Skip to content

Commit d853e56

Browse files
butonicbutonic
authored
Merge branch 'main' into 20250603_remove_gateway_from_README
2 parents b8a9309 + c48206e commit d853e56

File tree

14 files changed

+243
-926
lines changed

14 files changed

+243
-926
lines changed

‎README.md

Lines changed: 1 addition & 845 deletions
Large diffs are not rendered by default.

‎charts/opencloud/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ maintainers:
1010
email: [email protected]
1111
url: https://opencloud.eu
1212
type: application
13-
version: 0.1.5
13+
version: 0.1.7
1414
# renovate: datasource=docker depName=opencloudeu/opencloud-rolling
1515
appVersion: latest
1616
kubeVersion: ""

‎charts/opencloud/README.md

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,25 @@ Key interactions:
191191

192192
The following table lists the configurable parameters of the OpenCloud chart and their default values.
193193

194+
### Using Private Registries
195+
196+
The chart supports using private container registries through global overrides. This is useful for:
197+
- Air-gapped environments
198+
- Corporate registry mirrors
199+
- Pull-through caches
200+
201+
To use a private registry for all images:
202+
203+
```bash
204+
helm install opencloud ./charts/opencloud \
205+
--set global.image.registry=my-registry.com \
206+
--set global.image.pullPolicy=Always
207+
```
208+
209+
This will prepend `my-registry.com/` to all image references in the chart. For example:
210+
- `keycloak/keycloak:26.1.4` becomes `my-registry.com/keycloak/keycloak:26.1.4`
211+
- `opencloudeu/opencloud-rolling:latest` becomes `my-registry.com/opencloudeu/opencloud-rolling:latest`
212+
194213
### Global Settings
195214

196215
| Parameter | Description | Default |
@@ -202,14 +221,18 @@ The following table lists the configurable parameters of the OpenCloud chart and
202221
| `global.domain.collabora` | Domain for Collabora | `collabora.opencloud.test` |
203222
| `global.domain.onlyoffice` | Domain for OnlyOffice | `onlyoffice.opencloud.test` |
204223
| `global.domain.companion` | Domain for Companion | `companion.opencloud.test` |
224+
| `global.domain.wopi` | Domain for WOPI server | `wopiserver.opencloud.test` |
205225
| `global.tls.enabled` | Enable TLS (set to false when using gateway TLS termination externally) | `false` |
206226
| `global.tls.secretName` | secretName for TLS certificate | `""` |
207227
| `global.storage.storageClass` | Storage class for persistent volumes | `""` |
228+
| `global.image.registry` | Global registry override for all images (e.g., `my-registry.com`) | `""` |
229+
| `global.image.pullPolicy` | Global pull policy override for all images (`Always`, `IfNotPresent`, `Never`) | `""` |
208230

209231
### Image Settings
210232

211233
| Parameter | Description | Default |
212234
| --------- | ----------- | ------- |
235+
| `image.registry` | OpenCloud image registry | `docker.io` |
213236
| `image.repository` | OpenCloud image repository | `opencloudeu/opencloud-rolling` |
214237
| `image.tag` | OpenCloud image tag | `latest` |
215238
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
@@ -325,7 +348,6 @@ This ensures the `X-Forwarded-Proto: https` header is added as required by OnlyO
325348
| Parameter | Description | Default |
326349
| --------- | ----------- | ------- |
327350
| `collaboration.enabled` | Enable collaboration service | `true` |
328-
| `collaboration.wopiDomain` | WOPI server domain | `collaboration.opencloud.test` |
329351
| `collaboration.resources` | CPU/Memory resource requests/limits | `{}` |
330352

331353
## Gateway API Configuration
@@ -384,7 +406,7 @@ The following HTTPRoutes are created when `httpRoute.enabled` is set to `true`:
384406
- Headers: Adds Permissions-Policy header to prevent browser features like interest-based advertising
385407

386408
7. **Collaboration (WOPI) HTTPRoute** (when `collaboration.enabled` is `true`):
387-
- Hostname: `collaboration.wopiDomain`
409+
- Hostname: `global.domain.wopi`
388410
- Service: `{{ release-name }}-collaboration`
389411
- Port: 9300
390412
- Headers: Adds Permissions-Policy header to prevent browser features like interest-based advertising
@@ -447,19 +469,12 @@ Apply the ClusterIssuer:
447469
kubectl apply -f cluster-issuer.yaml
448470
```
449471

450-
### Step 3: Create a Wildcard Certificate for OpenCloud Domains
472+
### Step 4: Create a Wildcard Certificate for OpenCloud Domains
451473

452474
Create a wildcard certificate for all OpenCloud subdomains:
453475

454476
```yaml
455-
# cluster-issuer.yaml
456-
apiVersion: cert-manager.io/v1
457-
kind: ClusterIssuer
458-
metadata:
459-
name: selfsigned-issuer
460-
spec:
461-
selfSigned: {}
462-
---
477+
# certificate.yaml
463478
apiVersion: cert-manager.io/v1
464479
kind: Certificate
465480
metadata:
@@ -478,7 +493,7 @@ spec:
478493
Apply the certificate:
479494
480495
```bash
481-
kubectl apply -f cluster-issuer.yaml
496+
kubectl apply -f certificate.yaml
482497
```
483498

484499
### Step 4: Configure DNS

‎charts/opencloud/templates/_helpers/tpl.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,32 @@ Create a fully qualified Tika name.
148148

149149
{{/* namespace helper removed - use .Release.Namespace directly */}}
150150

151+
{{/*
152+
Return the image registry, using global override if set
153+
*/}}
154+
{{- define "opencloud.image.registry" -}}
155+
{{- coalesce .global.image.registry .registry -}}
156+
{{- end -}}
157+
158+
{{/*
159+
Return the image pull policy, using global override if set
160+
*/}}
161+
{{- define "opencloud.image.pullPolicy" -}}
162+
{{- coalesce .global.image.pullPolicy .pullPolicy -}}
163+
{{- end -}}
164+
165+
{{/*
166+
Return the full image name with registry
167+
*/}}
168+
{{- define "opencloud.image" -}}
169+
{{- $registry := include "opencloud.image.registry" (dict "registry" .imageValues.registry "global" .global) -}}
170+
{{- if $registry -}}
171+
{{- printf "%s/%s:%s" $registry .imageValues.repository .imageValues.tag -}}
172+
{{- else -}}
173+
{{- printf "%s:%s" .imageValues.repository .imageValues.tag -}}
174+
{{- end -}}
175+
{{- end -}}
176+
151177
{{/*
152178
Return the appropriate apiVersion for ingress
153179
*/}}

‎charts/opencloud/templates/collabora/deployment.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ spec:
2020
spec:
2121
containers:
2222
- name: collabora
23-
image: {{ .Values.collabora.image.repository }}:{{ .Values.collabora.image.tag }}
24-
imagePullPolicy: {{ .Values.collabora.image.pullPolicy | default "IfNotPresent" }}
23+
image: {{ include "opencloud.image" (dict "imageValues" .Values.collabora.image "global" .Values.global) | quote }}
24+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.collabora.image.pullPolicy "global" .Values.global) }}
2525
command: ['/bin/bash', '-c']
2626
args:
2727
- 'coolconfig generate-proof-key && /start-collabora-online.sh'

‎charts/opencloud/templates/collaboration/deployment.yaml

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,35 +26,39 @@ spec:
2626
initContainers:
2727
# Wait for OpenCloud to be ready
2828
- name: wait-for-opencloud
29-
image: busybox
29+
image: {{ include "opencloud.image" (dict "imageValues" .Values.busybox.image "global" .Values.global) | quote }}
30+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.busybox.image.pullPolicy "global" .Values.global) | quote }}
3031
command: ['sh', '-c', 'until wget -q -O- http://{{ include "opencloud.opencloud.fullname" . }}:9200/health; do echo waiting for opencloud; sleep 5; done;']
31-
32+
3233
{{- if not .Values.opencloud.persistence.enabled }}
3334
# Copy config from OpenCloud API if persistence is disabled
3435
- name: copy-config
35-
image: busybox
36+
image: {{ include "opencloud.image" (dict "imageValues" .Values.busybox.image "global" .Values.global) | quote }}
37+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.busybox.image.pullPolicy "global" .Values.global) | quote }}
3638
command: ['sh', '-c', 'mkdir -p /etc/opencloud && wget -q -O /etc/opencloud/config.json http://{{ include "opencloud.opencloud.fullname" . }}:9200/api/v1/config/secrets || echo "Failed to get config from OpenCloud"']
3739
volumeMounts:
3840
- name: etc-opencloud
3941
mountPath: /etc/opencloud
4042
{{- end }}
41-
43+
4244
{{- if .Values.onlyoffice.enabled }}
4345
# Wait for OnlyOffice to be ready
4446
- name: wait-for-onlyoffice
45-
image: busybox
47+
image: {{ include "opencloud.image" (dict "imageValues" .Values.busybox.image "global" .Values.global) | quote }}
48+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.busybox.image.pullPolicy "global" .Values.global) | quote }}
4649
command: ['sh', '-c', 'until wget -q -O- http://{{ include "opencloud.fullname" . }}-onlyoffice:80/hosting/discovery; do echo waiting for onlyoffice; sleep 2; done;']
4750
{{- end }}
4851
{{- if .Values.collabora.enabled }}
4952
# Wait for Collabora to be ready
5053
- name: wait-for-collabora
51-
image: busybox
54+
image: {{ include "opencloud.image" (dict "imageValues" .Values.busybox.image "global" .Values.global) | quote }}
55+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.busybox.image.pullPolicy "global" .Values.global) | quote }}
5256
command: ['sh', '-c', 'until wget -q -O- http://{{ include "opencloud.fullname" . }}-collabora:9980/hosting/discovery; do echo waiting for collabora; sleep 2; done;']
5357
{{- end }}
5458
containers:
5559
- name: collaboration
56-
image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
57-
imagePullPolicy: {{ .Values.image.pullPolicy }}
60+
image: {{ include "opencloud.image" (dict "imageValues" .Values.image "global" .Values.global) | quote }}
61+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.image.pullPolicy "global" .Values.global) }}
5862
command: ["/bin/sh"]
5963
args: ["-c", "opencloud collaboration server"]
6064
env:
@@ -95,9 +99,9 @@ spec:
9599
- name: COLLABORATION_APP_PROOF_DISABLE
96100
value: "true"
97101
- name: COLLABORATION_APP_INSECURE
98-
value: "{{ .Values.opencloud.insecure }}"
102+
value: {{ tpl (toString .Values.opencloud.insecure) . | quote }}
99103
- name: COLLABORATION_CS3API_DATAGATEWAY_INSECURE
100-
value: "{{ .Values.opencloud.insecure }}"
104+
value: {{ tpl (toString .Values.opencloud.insecure) . | quote }}
101105
- name: COLLABORATION_LOG_LEVEL
102106
value: "{{ .Values.opencloud.logLevel }}"
103107
- name: OC_URL

‎charts/opencloud/templates/gateway/gateway.yaml

Lines changed: 72 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,51 @@ spec:
1717
{{- toYaml . | nindent 4 }}
1818
{{- end }}
1919
listeners:
20+
{{- if .Values.global.tls.enabled }}
2021
- name: opencloud-https
22+
{{- else }}
23+
- name: opencloud-http
24+
{{- end }}
25+
{{- if .Values.global.tls.enabled }}
2126
protocol: HTTPS
22-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
27+
{{- else }}
28+
protocol: HTTP
29+
{{- end }}
30+
port: {{ .Values.httpRoute.gateway.port }}
2331
hostname: {{ .Values.global.domain.opencloud | quote }}
32+
{{- if .Values.global.tls.enabled }}
2433
tls:
2534
mode: Terminate
2635
certificateRefs:
27-
- name: opencloud-wildcard-tls
36+
- name: {{ .Values.global.tls.secretName }}
2837
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
38+
{{- end }}
2939
allowedRoutes:
3040
namespaces:
3141
from: Selector
3242
selector:
3343
matchLabels:
3444
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
3545
{{- if .Values.keycloak.enabled }}
46+
{{- if .Values.global.tls.enabled }}
3647
- name: keycloak-https
48+
{{- else }}
49+
- name: keycloak-http
50+
{{- end }}
51+
{{- if .Values.global.tls.enabled }}
3752
protocol: HTTPS
38-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
53+
{{- else }}
54+
protocol: HTTP
55+
{{- end }}
56+
port: {{ .Values.httpRoute.gateway.port }}
3957
hostname: {{ .Values.global.domain.keycloak | quote }}
58+
{{- if .Values.global.tls.enabled }}
4059
tls:
4160
mode: Terminate
4261
certificateRefs:
43-
- name: opencloud-wildcard-tls
62+
- name: {{ .Values.global.tls.secretName }}
4463
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
64+
{{- end }}
4565
allowedRoutes:
4666
namespaces:
4767
from: Selector
@@ -50,15 +70,25 @@ spec:
5070
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
5171
{{- end }}
5272
{{- if and .Values.opencloud.storage.s3.internal.enabled .Values.opencloud.storage.s3.internal.httpRoute.enabled }}
73+
{{- if .Values.global.tls.enabled }}
5374
- name: minio-https
75+
{{- else }}
76+
- name: minio-http
77+
{{- end }}
78+
{{- if .Values.global.tls.enabled }}
5479
protocol: HTTPS
55-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
80+
{{- else }}
81+
protocol: HTTP
82+
{{- end }}
83+
port: {{ .Values.httpRoute.gateway.port }}
5684
hostname: {{ .Values.global.domain.minio | quote }}
85+
{{- if .Values.global.tls.enabled }}
5786
tls:
5887
mode: Terminate
5988
certificateRefs:
60-
- name: opencloud-wildcard-tls
89+
- name: {{ .Values.global.tls.secretName }}
6190
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
91+
{{- end }}
6292
allowedRoutes:
6393
namespaces:
6494
from: Selector
@@ -67,15 +97,25 @@ spec:
6797
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
6898
{{- end }}
6999
{{- if .Values.collabora.enabled }}
100+
{{- if .Values.global.tls.enabled }}
70101
- name: collabora-https
102+
{{- else }}
103+
- name: collabora-http
104+
{{- end }}
105+
{{- if .Values.global.tls.enabled }}
71106
protocol: HTTPS
72-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
107+
{{- else }}
108+
protocol: HTTP
109+
{{- end }}
110+
port: {{ .Values.httpRoute.gateway.port }}
73111
hostname: {{ .Values.global.domain.collabora | quote }}
112+
{{- if .Values.global.tls.enabled }}
74113
tls:
75114
mode: Terminate
76115
certificateRefs:
77-
- name: opencloud-wildcard-tls
116+
- name: {{ .Values.global.tls.secretName }}
78117
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
118+
{{- end }}
79119
allowedRoutes:
80120
namespaces:
81121
from: Selector
@@ -84,15 +124,25 @@ spec:
84124
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
85125
{{- end }}
86126
{{- if .Values.onlyoffice.enabled }}
127+
{{- if .Values.global.tls.enabled }}
87128
- name: onlyoffice-https
129+
{{- else }}
130+
- name: onlyoffice-http
131+
{{- end }}
132+
{{- if .Values.global.tls.enabled }}
88133
protocol: HTTPS
89-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
134+
{{- else }}
135+
protocol: HTTP
136+
{{- end }}
137+
port: {{ .Values.httpRoute.gateway.port }}
90138
hostname: {{ .Values.global.domain.onlyoffice | quote }}
139+
{{- if .Values.global.tls.enabled }}
91140
tls:
92141
mode: Terminate
93142
certificateRefs:
94-
- name: opencloud-wildcard-tls
143+
- name: {{ .Values.global.tls.secretName }}
95144
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
145+
{{- end }}
96146
allowedRoutes:
97147
namespaces:
98148
from: Selector
@@ -101,15 +151,25 @@ spec:
101151
kubernetes.io/metadata.name: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
102152
{{- end }}
103153
{{- if and .Values.onlyoffice.collaboration.enabled .Values.onlyoffice.enabled }}
154+
{{- if .Values.global.tls.enabled }}
104155
- name: collaboration-https
156+
{{- else }}
157+
- name: collaboration-http
158+
{{- end }}
159+
{{- if .Values.global.tls.enabled }}
105160
protocol: HTTPS
106-
port: {{ .Values.httpRoute.gateway.port | default 443 }}
161+
{{- else }}
162+
protocol: HTTP
163+
{{- end }}
164+
port: {{ .Values.httpRoute.gateway.port }}
107165
hostname: {{ .Values.global.domain.wopi | quote }}
166+
{{- if .Values.global.tls.enabled }}
108167
tls:
109168
mode: Terminate
110169
certificateRefs:
111-
- name: opencloud-wildcard-tls
170+
- name: {{ .Values.global.tls.secretName }}
112171
namespace: {{ .Values.httpRoute.gateway.namespace | default .Release.Namespace }}
172+
{{- end }}
113173
allowedRoutes:
114174
namespaces:
115175
from: Selector

‎charts/opencloud/templates/keycloak/deployment.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ spec:
2424
fsGroup: 1000
2525
containers:
2626
- name: keycloak
27-
image: {{ .Values.keycloak.image.repository }}:{{ .Values.keycloak.image.tag }}
28-
imagePullPolicy: {{ .Values.keycloak.image.pullPolicy }}
27+
image: {{ include "opencloud.image" (dict "imageValues" .Values.keycloak.image "global" .Values.global) | quote }}
28+
imagePullPolicy: {{ include "opencloud.image.pullPolicy" (dict "pullPolicy" .Values.keycloak.image.pullPolicy "global" .Values.global) }}
2929
securityContext:
3030
allowPrivilegeEscalation: false
3131
capabilities:

0 commit comments

Comments
 (0)