Skip to content

Commit 64a06df

Browse files
mikeshootzzmikeshootzz
committed
Add helmchart for rclone as an intermediate s3 proxy
This adds a helmchart for rclone as an intermediate encryption proxy.
1 parent 3a46f56 commit 64a06df

File tree

6 files changed

+273
-0
lines changed

6 files changed

+273
-0
lines changed

‎charts/rcloneproxy/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
name: rcloneproxy
3+
description: A Helm chart for deploying rclone as an intermediate s3 proxy
4+
type: application
5+
version: 0.0.1
6+
maintainers:
7+
- name: Schedar Team
8+
email: info@vshn.ch

‎charts/rcloneproxy/templates/_helpers.tpl‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "rcloneproxy.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "rcloneproxy.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "rcloneproxy.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "rcloneproxy.labels" -}}
37+
helm.sh/chart: {{ include "rcloneproxy.chart" . }}
38+
{{ include "rcloneproxy.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "rcloneproxy.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "rcloneproxy.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+

‎charts/rcloneproxy/templates/deployment.yaml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "rcloneproxy.fullname" . }}
5+
labels:
6+
{{- include "rcloneproxy.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "rcloneproxy.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
labels:
15+
{{- include "rcloneproxy.labels" . | nindent 8 }}
16+
spec:
17+
initContainers:
18+
- name: generate-config
19+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
20+
imagePullPolicy: {{ .Values.image.pullPolicy }}
21+
command:
22+
- /bin/sh
23+
- -c
24+
args:
25+
- |
26+
set -e
27+
# Obscure the encryption passwords
28+
OBSCURED_PASSWORD=$(echo -n "$ENCRYPTION_PASSWORD" | rclone obscure -)
29+
OBSCURED_PASSWORD2=$(echo -n "$ENCRYPTION_PASSWORD2" | rclone obscure -)
30+
31+
# Generate rclone.conf with obscured passwords
32+
cat > /config/rclone/rclone.conf <<EOF
33+
[target]
34+
type = s3
35+
provider = Other
36+
env_auth = false
37+
access_key_id = $BACKEND_ACCESS_KEY_ID
38+
secret_access_key = $BACKEND_SECRET_ACCESS_KEY
39+
endpoint = $BACKEND_ENDPOINT
40+
region = $BACKEND_REGION
41+
location_constraint = $BACKEND_REGION
42+
force_path_style = true
43+
44+
[s3-crypt]
45+
type = crypt
46+
remote = target:$BACKEND_BUCKET
47+
filename_encryption = standard
48+
directory_name_encryption = true
49+
password = $OBSCURED_PASSWORD
50+
password2 = $OBSCURED_PASSWORD2
51+
EOF
52+
53+
echo "Generated rclone.conf with obscured passwords"
54+
env:
55+
- name: BACKEND_ACCESS_KEY_ID
56+
valueFrom:
57+
secretKeyRef:
58+
name: {{ .Values.backend.secretRef.name }}
59+
key: {{ .Values.backend.secretRef.keys.accessKeyID }}
60+
- name: BACKEND_SECRET_ACCESS_KEY
61+
valueFrom:
62+
secretKeyRef:
63+
name: {{ .Values.backend.secretRef.name }}
64+
key: {{ .Values.backend.secretRef.keys.accessKeySecret }}
65+
- name: BACKEND_ENDPOINT
66+
valueFrom:
67+
secretKeyRef:
68+
name: {{ .Values.backend.secretRef.name }}
69+
key: {{ .Values.backend.secretRef.keys.endpoint }}
70+
- name: BACKEND_REGION
71+
valueFrom:
72+
secretKeyRef:
73+
name: {{ .Values.backend.secretRef.name }}
74+
key: {{ .Values.backend.secretRef.keys.region }}
75+
- name: BACKEND_BUCKET
76+
valueFrom:
77+
secretKeyRef:
78+
name: {{ .Values.backend.secretRef.name }}
79+
key: {{ .Values.backend.secretRef.keys.bucket }}
80+
- name: ENCRYPTION_PASSWORD
81+
valueFrom:
82+
secretKeyRef:
83+
name: {{ include "rcloneproxy.fullname" . }}-encryption-plain
84+
key: password
85+
- name: ENCRYPTION_PASSWORD2
86+
valueFrom:
87+
secretKeyRef:
88+
name: {{ include "rcloneproxy.fullname" . }}-encryption-plain
89+
key: password2
90+
volumeMounts:
91+
- name: rclone-config
92+
mountPath: /config/rclone
93+
containers:
94+
- name: {{ .Chart.Name }}
95+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
96+
imagePullPolicy: {{ .Values.image.pullPolicy }}
97+
command:
98+
- /bin/sh
99+
- -c
100+
args:
101+
- |
102+
rclone -vv serve s3 s3-crypt: --addr :{{ .Values.service.port }} --auth-key "${BACKEND_ACCESS_KEY_ID},${BACKEND_SECRET_ACCESS_KEY}"
103+
env:
104+
- name: RCLONE_CONFIG
105+
value: /config/rclone/rclone.conf
106+
- name: BACKEND_ACCESS_KEY_ID
107+
valueFrom:
108+
secretKeyRef:
109+
name: {{ .Values.backend.secretRef.name }}
110+
key: {{ .Values.backend.secretRef.keys.accessKeyID }}
111+
- name: BACKEND_SECRET_ACCESS_KEY
112+
valueFrom:
113+
secretKeyRef:
114+
name: {{ .Values.backend.secretRef.name }}
115+
key: {{ .Values.backend.secretRef.keys.accessKeySecret }}
116+
ports:
117+
- name: s3
118+
containerPort: {{ .Values.service.port }}
119+
protocol: TCP
120+
resources:
121+
{{- toYaml .Values.resources | nindent 12 }}
122+
volumeMounts:
123+
- name: rclone-config
124+
mountPath: /config/rclone
125+
readOnly: true
126+
stdin: true
127+
tty: true
128+
volumes:
129+
- name: rclone-config
130+
emptyDir: {}

‎charts/rcloneproxy/templates/secret.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-encryption-plain" (include "rcloneproxy.fullname" .)) -}}
2+
{{- $encryptionPassword := "" -}}
3+
{{- $encryptionPassword2 := "" -}}
4+
{{- if $existingSecret -}}
5+
{{- $encryptionPassword = index $existingSecret.data "password" | b64dec -}}
6+
{{- $encryptionPassword2 = index $existingSecret.data "password2" | b64dec -}}
7+
{{- else -}}
8+
{{- $encryptionPassword = randAlphaNum 32 -}}
9+
{{- $encryptionPassword2 = randAlphaNum 32 -}}
10+
{{- end -}}
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: {{ include "rcloneproxy.fullname" . }}-encryption-plain
16+
labels:
17+
{{- include "rcloneproxy.labels" . | nindent 4 }}
18+
annotations:
19+
helm.sh/resource-policy: keep
20+
type: Opaque
21+
stringData:
22+
password: "{{ $encryptionPassword }}"
23+
password2: "{{ $encryptionPassword2 }}"

‎charts/rcloneproxy/templates/service.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ include "rcloneproxy.fullname" . }}
5+
labels:
6+
{{- include "rcloneproxy.labels" . | nindent 4 }}
7+
spec:
8+
type: {{ .Values.service.type }}
9+
ports:
10+
- port: {{ .Values.service.port }}
11+
targetPort: s3
12+
protocol: TCP
13+
name: s3
14+
selector:
15+
{{- include "rcloneproxy.selectorLabels" . | nindent 4 }}

‎charts/rcloneproxy/values.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
image:
2+
# -- Image repository for rclone
3+
repository: rclone/rclone
4+
# -- Configure the image tag. To update to a newer version, use the commit sha from the tagged release
5+
tag: "sha-73bcae2"
6+
# -- Image pull policy
7+
pullPolicy: Always
8+
9+
# -- Number of replicas
10+
replicaCount: 1
11+
12+
# -- Service configuration
13+
service:
14+
# -- Service type
15+
type: ClusterIP
16+
# -- Service port (rclone S3 server port)
17+
port: 9095
18+
19+
# -- Backend S3 storage configuration
20+
backend:
21+
# -- Reference to an existing secret containing backend S3 credentials
22+
secretRef:
23+
# -- Name of the secret containing backend credentials
24+
name: ""
25+
# -- Keys in the secret for each configuration value
26+
keys:
27+
# -- Key for S3 access key ID
28+
accessKeyID: "access-key-id"
29+
# -- Key for S3 access key secret
30+
accessKeySecret: "access-key-secret"
31+
# -- Key for S3 endpoint URL
32+
endpoint: "endpoint"
33+
# -- Key for S3 region
34+
region: "region"
35+
# -- Key for S3 bucket name
36+
bucket: "bucket"
37+
38+
# -- Resource requests and limits
39+
resources:
40+
requests:
41+
memory: "96Mi"
42+
cpu: "10m"
43+
limits:
44+
memory: "128Mi"
45+
cpu: "25m"

0 commit comments

Comments
 (0)