Skip to content

Commit 74e01ea

Browse files
AnadrisAnadris
committed
fix bw statefulset, now exposes bwapi
1 parent 57b52d1 commit 74e01ea

File tree

2 files changed

+89
-2
lines changed

2 files changed

+89
-2
lines changed

‎charts/bunkerweb/templates/bunkerweb-statefulset.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,30 @@ spec:
2929
{{- end }}
3030
bunkerweb.io/component: "bunkerweb"
3131
spec:
32+
{{- with .Values.bunkerweb.affinity }}
33+
affinity:
34+
{{- toYaml . | nindent 8}}
35+
{{- end }}
36+
{{- if not .Values.bunkerweb.affinity}}
37+
affinity:
38+
{{- end }}
39+
{{- if eq .Values.bunkerweb.podAntiAffinityPreset "hard" }}
40+
podAntiAffinity:
41+
requiredDuringSchedulingIgnoredDuringExecution:
42+
- topologyKey: kubernetes.io/hostname
43+
labelSelector:
44+
matchLabels:
45+
bunkerweb.io/component: "bunkerweb"
46+
{{- else if eq .Values.bunkerweb.podAntiAffinityPreset "soft" }}
47+
podAntiAffinity:
48+
preferredDuringSchedulingIgnoredDuringExecution:
49+
- weight: 1
50+
podAffinityTerm:
51+
topologyKey: kubernetes.io/hostname
52+
labelSelector:
53+
matchLabels:
54+
bunkerweb.io/component: "bunkerweb"
55+
{{- end }}
3256
containers:
3357
- name: bunkerweb
3458
image: {{ .Values.bunkerweb.repository }}:{{ .Values.bunkerweb.tag }}
@@ -42,17 +66,22 @@ spec:
4266
{{- toYaml . | nindent 12 }}
4367
{{- end }}
4468
ports:
69+
- containerPort: 5000
70+
name: bwapi
4571
- containerPort: 8080
4672
- containerPort: 8443
4773
{{- if and .Values.bunkerweb.usePrometheusExporter }}
4874
- containerPort: 9113
4975
name: metrics
5076
{{- end }}
5177
env:
78+
# Mandatory for k8s integration
5279
- name: KUBERNETES_MODE
5380
value: "yes"
81+
# DNS resolver
5482
- name: DNS_RESOLVERS
5583
value: "{{ .Values.settings.misc.dnsResolvers }}"
84+
# Internal subnet(s) + localhost
5685
- name: API_WHITELIST_IP
5786
value: "{{ .Values.settings.misc.apiWhitelistIp }}"
5887
{{- if .Values.ui.logs.enabled }}

‎docs/values.md‎

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ Comprehensive reference for all configuration values available in the BunkerWeb
1616
- [redis](#redis) - Cache and session storage for BunkerWeb
1717
- [grafana](#grafana) - Dashboards and visualization
1818
- [prometheus](#prometheus) - Metrics collection and storage
19+
- [api](#api) - External API for BunkerWeb that exposes REST interface for automation tools
1920
- [ingressClass](#ingressclass) - Kubernetes IngressClass resource for BunkerWeb
2021
- [networkPolicy](#networkpolicy) - Network policies for micro-segmentation
2122
- [service](#service) - External service for BunkerWeb (LoadBalancer/NodePort)
@@ -200,7 +201,7 @@ Manages BunkerWeb configuration and coordination
200201
| `scheduler.features.metrics` | Configuration for metrics | `object` | See nested values |
201202
| `scheduler.features.modsecurity` | Configuration for modsecurity | `object` | See nested values |
202203
| `scheduler.features.php` | Configuration for php | `object` | See nested values |
203-
| `scheduler.features.rateLimit` | Configuration for rateLimit | `object` | See nested values |
204+
| `scheduler.features.rateLimit` | Rate limiting configuration for API access https://docs.bunkerweb.io/latest/api/#rate-limiting | `object` | See nested values |
204205
| `scheduler.features.realIp` | Configuration for realIp | `object` | See nested values |
205206
| `scheduler.features.redirect` | Configuration for redirect | `object` | See nested values |
206207
| `scheduler.features.reverseProxy` | Configuration for reverseProxy | `object` | See nested values |
@@ -209,7 +210,7 @@ Manages BunkerWeb configuration and coordination
209210
| `scheduler.features.securityTxt` | Configuration for securityTxt | `object` | See nested values |
210211
| `scheduler.features.sessions` | Configuration for sessions | `object` | See nested values |
211212
| `scheduler.features.ssl` | Configuration for ssl | `object` | See nested values |
212-
| `scheduler.features.whitelist` | Configuration for whitelist | `object` | See nested values |
213+
| `scheduler.features.whitelist` | Whitelist configuration for API access | `object` | See nested values |
213214
| `scheduler.livenessProbe.exec` | Configuration for exec | `object` | See nested values |
214215
| `scheduler.livenessProbe.failureThreshold` | Configuration for failureThreshold | `int` | `3` |
215216
| `scheduler.livenessProbe.initialDelaySeconds` | Configuration for initialDelaySeconds | `int` | `90` |
@@ -520,6 +521,39 @@ Metrics collection and storage
520521

521522
---
522523

524+
## api
525+
526+
External API for BunkerWeb that exposes REST interface for automation tools
527+
528+
| Parameter | Description | Type | Default |
529+
|-----------|-------------|------|---------|
530+
| `api` | External API for BunkerWeb that exposes REST interface for automation tools | `object` | See nested values |
531+
| `api.enabled` | Enable external service creation | `bool` | `true` |
532+
| `api.extraEnvs` | Additional environment variables | `list` | `[]` |
533+
| `api.imagePullSecrets` | Image pull secrets (overrides global setting) | `list` | `[]` |
534+
| `api.livenessProbe` | Liveness probe configuration | `object` | See nested values |
535+
| `api.nodeSelector` | Node selector (overrides global setting) | `object` | `{}` |
536+
| `api.podAnnotations` | Additional pod annotations | `object` | `{}` |
537+
| `api.podLabels` | Additional pod labels | `object` | `{}` |
538+
| `api.pullPolicy` | Configuration for pullPolicy | `string` | `"Always"` |
539+
| `api.repository` | Container image configuration | `string` | `"bunkerity/bunkerweb-api"` |
540+
| `api.securityContext` | Security context for BunkerWeb container | `object` | See nested values |
541+
| `api.tag` | Configuration for tag | `string` | `"1.6.6"` |
542+
| `api.tolerations` | Tolerations (overrides global setting) | `list` | `[]` |
543+
| `api.livenessProbe.exec` | Configuration for exec | `object` | See nested values |
544+
| `api.livenessProbe.failureThreshold` | Configuration for failureThreshold | `int` | `3` |
545+
| `api.livenessProbe.initialDelaySeconds` | Configuration for initialDelaySeconds | `int` | `30` |
546+
| `api.livenessProbe.periodSeconds` | Configuration for periodSeconds | `int` | `5` |
547+
| `api.livenessProbe.timeoutSeconds` | Configuration for timeoutSeconds | `int` | `1` |
548+
| `api.securityContext.allowPrivilegeEscalation` | Configuration for allowPrivilegeEscalation | `bool` | `false` |
549+
| `api.securityContext.capabilities` | Configuration for capabilities | `object` | See nested values |
550+
| `api.securityContext.runAsGroup` | Configuration for runAsGroup | `int` | `101` |
551+
| `api.securityContext.runAsUser` | Configuration for runAsUser | `int` | `101` |
552+
| `api.livenessProbe.exec.command` | Configuration for command | `list` | `['/usr/share/bunkerweb/helpers/healthcheck-api.sh']` |
553+
| `api.securityContext.capabilities.drop` | Configuration for drop | `list` | `['ALL']` |
554+
555+
---
556+
523557
## ingressClass
524558

525559
Kubernetes IngressClass resource for BunkerWeb
@@ -572,11 +606,24 @@ Configuration for BunkerWeb behavior in Kubernetes environment
572606
| Parameter | Description | Type | Default |
573607
|-----------|-------------|------|---------|
574608
| `settings` | Configuration for BunkerWeb behavior in Kubernetes environment | `object` | See nested values |
609+
| `settings.api` | Configuration for api | `object` | See nested values |
575610
| `settings.existingSecret` | Specify the name of an existing secret containing sensitive parameters. When using this, the followi... | `string` | `""` |
576611
| `settings.kubernetes` | Configuration for kubernetes | `object` | See nested values |
577612
| `settings.misc` | Configuration for misc | `object` | See nested values |
578613
| `settings.redis` | Configuration for redis | `object` | See nested values |
579614
| `settings.ui` | Configuration for ui | `object` | See nested values |
615+
| `settings.api.apiAclBootstrapFile` | OR/AND ConfigMap name that includes ACL based JSON File https://docs.bunkerweb.io/latest/api/#permis... | `string` | `""` |
616+
| `settings.api.apiPassword` | Configuration for apiPassword | `string` | `""` |
617+
| `settings.api.apiToken` | Authentication settings https://docs.bunkerweb.io/latest/api/#authentication API Bearer Token Leave ... | `string` | `""` |
618+
| `settings.api.apiUsername` | OR/AND API Username and Password Leave Empty if using settings.existingSecret | `string` | `""` |
619+
| `settings.api.docsUrl` | URL for API documentation, set to an empty value to disable | `string` | `"/docs"` |
620+
| `settings.api.forwardedAllowIps` | Forwarded allow IPs for correct client IP detection | `string` | `"*"` |
621+
| `settings.api.ingress` | Ingress configuration for UI access | `object` | See nested values |
622+
| `settings.api.openApiUrl` | URL for OpenAPI specification, set to an empty value to disable | `string` | `"/openapi.json"` |
623+
| `settings.api.rateLimit` | Rate limiting configuration for API access https://docs.bunkerweb.io/latest/api/#rate-limiting | `object` | See nested values |
624+
| `settings.api.redocUrl` | URL for ReDoc API documentation, set to an empty value to disable | `string` | `"/redoc"` |
625+
| `settings.api.rootPath` | API Configuration https://docs.bunkerweb.io/latest/api/#configuration Root path for the API | `string` | `""` |
626+
| `settings.api.whitelist` | Whitelist configuration for API access | `object` | See nested values |
580627
| `settings.kubernetes.domainName` | Kubernetes cluster domain name for service discovery | `string` | `"cluster.local"` |
581628
| `settings.kubernetes.ignoreAnnotations` | Annotations to be ignored by bunkerweb-controller when multiple ingress controllers (comma-separated... | `string` | `""` |
582629
| `settings.kubernetes.ingressClass` | Ingress class name that BunkerWeb will handle Must match the IngressClass resource name | `string` | `""` |
@@ -595,6 +642,17 @@ Configuration for BunkerWeb behavior in Kubernetes environment
595642
| `settings.ui.overrideAdminCreds` | Override admin credentials on startup Set to "yes" to reset admin credentials to the values above | `string` | `"no"` |
596643
| `settings.ui.totpSecrets` | TOTP secrets for two-factor authentication | `string` | `""` |
597644
| `settings.ui.wizard` | Enable the setup wizard on first launch | `bool` | `true` |
645+
| `settings.api.ingress.enabled` | Set to true to create an Ingress resource for the UI | `bool` | `false` |
646+
| `settings.api.ingress.extraAnnotations` | Additional annotations for the Ingress resource | `object` | `{}` |
647+
| `settings.api.ingress.ingressClassName` | IngressClass name to use | `string` | `""` |
648+
| `settings.api.ingress.serverName` | Domain name for UI access | `string` | `""` |
649+
| `settings.api.ingress.serverPath` | Path for UI access (usually "/") | `string` | `"/"` |
650+
| `settings.api.ingress.tlsSecretName` | Secret name containing TLS certificate Leave empty to disable HTTPS | `string` | `""` |
651+
| `settings.api.rateLimit.defaults` | Rate limit per period, Supported formats: "[10/seconde]", "[100/minute]", "[1000/day]" https://limit... | `list` | `['100/minute']` |
652+
| `settings.api.rateLimit.enabled` | Set to true to create an Ingress resource for the UI | `bool` | `true` |
653+
| `settings.api.rateLimit.strategy` | Strategy: "fixed-window" or "moving-window" or "sliding-window" https://limits.readthedocs.io/en/sta... | `string` | `"fixed-window"` |
654+
| `settings.api.whitelist.enabled` | Set to true to create an Ingress resource for the UI | `bool` | `true` |
655+
| `settings.api.whitelist.whitelistIps` | space-separated list of IPs/CIDR allowed to access the API | `string` | `"10.0.0.0/8"` |
598656
| `settings.ui.ingress.enabled` | Set to true to create an Ingress resource for the UI | `bool` | `false` |
599657
| `settings.ui.ingress.extraAnnotations` | Additional annotations for the Ingress resource | `object` | `{}` |
600658
| `settings.ui.ingress.ingressClassName` | IngressClass name to use | `string` | `""` |

0 commit comments

Comments
 (0)