Skip to content

Commit 593c879

Browse files
butonicbutonic
authored
Merge pull request opencloud-eu#92 from opencloud-eu/external-nats
support external nats
2 parents 6e60af0 + f7bb63c commit 593c879

File tree

11 files changed

+2152
-3
lines changed

11 files changed

+2152
-3
lines changed

‎charts/opencloud/README.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,27 @@ This will prepend `my-registry.com/` to all image references in the chart. For e
288288
| `opencloud.storage.s3.external.bucket` | External S3 bucket | `""` |
289289
| `opencloud.storage.s3.external.createBucket` | Create bucket if it doesn't exist | `true` |
290290

291+
### NATS Messaging Configuration
292+
293+
| Parameter | Description | Default |
294+
| ---------- | ----------- | ------- |
295+
| `opencloud.nats.external.enabled` | Use an external NATS server (required for high availability) | `false` |
296+
| `opencloud.nats.external.endpoint` | Endpoint of the external NATS server | `nats.opencloud-nats.svc.cluster.local:4222` |
297+
| `opencloud.nats.external.cluster` | NATS cluster name | `opencloud-cluster` |
298+
| `opencloud.nats.external.tls.enabled` | Enable TLS for communication with NATS | `false` |
299+
| `opencloud.nats.external.tls.certTrusted` | Set to `false` if the external NATS server's certificate is not trusted by default (e.g. self-signed) | `true` |
300+
| `opencloud.nats.external.tls.insecure` | Disable certificate validation (not recommended for production) | `false` |
301+
| `opencloud.nats.external.tls.caSecretName` | Name of the Kubernetes Secret containing the CA certificate (only required if `certTrusted` is `false`) | `opencloud-nats-ca` |
302+
303+
> 💡 The secret referenced by `caSecretName` **must contain a key named `ca.crt`** with the root CA certificate used to verify the external NATS server.
304+
> Example:
305+
>
306+
> ```bash
307+
> kubectl create secret generic opencloud-nats-ca \
308+
> --from-file=ca.crt=./path/to/nats-ca.pem \
309+
> --namespace your-namespace
310+
> ```
311+
291312
### Keycloak Settings
292313
293314
By default the chart deploys an internal keycloak. It can be disabled and replaced with an external IdP.

‎charts/opencloud/templates/collaboration/deployment.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,15 @@ spec:
6868
value: "0.0.0.0:9300"
6969
- name: MICRO_REGISTRY
7070
value: "nats-js-kv"
71+
{{- if .Values.opencloud.nats.external.enabled }}
72+
- name: OC_PERSISTENT_STORE_NODES
73+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
74+
- name: MICRO_REGISTRY_ADDRESS
75+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
76+
{{- else }}
7177
- name: MICRO_REGISTRY_ADDRESS
7278
value: "{{ include "opencloud.opencloud.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:9233"
79+
{{- end }}
7380
{{- if .Values.onlyoffice.enabled }}
7481
- name: COLLABORATION_WOPI_SRC
7582
# onlyoffice has to connect to the wopi server from the web

‎charts/opencloud/templates/opencloud/deployment.yaml

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,13 @@ spec:
147147
- name: OC_ADD_RUN_SERVICES
148148
value: {{ join "," . | quote }}
149149
{{- end }}
150-
{{- with .Values.opencloud.excludeServices }}
150+
{{- $exclude := .Values.opencloud.excludeServices | default (list) }}
151+
{{- if .Values.opencloud.nats.external.enabled }}
152+
{{- $exclude = append $exclude "nats" }}
153+
{{- end }}
154+
{{- if gt (len $exclude) 0 }}
151155
- name: OC_EXCLUDE_RUN_SERVICES
152-
value: {{ join "," . | quote }}
156+
value: {{ join "," $exclude | quote }}
153157
{{- end }}
154158
# Do not use SSL between proxy and OpenCloud
155159
- name: PROXY_TLS
@@ -269,13 +273,37 @@ spec:
269273
# Demo users
270274
- name: IDM_CREATE_DEMO_USERS
271275
value: {{ .Values.opencloud.createDemoUsers | quote }}
272-
# Make the registry available to the app provider containers
276+
{{- if .Values.opencloud.nats.external.enabled }}
277+
# Use the external nats as the service registry
278+
- name: MICRO_REGISTRY_ADDRESS
279+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
280+
# Use the external nats as the cache and persistent store
281+
- name: OC_CACHE_STORE_NODES
282+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
283+
- name: OC_PERSISTENT_STORE_NODES
284+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
285+
# Use the external nats as the messaging system
286+
- name: OC_EVENTS_ENDPOINT
287+
value: {{ .Values.opencloud.nats.external.endpoint | quote }}
288+
- name: OC_EVENTS_CLUSTER
289+
value: {{ .Values.opencloud.nats.external.cluster | quote }}
290+
- name: OC_EVENTS_ENABLE_TLS
291+
value: {{ .Values.opencloud.nats.external.tls.enabled | quote }}
292+
- name: OC_EVENTS_TLS_INSECURE
293+
value: {{ .Values.opencloud.nats.external.tls.insecure | quote }}
294+
{{- if not .Values.opencloud.nats.external.tls.certTrusted }}
295+
- name: OC_EVENTS_TLS_ROOT_CA_CERTIFICATE
296+
value: /etc/opencloud/nats-ca/ca.crt
297+
{{- end }}
298+
{{- else }}
273299
- name: MICRO_REGISTRY_ADDRESS
274300
value: "127.0.0.1:9233"
301+
# Make the registry available to the app provider containers
275302
- name: NATS_NATS_HOST
276303
value: "0.0.0.0"
277304
- name: NATS_NATS_PORT
278305
value: "9233"
306+
{{- end }}
279307
# CSP configuration
280308
- name: PROXY_CSP_CONFIG_FILE_LOCATION
281309
value: "/etc/opencloud/csp.yaml"
@@ -374,6 +402,11 @@ spec:
374402
- name: config-files
375403
mountPath: /etc/opencloud/banned-password-list.txt
376404
subPath: banned-password-list.txt
405+
{{- if and (.Values.opencloud.nats.external.enabled) (not .Values.opencloud.nats.external.tls.certTrusted) }}
406+
- name: nats-ca
407+
mountPath: /etc/opencloud/nats-ca
408+
readOnly: true
409+
{{- end }}
377410
resources:
378411
{{- toYaml .Values.opencloud.resources | nindent 12 }}
379412
volumes:
@@ -400,6 +433,11 @@ spec:
400433
- name: proxy-config
401434
configMap:
402435
name: {{ include "opencloud.opencloud.fullname" . }}-proxy-config
436+
{{ if and (.Values.opencloud.nats.external.enabled) (not .Values.opencloud.nats.external.tls.certTrusted) }}
437+
- name: nats-ca
438+
secret:
439+
secretName: {{ .Values.opencloud.nats.external.tls.caSecretName }}
440+
{{ end }}
403441
{{- if .Values.webExtensions.enabled }}
404442
- name: extensions
405443
emptyDir: {}

‎charts/opencloud/templates/opencloud/service.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@ spec:
1313
targetPort: http
1414
protocol: TCP
1515
name: http
16+
{{- if not .Values.opencloud.nats.external.enabled }}
1617
- port: 9233
1718
targetPort: 9233
1819
protocol: TCP
1920
name: nats
21+
{{- end }}
2022
selector:
2123
{{- include "opencloud.selectorLabels" . | nindent 4 }}
2224
app.kubernetes.io/component: opencloud

‎charts/opencloud/values.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,6 +477,38 @@ opencloud:
477477
# For very long lists override the file 'files/opencloud/banned-password-list.txt'
478478
bannedPasswordList: |-
479479
480+
nats:
481+
external:
482+
# -- Use an external NATS messaging system instead of the internal one.
483+
# Recommended for all production instances.
484+
# Needs to be used if HighAvailability is needed.
485+
# Needs to be used if OpenCloud shall be used by more than a 2-digit user count.
486+
enabled: false
487+
488+
# -- Endpoint of the messaging system.
489+
endpoint: nats.opencloud-nats.svc.cluster.local:4222
490+
491+
# -- Cluster name to use with the messaging system.
492+
cluster: opencloud-cluster
493+
494+
tls:
495+
# -- Enables TLS encrypted communication with the messaging system.
496+
# Recommended for production installations.
497+
enabled: false
498+
499+
# -- Set only to false, if the certificate of your messaging system service is not trusted.
500+
# If set to false, you need to put the CA cert of the messaging system server into the secret referenced by "caSecretName"
501+
certTrusted: true
502+
503+
# -- Disables SSL certificate checking for connections to the messaging system server.
504+
# -- For self signed certificates, consider to put the CA cert of the messaging system secure server into the secret referenced by "caSecretName"
505+
# Not recommended for production installations.
506+
insecure: false
507+
508+
# Use existing CA secret for nats credentials (Note: secretKeyName must be 'ca.crt' with the root CA certificate for NATS)
509+
# Only used if certTrusted is false
510+
caSecretName : opencloud-nats-ca
511+
480512
# =====================================================================
481513
# EMAIL (SMTP)
482514
# =====================================================================

‎deployments/nats/README.md

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# OpenCloud with NATS deployment example
2+
3+
## Introduction
4+
5+
This example shows how to deploy OpenCloud with NATS as message bus and store.
6+
It will deploy an OpenCloud instance and NATS, preconfigured to work together.
7+
8+
***Note***: This example is not intended for production use. It is intended to get a working OpenCloud
9+
with NATS running in Kubernetes as quickly as possible. It is not hardened in any way.
10+
11+
## Getting started
12+
13+
### Prerequisites
14+
15+
This example requires the following things to be installed:
16+
17+
- [Kubernetes](https://kubernetes.io/) cluster, with an ingress controller installed.
18+
- [Helm](https://helm.sh/) v3
19+
- [Helmfile](https://github.com/helmfile/helmfile)
20+
21+
### End result
22+
23+
After following the steps in this guide, you should be able to access the following endpoint, you
24+
may want to add these to your `/etc/hosts` file pointing to your ingress controller IP:
25+
26+
- https://cloud.opencloud.test
27+
28+
Note that if you want to use your own hostname and domain, you will have to change the `global.domain.opencloud` value.
29+
30+
### Deploying
31+
32+
In this directory, run the following commands:
33+
34+
```bash
35+
$ helmfile sync
36+
```
37+
38+
This will deploy OpenCloud and NATS.

‎deployments/nats/helmfile.yaml

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
repositories:
2+
- name: nats
3+
url: https://nats-io.github.io/k8s/helm/charts
4+
5+
6+
releases:
7+
- name: nats
8+
namespace: opencloud-nats
9+
chart: nats/nats
10+
version: 1.3.7
11+
labels:
12+
ci-lint-skip: true # skip linting this chart in CI
13+
values:
14+
- config:
15+
cluster:
16+
enabled: true
17+
replicas: 3
18+
name: "opencloud-cluster"
19+
jetstream:
20+
enabled: true
21+
memoryStore:
22+
enabled: true
23+
maxSize: 2Gi
24+
merge:
25+
00$include: auth.conf
26+
- configMap:
27+
merge:
28+
data:
29+
# bcrypted password generated with `nats server passwd`:
30+
# nats-sys: O0Z1O5WG2SIisXUToxUPxQUx
31+
# opencloud-admin: pwnnH3S42D5dZL90paHEsQop
32+
auth.conf: |
33+
accounts {
34+
$SYS {
35+
users = [
36+
{ user: "nats-sys",
37+
pass: "$2a$11$5BJO2C7WJLjuOm8FBjGjCugs//lL.Sp9gVIBWzU.fITE5MfCbHCMK"
38+
}
39+
]
40+
}
41+
$OPENCLOUD {
42+
jetstream: enabled
43+
users = [
44+
{ user: "opencloud"
45+
},
46+
{ user: "opencloud-admin",
47+
pass: "$2a$11$6SAHUpN.m2TXOMSdSZVWsOjQ69VCQOBUmxD8FZ/aJpdvzSEOfRodC"
48+
}
49+
]
50+
}
51+
}
52+
no_auth_user: opencloud
53+
54+
- name: nack-crds
55+
namespace: opencloud-nack
56+
chart: ./nack
57+
labels:
58+
ci-lint-skip: true # skip linting this chart in CI
59+
60+
- name: nack-streams
61+
namespace: opencloud-nats
62+
chart: ./streams
63+
labels:
64+
ci-lint-skip: true # skip linting this chart in CI
65+
needs:
66+
- opencloud-nats/nats
67+
- opencloud-nack/nack-crds
68+
69+
- name: nack
70+
namespace: opencloud-nack
71+
chart: nats/nack
72+
version: 0.29.0
73+
labels:
74+
ci-lint-skip: true # skip linting this chart in CI
75+
values:
76+
- namespaced: false
77+
- readOnly: false
78+
needs:
79+
- opencloud-nack/nack-crds
80+
81+
- name: opencloud
82+
chart: ../../charts/opencloud
83+
namespace: opencloud
84+
values:
85+
- global:
86+
# TLS settings
87+
tls:
88+
# Enable TLS
89+
enabled: true
90+
secretName: opencloud-wildcard-tls
91+
# Use self-signed certificates
92+
selfSigned: true
93+
- opencloud:
94+
nats:
95+
# Use an external NATS server (required for high availability)
96+
external:
97+
enabled: true
98+
# these are the default values, you can change them if needed
99+
#endpoint: nats.opencloud-nats.svc.cluster.local:4222
100+
#cluster: opencloud-cluster
101+
tls:
102+
# we disable TLS verification for this example
103+
# for production, you should set this to true and provide a CA certificate
104+
enabled: false
105+
106+
- collabora:
107+
# Enable Collabora
108+
enabled: true
109+
ssl:
110+
enabled: false
111+
verification: false
112+
113+
- onlyoffice:
114+
enabled: false
115+
116+
- ingress:
117+
# Enable Ingress
118+
enabled: true
119+
# Ingress class name
120+
annotationsPreset: traefik

‎deployments/nats/nack/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Contains the CustomResourceDefinitions for NATS Controllers for Kubernetes (NACK)
2+
3+
Taken from https://github.com/nats-io/nack/blob/v0.18.2/deploy/crds.yml

0 commit comments

Comments
 (0)