates/networkpolicy.yaml @@ -0,0 +1,25 @@ +{{- if .Values.networkPolicy.enabled }} +kind: NetworkPolicy +apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + podSelector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + ingress: + - ports: + - port: {{ .Values.service.port }} + {{- if not .Values.networkPolicy.allowExternal }} + from: + - podSelector: + matchLabels: + {{ template "minio.name" . }}-client: "true" + {{- end }} +{{- end }} diff --git a/test/minio/8.0.5/templates/poddisruptionbudget.yaml b/test/minio/8.0.5/templates/poddisruptionbudget.yaml new file mode 100644 index 00000000000..1de813b8b80 --- /dev/null +++ b/test/minio/8.0.5/templates/poddisruptionbudget.yaml @@ -0,0 +1,13 @@ +{{- if .Values.podDisruptionBudget.enabled }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: minio + labels: + app: {{ template "minio.name" . }} +spec: + maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + selector: + matchLabels: + app: {{ template "minio.name" . }} +{{- end }} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml new file mode 100644 index 00000000000..27e30d4ab73 --- /dev/null +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -0,0 +1,87 @@ +{{- if or .Values.defaultBucket.enabled .Values.buckets }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ template "minio.fullname" . }}-make-bucket-job + labels: + app: {{ template "minio.name" . }}-make-bucket-job + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation +{{- with .Values.makeBucketJob.annotations }} +{{ toYaml . | indent 4 }} +{{- end }} +spec: + template: + metadata: + labels: + app: {{ template "minio.name" . }}-job + release: {{ .Release.Name }} +{{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} +{{- end }} +{{- if .Values.makeBucketJob.podAnnotations }} + annotations: +{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} +{{- end }} + spec: + restartPolicy: OnFailure +{{- include "minio.imagePullSecrets" . | indent 6 }} +{{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} +{{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} +{{- end }} +{{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} +{{- end }} +{{- if .Values.makeBucketJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} + fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} +{{- end }} + volumes: + - name: minio-configuration + projected: + sources: + - configMap: + name: {{ template "minio.fullname" . }} + - secret: + name: {{ template "minio.secretName" . }} + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + secret: + secretName: {{ .Values.tls.certSecret }} + items: + - key: {{ .Values.tls.publicCrt }} + path: CAs/public.crt + {{ end }} + serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} + containers: + - name: minio-mc + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + command: ["/bin/sh", "/config/initialize"] + env: + - name: MINIO_ENDPOINT + value: {{ template "minio.fullname" . }} + - name: MINIO_PORT + value: {{ .Values.service.port | quote }} + volumeMounts: + - name: minio-configuration + mountPath: /config + {{- if .Values.tls.enabled }} + - name: cert-secret-volume-mc + mountPath: {{ .Values.configPathmc }}certs + {{ end }} + resources: +{{ toYaml .Values.makeBucketJob.resources | indent 10 }} +{{- end }} diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml new file mode 100644 index 00000000000..d7590db7c9c --- /dev/null +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml @@ -0,0 +1,135 @@ +{{- if .Values.metrics.serviceMonitor.enabled }} +{{- $fullName := include "minio.fullname" . -}} +{{ $scheme := "http" }} +{{- if .Values.tls.enabled }} +{{ $scheme = "https" }} +{{ end }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ $fullName }}-update-prometheus-secret + labels: + app: {{ template "minio.name" . }}-update-prometheus-secret + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation + {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} +spec: + template: + metadata: + labels: + app: {{ template "minio.name" . }}-update-prometheus-secret + release: {{ .Release.Name }} +{{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} +{{- end }} +{{- if .Values.updatePrometheusJob.podAnnotations }} + annotations: +{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} +{{- end }} + spec: +{{- if .Values.serviceAccount.create }} + serviceAccountName: {{ $fullName }}-update-prometheus-secret +{{- end }} + restartPolicy: OnFailure +{{- include "minio.imagePullSecrets" . | indent 6 }} +{{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} +{{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} +{{- end }} +{{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} +{{- end }} +{{- if .Values.updatePrometheusJob.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} + runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} + fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} +{{- end }} + volumes: + - name: workdir + emptyDir: {} + initContainers: + - name: minio-mc + image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" + imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + command: + - /bin/sh + - "-c" + - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json + env: + - name: MINIO_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: accesskey + - name: MINIO_SECRET_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: secretkey + # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required + - name: MC_HOST_target + value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} + volumeMounts: + - name: workdir + mountPath: /workdir + resources: +{{ toYaml .Values.resources | indent 12 }} + # extract bearerToken from mc admin output + - name: jq + image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" + imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} + command: + - /bin/sh + - "-c" + - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token + volumeMounts: + - name: workdir + mountPath: /workdir + resources: +{{ toYaml .Values.resources | indent 12 }} + - name: kubectl-create + image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" + imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} + command: + - /bin/sh + - "-c" + # The following script does: + # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file + # - create the secret + # - merge both json + - > + kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | + jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && + kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && + cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json + volumeMounts: + - name: workdir + mountPath: /workdir + resources: +{{ toYaml .Values.resources | indent 12 }} + containers: + - name: kubectl-apply + image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" + imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} + command: + - kubectl + - apply + - "-f" + - /workdir/object.json + volumeMounts: + - name: workdir + mountPath: /workdir + resources: +{{ toYaml .Values.resources | indent 12 }} +{{- end }} diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml new file mode 100644 index 00000000000..26c0ce7edc4 --- /dev/null +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml @@ -0,0 +1,38 @@ +{{- if .Values.serviceAccount.create -}} +{{- $fullName := include "minio.fullname" . -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $fullName }}-update-prometheus-secret + labels: + app: {{ template "minio.name" . }}-update-prometheus-secret + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create + - update + - patch + resourceNames: + - {{ $fullName }}-prometheus + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + resourceNames: + - {{ $fullName }} +{{- end -}} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml new file mode 100644 index 00000000000..7d0ea75b752 --- /dev/null +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.serviceAccount.create -}} +{{- $fullName := include "minio.fullname" . -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ $fullName }}-update-prometheus-secret + labels: + app: {{ template "minio.name" . }}-update-prometheus-secret + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ $fullName }}-update-prometheus-secret +subjects: + - kind: ServiceAccount + name: {{ $fullName }}-update-prometheus-secret + namespace: {{ .Release.Namespace | quote }} +{{- end -}} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml new file mode 100644 index 00000000000..050d368a562 --- /dev/null +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +{{- $fullName := include "minio.fullname" . -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ $fullName }}-update-prometheus-secret + labels: + app: {{ template "minio.name" . }}-update-prometheus-secret + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end -}} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/pvc.yaml b/test/minio/8.0.5/templates/pvc.yaml new file mode 100644 index 00000000000..014f90f3e62 --- /dev/null +++ b/test/minio/8.0.5/templates/pvc.yaml @@ -0,0 +1,35 @@ +{{- if eq .Values.mode "standalone" }} +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: +{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} + selector: + matchLabels: + pv: {{ .Values.nasgateway.pv | quote }} +{{- end }} + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + +{{- if .Values.persistence.storageClass }} +{{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" +{{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" +{{- end }} +{{- end }} +{{- if .Values.persistence.VolumeName }} + volumeName: "{{ .Values.persistence.VolumeName }}" +{{- end }} +{{- end }} +{{- end }} diff --git a/test/minio/8.0.5/templates/rolebindings.yaml b/test/minio/8.0.5/templates/rolebindings.yaml new file mode 100644 index 00000000000..ea8b98c5857 --- /dev/null +++ b/test/minio/8.0.5/templates/rolebindings.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "minio.serviceAccountName" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + namespace: {{ .Release.Namespace | quote }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "minio.serviceAccountName" . }} +subjects: +- kind: ServiceAccount + name: {{ template "minio.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} +{{- end }} diff --git a/test/minio/8.0.5/templates/secrets.yaml b/test/minio/8.0.5/templates/secrets.yaml new file mode 100644 index 00000000000..c254142f92b --- /dev/null +++ b/test/minio/8.0.5/templates/secrets.yaml @@ -0,0 +1,32 @@ +{{- if not .Values.existingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "minio.secretName" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +type: Opaque +data: + accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} + secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} +{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} + gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} +{{- end }} +{{- if .Values.s3gateway.enabled -}} +{{- if .Values.s3gateway.accessKey }} + awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} +{{- end }} +{{- if .Values.s3gateway.secretKey }} + awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} +{{- end }} +{{- end }} +{{- if .Values.etcd.clientCert }} + etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} +{{- end }} +{{- if .Values.etcd.clientCertKey }} + etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/test/minio/8.0.5/templates/securitycontextconstraints.yaml b/test/minio/8.0.5/templates/securitycontextconstraints.yaml new file mode 100644 index 00000000000..dfde6fb99e9 --- /dev/null +++ b/test/minio/8.0.5/templates/securitycontextconstraints.yaml @@ -0,0 +1,46 @@ +{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +priority: 10 +allowHostDirVolumePlugin: false +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: false +allowedCapabilities: [] +readOnlyRootFilesystem: false +defaultAddCapabilities: [] +requiredDropCapabilities: +- KILL +- MKNOD +- SETUID +- SETGID +fsGroup: + type: MustRunAs + ranges: + - max: {{ .Values.securityContext.fsGroup }} + min: {{ .Values.securityContext.fsGroup }} +runAsUser: + type: MustRunAs + uid: {{ .Values.securityContext.runAsUser }} +seLinuxContext: + type: MustRunAs +supplementalGroups: + type: RunAsAny +volumes: +- configMap +- downwardAPI +- emptyDir +- persistentVolumeClaim +- projected +- secret +{{- end }} diff --git a/test/minio/8.0.5/templates/service.yaml b/test/minio/8.0.5/templates/service.yaml new file mode 100644 index 00000000000..ea681e22079 --- /dev/null +++ b/test/minio/8.0.5/templates/service.yaml @@ -0,0 +1,47 @@ +{{ $scheme := "http" }} +{{- if .Values.tls.enabled }} +{{ $scheme = "https" }} +{{ end }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- if .Values.service.annotations }} + annotations: +{{ toYaml .Values.service.annotations | indent 4 }} +{{- end }} +spec: +{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} + type: ClusterIP + {{- if not (empty .Values.service.clusterIP) }} + clusterIP: {{ .Values.service.clusterIP }} + {{end}} +{{- else if eq .Values.service.type "LoadBalancer" }} + type: {{ .Values.service.type }} + loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} +{{- else }} + type: {{ .Values.service.type }} +{{- end }} + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP +{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} + nodePort: {{ .Values.service.nodePort }} +{{- else }} + targetPort: 9000 +{{- end}} +{{- if .Values.service.externalIPs }} + externalIPs: +{{- range $i , $ip := .Values.service.externalIPs }} + - {{ $ip }} +{{- end }} +{{- end }} + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} diff --git a/test/minio/8.0.5/templates/serviceaccount.yaml b/test/minio/8.0.5/templates/serviceaccount.yaml new file mode 100644 index 00000000000..243dfef538f --- /dev/null +++ b/test/minio/8.0.5/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "minio.serviceAccountName" . | quote }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: "{{ .Release.Name }}" +{{- end -}} diff --git a/test/minio/8.0.5/templates/servicemonitor.yaml b/test/minio/8.0.5/templates/servicemonitor.yaml new file mode 100644 index 00000000000..e1259097345 --- /dev/null +++ b/test/minio/8.0.5/templates/servicemonitor.yaml @@ -0,0 +1,41 @@ +{{- if .Values.metrics.serviceMonitor.enabled }} +{{ $scheme := "http" }} +{{- if .Values.tls.enabled }} +{{ $scheme = "https" }} +{{ end }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "minio.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- end }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} +{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} + {{- end }} +spec: + endpoints: + - port: {{ $scheme }} + path: /minio/prometheus/metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + bearerTokenSecret: + name: {{ template "minio.fullname" . }}-prometheus + key: token + namespaceSelector: + matchNames: + - {{ .Release.Namespace | quote }} + selector: + matchLabels: + app: {{ include "minio.name" . }} + release: {{ .Release.Name }} +{{- end }} diff --git a/test/minio/8.0.5/templates/statefulset.yaml b/test/minio/8.0.5/templates/statefulset.yaml new file mode 100644 index 00000000000..b1d2d449770 --- /dev/null +++ b/test/minio/8.0.5/templates/statefulset.yaml @@ -0,0 +1,174 @@ +{{- if eq .Values.mode "distributed" }} +{{ $zoneCount := .Values.zones | int }} +{{ $nodeCount := .Values.replicas | int }} +{{ $drivesPerNode := .Values.drivesPerNode | int }} +{{ $scheme := "http" }} +{{- if .Values.tls.enabled }} +{{ $scheme = "https" }} +{{ end }} +{{ $mountPath := .Values.mountPath }} +{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} +{{ $subPath := .Values.persistence.subPath }} +{{ $penabled := .Values.persistence.enabled }} +{{ $accessMode := .Values.persistence.accessMode }} +{{ $storageClass := .Values.persistence.storageClass }} +{{ $psize := .Values.persistence.size }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "minio.fullname" . }}-svc + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +spec: + publishNotReadyAddresses: true + clusterIP: None + ports: + - name: {{ $scheme }} + port: {{ .Values.service.port }} + protocol: TCP + selector: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} +--- +apiVersion: {{ template "minio.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + chart: {{ template "minio.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + updateStrategy: + type: {{ .Values.StatefulSetUpdate.updateStrategy }} + podManagementPolicy: "Parallel" + serviceName: {{ template "minio.fullname" . }}-svc + replicas: {{ mul $zoneCount $nodeCount }} + selector: + matchLabels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} + template: + metadata: + name: {{ template "minio.fullname" . }} + labels: + app: {{ template "minio.name" . }} + release: {{ .Release.Name }} +{{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} +{{- end }} + annotations: + checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} +{{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} +{{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} +{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} +{{- end }} + containers: + - name: {{ .Chart.Name }} + image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] + volumeMounts: + {{- if $penabled }} + {{- if (gt $drivesPerNode 1) }} + {{- range $i := until $drivesPerNode }} + - name: export-{{ $i }} + mountPath: {{ $mountPath }}-{{ $i }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- else }} + - name: export + mountPath: {{ $mountPath }} + {{- if and $penabled $subPath }} + subPath: {{ $subPath }} + {{- end }} + {{- end }} + {{- end }} + {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} + ports: + - name: {{ $scheme }} + containerPort: 9000 + env: + - name: MINIO_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: accesskey + - name: MINIO_SECRET_KEY + valueFrom: + secretKeyRef: + name: {{ template "minio.secretName" . }} + key: secretkey + {{- range $key, $val := .Values.environment }} + - name: {{ $key }} + value: {{ $val | quote }} + {{- end}} + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} +{{- include "minio.imagePullSecrets" . | indent 6 }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + volumes: + - name: minio-user + secret: + secretName: {{ template "minio.secretName" . }} + {{- include "minio.tlsKeysVolume" . | indent 8 }} +{{- if .Values.persistence.enabled }} + volumeClaimTemplates: + {{- if gt $drivesPerNode 1 }} + {{- range $diskId := until $drivesPerNode}} + - metadata: + name: export-{{ $diskId }} + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} + {{- else }} + - metadata: + name: export + spec: + accessModes: [ {{ $accessMode | quote }} ] + {{- if $storageClass }} + storageClassName: {{ $storageClass }} + {{- end }} + resources: + requests: + storage: {{ $psize }} + {{- end }} +{{- end }} +{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml new file mode 100644 index 00000000000..d18a8cecc7b --- /dev/null +++ b/test/minio/8.0.5/values.yaml @@ -0,0 +1,344 @@ +## Provide a name in place of minio for `app:` labels +## +nameOverride: "" + +## Provide a name to substitute for the full names of resources +## +fullnameOverride: "" + +## set kubernetes cluster domain where minio is running +## +clusterDomain: cluster.local + +## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the +## +image: + repository: minio/minio + tag: RELEASE.2020-11-19T23-48-16Z + pullPolicy: IfNotPresent + +## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio +## client used to create a default bucket). +## +mcImage: + repository: minio/mc + tag: RELEASE.2020-11-17T00-39-14Z + pullPolicy: IfNotPresent + +## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON +## process used to create secret for prometheus ServiceMonitor). +## +helmKubectlJqImage: + repository: bskim45/helm-kubectl-jq + tag: 3.1.0 + pullPolicy: IfNotPresent + +## minio server mode, i.e. standalone or distributed. +## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide +## +mode: standalone + +## Additional arguments to pass to minio binary +extraArgs: [] + +## Update strategy for Deployments +DeploymentUpdate: + type: RollingUpdate + maxUnavailable: 0 + maxSurge: 100% + +## Update strategy for StatefulSets +StatefulSetUpdate: + updateStrategy: RollingUpdate + +## Pod priority settings +## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ +## +priorityClassName: "" + +## Set default accesskey, secretkey, Minio config file path, volume mount path and +## number of nodes (only used for Minio distributed mode) +## AccessKey and secretKey is generated when not set +## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide +## +accessKey: "" +secretKey: "" +certsPath: "/etc/minio/certs/" +configPathmc: "/etc/minio/mc/" +mountPath: "/export" + +## Use existing Secret that store following variables: +## +## | Chart var | .data. in Secret | +## |:----------------------|:-------------------------| +## | accessKey | accesskey | +## | secretKey | secretkey | +## | gcsgateway.gcsKeyJson | gcs_key.json | +## | s3gateway.accessKey | awsAccessKeyId | +## | s3gateway.secretKey | awsSecretAccessKey | +## | etcd.clientCert | etcd_client_cert.pem | +## | etcd.clientCertKey | etcd_client_cert_key.pem | +## +## All mentioned variables will be ignored in values file. +## .data.accesskey and .data.secretkey are mandatory, +## others depend on enabled status of corresponding sections. +existingSecret: "" + +## Override the root directory which the minio server should serve from. +## If left empty, it defaults to the value of {{ .Values.mountPath }} +## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} +bucketRoot: "" + +# Number of drives attached to a node +drivesPerNode: 1 +# Number of MinIO containers running +replicas: 4 +# Number of expanded MinIO clusters +zones: 1 + +## TLS Settings for Minio +tls: + enabled: false + ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret + certSecret: "" + publicCrt: public.crt + privateKey: private.key + +## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas +## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret +## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. +## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. +trustedCertsSecret: "" + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + enabled: true + + ## A manually managed Persistent Volume and Claim + ## Requires persistence.enabled: true + ## If defined, PVC must be created manually before volume will be bound + existingClaim: "" + + ## minio data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + ## Storage class of PV to bind. By default it looks for standard storage class. + ## If the PV uses a different storage class, specify that here. + storageClass: "" + VolumeName: "" + accessMode: ReadWriteOnce + size: 500Gi + + ## If subPath is set mount a sub folder of a volume instead of the root of the volume. + ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). + ## + subPath: "" + +## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). +## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. +## ref: http://kubernetes.io/docs/user-guide/services/ +## + +service: + type: ClusterIP + clusterIP: ~ + port: 9000 + nodePort: 32000 + + ## List of IP addresses at which the Prometheus server service is available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # - externalIp1 + + annotations: {} + # prometheus.io/scrape: 'true' + # prometheus.io/path: '/minio/prometheus/metrics' + # prometheus.io/port: '9000' + +## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ +## + +imagePullSecrets: [] +# - name: "image-pull-secret" + +ingress: + enabled: false + labels: {} + # node-role.kubernetes.io/ingress: platform + + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # kubernetes.io/ingress.allow-http: "false" + # kubernetes.io/ingress.global-static-ip-name: "" + # nginx.ingress.kubernetes.io/secure-backends: "true" + # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 + path: / + hosts: + - chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +tolerations: [] +affinity: {} + +## Add stateful containers to have security context, if enabled MinIO will run as this +## user and group NOTE: securityContext is only enabled if persistence.enabled=true +securityContext: + enabled: true + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + +# Additational pod annotations +podAnnotations: {} + +# Additional pod labels +podLabels: {} + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + requests: + memory: 4Gi + +## Create a bucket after minio install +## +defaultBucket: + enabled: false + ## If enabled, must be a string with length > 0 + name: bucket + ## Can be one of none|download|upload|public + policy: none + ## Purge if bucket exists already + purge: false + ## set versioning for bucket true|false + # versioning: false + +## Create multiple buckets after minio install +## Enabling `defaultBucket` will take priority over this list +## +buckets: [] + # - name: bucket1 + # policy: none + # purge: false + # - name: bucket2 + # policy: none + # purge: false + +## Additional Annotations for the Kubernetes Batch (make-bucket-job) +makeBucketJob: + podAnnotations: + annotations: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + resources: + requests: + memory: 128Mi + +## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) +updatePrometheusJob: + podAnnotations: + annotations: + securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + +s3gateway: + enabled: false + replicas: 4 + serviceEndpoint: "" + accessKey: "" + secretKey: "" + +## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. +## https://docs.minio.io/docs/minio-gateway-for-azure +azuregateway: + enabled: false + # Number of parallel instances + replicas: 4 + +## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. +## https://docs.minio.io/docs/minio-gateway-for-gcs + +gcsgateway: + enabled: false + # Number of parallel instances + replicas: 4 + # credential json file of service account key + gcsKeyJson: "" + # Google cloud project-id + projectId: "" + +## Use minio on NAS backend +## https://docs.minio.io/docs/minio-gateway-for-nas + +nasgateway: + enabled: false + # Number of parallel instances + replicas: 4 + # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have + # a label like "pv: ", use value here. + pv: ~ + +## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) +## when Chart is deployed +environment: + ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html + +networkPolicy: + enabled: false + allowExternal: true + +## PodDisruptionBudget settings +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ +## +podDisruptionBudget: + enabled: false + maxUnavailable: 1 + +## Specify the service account to use for the Minio pods. If 'create' is set to 'false' +## and 'name' is left unspecified, the account 'default' will be used. +serviceAccount: + create: true + ## The name of the service account to use. If 'create' is 'true', a service account with that name + ## will be created. Otherwise, a name will be auto-generated. + name: + +metrics: + # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 + serviceMonitor: + enabled: false + additionalLabels: {} + # namespace: monitoring + # interval: 30s + # scrapeTimeout: 10s + +## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md +## Define endpoints to enable this section. +etcd: + endpoints: [] + pathPrefix: "" + corednsPathPrefix: "" + clientCert: "" + clientCertKey: "" From 260a4c49ddaee1ebc47c474b48e1482744261fe0 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:01:59 +0500 Subject: [PATCH 02/29] Remove ci dir --- test/minio/8.0.5/README.md | 412 +++++++++++++++++++- test/minio/8.0.5/ci/distributed-values.yaml | 1 - 2 files changed, 411 insertions(+), 2 deletions(-) mode change 120000 => 100755 test/minio/8.0.5/README.md delete mode 100644 test/minio/8.0.5/ci/distributed-values.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md deleted file mode 120000 index 32d46ee883b..00000000000 --- a/test/minio/8.0.5/README.md +++ /dev/null @@ -1 +0,0 @@ -../README.md \ No newline at end of file diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md new file mode 100755 index 00000000000..84506bd3978 --- /dev/null +++ b/test/minio/8.0.5/README.md @@ -0,0 +1,411 @@ +MinIO +===== + +[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. + +MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. + +For more detailed documentation please visit [here](https://docs.minio.io/) + +Introduction +------------ + +This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +Prerequisites +------------- + +- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. +- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). +- PV provisioner support in the underlying infrastructure. + +Configure MinIO Helm repo +-------------------- +```bash +$ helm repo add minio https://helm.min.io/ +``` + +Installing the Chart +-------------------- + +Install this chart using: + +```bash +$ helm install --namespace minio --generate-name minio/minio +``` + +The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +### Release name + +An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: + +```bash +$ helm install my-release minio/minio +``` + +### Access and Secret keys + +By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. + +```bash +$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio +``` + +### Updating MinIO configuration via Helm + +[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. + +To update your MinIO server configuration while it is deployed in a release, you need to + +1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. +2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. +3. Restart the MinIO server(s) for the changes to take effect. + +You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. + +### Installing certificates from third party CAs + +MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. + +For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt +``` + +If TLS is not enabled, you would need only the third party CA: + +``` +kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt +``` + +The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: + +``` +trustedCertsSecret: "minio-trusted-certs" + +or + +--set trustedCertsSecret=minio-trusted-certs +``` + +Uninstalling the Chart +---------------------- + +Assuming your release is named as `my-release`, delete it using the command: + +```bash +$ helm delete my-release +``` + +or + +```bash +$ helm uninstall my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +Upgrading the Chart +------------------- + +You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: + +```bash +$ helm get values my-release > old_values.yaml +``` + +Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using + +```bash +$ helm upgrade -f old_values.yaml my-release minio/minio +``` + +Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. + +Configuration +------------- + +The following table lists the configurable parameters of the MinIO chart and their default values. + +| Parameter | Description | Default | +|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| +| `nameOverride` | Provide a name in place of `minio` | `""` | +| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | +| `image.repository` | Image repository | `minio/minio` | +| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `imagePullSecrets` | List of container registry secrets | `[]` | +| `mcImage.repository` | Client image repository | `minio/mc` | +| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | +| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | +| `ingress.enabled` | Enables Ingress | `false` | +| `ingress.labels ` | Ingress labels | `{}` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.hosts` | Ingress accepted hostnames | `[]` | +| `ingress.tls` | Ingress TLS configuration | `[]` | +| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | +| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | +| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | +| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | +| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | +| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | +| `existingSecret` | Name of existing secret with access and secret key. | `""` | +| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | +| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | +| `certsPath` | Default certs path location | `/etc/minio/certs` | +| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | +| `mountPath` | Default mount location for persistent drive | `/export` | +| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | +| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | +| `service.type` | Kubernetes service type | `ClusterIP` | +| `service.port` | Kubernetes port where service is exposed | `9000` | +| `service.externalIPs` | service external IP addresses | `nil` | +| `service.annotations` | Service annotations | `{}` | +| `serviceAccount.create` | Toggle creation of new service account | `true` | +| `serviceAccount.name` | Name of service account to create and/or use | `""` | +| `persistence.enabled` | Use persistent volume to store data | `true` | +| `persistence.size` | Size of persistent volume claim | `500Gi` | +| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | +| `persistence.storageClass` | Storage class name of PVC | `nil` | +| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | +| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | +| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | +| `priorityClassName` | Pod priority settings | `""` | +| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | +| `securityContext.runAsUser` | User id of the user for the container | `1000` | +| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | +| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `affinity` | Affinity settings for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `podAnnotations` | Pod annotations | `{}` | +| `podLabels` | Pod Labels | `{}` | +| `tls.enabled` | Enable TLS for MinIO server | `false` | +| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | +| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | +| `defaultBucket.name` | Bucket name | `bucket` | +| `defaultBucket.policy` | Bucket policy | `none` | +| `defaultBucket.purge` | Purge the bucket if already exists | `false` | +| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | +| `buckets` | List of buckets to create after MinIO install | `[]` | +| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | +| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | +| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | +| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | +| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | +| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | +| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | +| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | +| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | +| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | +| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | +| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | +| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | +| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | +| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | +| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | +| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | +| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | +| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | +| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | +| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | +| `gcsgateway.projectId` | Google cloud project id | `""` | +| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | +| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | +| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | +| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | +| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | +| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | +| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | +| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | +| `etcd.endpoints` | Enpoints of etcd | `[]` | +| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | +| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | +| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | +| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | + +Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). + +You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```bash +$ helm install --name my-release --set persistence.size=1Ti minio/minio +``` + +The above command deploys MinIO server with a 1Ti backing persistent volume. + +Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, + +```bash +$ helm install --name my-release -f values.yaml minio/minio +``` + +> **Tip**: You can use the default [values.yaml](minio/values.yaml) + +Distributed MinIO +----------- + +This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, + +```bash +$ helm install --set mode=distributed minio/minio +``` + +This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, + +```bash +$ helm install --set mode=distributed,replicas=8 minio/minio +``` + +This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. + +You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. + +```bash +$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio +``` + +### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO + +1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. +2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. + +NAS Gateway +----------- + +### Prerequisites + +MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) +outlines steps to create a NFS PV in Kubernetes cluster. + +### Provision NAS Gateway MinIO instances + +To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, + +```bash +$ helm install --set nasgateway.enabled=true minio/minio +``` + +This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, + +```bash +$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio +``` + +This provisions MinIO NAS gateway with 8 instances. + +Persistence +----------- + +This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: + +```bash +$ helm install --set persistence.enabled=false minio/minio +``` + +> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* + +Existing PersistentVolumeClaim +------------------------------ + +If a Persistent Volume Claim already exists, specify it during installation. + +1. Create the PersistentVolume +2. Create the PersistentVolumeClaim +3. Install the chart + +```bash +$ helm install --set persistence.existingClaim=PVC_NAME minio/minio +``` + +NetworkPolicy +------------- + +To enable network policy for MinIO, +install [a networking plugin that implements the Kubernetes +NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), +and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting +the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + + kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" + +With NetworkPolicy enabled, traffic will be limited to just port 9000. + +For more precise policy, set `networkPolicy.allowExternal=true`. This will +only allow pods with the generated client label to connect to MinIO. +This label will be displayed in the output of a successful install. + +Existing secret +--------------- + +Instead of having this chart create the secret for you, you can supply a preexisting secret, much +like an existing PersistentVolumeClaim. + +First, create the secret: +```bash +$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux +``` + +Then install the chart, specifying that you want to use an existing secret: +```bash +$ helm install --set existingSecret=my-minio-secret minio/minio +``` + +The following fields are expected in the secret: + +| .data. in Secret | Corresponding variable | Description | +|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| +| `accesskey` | `accessKey` | Access key ID. Mandatory. | +| `secretkey` | `secretKey` | Secret key. Mandatory. | +| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | +| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | +| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | +| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | +| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | + +All corresponding variables will be ignored in values file. + +Configure TLS +------------- + +To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using + +```bash +$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt +``` + +Then install the chart, specifying that you want to use the TLS secret: + +```bash +$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio +``` + +Pass environment variables to MinIO containers +---------------------------------------------- + +To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format + +```bash +$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio +``` + +You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. + +Create buckets after install +--------------------------- + +Install the chart, specifying the buckets you want to create after install: + +```bash +$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio +``` + +Description of the configuration parameters used above - + +- `buckets[].name` - name of the bucket to create, must be a string with length > 0 +- `buckets[].policy` - can be one of none|download|upload|public +- `buckets[].purge` - purge if bucket exists already diff --git a/test/minio/8.0.5/ci/distributed-values.yaml b/test/minio/8.0.5/ci/distributed-values.yaml deleted file mode 100644 index e6c46738087..00000000000 --- a/test/minio/8.0.5/ci/distributed-values.yaml +++ /dev/null @@ -1 +0,0 @@ -mode: distributed From 7ee19dd17045c13f6cdc25efc2c8e06782d964f2 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:05:45 +0500 Subject: [PATCH 03/29] Remove ingress from minio chart --- test/minio/8.0.5/README.md | 5 --- test/minio/8.0.5/templates/_helpers.tpl | 11 ------ test/minio/8.0.5/templates/ingress.yaml | 45 ------------------------- test/minio/8.0.5/values.yaml | 24 ------------- 4 files changed, 85 deletions(-) delete mode 100644 test/minio/8.0.5/templates/ingress.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 84506bd3978..3690215dfef 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -140,11 +140,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `mcImage.repository` | Client image repository | `minio/mc` | | `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | | `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | -| `ingress.enabled` | Enables Ingress | `false` | -| `ingress.labels ` | Ingress labels | `{}` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | | `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | | `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 227762b13e6..01a21e84196 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -64,17 +64,6 @@ Return the appropriate apiVersion for statefulset. {{- end -}} {{- end -}} -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - {{/* Determine secret name. */}} diff --git a/test/minio/8.0.5/templates/ingress.yaml b/test/minio/8.0.5/templates/ingress.yaml deleted file mode 100644 index 2d9bbda0559..00000000000 --- a/test/minio/8.0.5/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.labels }} -{{ toYaml . | indent 4 }} -{{- end }} - -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- if . }} - host: {{ . | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index d18a8cecc7b..685bb0c4b9f 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -162,33 +162,9 @@ service: # prometheus.io/path: '/minio/prometheus/metrics' # prometheus.io/port: '9000' -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - imagePullSecrets: [] # - name: "image-pull-secret" -ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## From f60c605f5cacf063c36159544e29250f48d623f6 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:18:12 +0500 Subject: [PATCH 04/29] Remove minio gateway feature --- test/minio/8.0.5/README.md | 39 ------------- test/minio/8.0.5/templates/deployment.yaml | 66 +--------------------- test/minio/8.0.5/templates/pvc.yaml | 5 -- test/minio/8.0.5/templates/secrets.yaml | 11 ---- test/minio/8.0.5/values.yaml | 40 ------------- 5 files changed, 2 insertions(+), 159 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 3690215dfef..1d1a077d0fe 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -197,18 +197,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | | `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | | `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | -| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | -| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | -| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | -| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | -| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | -| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | -| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | -| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | -| `gcsgateway.projectId` | Google cloud project id | `""` | -| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | -| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | | `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | | `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | @@ -267,30 +255,6 @@ $ helm install --set mode=distributed,replicas=8,zones=2 minio/minio 1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. 2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. -NAS Gateway ------------ - -### Prerequisites - -MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) -outlines steps to create a NFS PV in Kubernetes cluster. - -### Provision NAS Gateway MinIO instances - -To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, - -```bash -$ helm install --set nasgateway.enabled=true minio/minio -``` - -This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, - -```bash -$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio -``` - -This provisions MinIO NAS gateway with 8 instances. - Persistence ----------- @@ -356,9 +320,6 @@ The following fields are expected in the secret: |:---------------------------|:------------------------|:----------------------------------------------------------------------------------| | `accesskey` | `accessKey` | Access key ID. Mandatory. | | `secretkey` | `secretKey` | Secret key. Mandatory. | -| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | -| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | -| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | | `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | | `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 2fa9edf173e..a1b6747d0ce 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -21,18 +21,6 @@ spec: maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} {{- end}} - {{- if .Values.nasgateway.enabled }} - replicas: {{ .Values.nasgateway.replicas }} - {{- end }} - {{- if .Values.s3gateway.enabled }} - replicas: {{ .Values.s3gateway.replicas }} - {{- end }} - {{- if .Values.azuregateway.enabled }} - replicas: {{ .Values.azuregateway.replicas }} - {{- end }} - {{- if .Values.gcsgateway.enabled }} - replicas: {{ .Values.gcsgateway.replicas }} - {{- end }} selector: matchLabels: app: {{ template "minio.name" . }} @@ -67,47 +55,19 @@ spec: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if .Values.s3gateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.azuregateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.gcsgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.nasgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- else }} command: - "/bin/sh" - "-ce" - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- end }} - {{- end }} - {{- end }} - {{- end }} volumeMounts: - {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} + {{- if .Values.persistence.enabled }} - name: export mountPath: {{ .Values.mountPath }} {{- if .Values.persistence.subPath }} subPath: "{{ .Values.persistence.subPath }}" {{- end }} {{- end }} - {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} + {{- if or .Values.etcd.clientCert .Values.etcd.clientCertKey }} - name: minio-user mountPath: "/etc/credentials" readOnly: true @@ -127,10 +87,6 @@ spec: secretKeyRef: name: {{ template "minio.secretName" . }} key: secretkey - {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/credentials/gcs_key.json" - {{- end }} {{- if .Values.etcd.endpoints }} - name: MINIO_ETCD_ENDPOINTS value: {{ join "," .Values.etcd.endpoints | quote }} @@ -151,22 +107,6 @@ spec: value: {{ .Values.etcd.corednsPathPrefix }} {{- end }} {{- end }} - {{- if .Values.s3gateway.enabled -}} - {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsAccessKeyId - {{- end }} - {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsSecretAccessKey - {{- end }} - {{- end }} {{- range $key, $val := .Values.environment }} - name: {{ $key }} value: {{ $val | quote }} @@ -187,7 +127,6 @@ spec: {{ toYaml . | indent 8 }} {{- end }} volumes: - {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - name: export {{- if .Values.persistence.enabled }} persistentVolumeClaim: @@ -195,7 +134,6 @@ spec: {{- else }} emptyDir: {} {{- end }} - {{- end }} - name: minio-user secret: secretName: {{ template "minio.secretName" . }} diff --git a/test/minio/8.0.5/templates/pvc.yaml b/test/minio/8.0.5/templates/pvc.yaml index 014f90f3e62..7454eca70b0 100644 --- a/test/minio/8.0.5/templates/pvc.yaml +++ b/test/minio/8.0.5/templates/pvc.yaml @@ -10,11 +10,6 @@ metadata: release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: -{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} - selector: - matchLabels: - pv: {{ .Values.nasgateway.pv | quote }} -{{- end }} accessModes: - {{ .Values.persistence.accessMode | quote }} resources: diff --git a/test/minio/8.0.5/templates/secrets.yaml b/test/minio/8.0.5/templates/secrets.yaml index c254142f92b..534a0ebab73 100644 --- a/test/minio/8.0.5/templates/secrets.yaml +++ b/test/minio/8.0.5/templates/secrets.yaml @@ -12,17 +12,6 @@ type: Opaque data: accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} -{{- end }} -{{- if .Values.s3gateway.enabled -}} -{{- if .Values.s3gateway.accessKey }} - awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} -{{- end }} -{{- if .Values.s3gateway.secretKey }} - awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} -{{- end }} -{{- end }} {{- if .Values.etcd.clientCert }} etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} {{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 685bb0c4b9f..7e7cb1385e8 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -73,9 +73,6 @@ mountPath: "/export" ## |:----------------------|:-------------------------| ## | accessKey | accesskey | ## | secretKey | secretkey | -## | gcsgateway.gcsKeyJson | gcs_key.json | -## | s3gateway.accessKey | awsAccessKeyId | -## | s3gateway.secretKey | awsSecretAccessKey | ## | etcd.clientCert | etcd_client_cert.pem | ## | etcd.clientCertKey | etcd_client_cert_key.pem | ## @@ -240,43 +237,6 @@ updatePrometheusJob: runAsGroup: 1000 fsGroup: 1000 -s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - -## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-azure -azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - -## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-gcs - -gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - -## Use minio on NAS backend -## https://docs.minio.io/docs/minio-gateway-for-nas - -nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) ## when Chart is deployed environment: From e1bdf35bac35a7d22a20c94b15971159960638c2 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:19:50 +0500 Subject: [PATCH 05/29] Remove metrics service monitor --- test/minio/8.0.5/README.md | 5 - .../post-install-prometheus-metrics-job.yaml | 135 ------------------ .../minio/8.0.5/templates/servicemonitor.yaml | 41 ------ test/minio/8.0.5/values.yaml | 9 -- 4 files changed, 190 deletions(-) delete mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml delete mode 100644 test/minio/8.0.5/templates/servicemonitor.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 1d1a077d0fe..0860f012bad 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -198,11 +198,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | | `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | | `etcd.endpoints` | Enpoints of etcd | `[]` | | `etcd.pathPrefix` | Prefix for all etcd keys | `""` | | `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml deleted file mode 100644 index d7590db7c9c..00000000000 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-job.yaml +++ /dev/null @@ -1,135 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{- $fullName := include "minio.fullname" . -}} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.podAnnotations }} - annotations: -{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} -{{- end }} - spec: -{{- if .Values.serviceAccount.create }} - serviceAccountName: {{ $fullName }}-update-prometheus-secret -{{- end }} - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: workdir - emptyDir: {} - initContainers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required - - name: MC_HOST_target - value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - # extract bearerToken from mc admin output - - name: jq - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - - name: kubectl-create - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - # The following script does: - # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file - # - create the secret - # - merge both json - - > - kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | - jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && - kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && - cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - containers: - - name: kubectl-apply - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - kubectl - - apply - - "-f" - - /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- end }} diff --git a/test/minio/8.0.5/templates/servicemonitor.yaml b/test/minio/8.0.5/templates/servicemonitor.yaml deleted file mode 100644 index e1259097345..00000000000 --- a/test/minio/8.0.5/templates/servicemonitor.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} -{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - endpoints: - - port: {{ $scheme }} - path: /minio/prometheus/metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 7e7cb1385e8..a04a535901c 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -261,15 +261,6 @@ serviceAccount: ## will be created. Otherwise, a name will be auto-generated. name: -metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - ## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md ## Define endpoints to enable this section. etcd: From 57d32d69e0cac36f53d1bad1bcace637b37c9e73 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:23:13 +0500 Subject: [PATCH 06/29] Remove etcd --- test/minio/8.0.5/README.md | 12 ----------- test/minio/8.0.5/templates/deployment.yaml | 25 ---------------------- test/minio/8.0.5/templates/secrets.yaml | 6 ------ test/minio/8.0.5/values.yaml | 21 ------------------ 4 files changed, 64 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 0860f012bad..1c3bb138a5c 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -192,17 +192,7 @@ The following table lists the configurable parameters of the MinIO chart and the | `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | | `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | | `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | -| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | -| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | -| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `etcd.endpoints` | Enpoints of etcd | `[]` | -| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | -| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | -| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | -| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). @@ -315,8 +305,6 @@ The following fields are expected in the secret: |:---------------------------|:------------------------|:----------------------------------------------------------------------------------| | `accesskey` | `accessKey` | Access key ID. Mandatory. | | `secretkey` | `secretKey` | Secret key. Mandatory. | -| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | -| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | All corresponding variables will be ignored in values file. diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index a1b6747d0ce..89dc455df42 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -67,11 +67,6 @@ spec: subPath: "{{ .Values.persistence.subPath }}" {{- end }} {{- end }} - {{- if or .Values.etcd.clientCert .Values.etcd.clientCertKey }} - - name: minio-user - mountPath: "/etc/credentials" - readOnly: true - {{- end }} {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} ports: - name: {{ $scheme }} @@ -87,26 +82,6 @@ spec: secretKeyRef: name: {{ template "minio.secretName" . }} key: secretkey - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/etc/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/etc/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} {{- range $key, $val := .Values.environment }} - name: {{ $key }} value: {{ $val | quote }} diff --git a/test/minio/8.0.5/templates/secrets.yaml b/test/minio/8.0.5/templates/secrets.yaml index 534a0ebab73..a9e7ec276e6 100644 --- a/test/minio/8.0.5/templates/secrets.yaml +++ b/test/minio/8.0.5/templates/secrets.yaml @@ -12,10 +12,4 @@ type: Opaque data: accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if .Values.etcd.clientCert }} - etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} -{{- end }} -{{- if .Values.etcd.clientCertKey }} - etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} -{{- end }} {{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index a04a535901c..f75e98e09e6 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -73,8 +73,6 @@ mountPath: "/export" ## |:----------------------|:-------------------------| ## | accessKey | accesskey | ## | secretKey | secretkey | -## | etcd.clientCert | etcd_client_cert.pem | -## | etcd.clientCertKey | etcd_client_cert_key.pem | ## ## All mentioned variables will be ignored in values file. ## .data.accesskey and .data.secretkey are mandatory, @@ -227,16 +225,6 @@ makeBucketJob: requests: memory: 128Mi -## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) -updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) ## when Chart is deployed environment: @@ -260,12 +248,3 @@ serviceAccount: ## The name of the service account to use. If 'create' is 'true', a service account with that name ## will be created. Otherwise, a name will be auto-generated. name: - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" From 8d5bad11fb4f14124da65a59c66f009a5811c609 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:32:08 +0500 Subject: [PATCH 07/29] Remove makeBucketJob options --- test/minio/8.0.5/README.md | 7 ------- .../templates/post-install-create-bucket-job.yaml | 15 --------------- test/minio/8.0.5/values.yaml | 13 ------------- 3 files changed, 35 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 1c3bb138a5c..5b438fc063c 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -185,13 +185,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `defaultBucket.purge` | Purge the bucket if already exists | `false` | | `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | | `buckets` | List of buckets to create after MinIO install | `[]` | -| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | -| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml index 27e30d4ab73..744934517bb 100644 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -11,9 +11,6 @@ metadata: annotations: "helm.sh/hook": post-install,post-upgrade "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -{{- with .Values.makeBucketJob.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} spec: template: metadata: @@ -22,10 +19,6 @@ spec: release: {{ .Release.Name }} {{- if .Values.podLabels }} {{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.podAnnotations }} - annotations: -{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} {{- end }} spec: restartPolicy: OnFailure @@ -41,12 +34,6 @@ spec: {{- with .Values.tolerations }} tolerations: {{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} {{- end }} volumes: - name: minio-configuration @@ -82,6 +69,4 @@ spec: - name: cert-secret-volume-mc mountPath: {{ .Values.configPathmc }}certs {{ end }} - resources: -{{ toYaml .Values.makeBucketJob.resources | indent 10 }} {{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index f75e98e09e6..778f6a6bffa 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -212,19 +212,6 @@ buckets: [] # policy: none # purge: false -## Additional Annotations for the Kubernetes Batch (make-bucket-job) -makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) ## when Chart is deployed environment: From 4abf36ffb2d2116e0dc1de1212d5d829dd71ae2a Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:39:15 +0500 Subject: [PATCH 08/29] Remove minoi/mc configurable options --- test/minio/8.0.5/README.md | 3 --- .../minio/8.0.5/templates/post-install-create-bucket-job.yaml | 4 ++-- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 5b438fc063c..48e56dc77a1 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -137,9 +137,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `imagePullSecrets` | List of container registry secrets | `[]` | -| `mcImage.repository` | Client image repository | `minio/mc` | -| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | -| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | | `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | | `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml index 744934517bb..bb88fa1a428 100644 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -54,8 +54,8 @@ spec: serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} containers: - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} + image: "minio/mc:latest" + imagePullPolicy: IfNotPresent command: ["/bin/sh", "/config/initialize"] env: - name: MINIO_ENDPOINT From 993b6e35bc70ac9db8f321bcaf6b9ade7662bc96 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:40:32 +0500 Subject: [PATCH 09/29] Remove imagePullSecrets options --- test/minio/8.0.5/README.md | 1 - test/minio/8.0.5/templates/_helpers.tpl | 25 ------------------- test/minio/8.0.5/templates/deployment.yaml | 1 - .../post-install-create-bucket-job.yaml | 1 - test/minio/8.0.5/templates/statefulset.yaml | 1 - test/minio/8.0.5/values.yaml | 3 --- 6 files changed, 32 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 48e56dc77a1..21fa1da1bd5 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -136,7 +136,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `image.repository` | Image repository | `minio/minio` | | `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `imagePullSecrets` | List of container registry secrets | `[]` | | `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | | `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 01a21e84196..6f2f5cf4a11 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -102,31 +102,6 @@ Properly format optional additional arguments to Minio binary {{- end -}} {{- end -}} -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - {{/* Formats volumeMount for Minio tls keys and trusted certs */}} diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 89dc455df42..927ec52c246 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -92,7 +92,6 @@ spec: nodeSelector: {{ toYaml . | indent 8 }} {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} {{- with .Values.affinity }} affinity: {{ toYaml . | indent 8 }} diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml index bb88fa1a428..610eb317c5e 100644 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -22,7 +22,6 @@ spec: {{- end }} spec: restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 8 }} diff --git a/test/minio/8.0.5/templates/statefulset.yaml b/test/minio/8.0.5/templates/statefulset.yaml index b1d2d449770..789f73c7cfa 100644 --- a/test/minio/8.0.5/templates/statefulset.yaml +++ b/test/minio/8.0.5/templates/statefulset.yaml @@ -129,7 +129,6 @@ spec: nodeSelector: {{ toYaml . | indent 8 }} {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} {{- with .Values.affinity }} affinity: {{ toYaml . | indent 8 }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 778f6a6bffa..e13f903c322 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -157,9 +157,6 @@ service: # prometheus.io/path: '/minio/prometheus/metrics' # prometheus.io/port: '9000' -imagePullSecrets: [] -# - name: "image-pull-secret" - ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## From f684d9f15a9f5160aa567babf1e3079adcfe4712 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:41:37 +0500 Subject: [PATCH 10/29] Remove fullnameOverride option --- test/minio/8.0.5/README.md | 2 -- test/minio/8.0.5/values.yaml | 8 -------- 2 files changed, 10 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 21fa1da1bd5..96391b9d1a1 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -131,8 +131,6 @@ The following table lists the configurable parameters of the MinIO chart and the | Parameter | Description | Default | |:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| -| `nameOverride` | Provide a name in place of `minio` | `""` | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | | `image.repository` | Image repository | `minio/minio` | | `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index e13f903c322..281a46c2779 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -1,11 +1,3 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - ## set kubernetes cluster domain where minio is running ## clusterDomain: cluster.local From ad300671d852797a2f189439c5c541583abf8fd5 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:44:01 +0500 Subject: [PATCH 11/29] Remove node selector related options --- test/minio/8.0.5/README.md | 5 ----- test/minio/8.0.5/templates/deployment.yaml | 18 ------------------ .../post-install-create-bucket-job.yaml | 15 --------------- test/minio/8.0.5/templates/statefulset.yaml | 18 ------------------ test/minio/8.0.5/values.yaml | 13 ------------- 5 files changed, 69 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 96391b9d1a1..76ec096539d 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -166,11 +166,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `securityContext.runAsUser` | User id of the user for the container | `1000` | | `securityContext.runAsGroup` | Group id of the user for the container | `1000` | | `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity settings for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `podAnnotations` | Pod annotations | `{}` | -| `podLabels` | Pod Labels | `{}` | | `tls.enabled` | Enable TLS for MinIO server | `false` | | `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | | `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 927ec52c246..b21dcdc4cb0 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -31,15 +31,9 @@ spec: labels: app: {{ template "minio.name" . }} release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} annotations: checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" @@ -88,18 +82,6 @@ spec: {{- end}} resources: {{ toYaml .Values.resources | indent 12 }} -{{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} volumes: - name: export {{- if .Values.persistence.enabled }} diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml index 610eb317c5e..ea1893e1b5b 100644 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -17,23 +17,8 @@ spec: labels: app: {{ template "minio.name" . }}-job release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} spec: restartPolicy: OnFailure -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} volumes: - name: minio-configuration projected: diff --git a/test/minio/8.0.5/templates/statefulset.yaml b/test/minio/8.0.5/templates/statefulset.yaml index 789f73c7cfa..dacf16f47b3 100644 --- a/test/minio/8.0.5/templates/statefulset.yaml +++ b/test/minio/8.0.5/templates/statefulset.yaml @@ -58,15 +58,9 @@ spec: labels: app: {{ template "minio.name" . }} release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} annotations: checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" @@ -125,18 +119,6 @@ spec: {{- end}} resources: {{ toYaml .Values.resources | indent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} volumes: - name: minio-user secret: diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 281a46c2779..297345fb9b9 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -149,13 +149,6 @@ service: # prometheus.io/path: '/minio/prometheus/metrics' # prometheus.io/port: '9000' -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} - ## Add stateful containers to have security context, if enabled MinIO will run as this ## user and group NOTE: securityContext is only enabled if persistence.enabled=true securityContext: @@ -164,12 +157,6 @@ securityContext: runAsGroup: 1000 fsGroup: 1000 -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## From 17d83f6bd474bcb5847b0cfe9985138951286ca9 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:45:02 +0500 Subject: [PATCH 12/29] Remove priorityClassName setting --- test/minio/8.0.5/README.md | 1 - test/minio/8.0.5/templates/deployment.yaml | 3 --- test/minio/8.0.5/templates/statefulset.yaml | 3 --- test/minio/8.0.5/values.yaml | 5 ----- 4 files changed, 12 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 76ec096539d..d93532eef20 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -161,7 +161,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | | `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `priorityClassName` | Pod priority settings | `""` | | `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | | `securityContext.runAsUser` | User id of the user for the container | `1000` | | `securityContext.runAsGroup` | Group id of the user for the container | `1000` | diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index b21dcdc4cb0..1e4dd5d2aa7 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -35,9 +35,6 @@ spec: checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} securityContext: diff --git a/test/minio/8.0.5/templates/statefulset.yaml b/test/minio/8.0.5/templates/statefulset.yaml index dacf16f47b3..1ad8d182080 100644 --- a/test/minio/8.0.5/templates/statefulset.yaml +++ b/test/minio/8.0.5/templates/statefulset.yaml @@ -62,9 +62,6 @@ spec: checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} {{- if and .Values.securityContext.enabled .Values.persistence.enabled }} securityContext: diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 297345fb9b9..331a0889494 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -43,11 +43,6 @@ DeploymentUpdate: StatefulSetUpdate: updateStrategy: RollingUpdate -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - ## Set default accesskey, secretkey, Minio config file path, volume mount path and ## number of nodes (only used for Minio distributed mode) ## AccessKey and secretKey is generated when not set From 26707b648b36a8dd58b0ed5c1c77bccd1246fea9 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:47:27 +0500 Subject: [PATCH 13/29] Remove configPathmc config options --- test/minio/8.0.5/README.md | 1 - test/minio/8.0.5/templates/_helper_create_bucket.txt | 6 +----- .../8.0.5/templates/post-install-create-bucket-job.yaml | 2 +- test/minio/8.0.5/values.yaml | 1 - 4 files changed, 2 insertions(+), 8 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index d93532eef20..e80e9346069 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -144,7 +144,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `accessKey` | Default access key (5 to 20 characters) | random 20 chars | | `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | | `certsPath` | Default certs path location | `/etc/minio/certs` | -| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | | `mountPath` | Default mount location for persistent drive | `/export` | | `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | | `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | diff --git a/test/minio/8.0.5/templates/_helper_create_bucket.txt b/test/minio/8.0.5/templates/_helper_create_bucket.txt index ad2f546b758..5a2cbaacac4 100644 --- a/test/minio/8.0.5/templates/_helper_create_bucket.txt +++ b/test/minio/8.0.5/templates/_helper_create_bucket.txt @@ -1,12 +1,8 @@ #!/bin/sh set -e ; # Have script exit in the event of a failed command. -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" +MC_CONFIG_DIR="/etc/minio/mc/" MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} # connectToMinio # Use a check-sleep-check loop to wait for Minio service to be available diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml index ea1893e1b5b..6bf19fd8ba9 100644 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml @@ -51,6 +51,6 @@ spec: mountPath: /config {{- if .Values.tls.enabled }} - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs + mountPath: /etc/minio/mc/certs {{ end }} {{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 331a0889494..187b5cf2385 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -51,7 +51,6 @@ StatefulSetUpdate: accessKey: "" secretKey: "" certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" mountPath: "/export" ## Use existing Secret that store following variables: From 36f7e7a4972604f600e97323555e100caa40c89f Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 00:49:23 +0500 Subject: [PATCH 14/29] Remove podDisruptionBudget configuration --- test/minio/8.0.5/templates/poddisruptionbudget.yaml | 13 ------------- test/minio/8.0.5/values.yaml | 7 ------- 2 files changed, 20 deletions(-) delete mode 100644 test/minio/8.0.5/templates/poddisruptionbudget.yaml diff --git a/test/minio/8.0.5/templates/poddisruptionbudget.yaml b/test/minio/8.0.5/templates/poddisruptionbudget.yaml deleted file mode 100644 index 1de813b8b80..00000000000 --- a/test/minio/8.0.5/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} \ No newline at end of file diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 187b5cf2385..ff8208e294f 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -191,13 +191,6 @@ networkPolicy: enabled: false allowExternal: true -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - ## Specify the service account to use for the Minio pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: From 80ff32ba58a707c63c32b397ee0953e87dd01c3b Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:21:18 +0500 Subject: [PATCH 15/29] Only have standalone mode for now --- test/minio/8.0.5/README.md | 4 - test/minio/8.0.5/templates/clusterroles.yaml | 20 --- test/minio/8.0.5/templates/deployment.yaml | 2 - test/minio/8.0.5/templates/pvc.yaml | 2 - test/minio/8.0.5/templates/statefulset.yaml | 152 ------------------- test/minio/8.0.5/values.yaml | 12 -- 6 files changed, 192 deletions(-) delete mode 100644 test/minio/8.0.5/templates/clusterroles.yaml delete mode 100644 test/minio/8.0.5/templates/statefulset.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index e80e9346069..7ee74746a0d 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -135,11 +135,7 @@ The following table lists the configurable parameters of the MinIO chart and the | `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | -| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | | `existingSecret` | Name of existing secret with access and secret key. | `""` | | `accessKey` | Default access key (5 to 20 characters) | random 20 chars | | `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | diff --git a/test/minio/8.0.5/templates/clusterroles.yaml b/test/minio/8.0.5/templates/clusterroles.yaml deleted file mode 100644 index c4d9a9371b5..00000000000 --- a/test/minio/8.0.5/templates/clusterroles.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - {{ template "minio.fullname" . }} - verbs: - - use -{{- end }} diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 1e4dd5d2aa7..2c81bbab537 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -1,4 +1,3 @@ -{{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} @@ -91,4 +90,3 @@ spec: secret: secretName: {{ template "minio.secretName" . }} {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- end }} diff --git a/test/minio/8.0.5/templates/pvc.yaml b/test/minio/8.0.5/templates/pvc.yaml index 7454eca70b0..5a1d093031e 100644 --- a/test/minio/8.0.5/templates/pvc.yaml +++ b/test/minio/8.0.5/templates/pvc.yaml @@ -1,4 +1,3 @@ -{{- if eq .Values.mode "standalone" }} {{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} apiVersion: v1 kind: PersistentVolumeClaim @@ -27,4 +26,3 @@ spec: volumeName: "{{ .Values.persistence.VolumeName }}" {{- end }} {{- end }} -{{- end }} diff --git a/test/minio/8.0.5/templates/statefulset.yaml b/test/minio/8.0.5/templates/statefulset.yaml deleted file mode 100644 index 1ad8d182080..00000000000 --- a/test/minio/8.0.5/templates/statefulset.yaml +++ /dev/null @@ -1,152 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $zoneCount := .Values.zones | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - updateStrategy: - type: {{ .Values.StatefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ mul $zoneCount $nodeCount }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - spec: - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - metadata: - name: export-{{ $diskId }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - metadata: - name: export - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} -{{- end }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index ff8208e294f..266137d21a7 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -25,11 +25,6 @@ helmKubectlJqImage: tag: 3.1.0 pullPolicy: IfNotPresent -## minio server mode, i.e. standalone or distributed. -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -mode: standalone - ## Additional arguments to pass to minio binary extraArgs: [] @@ -70,13 +65,6 @@ existingSecret: "" ## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} bucketRoot: "" -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 4 -# Number of expanded MinIO clusters -zones: 1 - ## TLS Settings for Minio tls: enabled: false From a9cf23677a3c7b0e6f70eae4ee368f081f9d0b5c Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:26:44 +0500 Subject: [PATCH 16/29] Remove serviceAccount configuration options --- test/minio/8.0.5/README.md | 2 -- test/minio/8.0.5/templates/_helpers.tpl | 6 +----- .../templates/post-install-prometheus-metrics-role.yaml | 2 -- .../post-install-prometheus-metrics-rolebinding.yaml | 4 +--- .../post-install-prometheus-metrics-serviceaccount.yaml | 2 -- test/minio/8.0.5/templates/serviceaccount.yaml | 2 -- test/minio/8.0.5/values.yaml | 8 -------- 7 files changed, 2 insertions(+), 24 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 7ee74746a0d..25894724794 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -147,8 +147,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `service.port` | Kubernetes port where service is exposed | `9000` | | `service.externalIPs` | service external IP addresses | `nil` | | `service.annotations` | Service annotations | `{}` | -| `serviceAccount.create` | Toggle creation of new service account | `true` | -| `serviceAccount.name` | Name of service account to create and/or use | `""` | | `persistence.enabled` | Use persistent volume to store data | `true` | | `persistence.size` | Size of persistent volume claim | `500Gi` | | `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 6f2f5cf4a11..09c4588612f 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -79,11 +79,7 @@ Determine secret name. Determine service account name for deployment or statefulset. */}} {{- define "minio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- default "default" .Values.serviceAccount.name -}} -{{- end -}} +{{- (include "minio.fullname" .) | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml index 26c0ce7edc4..31de593cc72 100644 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml @@ -1,4 +1,3 @@ -{{- if .Values.serviceAccount.create -}} {{- $fullName := include "minio.fullname" . -}} apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -35,4 +34,3 @@ rules: - get resourceNames: - {{ $fullName }} -{{- end -}} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml index 7d0ea75b752..442a80bfd35 100644 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml @@ -1,4 +1,3 @@ -{{- if .Values.serviceAccount.create -}} {{- $fullName := include "minio.fullname" . -}} apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -16,5 +15,4 @@ roleRef: subjects: - kind: ServiceAccount name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} -{{- end -}} \ No newline at end of file + namespace: {{ .Release.Namespace | quote }} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml index 050d368a562..8f9824fe360 100644 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ b/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml @@ -1,4 +1,3 @@ -{{- if .Values.serviceAccount.create -}} {{- $fullName := include "minio.fullname" . -}} apiVersion: v1 kind: ServiceAccount @@ -9,4 +8,3 @@ metadata: chart: {{ template "minio.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} -{{- end -}} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/serviceaccount.yaml b/test/minio/8.0.5/templates/serviceaccount.yaml index 243dfef538f..2db987867ad 100644 --- a/test/minio/8.0.5/templates/serviceaccount.yaml +++ b/test/minio/8.0.5/templates/serviceaccount.yaml @@ -1,4 +1,3 @@ -{{- if .Values.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount metadata: @@ -8,4 +7,3 @@ metadata: app: {{ template "minio.name" . }} chart: {{ template "minio.chart" . }} release: "{{ .Release.Name }}" -{{- end -}} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 266137d21a7..833a6901451 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -178,11 +178,3 @@ environment: networkPolicy: enabled: false allowExternal: true - -## Specify the service account to use for the Minio pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: From d4cd85e0b04cdf8aaed64e108c38ec84451dc7de Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:46:39 +0500 Subject: [PATCH 17/29] Remove securitycontext options for now --- test/minio/8.0.5/README.md | 5 -- test/minio/8.0.5/templates/deployment.yaml | 6 --- test/minio/8.0.5/templates/rolebindings.yaml | 20 -------- .../templates/securitycontextconstraints.yaml | 46 ------------------- test/minio/8.0.5/values.yaml | 12 ----- 5 files changed, 89 deletions(-) delete mode 100644 test/minio/8.0.5/templates/rolebindings.yaml delete mode 100644 test/minio/8.0.5/templates/securitycontextconstraints.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 25894724794..b4afbad2710 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -142,7 +142,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `certsPath` | Default certs path location | `/etc/minio/certs` | | `mountPath` | Default mount location for persistent drive | `/export` | | `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | | `service.type` | Kubernetes service type | `ClusterIP` | | `service.port` | Kubernetes port where service is exposed | `9000` | | `service.externalIPs` | service external IP addresses | `nil` | @@ -154,10 +153,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | | `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | -| `securityContext.runAsUser` | User id of the user for the container | `1000` | -| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | | `tls.enabled` | Enable TLS for MinIO server | `false` | | `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | | `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 2c81bbab537..acf7e1530bb 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -35,12 +35,6 @@ spec: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} spec: serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" diff --git a/test/minio/8.0.5/templates/rolebindings.yaml b/test/minio/8.0.5/templates/rolebindings.yaml deleted file mode 100644 index ea8b98c5857..00000000000 --- a/test/minio/8.0.5/templates/rolebindings.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - namespace: {{ .Release.Namespace | quote }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "minio.serviceAccountName" . }} -subjects: -- kind: ServiceAccount - name: {{ template "minio.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} -{{- end }} diff --git a/test/minio/8.0.5/templates/securitycontextconstraints.yaml b/test/minio/8.0.5/templates/securitycontextconstraints.yaml deleted file mode 100644 index dfde6fb99e9..00000000000 --- a/test/minio/8.0.5/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -priority: 10 -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 833a6901451..61328fd8830 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -1,7 +1,3 @@ -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - ## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the ## image: @@ -131,14 +127,6 @@ service: # prometheus.io/path: '/minio/prometheus/metrics' # prometheus.io/port: '9000' -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## From cca836e3dc2e8bf37c0a7ae22d32ce8a265ed1dc Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:48:46 +0500 Subject: [PATCH 18/29] Remove existingSecret option --- test/minio/8.0.5/README.md | 26 ------------------------- test/minio/8.0.5/templates/_helpers.tpl | 4 ---- test/minio/8.0.5/templates/secrets.yaml | 2 -- test/minio/8.0.5/values.yaml | 12 ------------ 4 files changed, 44 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index b4afbad2710..237a0cf33a3 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -136,7 +136,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `existingSecret` | Name of existing secret with access and secret key. | `""` | | `accessKey` | Default access key (5 to 20 characters) | random 20 chars | | `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | | `certsPath` | Default certs path location | `/etc/minio/certs` | @@ -252,31 +251,6 @@ For more precise policy, set `networkPolicy.allowExternal=true`. This will only allow pods with the generated client label to connect to MinIO. This label will be displayed in the output of a successful install. -Existing secret ---------------- - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: -```bash -$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: -```bash -$ helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data. in Secret | Corresponding variable | Description | -|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| -| `accesskey` | `accessKey` | Access key ID. Mandatory. | -| `secretkey` | `secretKey` | Secret key. Mandatory. | - -All corresponding variables will be ignored in values file. - Configure TLS ------------- diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 09c4588612f..63e23f1f7da 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -68,12 +68,8 @@ Return the appropriate apiVersion for statefulset. Determine secret name. */}} {{- define "minio.secretName" -}} -{{- if .Values.existingSecret -}} -{{- .Values.existingSecret }} -{{- else -}} {{- include "minio.fullname" . -}} {{- end -}} -{{- end -}} {{/* Determine service account name for deployment or statefulset. diff --git a/test/minio/8.0.5/templates/secrets.yaml b/test/minio/8.0.5/templates/secrets.yaml index a9e7ec276e6..c62e183a35b 100644 --- a/test/minio/8.0.5/templates/secrets.yaml +++ b/test/minio/8.0.5/templates/secrets.yaml @@ -1,4 +1,3 @@ -{{- if not .Values.existingSecret }} apiVersion: v1 kind: Secret metadata: @@ -12,4 +11,3 @@ type: Opaque data: accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 61328fd8830..7d508414346 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -44,18 +44,6 @@ secretKey: "" certsPath: "/etc/minio/certs/" mountPath: "/export" -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | accessKey | accesskey | -## | secretKey | secretkey | -## -## All mentioned variables will be ignored in values file. -## .data.accesskey and .data.secretkey are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - ## Override the root directory which the minio server should serve from. ## If left empty, it defaults to the value of {{ .Values.mountPath }} ## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} From 531c84045083e877bd54939ecc0eb053a791bece Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:53:51 +0500 Subject: [PATCH 19/29] Remove ability to automatically create buckets after release creation for now --- test/minio/8.0.5/README.md | 21 ---- .../8.0.5/templates/_helper_create_bucket.txt | 107 ------------------ test/minio/8.0.5/templates/configmap.yaml | 12 -- .../post-install-create-bucket-job.yaml | 56 --------- test/minio/8.0.5/values.yaml | 24 ---- 5 files changed, 220 deletions(-) delete mode 100644 test/minio/8.0.5/templates/_helper_create_bucket.txt delete mode 100644 test/minio/8.0.5/templates/configmap.yaml delete mode 100644 test/minio/8.0.5/templates/post-install-create-bucket-job.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 237a0cf33a3..0abacd614e1 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -154,12 +154,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | | `tls.enabled` | Enable TLS for MinIO server | `false` | | `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | -| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | -| `defaultBucket.name` | Bucket name | `bucket` | -| `defaultBucket.policy` | Bucket policy | `none` | -| `defaultBucket.purge` | Purge the bucket if already exists | `false` | -| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | -| `buckets` | List of buckets to create after MinIO install | `[]` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). @@ -276,18 +270,3 @@ $ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domai ``` You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. - -Create buckets after install ---------------------------- - -Install the chart, specifying the buckets you want to create after install: - -```bash -$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already diff --git a/test/minio/8.0.5/templates/_helper_create_bucket.txt b/test/minio/8.0.5/templates/_helper_create_bucket.txt deleted file mode 100644 index 5a2cbaacac4..00000000000 --- a/test/minio/8.0.5/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -MC_CONFIG_DIR="/etc/minio/mc/" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" - -# connectToMinio -# Use a check-sleep-check loop to wait for Minio service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET ; then - echo "Purging bucket '$BUCKET'." - set +e ; # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e ; # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist - if ! checkBucketExists $BUCKET ; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - - - # set versioning for bucket - if [ ! -z $VERSIONING ] ; then - if [ $VERSIONING = true ] ; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ] ; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} policy set $POLICY myminio/$BUCKET -} - -# Try connecting to Minio instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{- if or .Values.defaultBucket.enabled }} -# Create the bucket -createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} -{{ else if .Values.buckets }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} -{{- end }} -{{- end }} diff --git a/test/minio/8.0.5/templates/configmap.yaml b/test/minio/8.0.5/templates/configmap.yaml deleted file mode 100644 index cb11fcd7dda..00000000000 --- a/test/minio/8.0.5/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- -{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml b/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml deleted file mode 100644 index 6bf19fd8ba9..00000000000 --- a/test/minio/8.0.5/templates/post-install-create-bucket-job.yaml +++ /dev/null @@ -1,56 +0,0 @@ -{{- if or .Values.defaultBucket.enabled .Values.buckets }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-make-bucket-job - labels: - app: {{ template "minio.name" . }}-make-bucket-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} - spec: - restartPolicy: OnFailure - volumes: - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{ end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} - containers: - - name: minio-mc - image: "minio/mc:latest" - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "/config/initialize"] - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: /etc/minio/mc/certs - {{ end }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 7d508414346..131dac66f60 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -122,30 +122,6 @@ resources: requests: memory: 4Gi -## Create a bucket after minio install -## -defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - name: bucket - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - -## Create multiple buckets after minio install -## Enabling `defaultBucket` will take priority over this list -## -buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none - # purge: false - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) ## when Chart is deployed environment: From 4917a6214a0315eeef5dc8cd3e204eb66b36dc8e Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 01:55:59 +0500 Subject: [PATCH 20/29] Remove ability to set resources --- test/minio/8.0.5/README.md | 1 - test/minio/8.0.5/templates/deployment.yaml | 2 -- test/minio/8.0.5/values.yaml | 7 ------- 3 files changed, 10 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 0abacd614e1..6c10bc1b176 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -151,7 +151,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.storageClass` | Storage class name of PVC | `nil` | | `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | | `tls.enabled` | Enable TLS for MinIO server | `false` | | `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index acf7e1530bb..ae6f888a82e 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -70,8 +70,6 @@ spec: - name: {{ $key }} value: {{ $val | quote }} {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} volumes: - name: export {{- if .Values.persistence.enabled }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 131dac66f60..0de1c00ca86 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -115,13 +115,6 @@ service: # prometheus.io/path: '/minio/prometheus/metrics' # prometheus.io/port: '9000' -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 4Gi - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) ## when Chart is deployed environment: From ac0cfab7b7f3d8d5a327052ca525c09c2e65fb4a Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 02:01:18 +0500 Subject: [PATCH 21/29] Only have nodeport service --- test/minio/8.0.5/README.md | 23 ---------------- test/minio/8.0.5/templates/_helpers.tpl | 11 -------- test/minio/8.0.5/templates/networkpolicy.yaml | 25 ----------------- test/minio/8.0.5/templates/service.yaml | 27 ++----------------- test/minio/8.0.5/values.yaml | 25 ----------------- 5 files changed, 2 insertions(+), 109 deletions(-) delete mode 100644 test/minio/8.0.5/templates/networkpolicy.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 6c10bc1b176..778db58b042 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -141,10 +141,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `certsPath` | Default certs path location | `/etc/minio/certs` | | `mountPath` | Default mount location for persistent drive | `/export` | | `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | Kubernetes port where service is exposed | `9000` | -| `service.externalIPs` | service external IP addresses | `nil` | -| `service.annotations` | Service annotations | `{}` | | `persistence.enabled` | Use persistent volume to store data | `true` | | `persistence.size` | Size of persistent volume claim | `500Gi` | | `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | @@ -225,25 +221,6 @@ If a Persistent Volume Claim already exists, specify it during installation. $ helm install --set persistence.existingClaim=PVC_NAME minio/minio ``` -NetworkPolicy -------------- - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - Configure TLS ------------- diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 63e23f1f7da..08964efb9a6 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -31,17 +31,6 @@ Create chart name and version as used by the chart label. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - {{/* Return the appropriate apiVersion for deployment. */}} diff --git a/test/minio/8.0.5/templates/networkpolicy.yaml b/test/minio/8.0.5/templates/networkpolicy.yaml deleted file mode 100644 index de57f485fee..00000000000 --- a/test/minio/8.0.5/templates/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.service.port }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/test/minio/8.0.5/templates/service.yaml b/test/minio/8.0.5/templates/service.yaml index ea681e22079..f2a6a30e6e6 100644 --- a/test/minio/8.0.5/templates/service.yaml +++ b/test/minio/8.0.5/templates/service.yaml @@ -11,37 +11,14 @@ metadata: chart: {{ template "minio.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} spec: -{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} - type: ClusterIP - {{- if not (empty .Values.service.clusterIP) }} - clusterIP: {{ .Values.service.clusterIP }} - {{end}} -{{- else if eq .Values.service.type "LoadBalancer" }} - type: {{ .Values.service.type }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} -{{- else }} - type: {{ .Values.service.type }} -{{- end }} + type: "NodePort" ports: - name: {{ $scheme }} - port: {{ .Values.service.port }} + port: {{ .Values.service.nodePort }} protocol: TCP -{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} nodePort: {{ .Values.service.nodePort }} -{{- else }} targetPort: 9000 -{{- end}} -{{- if .Values.service.externalIPs }} - externalIPs: -{{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} -{{- end }} -{{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 0de1c00ca86..405e945c5c7 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -93,33 +93,8 @@ persistence: ## subPath: "" -## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## - service: - type: ClusterIP - clusterIP: ~ - port: 9000 nodePort: 32000 - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - -## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) -## when Chart is deployed environment: ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - -networkPolicy: - enabled: false - allowExternal: true From 440ed29531f7582792d0a089685fcd474388e061 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 03:47:46 +0500 Subject: [PATCH 22/29] Remove tls configuration from minio chart for now --- test/minio/8.0.5/README.md | 42 --------------------- test/minio/8.0.5/templates/_helpers.tpl | 43 ---------------------- test/minio/8.0.5/templates/deployment.yaml | 14 +------ test/minio/8.0.5/templates/service.yaml | 3 -- test/minio/8.0.5/values.yaml | 33 +---------------- 5 files changed, 3 insertions(+), 132 deletions(-) diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index 778db58b042..cce818f8185 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -52,44 +52,6 @@ By default a pre-generated access and secret key will be used. To override the d $ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio ``` -### Updating MinIO configuration via Helm - -[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. - -To update your MinIO server configuration while it is deployed in a release, you need to - -1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. -2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. -3. Restart the MinIO server(s) for the changes to take effect. - -You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - Uninstalling the Chart ---------------------- @@ -134,11 +96,9 @@ The following table lists the configurable parameters of the MinIO chart and the | `image.repository` | Image repository | `minio/minio` | | `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | | `accessKey` | Default access key (5 to 20 characters) | random 20 chars | | `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `certsPath` | Default certs path location | `/etc/minio/certs` | | `mountPath` | Default mount location for persistent drive | `/export` | | `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | | `persistence.enabled` | Use persistent volume to store data | `true` | @@ -147,8 +107,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.storageClass` | Storage class name of PVC | `nil` | | `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `tls.enabled` | Enable TLS for MinIO server | `false` | -| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). diff --git a/test/minio/8.0.5/templates/_helpers.tpl b/test/minio/8.0.5/templates/_helpers.tpl index 08964efb9a6..aa82dc8b170 100644 --- a/test/minio/8.0.5/templates/_helpers.tpl +++ b/test/minio/8.0.5/templates/_helpers.tpl @@ -82,46 +82,3 @@ Properly format optional additional arguments to Minio binary {{ " " }}{{ . }} {{- end -}} {{- end -}} - -{{/* -Formats volumeMount for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index ae6f888a82e..5e5f12f1e4f 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -1,7 +1,4 @@ {{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} {{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} apiVersion: {{ template "minio.deployment.apiVersion" . }} kind: Deployment @@ -14,12 +11,7 @@ metadata: heritage: {{ .Release.Service }} spec: strategy: - type: {{ .Values.DeploymentUpdate.type }} - {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} - {{- end}} + type: {{ .Values.updateStrategy }} selector: matchLabels: app: {{ template "minio.name" . }} @@ -42,7 +34,7 @@ spec: command: - "/bin/sh" - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" + - "/usr/bin/docker-entrypoint.sh minio -S server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" volumeMounts: {{- if .Values.persistence.enabled }} - name: export @@ -51,7 +43,6 @@ spec: subPath: "{{ .Values.persistence.subPath }}" {{- end }} {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} ports: - name: {{ $scheme }} containerPort: 9000 @@ -81,4 +72,3 @@ spec: - name: minio-user secret: secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} diff --git a/test/minio/8.0.5/templates/service.yaml b/test/minio/8.0.5/templates/service.yaml index f2a6a30e6e6..3f0c68b9304 100644 --- a/test/minio/8.0.5/templates/service.yaml +++ b/test/minio/8.0.5/templates/service.yaml @@ -1,7 +1,4 @@ {{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} apiVersion: v1 kind: Service metadata: diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 405e945c5c7..c7a74f390cc 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -5,14 +5,6 @@ image: tag: RELEASE.2020-11-19T23-48-16Z pullPolicy: IfNotPresent -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: minio/mc - tag: RELEASE.2020-11-17T00-39-14Z - pullPolicy: IfNotPresent - ## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON ## process used to create secret for prometheus ServiceMonitor). ## @@ -24,15 +16,7 @@ helmKubectlJqImage: ## Additional arguments to pass to minio binary extraArgs: [] -## Update strategy for Deployments -DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -StatefulSetUpdate: - updateStrategy: RollingUpdate +updateStrategy: RollingUpdate ## Set default accesskey, secretkey, Minio config file path, volume mount path and ## number of nodes (only used for Minio distributed mode) @@ -41,7 +25,6 @@ StatefulSetUpdate: ## accessKey: "" secretKey: "" -certsPath: "/etc/minio/certs/" mountPath: "/export" ## Override the root directory which the minio server should serve from. @@ -49,20 +32,6 @@ mountPath: "/export" ## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} bucketRoot: "" -## TLS Settings for Minio -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - ## Enable persistence using Persistent Volume Claims ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ ## From 0b17b07bf6dee691bd96902a243aa3f711a4444c Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 03:49:29 +0500 Subject: [PATCH 23/29] Remove prometheus from minio chart --- .../post-install-prometheus-metrics-role.yaml | 36 ------------------- ...nstall-prometheus-metrics-rolebinding.yaml | 18 ---------- ...all-prometheus-metrics-serviceaccount.yaml | 10 ------ test/minio/8.0.5/values.yaml | 8 ----- 4 files changed, 72 deletions(-) delete mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml delete mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml delete mode 100644 test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml deleted file mode 100644 index 31de593cc72..00000000000 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-role.yaml +++ /dev/null @@ -1,36 +0,0 @@ -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - update - - patch - resourceNames: - - {{ $fullName }}-prometheus - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - resourceNames: - - {{ $fullName }} diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml deleted file mode 100644 index 442a80bfd35..00000000000 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-rolebinding.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $fullName }}-update-prometheus-secret -subjects: - - kind: ServiceAccount - name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} \ No newline at end of file diff --git a/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml b/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml deleted file mode 100644 index 8f9824fe360..00000000000 --- a/test/minio/8.0.5/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- $fullName := include "minio.fullname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index c7a74f390cc..5c07fbb2089 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -5,14 +5,6 @@ image: tag: RELEASE.2020-11-19T23-48-16Z pullPolicy: IfNotPresent -## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON -## process used to create secret for prometheus ServiceMonitor). -## -helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - ## Additional arguments to pass to minio binary extraArgs: [] From 24f4bad8ed0dc04691a2c7a58f12c22053d687a7 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 04:27:42 +0500 Subject: [PATCH 24/29] Add TN specific files --- test/minio/8.0.5/Chart.yaml | 3 - test/minio/8.0.5/README.md | 87 +----------- test/minio/8.0.5/app-readme.md | 1 + test/minio/8.0.5/questions.yaml | 156 +++++++++++++++++++++ test/minio/8.0.5/templates/deployment.yaml | 5 +- test/minio/8.0.5/values.yaml | 6 - test/minio/item.yaml | 4 + 7 files changed, 164 insertions(+), 98 deletions(-) create mode 100644 test/minio/8.0.5/app-readme.md create mode 100644 test/minio/8.0.5/questions.yaml create mode 100644 test/minio/item.yaml diff --git a/test/minio/8.0.5/Chart.yaml b/test/minio/8.0.5/Chart.yaml index dae38ea07d0..ed1225ae65d 100644 --- a/test/minio/8.0.5/Chart.yaml +++ b/test/minio/8.0.5/Chart.yaml @@ -11,6 +11,3 @@ home: https://min.io icon: https://min.io/resources/img/logo/MINIO_wordmark.png sources: - https://github.com/minio/minio -maintainers: -- name: MinIO, Inc - email: dev@minio.io diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index cce818f8185..dde5f41722f 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -99,8 +99,6 @@ The following table lists the configurable parameters of the MinIO chart and the | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | | `accessKey` | Default access key (5 to 20 characters) | random 20 chars | | `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `mountPath` | Default mount location for persistent drive | `/export` | -| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | | `persistence.enabled` | Use persistent volume to store data | `true` | | `persistence.size` | Size of persistent volume claim | `500Gi` | | `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | @@ -109,90 +107,7 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | | `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -$ helm install --name my-release -f values.yaml minio/minio -``` - -> **Tip**: You can use the default [values.yaml](minio/values.yaml) - -Distributed MinIO ------------ - -This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, - -```bash -$ helm install --set mode=distributed minio/minio -``` - -This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, - -```bash -$ helm install --set mode=distributed,replicas=8 minio/minio -``` - -This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. - -You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. - -```bash -$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio -``` - -### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO - -1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. -2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. - -Persistence ------------ - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -$ helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -Existing PersistentVolumeClaim ------------------------------- - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -Configure TLS -------------- - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` +Some parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). Pass environment variables to MinIO containers ---------------------------------------------- diff --git a/test/minio/8.0.5/app-readme.md b/test/minio/8.0.5/app-readme.md new file mode 100644 index 00000000000..246e247c39a --- /dev/null +++ b/test/minio/8.0.5/app-readme.md @@ -0,0 +1 @@ +[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. diff --git a/test/minio/8.0.5/questions.yaml b/test/minio/8.0.5/questions.yaml new file mode 100644 index 00000000000..1bec762afa5 --- /dev/null +++ b/test/minio/8.0.5/questions.yaml @@ -0,0 +1,156 @@ +groups: + - name: "Container Images" + description: "Image to be used for container" + - name: "Workload Configuration" + description: "Configure workload deployment" + - name: "Storage" + description: "Configure Storage for Nextcloud" + - name: "Minio Configuration" + description: "Configure Minio credentials" + +portals: + web_portal: + protocols: + - "http" + host: + - "$variable-nextcloud.host" + ports: + - "$variable-service.nodePort" + +questions: + # Image related + - variable: image + description: "Docker Image Details" + label: "Docker Image" + group: "Container Images" + schema: + type: dict + required: true + attrs: + - variable: repository + description: "Docker image repository" + label: "Image repository" + schema: + type: string + default: "minio/minio" + required: true + - variable: tag + description: "Tag to use for specified image" + label: "Image Tag" + schema: + type: string + default: "RELEASE.2020-11-19T23-48-16Z" + - variable: pullPolicy + description: "Docker Image Pull Policy" + label: "Image Pull Policy" + schema: + type: string + default: "IfNotPresent" + enum: + - value: "IfNotPresent" + description: "Only pull image if not present on host" + - value: "Always" + description: "Always pull image even if present on host" + - value: "Never" + description: "Never pull image even if it's not present on host" + + - variable: updateStrategy + label: "Minio update strategy" + group: "Workload Configuration" + schema: + type: string + default: "RollingUpdate" + enum: + - value: "RollingUpdate" + description: "Create new pods and then kill old ones" + - value: "Recreate" + description: "Kill existing pods before creating new ones" + + - variable: extraArgs + label: "Minio Extra Arguments" + group: "Minio Configuration" + schema: + type: list + default: [] + items: + - variable: arg + label: "Argument" + schema: + type: string + + - variable: accessKey + label: "Access Key" + group: "Minio Configuration" + schema: + type: string + required: true + min_length: 5 + max_length: 20 + + - variable: secretKey + label: "Secret Key" + schema: + type: string + required: true + min_length: 8 + max_length: 40 + + - variable: environment + label: "Minio image environment" + group: "Minio Configuration" + schema: + type: dict + additional_attrs: true + + - variable: service + description: "Minio Service Configuration" + label: "Minio Service Configuration" + group: "Minio Configuration" + schema: + type: dict + required: true + attrs: + - variable: nodePort + label: "Node Port to use for Minio" + schema: + type: int + min: 9000 + max: 65535 + default: 9001 + required: true + + - variable: nextcloudDataHostPathEnabled + label: "Configure Host Path for Nextcloud data" + group: "Storage" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: nextcloudHostPath + label: "Specify HostPath for Nextcloud data" + schema: + type: hostpath + + - variable: nextcloudDataVolume + label: "Configure iXVolume" + group: "Storage" + schema: + type: dict + $ref: + - "normalize/ixVolume" + show_if: [["nextcloudDataHostPathEnabled", "=", false]] + attrs: + - variable: mountPath + label: "Mount Path" + description: "Path where the volume will be mounted inside the pod" + schema: + type: path + editable: false + default: "/var/www" + - variable: datasetName + label: "Dataset Name" + schema: + type: string + default: "ix-nextcloud_data" + editable: false diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 5e5f12f1e4f..eaf323a290f 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -1,5 +1,4 @@ {{ $scheme := "http" }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} apiVersion: {{ template "minio.deployment.apiVersion" . }} kind: Deployment metadata: @@ -34,11 +33,11 @@ spec: command: - "/bin/sh" - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" + - "/usr/bin/docker-entrypoint.sh minio -S server /export {{- template "minio.extraArgs" . }}" volumeMounts: {{- if .Values.persistence.enabled }} - name: export - mountPath: {{ .Values.mountPath }} + mountPath: /export {{- if .Values.persistence.subPath }} subPath: "{{ .Values.persistence.subPath }}" {{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 5c07fbb2089..4265d5f848a 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -17,12 +17,6 @@ updateStrategy: RollingUpdate ## accessKey: "" secretKey: "" -mountPath: "/export" - -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -bucketRoot: "" ## Enable persistence using Persistent Volume Claims ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ diff --git a/test/minio/item.yaml b/test/minio/item.yaml new file mode 100644 index 00000000000..4f175acf54a --- /dev/null +++ b/test/minio/item.yaml @@ -0,0 +1,4 @@ +categories: + - storage + - S3 +icon_url: https://min.io/resources/img/logo/MINIO_wordmark.png From 7d54cef34e96ed1847f72686c866502ba2e70440 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 04:35:07 +0500 Subject: [PATCH 25/29] Add persistent storage support for minio --- test/minio/8.0.5/README.md | 73 ---------------------- test/minio/8.0.5/questions.yaml | 18 +++--- test/minio/8.0.5/templates/_storage.tpl | 23 +++++++ test/minio/8.0.5/templates/deployment.yaml | 13 ++-- test/minio/8.0.5/templates/pvc.yaml | 28 --------- test/minio/8.0.5/values.yaml | 38 ----------- 6 files changed, 36 insertions(+), 157 deletions(-) create mode 100644 test/minio/8.0.5/templates/_storage.tpl delete mode 100644 test/minio/8.0.5/templates/pvc.yaml diff --git a/test/minio/8.0.5/README.md b/test/minio/8.0.5/README.md index dde5f41722f..e1eaee76058 100755 --- a/test/minio/8.0.5/README.md +++ b/test/minio/8.0.5/README.md @@ -12,79 +12,6 @@ Introduction This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. -Prerequisites -------------- - -- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. -- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). -- PV provisioner support in the underlying infrastructure. - -Configure MinIO Helm repo --------------------- -```bash -$ helm repo add minio https://helm.min.io/ -``` - -Installing the Chart --------------------- - -Install this chart using: - -```bash -$ helm install --namespace minio --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Release name - -An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: - -```bash -$ helm install my-release minio/minio -``` - -### Access and Secret keys - -By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. - -```bash -$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio -``` - -Uninstalling the Chart ----------------------- - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -$ helm delete my-release -``` - -or - -```bash -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -Upgrading the Chart -------------------- - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -$ helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -$ helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. Configuration ------------- diff --git a/test/minio/8.0.5/questions.yaml b/test/minio/8.0.5/questions.yaml index 1bec762afa5..6591a040110 100644 --- a/test/minio/8.0.5/questions.yaml +++ b/test/minio/8.0.5/questions.yaml @@ -13,7 +13,7 @@ portals: protocols: - "http" host: - - "$variable-nextcloud.host" + - "$node_ip" ports: - "$variable-service.nodePort" @@ -119,27 +119,27 @@ questions: default: 9001 required: true - - variable: nextcloudDataHostPathEnabled - label: "Configure Host Path for Nextcloud data" + - variable: minioHostPathEnabled + label: "Configure Host Path for Minio data" group: "Storage" schema: type: boolean default: false show_subquestions_if: true subquestions: - - variable: nextcloudHostPath - label: "Specify HostPath for Nextcloud data" + - variable: minioHostPath + label: "Specify HostPath for Minio data" schema: type: hostpath - - variable: nextcloudDataVolume + - variable: minioDataVolume label: "Configure iXVolume" group: "Storage" schema: type: dict $ref: - "normalize/ixVolume" - show_if: [["nextcloudDataHostPathEnabled", "=", false]] + show_if: [["minioHostPathEnabled", "=", false]] attrs: - variable: mountPath label: "Mount Path" @@ -147,10 +147,10 @@ questions: schema: type: path editable: false - default: "/var/www" + default: "/export" - variable: datasetName label: "Dataset Name" schema: type: string - default: "ix-nextcloud_data" + default: "ix-minio" editable: false diff --git a/test/minio/8.0.5/templates/_storage.tpl b/test/minio/8.0.5/templates/_storage.tpl new file mode 100644 index 00000000000..062eb2cb7c5 --- /dev/null +++ b/test/minio/8.0.5/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* +Retrieve host path from ix volumes based on dataset name +*/}} +{{- define "retrieveHostPathFromiXVolume" -}} +{{- range $index, $hostPathConfiguration := $.ixVolumes }} +{{- $dsName := base $hostPathConfiguration.hostPath -}} +{{- if eq $.datasetName $dsName -}} +{{- $hostPathConfiguration.hostPath -}} +{{- end -}} +{{- end }} +{{- end -}} + +{{/* +Retrieve host path for minio +*/}} +{{- define "configuredMinioHostPath" -}} +{{- if .Values.minioHostPathEnabled -}} +{{- .Values.minioHostPath -}} +{{- else -}} +{{- $volDict := dict "datasetName" $.Values.minioDataVolume.datasetName "ixVolumes" $.Values.ixVolumes -}} +{{- include "retrieveHostPathFromiXVolume" $volDict -}} +{{- end -}} +{{- end -}} diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index eaf323a290f..26284e7f55a 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -35,13 +35,8 @@ spec: - "-ce" - "/usr/bin/docker-entrypoint.sh minio -S server /export {{- template "minio.extraArgs" . }}" volumeMounts: - {{- if .Values.persistence.enabled }} - name: export mountPath: /export - {{- if .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- end }} ports: - name: {{ $scheme }} containerPort: 9000 @@ -62,11 +57,11 @@ spec: {{- end}} volumes: - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} + {{- if .Values.emptyDirVolumes }} emptyDir: {} + {{- else }} + hostPath: + path: {{ template "configuredMinioHostPath" . }} {{- end }} - name: minio-user secret: diff --git a/test/minio/8.0.5/templates/pvc.yaml b/test/minio/8.0.5/templates/pvc.yaml deleted file mode 100644 index 5a1d093031e..00000000000 --- a/test/minio/8.0.5/templates/pvc.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- end }} -{{- if .Values.persistence.VolumeName }} - volumeName: "{{ .Values.persistence.VolumeName }}" -{{- end }} -{{- end }} diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 4265d5f848a..9c03aa4a38b 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -10,44 +10,6 @@ extraArgs: [] updateStrategy: RollingUpdate -## Set default accesskey, secretkey, Minio config file path, volume mount path and -## number of nodes (only used for Minio distributed mode) -## AccessKey and secretKey is generated when not set -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -accessKey: "" -secretKey: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - service: nodePort: 32000 From a99d01b01e0996f0429b02dbf351eb87b0ec9dc1 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 04:37:07 +0500 Subject: [PATCH 26/29] Update notes.txt --- test/minio/8.0.5/questions.yaml | 30 ++++++++--------- test/minio/8.0.5/templates/NOTES.txt | 49 ++-------------------------- 2 files changed, 17 insertions(+), 62 deletions(-) diff --git a/test/minio/8.0.5/questions.yaml b/test/minio/8.0.5/questions.yaml index 6591a040110..64ee9feb610 100644 --- a/test/minio/8.0.5/questions.yaml +++ b/test/minio/8.0.5/questions.yaml @@ -55,16 +55,16 @@ questions: description: "Never pull image even if it's not present on host" - variable: updateStrategy - label: "Minio update strategy" - group: "Workload Configuration" - schema: - type: string - default: "RollingUpdate" - enum: - - value: "RollingUpdate" - description: "Create new pods and then kill old ones" - - value: "Recreate" - description: "Kill existing pods before creating new ones" + label: "Minio update strategy" + group: "Workload Configuration" + schema: + type: string + default: "RollingUpdate" + enum: + - value: "RollingUpdate" + description: "Create new pods and then kill old ones" + - value: "Recreate" + description: "Kill existing pods before creating new ones" - variable: extraArgs label: "Minio Extra Arguments" @@ -96,11 +96,11 @@ questions: max_length: 40 - variable: environment - label: "Minio image environment" - group: "Minio Configuration" - schema: - type: dict - additional_attrs: true + label: "Minio image environment" + group: "Minio Configuration" + schema: + type: dict + additional_attrs: true - variable: service description: "Minio Service Configuration" diff --git a/test/minio/8.0.5/templates/NOTES.txt b/test/minio/8.0.5/templates/NOTES.txt index 77efd37ff67..060e317c08e 100644 --- a/test/minio/8.0.5/templates/NOTES.txt +++ b/test/minio/8.0.5/templates/NOTES.txt @@ -1,47 +1,2 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - -To access Minio from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - - 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }}-local - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} +Minio can be accessed from the following URL: +http://$node_ip:{{ .Values.plexServiceTCP.port }}/ From 53ce8cd15ff6fff59aedaff2c14d63eed5b8a5d5 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 06:12:06 +0500 Subject: [PATCH 27/29] Add test values yaml file --- test/minio/8.0.5/questions.yaml | 2 ++ test/minio/8.0.5/templates/NOTES.txt | 2 +- test/minio/8.0.5/templates/deployment.yaml | 3 +-- test/minio/8.0.5/test_values.yaml | 17 +++++++++++++++++ 4 files changed, 21 insertions(+), 3 deletions(-) create mode 100644 test/minio/8.0.5/test_values.yaml diff --git a/test/minio/8.0.5/questions.yaml b/test/minio/8.0.5/questions.yaml index 64ee9feb610..134d32c4d72 100644 --- a/test/minio/8.0.5/questions.yaml +++ b/test/minio/8.0.5/questions.yaml @@ -89,6 +89,7 @@ questions: - variable: secretKey label: "Secret Key" + group: "Minio Configuration" schema: type: string required: true @@ -101,6 +102,7 @@ questions: schema: type: dict additional_attrs: true + attrs: [] - variable: service description: "Minio Service Configuration" diff --git a/test/minio/8.0.5/templates/NOTES.txt b/test/minio/8.0.5/templates/NOTES.txt index 060e317c08e..88e8e93ef89 100644 --- a/test/minio/8.0.5/templates/NOTES.txt +++ b/test/minio/8.0.5/templates/NOTES.txt @@ -1,2 +1,2 @@ Minio can be accessed from the following URL: -http://$node_ip:{{ .Values.plexServiceTCP.port }}/ +http://$node_ip:{{ .Values.service.nodePort }}/ diff --git a/test/minio/8.0.5/templates/deployment.yaml b/test/minio/8.0.5/templates/deployment.yaml index 26284e7f55a..ddbbebd51d1 100644 --- a/test/minio/8.0.5/templates/deployment.yaml +++ b/test/minio/8.0.5/templates/deployment.yaml @@ -23,7 +23,6 @@ spec: release: {{ .Release.Name }} annotations: checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} spec: serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} containers: @@ -33,7 +32,7 @@ spec: command: - "/bin/sh" - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S server /export {{- template "minio.extraArgs" . }}" + - "/usr/bin/docker-entrypoint.sh minio server /export {{- template "minio.extraArgs" . }}" volumeMounts: - name: export mountPath: /export diff --git a/test/minio/8.0.5/test_values.yaml b/test/minio/8.0.5/test_values.yaml new file mode 100644 index 00000000000..9c03aa4a38b --- /dev/null +++ b/test/minio/8.0.5/test_values.yaml @@ -0,0 +1,17 @@ +## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the +## +image: + repository: minio/minio + tag: RELEASE.2020-11-19T23-48-16Z + pullPolicy: IfNotPresent + +## Additional arguments to pass to minio binary +extraArgs: [] + +updateStrategy: RollingUpdate + +service: + nodePort: 32000 + +environment: + ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html From 9f876dc902333e8aa00d0c3daecfc72258a8a571 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 06:36:38 +0500 Subject: [PATCH 28/29] Update minio/nextcloud port defaults --- test/minio/8.0.5/questions.yaml | 2 +- test/minio/8.0.5/values.yaml | 2 +- test/nextcloud/2.3.2/questions.yaml | 2 +- test/nextcloud/2.3.2/values.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/minio/8.0.5/questions.yaml b/test/minio/8.0.5/questions.yaml index 134d32c4d72..d2e4e33d9e9 100644 --- a/test/minio/8.0.5/questions.yaml +++ b/test/minio/8.0.5/questions.yaml @@ -118,7 +118,7 @@ questions: type: int min: 9000 max: 65535 - default: 9001 + default: 9000 required: true - variable: minioHostPathEnabled diff --git a/test/minio/8.0.5/values.yaml b/test/minio/8.0.5/values.yaml index 9c03aa4a38b..702573e993d 100644 --- a/test/minio/8.0.5/values.yaml +++ b/test/minio/8.0.5/values.yaml @@ -11,7 +11,7 @@ extraArgs: [] updateStrategy: RollingUpdate service: - nodePort: 32000 + nodePort: 9000 environment: ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html diff --git a/test/nextcloud/2.3.2/questions.yaml b/test/nextcloud/2.3.2/questions.yaml index ab2ae990cf3..fb50040f7ce 100644 --- a/test/nextcloud/2.3.2/questions.yaml +++ b/test/nextcloud/2.3.2/questions.yaml @@ -116,7 +116,7 @@ questions: type: int min: 9000 max: 65535 - default: 9000 + default: 9001 required: true - variable: nextcloudDataHostPathEnabled diff --git a/test/nextcloud/2.3.2/values.yaml b/test/nextcloud/2.3.2/values.yaml index 12ee59bff9b..b60ae4172fb 100644 --- a/test/nextcloud/2.3.2/values.yaml +++ b/test/nextcloud/2.3.2/values.yaml @@ -14,4 +14,4 @@ nextcloud: strategy: "Recreate" service: - nodePort: 9000 + nodePort: 9001 From 3f7be3546476558c1e7331f32972a247943472b7 Mon Sep 17 00:00:00 2001 From: Waqar Ahmed Date: Wed, 9 Dec 2020 06:41:01 +0500 Subject: [PATCH 29/29] Set emptyDirVolumes to true for testing minio chart --- test/minio/8.0.5/test_values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/minio/8.0.5/test_values.yaml b/test/minio/8.0.5/test_values.yaml index 9c03aa4a38b..86f866e9f34 100644 --- a/test/minio/8.0.5/test_values.yaml +++ b/test/minio/8.0.5/test_values.yaml @@ -15,3 +15,5 @@ service: environment: ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html + +emptyDirVolumes: true