mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
build(helm): replace the minio chart with a silo chart that preserves identity
helm/minio becomes helm/silo: chart name silo, version 6.0.0 -> 7.0.0, the MinIO wordmark icon replaced with the project's own, image.repository and mcImage.repository pointing at pgsty/silo, and the container command changed to silo. User-visible titles, comments and documentation links are rebranded. The MINIO_* environment variables and every existing values key are kept - the first Silo chart is a rename, not a values-schema migration. The hard problem is that a chart rename normally rewrites Kubernetes resource identity, and a StatefulSet's selector and volumeClaimTemplate are immutable. An existing release upgraded carelessly would either fail or orphan its PVCs. Two things address that: - Templates no longer derive the container name from .Chart.Name. It comes from a helper, so nameOverride can pin it, which means an existing release can be upgraded with nameOverride=minio, fullnameOverride=<existing-fullname> and serviceAccount.name=minio-sa and render byte-stable identity while switching chart and image. - helm-migration-guard and verify-helm-migration.sh make that a gate rather than a documented hope. The script lints the chart, renders it in distributed and standalone modes plus the optional templates, then renders the legacy chart from a pinned commit and the new chart with those three overrides and compares resource identity. The guard additionally rejects any rendered container still pulling pgsty/minio or invoking /usr/bin/minio. It runs through a pinned alpine/helm image when helm is not installed locally, so the gate does not depend on the developer's machine. Currently green over 7 compared resources. Rollback is asymmetric and the README says so: the old chart with the new image survives via the entrypoint argv shim, but the new chart with an old MinIO image does not, because `silo server` is not a command that binary knows. Only `helm rollback` is supported, never an image-only downgrade. Not addressed here: the default image tag is pgsty/silo:RELEASE.2026-08-04T00-00-00Z, which does not exist yet. The chart must not be published until the first Silo image is pushed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
@@ -1,264 +0,0 @@
|
||||
# MinIO Community Helm Chart
|
||||
|
||||
[](https://slack.min.io) [](https://github.com/minio/minio/blob/master/LICENSE)
|
||||
|
||||
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.
|
||||
|
||||
| IMPORTANT |
|
||||
| -------------------------- |
|
||||
| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart. <br/><br/> MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://silo.pgsty.com/operations/deployments/k8s-deploy-operator-helm-on-kubernetes/?ref=github) for additional documentation. |
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Helm cli with Kubernetes cluster configured.
|
||||
- PV provisioner support in the underlying infrastructure. (We recommend using <https://github.com/minio/direct-csi>)
|
||||
- Use Kubernetes version v1.19 and later for best experience.
|
||||
|
||||
## Configure MinIO Helm repo
|
||||
|
||||
```bash
|
||||
helm repo add minio https://charts.min.io/
|
||||
```
|
||||
|
||||
### Installing the Chart
|
||||
|
||||
Install this chart using:
|
||||
|
||||
```bash
|
||||
helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
|
||||
```
|
||||
|
||||
The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
### Installing the Chart (toy-setup)
|
||||
|
||||
Minimal toy setup for testing purposes can be deployed using:
|
||||
|
||||
```bash
|
||||
helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
|
||||
```
|
||||
|
||||
### Upgrading the Chart
|
||||
|
||||
You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command:
|
||||
|
||||
```bash
|
||||
helm get values my-release > old_values.yaml
|
||||
```
|
||||
|
||||
Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using
|
||||
|
||||
```bash
|
||||
helm upgrade -f old_values.yaml my-release minio/minio
|
||||
```
|
||||
|
||||
Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy.
|
||||
|
||||
### Configuration
|
||||
|
||||
Refer the [Values file](./values.yaml) for all the possible config fields.
|
||||
|
||||
You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```bash
|
||||
helm install --name my-release --set persistence.size=1Ti minio/minio
|
||||
```
|
||||
|
||||
The above command deploys MinIO server with a 1Ti backing persistent volume.
|
||||
|
||||
Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example,
|
||||
|
||||
```bash
|
||||
helm install --name my-release -f values.yaml minio/minio
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by:
|
||||
|
||||
```bash
|
||||
helm install --set persistence.enabled=false minio/minio
|
||||
```
|
||||
|
||||
> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."*
|
||||
|
||||
### Existing PersistentVolumeClaim
|
||||
|
||||
If a Persistent Volume Claim already exists, specify it during installation.
|
||||
|
||||
1. Create the PersistentVolume
|
||||
2. Create the PersistentVolumeClaim
|
||||
3. Install the chart
|
||||
|
||||
```bash
|
||||
helm install --set persistence.existingClaim=PVC_NAME minio/minio
|
||||
```
|
||||
|
||||
### NetworkPolicy
|
||||
|
||||
To enable network policy for MinIO,
|
||||
install [a networking plugin that implements the Kubernetes
|
||||
NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin),
|
||||
and set `networkPolicy.enabled` to `true`.
|
||||
|
||||
For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting
|
||||
the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace:
|
||||
|
||||
```
|
||||
kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}"
|
||||
```
|
||||
|
||||
When using `Cilium` as a CNI in your cluster, please edit the `flavor` field to `cilium`.
|
||||
|
||||
With NetworkPolicy enabled, traffic will be limited to just port 9000.
|
||||
|
||||
For more precise policy, set `networkPolicy.allowExternal=true`. This will
|
||||
only allow pods with the generated client label to connect to MinIO.
|
||||
This label will be displayed in the output of a successful install.
|
||||
|
||||
### Existing secret
|
||||
|
||||
Instead of having this chart create the secret for you, you can supply a preexisting secret, much
|
||||
like an existing PersistentVolumeClaim.
|
||||
|
||||
First, create the secret:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz --from-literal=rootPassword=foobarbazqux
|
||||
```
|
||||
|
||||
Then install the chart, specifying that you want to use an existing secret:
|
||||
|
||||
```bash
|
||||
helm install --set existingSecret=my-minio-secret minio/minio
|
||||
```
|
||||
|
||||
The following fields are expected in the secret:
|
||||
|
||||
| .data.\<key\> in Secret | Corresponding variable | Description | Required |
|
||||
|:------------------------|:-----------------------|:---------------|:---------|
|
||||
| `rootUser` | `rootUser` | Root user. | yes |
|
||||
| `rootPassword` | `rootPassword` | Root password. | yes |
|
||||
|
||||
All corresponding variables will be ignored in values file.
|
||||
|
||||
### Configure TLS
|
||||
|
||||
To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using
|
||||
|
||||
```bash
|
||||
kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt
|
||||
```
|
||||
|
||||
Then install the chart, specifying that you want to use the TLS secret:
|
||||
|
||||
```bash
|
||||
helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio
|
||||
```
|
||||
|
||||
### Installing certificates from third party CAs
|
||||
|
||||
MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include MinIO's own certificate with key `public.crt`, if it also needs to be trusted.
|
||||
|
||||
For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:
|
||||
|
||||
```
|
||||
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
|
||||
```
|
||||
|
||||
If TLS is not enabled, you would need only the third party CA:
|
||||
|
||||
```
|
||||
kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt
|
||||
```
|
||||
|
||||
The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter:
|
||||
|
||||
```
|
||||
trustedCertsSecret: "minio-trusted-certs"
|
||||
|
||||
or
|
||||
|
||||
--set trustedCertsSecret=minio-trusted-certs
|
||||
```
|
||||
|
||||
### Create buckets after install
|
||||
|
||||
Install the chart, specifying the buckets you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
|
||||
- `buckets[].name` - name of the bucket to create, must be a string with length > 0
|
||||
- `buckets[].policy` - can be one of none|download|upload|public
|
||||
- `buckets[].purge` - purge if bucket exists already
|
||||
|
||||
### Create policies after install
|
||||
|
||||
Install the chart, specifying the policies you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
|
||||
- `policies[].name` - name of the policy to create, must be a string with length > 0
|
||||
- `policies[].statements[]` - list of statements, includes actions and resources
|
||||
- `policies[].statements[].resources[]` - list of resources that applies the statement
|
||||
- `policies[].statements[].actions[]` - list of actions granted
|
||||
|
||||
### Create user after install
|
||||
|
||||
Install the chart, specifying the users you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
|
||||
- `users[].accessKey` - accessKey of user
|
||||
- `users[].secretKey` - secretKey of usersecretRef
|
||||
- `users[].existingSecret` - secret name that contains the secretKey of user
|
||||
- `users[].existingSecretKey` - data key in existingSecret secret containing the secretKey
|
||||
- `users[].policy` - name of the policy to assign to user
|
||||
|
||||
### Create service account after install
|
||||
|
||||
Install the chart, specifying the service accounts you want to create after install:
|
||||
|
||||
```bash
|
||||
helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio
|
||||
```
|
||||
|
||||
Description of the configuration parameters used above -
|
||||
|
||||
- `svcaccts[].accessKey` - accessKey of service account
|
||||
- `svcaccts[].secretKey` - secretKey of svcacctsecretRef
|
||||
- `svcaccts[].existingSecret` - secret name that contains the secretKey of service account
|
||||
- `svcaccts[].existingSecretKey` - data key in existingSecret secret containing the secretKey
|
||||
- `svcaccts[].user` - name of the parent user to assign to service account
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
Assuming your release is named as `my-release`, delete it using the command:
|
||||
|
||||
```bash
|
||||
helm delete my-release
|
||||
```
|
||||
|
||||
or
|
||||
|
||||
```bash
|
||||
helm uninstall my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
@@ -1,43 +0,0 @@
|
||||
{{- if eq .Values.service.type "ClusterIP" "NodePort" }}
|
||||
MinIO can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
|
||||
{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }}
|
||||
|
||||
To access MinIO from localhost, run the below commands:
|
||||
|
||||
1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
|
||||
2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }}
|
||||
|
||||
Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/
|
||||
|
||||
You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client:
|
||||
|
||||
1. Download the MinIO mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
|
||||
|
||||
2. export MC_HOST_{{ template "minio.fullname" . }}_local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }}
|
||||
|
||||
3. mc ls {{ template "minio.fullname" . }}_local
|
||||
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
MinIO can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by:
|
||||
kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }}
|
||||
|
||||
Note that the public IP may take a couple of minutes to be available.
|
||||
|
||||
You can now access MinIO server on http://<External-IP>:9000. Follow the below steps to connect to MinIO server with mc client:
|
||||
|
||||
1. Download the MinIO mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
|
||||
|
||||
2. export MC_HOST_{{ template "minio.fullname" . }}_local=http://$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@<External-IP>:{{ .Values.service.port }}
|
||||
|
||||
3. mc ls {{ template "minio.fullname" . }}
|
||||
|
||||
Alternately, you can use your browser or the MinIO SDK to access the server - https://silo.pgsty.com/reference/minio-server/minio-server/
|
||||
{{- end }}
|
||||
|
||||
{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
|
||||
Note: Since NetworkPolicy is enabled, only pods with label
|
||||
{{ template "minio.fullname" . }}-client=true"
|
||||
will be able to connect to this minio cluster.
|
||||
{{- end }}
|
||||
@@ -1,16 +1,16 @@
|
||||
apiVersion: v1
|
||||
description: High Performance Object Storage
|
||||
name: minio
|
||||
version: 6.0.0
|
||||
description: S3-Interface Libre Object Storage
|
||||
name: silo
|
||||
version: 7.0.0
|
||||
appVersion: RELEASE.2026-08-04T00-00-00Z
|
||||
keywords:
|
||||
- minio
|
||||
- silo
|
||||
- storage
|
||||
- object-storage
|
||||
- s3
|
||||
- cluster
|
||||
home: https://silo.pgsty.com/
|
||||
icon: https://min.io/resources/img/logo/MINIO_wordmark.png
|
||||
icon: https://silo.pgsty.com/img/silo.svg
|
||||
sources:
|
||||
- https://github.com/pgsty/minio
|
||||
maintainers:
|
||||
@@ -0,0 +1,141 @@
|
||||
# Silo Helm Chart
|
||||
|
||||
This chart installs Silo, an independently maintained, S3-compatible object
|
||||
storage server, on Kubernetes. It supports standalone and distributed modes.
|
||||
The chart and server are licensed under AGPL-3.0-or-later.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19 or later
|
||||
- Helm 3
|
||||
- A PersistentVolume provisioner unless `persistence.enabled=false`
|
||||
|
||||
## Install
|
||||
|
||||
From this repository:
|
||||
|
||||
```bash
|
||||
helm install silo ./helm/silo \
|
||||
--namespace silo --create-namespace \
|
||||
--set rootUser=silo-admin \
|
||||
--set rootPassword='replace-with-a-long-random-secret'
|
||||
```
|
||||
|
||||
For a disposable standalone installation:
|
||||
|
||||
```bash
|
||||
helm install silo ./helm/silo \
|
||||
--namespace silo --create-namespace \
|
||||
--set mode=standalone \
|
||||
--set replicas=1 \
|
||||
--set persistence.enabled=false \
|
||||
--set resources.requests.memory=512Mi \
|
||||
--set rootUser=silo-admin \
|
||||
--set rootPassword='replace-with-a-long-random-secret'
|
||||
```
|
||||
|
||||
The default server and post-install image is `docker.io/pgsty/silo`. The image
|
||||
contains the `silo` server, `mcli`, and an `mc` compatibility symlink. It does
|
||||
not contain a `minio` server binary.
|
||||
|
||||
## Compatibility contract
|
||||
|
||||
The product and delivery names are Silo, while established interfaces remain
|
||||
compatible:
|
||||
|
||||
- `MINIO_*` environment variables and existing values keys are unchanged.
|
||||
- `/minio/*` API and metrics routes are unchanged.
|
||||
- `minio_*` Prometheus metrics and `x-minio-*` protocol headers are unchanged.
|
||||
- Existing storage, including `.minio.sys`, is used without conversion.
|
||||
- `nameOverride`, `fullnameOverride`, and `serviceAccount.name` can pin existing
|
||||
Kubernetes resource identities during an upgrade.
|
||||
|
||||
New installations default to Silo resource names and the `silo-sa` service
|
||||
account.
|
||||
|
||||
## Upgrade an existing release
|
||||
|
||||
Do not upgrade an existing release without first pinning its current resource
|
||||
names. Export the complete values and render the candidate chart offline:
|
||||
|
||||
```bash
|
||||
helm get values my-release -n my-namespace -a > values.before-silo.yaml
|
||||
SILO_TAG='<published-silo-release-tag>'
|
||||
|
||||
helm template my-release ./helm/silo \
|
||||
-n my-namespace \
|
||||
-f values.before-silo.yaml \
|
||||
--set nameOverride=minio \
|
||||
--set fullnameOverride=my-existing-fullname \
|
||||
--set serviceAccount.name=minio-sa \
|
||||
--set image.repository=pgsty/silo \
|
||||
--set mcImage.repository=pgsty/silo \
|
||||
--set-string image.tag="${SILO_TAG}" \
|
||||
--set-string mcImage.tag="${SILO_TAG}" \
|
||||
> rendered.silo.yaml
|
||||
```
|
||||
|
||||
Compare the old and new manifests. Stop if the candidate changes immutable
|
||||
selectors, StatefulSet or Service identity, PVC names, Secrets, or storage
|
||||
mounts. After review, upgrade the chart and image together:
|
||||
|
||||
```bash
|
||||
SILO_TAG='<published-silo-release-tag>'
|
||||
helm upgrade my-release ./helm/silo \
|
||||
-n my-namespace \
|
||||
-f values.before-silo.yaml \
|
||||
--set nameOverride=minio \
|
||||
--set fullnameOverride=my-existing-fullname \
|
||||
--set serviceAccount.name=minio-sa \
|
||||
--set image.repository=pgsty/silo \
|
||||
--set mcImage.repository=pgsty/silo \
|
||||
--set-string image.tag="${SILO_TAG}" \
|
||||
--set-string mcImage.tag="${SILO_TAG}"
|
||||
```
|
||||
|
||||
Rollback is chart-level: use `helm rollback`, not an image-only downgrade. The
|
||||
new chart invokes `silo server`; an old image does not provide that executable.
|
||||
The new image accepts a legacy first argv token of `minio` only to support old
|
||||
chart commands during the forward migration.
|
||||
|
||||
## Persistence and TLS
|
||||
|
||||
The default PersistentVolumeClaim mounts at `/export`. Use an existing claim
|
||||
with:
|
||||
|
||||
```bash
|
||||
helm install silo ./helm/silo --set persistence.existingClaim=PVC_NAME
|
||||
```
|
||||
|
||||
Create a TLS Secret containing `private.key` and `public.crt`, then set:
|
||||
|
||||
```bash
|
||||
helm upgrade --install silo ./helm/silo \
|
||||
--set tls.enabled=true \
|
||||
--set tls.certSecret=silo-tls
|
||||
```
|
||||
|
||||
Additional trusted CAs can be supplied through `trustedCertsSecret`.
|
||||
|
||||
## Existing Secrets and post-install resources
|
||||
|
||||
Set `existingSecret` to a Secret containing `rootUser` and `rootPassword`.
|
||||
Buckets, users, policies, service accounts, and custom commands can be created
|
||||
with the existing `buckets`, `users`, `policies`, `svcaccts`, and
|
||||
`customCommands` values. The post-install job uses `mcli` through its `mc`
|
||||
compatibility command. New custom commands should target `mysilo`; the legacy
|
||||
`myminio` target remains registered so existing values continue to work.
|
||||
|
||||
## Configuration
|
||||
|
||||
See [values.yaml](./values.yaml) for the complete values surface and the
|
||||
[Silo documentation](https://silo.pgsty.com/) for server operations.
|
||||
|
||||
To uninstall the chart:
|
||||
|
||||
```bash
|
||||
helm uninstall silo -n silo
|
||||
```
|
||||
|
||||
PersistentVolumeClaims may remain after uninstall; inspect them before any
|
||||
manual deletion.
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if eq .Values.service.type "ClusterIP" "NodePort" }}
|
||||
Silo can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
|
||||
{{ template "silo.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }}
|
||||
|
||||
To access Silo from localhost, run the below commands:
|
||||
|
||||
1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
|
||||
2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }}
|
||||
|
||||
Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/
|
||||
|
||||
You can now access Silo server on http://localhost:9000. Follow the below steps to connect to Silo server with mc client:
|
||||
|
||||
1. Download the Silo mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
|
||||
|
||||
2. export MC_HOST_{{ template "silo.fullname" . }}_local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "silo.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "silo.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }}
|
||||
|
||||
3. mc ls {{ template "silo.fullname" . }}_local
|
||||
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
Silo can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by:
|
||||
kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "silo.fullname" . }}
|
||||
|
||||
Note that the public IP may take a couple of minutes to be available.
|
||||
|
||||
You can now access Silo server on http://<External-IP>:9000. Follow the below steps to connect to Silo server with mc client:
|
||||
|
||||
1. Download the Silo mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
|
||||
|
||||
2. export MC_HOST_{{ template "silo.fullname" . }}_local=http://$(kubectl get secret {{ template "silo.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "silo.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@<External-IP>:{{ .Values.service.port }}
|
||||
|
||||
3. mc ls {{ template "silo.fullname" . }}
|
||||
|
||||
Alternately, use a browser, an S3 SDK, or a MinIO-compatible SDK to access Silo - https://silo.pgsty.com/reference/minio-server/minio-server/
|
||||
{{- end }}
|
||||
|
||||
{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
|
||||
Note: Since NetworkPolicy is enabled, only pods with label
|
||||
{{ template "silo.fullname" . }}-client=true"
|
||||
will be able to connect to this Silo cluster.
|
||||
{{- end }}
|
||||
+16
-16
@@ -8,18 +8,18 @@ MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
|
||||
MC="/usr/bin/mc --insecure"
|
||||
{{- end }}
|
||||
|
||||
# connectToMinio
|
||||
# Use a check-sleep-check loop to wait for MinIO service to be available
|
||||
connectToMinio() {
|
||||
# connectToSilo
|
||||
# Use a check-sleep-check loop to wait for Silo service to be available
|
||||
connectToSilo() {
|
||||
SCHEME=$1
|
||||
ATTEMPTS=0
|
||||
LIMIT=29 # Allow 30 attempts
|
||||
set -e # fail if we can't read the keys.
|
||||
ACCESS=$(cat /config/rootUser)
|
||||
SECRET=$(cat /config/rootPassword)
|
||||
set +e # The connections to minio are allowed to fail.
|
||||
echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT"
|
||||
MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET"
|
||||
set +e # The connections to Silo are allowed to fail.
|
||||
echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT"
|
||||
MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET"
|
||||
$MC_COMMAND
|
||||
STATUS=$?
|
||||
until [ $STATUS = 0 ]; do
|
||||
@@ -40,7 +40,7 @@ connectToMinio() {
|
||||
# Check if the bucket exists, by using the exit code of `mc ls`
|
||||
checkBucketExists() {
|
||||
BUCKET=$1
|
||||
CMD=$(${MC} stat myminio/$BUCKET >/dev/null 2>&1)
|
||||
CMD=$(${MC} stat mysilo/$BUCKET >/dev/null 2>&1)
|
||||
return $?
|
||||
}
|
||||
|
||||
@@ -59,7 +59,7 @@ createBucket() {
|
||||
if checkBucketExists $BUCKET; then
|
||||
echo "Purging bucket '$BUCKET'."
|
||||
set +e # don't exit if this fails
|
||||
${MC} rm -r --force myminio/$BUCKET
|
||||
${MC} rm -r --force mysilo/$BUCKET
|
||||
set -e # reset `e` as active
|
||||
else
|
||||
echo "Bucket '$BUCKET' does not exist, skipping purge."
|
||||
@@ -71,14 +71,14 @@ createBucket() {
|
||||
if [ ! -z $OBJECTLOCKING ]; then
|
||||
if [ $OBJECTLOCKING = true ]; then
|
||||
echo "Creating bucket with OBJECTLOCKING '$BUCKET'"
|
||||
${MC} mb --with-lock myminio/$BUCKET
|
||||
${MC} mb --with-lock mysilo/$BUCKET
|
||||
elif [ $OBJECTLOCKING = false ]; then
|
||||
echo "Creating bucket '$BUCKET'"
|
||||
${MC} mb myminio/$BUCKET
|
||||
${MC} mb mysilo/$BUCKET
|
||||
fi
|
||||
elif [ -z $OBJECTLOCKING ]; then
|
||||
echo "Creating bucket '$BUCKET'"
|
||||
${MC} mb myminio/$BUCKET
|
||||
${MC} mb mysilo/$BUCKET
|
||||
else
|
||||
echo "Bucket '$BUCKET' already exists."
|
||||
fi
|
||||
@@ -89,10 +89,10 @@ createBucket() {
|
||||
if [ ! -z $VERSIONING ]; then
|
||||
if [ $VERSIONING = true ]; then
|
||||
echo "Enabling versioning for '$BUCKET'"
|
||||
${MC} version enable myminio/$BUCKET
|
||||
${MC} version enable mysilo/$BUCKET
|
||||
elif [ $VERSIONING = false ]; then
|
||||
echo "Suspending versioning for '$BUCKET'"
|
||||
${MC} version suspend myminio/$BUCKET
|
||||
${MC} version suspend mysilo/$BUCKET
|
||||
fi
|
||||
else
|
||||
echo "No versioning action for '$BUCKET'"
|
||||
@@ -104,16 +104,16 @@ createBucket() {
|
||||
# At this point, the bucket should exist, skip checking for existence
|
||||
# Set policy on the bucket
|
||||
echo "Setting policy of bucket '$BUCKET' to '$POLICY'."
|
||||
${MC} anonymous set $POLICY myminio/$BUCKET
|
||||
${MC} anonymous set $POLICY mysilo/$BUCKET
|
||||
}
|
||||
|
||||
# Try connecting to MinIO instance
|
||||
# Try connecting to Silo instance
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme=https
|
||||
{{- else }}
|
||||
scheme=http
|
||||
{{- end }}
|
||||
connectToMinio $scheme
|
||||
connectToSilo $scheme
|
||||
|
||||
{{ if .Values.buckets }}
|
||||
{{ $global := . }}
|
||||
+10
-10
@@ -8,16 +8,16 @@ MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
|
||||
MC="/usr/bin/mc --insecure"
|
||||
{{- end }}
|
||||
|
||||
# connectToMinio
|
||||
# Use a check-sleep-check loop to wait for MinIO service to be available
|
||||
connectToMinio() {
|
||||
# connectToSilo
|
||||
# Use a check-sleep-check loop to wait for Silo service to be available
|
||||
connectToSilo() {
|
||||
SCHEME=$1
|
||||
ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
|
||||
set -e ; # fail if we can't read the keys.
|
||||
ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
|
||||
set +e ; # The connections to minio are allowed to fail.
|
||||
echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
set +e ; # The connections to Silo are allowed to fail.
|
||||
echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
$MC_COMMAND ;
|
||||
STATUS=$? ;
|
||||
until [ $STATUS = 0 ]
|
||||
@@ -39,7 +39,7 @@ connectToMinio() {
|
||||
# Check if the policy exists, by using the exit code of `mc admin policy info`
|
||||
checkPolicyExists() {
|
||||
POLICY=$1
|
||||
CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1)
|
||||
CMD=$(${MC} admin policy info mysilo $POLICY > /dev/null 2>&1)
|
||||
return $?
|
||||
}
|
||||
|
||||
@@ -55,17 +55,17 @@ createPolicy () {
|
||||
else
|
||||
echo "Policy '$NAME' already exists."
|
||||
fi
|
||||
${MC} admin policy create myminio $NAME /config/$FILENAME.json
|
||||
${MC} admin policy create mysilo $NAME /config/$FILENAME.json
|
||||
|
||||
}
|
||||
|
||||
# Try connecting to MinIO instance
|
||||
# Try connecting to Silo instance
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme=https
|
||||
{{- else }}
|
||||
scheme=http
|
||||
{{- end }}
|
||||
connectToMinio $scheme
|
||||
connectToSilo $scheme
|
||||
|
||||
{{ if .Values.policies }}
|
||||
# Create the policies
|
||||
+11
-11
@@ -12,16 +12,16 @@ MC="/usr/bin/mc --insecure"
|
||||
# Special characters for example : ',",<,>,{,}
|
||||
MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp"
|
||||
|
||||
# connectToMinio
|
||||
# Use a check-sleep-check loop to wait for MinIO service to be available
|
||||
connectToMinio() {
|
||||
# connectToSilo
|
||||
# Use a check-sleep-check loop to wait for Silo service to be available
|
||||
connectToSilo() {
|
||||
SCHEME=$1
|
||||
ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
|
||||
set -e ; # fail if we can't read the keys.
|
||||
ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
|
||||
set +e ; # The connections to minio are allowed to fail.
|
||||
echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
set +e ; # The connections to Silo are allowed to fail.
|
||||
echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
$MC_COMMAND ;
|
||||
STATUS=$? ;
|
||||
until [ $STATUS = 0 ]
|
||||
@@ -42,7 +42,7 @@ connectToMinio() {
|
||||
# checkSvcacctExists ()
|
||||
# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info`
|
||||
checkSvcacctExists() {
|
||||
CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
|
||||
CMD=$(${MC} admin user svcacct info mysilo $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
|
||||
return $?
|
||||
}
|
||||
|
||||
@@ -66,9 +66,9 @@ createSvcacct () {
|
||||
echo "Creating svcacct '$SVCACCT'"
|
||||
# Check if policy file is define
|
||||
if [ -z $FILENAME ]; then
|
||||
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER
|
||||
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) mysilo $USER
|
||||
else
|
||||
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER
|
||||
${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json mysilo $USER
|
||||
fi
|
||||
else
|
||||
echo "Svcacct '$SVCACCT' already exists."
|
||||
@@ -77,13 +77,13 @@ createSvcacct () {
|
||||
rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
|
||||
}
|
||||
|
||||
# Try connecting to MinIO instance
|
||||
# Try connecting to Silo instance
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme=https
|
||||
{{- else }}
|
||||
scheme=http
|
||||
{{- end }}
|
||||
connectToMinio $scheme
|
||||
connectToSilo $scheme
|
||||
|
||||
{{ if .Values.svcaccts }}
|
||||
{{ $global := . }}
|
||||
+11
-11
@@ -12,16 +12,16 @@ MC="/usr/bin/mc --insecure"
|
||||
# Special characters for example : ',",<,>,{,}
|
||||
MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp"
|
||||
|
||||
# connectToMinio
|
||||
# Use a check-sleep-check loop to wait for MinIO service to be available
|
||||
connectToMinio() {
|
||||
# connectToSilo
|
||||
# Use a check-sleep-check loop to wait for Silo service to be available
|
||||
connectToSilo() {
|
||||
SCHEME=$1
|
||||
ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
|
||||
set -e ; # fail if we can't read the keys.
|
||||
ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
|
||||
set +e ; # The connections to minio are allowed to fail.
|
||||
echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
set +e ; # The connections to Silo are allowed to fail.
|
||||
echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
$MC_COMMAND ;
|
||||
STATUS=$? ;
|
||||
until [ $STATUS = 0 ]
|
||||
@@ -42,7 +42,7 @@ connectToMinio() {
|
||||
# checkUserExists ()
|
||||
# Check if the user exists, by using the exit code of `mc admin user info`
|
||||
checkUserExists() {
|
||||
CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
|
||||
CMD=$(${MC} admin user info mysilo $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
|
||||
return $?
|
||||
}
|
||||
|
||||
@@ -63,7 +63,7 @@ createUser() {
|
||||
# Create the user if it does not exist
|
||||
if ! checkUserExists ; then
|
||||
echo "Creating user '$USER'"
|
||||
cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio
|
||||
cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add mysilo
|
||||
else
|
||||
echo "User '$USER' already exists."
|
||||
fi
|
||||
@@ -74,20 +74,20 @@ createUser() {
|
||||
if [ ! -z $POLICY -a $POLICY != " " ] ; then
|
||||
echo "Adding policy '$POLICY' for '$USER'"
|
||||
set +e ; # policy already attach errors out, allow it.
|
||||
${MC} admin policy attach myminio $POLICY --user=$USER
|
||||
${MC} admin policy attach mysilo $POLICY --user=$USER
|
||||
set -e
|
||||
else
|
||||
echo "User '$USER' has no policy attached."
|
||||
fi
|
||||
}
|
||||
|
||||
# Try connecting to MinIO instance
|
||||
# Try connecting to Silo instance
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme=https
|
||||
{{- else }}
|
||||
scheme=http
|
||||
{{- end }}
|
||||
connectToMinio $scheme
|
||||
connectToSilo $scheme
|
||||
|
||||
{{ if .Values.users }}
|
||||
{{ $global := . }}
|
||||
+11
-8
@@ -8,16 +8,16 @@ MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
|
||||
MC="/usr/bin/mc --insecure"
|
||||
{{- end }}
|
||||
|
||||
# connectToMinio
|
||||
# Use a check-sleep-check loop to wait for MinIO service to be available
|
||||
connectToMinio() {
|
||||
# connectToSilo
|
||||
# Use a check-sleep-check loop to wait for Silo service to be available
|
||||
connectToSilo() {
|
||||
SCHEME=$1
|
||||
ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
|
||||
set -e ; # fail if we can't read the keys.
|
||||
ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
|
||||
set +e ; # The connections to minio are allowed to fail.
|
||||
echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
set +e ; # The connections to Silo are allowed to fail.
|
||||
echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
|
||||
MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
|
||||
$MC_COMMAND ;
|
||||
STATUS=$? ;
|
||||
until [ $STATUS = 0 ]
|
||||
@@ -32,6 +32,9 @@ connectToMinio() {
|
||||
STATUS=$? ;
|
||||
done ;
|
||||
set -e ; # reset `e` as active
|
||||
# Keep the legacy target for existing customCommands values while making
|
||||
# mysilo the preferred target for new installations.
|
||||
${MC} alias set myminio "$SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" "$ACCESS" "$SECRET" ;
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -42,13 +45,13 @@ runCommand() {
|
||||
return $?
|
||||
}
|
||||
|
||||
# Try connecting to MinIO instance
|
||||
# Try connecting to Silo instance
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme=https
|
||||
{{- else }}
|
||||
scheme=http
|
||||
{{- end }}
|
||||
connectToMinio $scheme
|
||||
connectToSilo $scheme
|
||||
|
||||
{{ if .Values.customCommands }}
|
||||
# Run custom commands
|
||||
@@ -2,7 +2,7 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "minio.name" -}}
|
||||
{{- define "silo.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -11,7 +11,7 @@ Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "minio.fullname" -}}
|
||||
{{- define "silo.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
@@ -27,14 +27,14 @@ If release name contains chart name it will be used as a full name.
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "minio.chart" -}}
|
||||
{{- define "silo.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
{{- define "minio.networkPolicy.apiVersion" -}}
|
||||
{{- define "silo.networkPolicy.apiVersion" -}}
|
||||
{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}}
|
||||
@@ -47,7 +47,7 @@ Return the appropriate apiVersion for networkpolicy.
|
||||
{{/*
|
||||
Return the appropriate apiVersion for deployment.
|
||||
*/}}
|
||||
{{- define "minio.deployment.apiVersion" -}}
|
||||
{{- define "silo.deployment.apiVersion" -}}
|
||||
{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}}
|
||||
{{- print "apps/v1beta2" -}}
|
||||
{{- else -}}
|
||||
@@ -58,7 +58,7 @@ Return the appropriate apiVersion for deployment.
|
||||
{{/*
|
||||
Return the appropriate apiVersion for statefulset.
|
||||
*/}}
|
||||
{{- define "minio.statefulset.apiVersion" -}}
|
||||
{{- define "silo.statefulset.apiVersion" -}}
|
||||
{{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}}
|
||||
{{- print "apps/v1beta2" -}}
|
||||
{{- else -}}
|
||||
@@ -69,7 +69,7 @@ Return the appropriate apiVersion for statefulset.
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "minio.ingress.apiVersion" -}}
|
||||
{{- define "silo.ingress.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
@@ -82,7 +82,7 @@ Return the appropriate apiVersion for ingress.
|
||||
{{/*
|
||||
Return the appropriate apiVersion for console ingress.
|
||||
*/}}
|
||||
{{- define "minio.consoleIngress.apiVersion" -}}
|
||||
{{- define "silo.consoleIngress.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
@@ -95,25 +95,25 @@ Return the appropriate apiVersion for console ingress.
|
||||
{{/*
|
||||
Determine secret name.
|
||||
*/}}
|
||||
{{- define "minio.secretName" -}}
|
||||
{{- define "silo.secretName" -}}
|
||||
{{- if .Values.existingSecret -}}
|
||||
{{- .Values.existingSecret }}
|
||||
{{- else -}}
|
||||
{{- include "minio.fullname" . -}}
|
||||
{{- include "silo.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Determine name for scc role and rolebinding
|
||||
*/}}
|
||||
{{- define "minio.sccRoleName" -}}
|
||||
{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- define "silo.sccRoleName" -}}
|
||||
{{- printf "%s-%s" "scc" (include "silo.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Properly format optional additional arguments to MinIO binary
|
||||
Properly format optional additional arguments to Silo binary
|
||||
*/}}
|
||||
{{- define "minio.extraArgs" -}}
|
||||
{{- define "silo.extraArgs" -}}
|
||||
{{- range .Values.extraArgs -}}
|
||||
{{ " " }}{{ . }}
|
||||
{{- end -}}
|
||||
@@ -122,7 +122,7 @@ Properly format optional additional arguments to MinIO binary
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "minio.imagePullSecrets" -}}
|
||||
{{- define "silo.imagePullSecrets" -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
|
||||
@@ -143,9 +143,9 @@ imagePullSecrets:
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Formats volumeMount for MinIO TLS keys and trusted certs
|
||||
Formats volumeMount for Silo TLS keys and trusted certs
|
||||
*/}}
|
||||
{{- define "minio.tlsKeysVolumeMount" -}}
|
||||
{{- define "silo.tlsKeysVolumeMount" -}}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
mountPath: {{ .Values.certsPath }}
|
||||
@@ -158,9 +158,9 @@ Formats volumeMount for MinIO TLS keys and trusted certs
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Formats volume for MinIO TLS keys and trusted certs
|
||||
Formats volume for Silo TLS keys and trusted certs
|
||||
*/}}
|
||||
{{- define "minio.tlsKeysVolume" -}}
|
||||
{{- define "silo.tlsKeysVolume" -}}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
secret:
|
||||
@@ -189,7 +189,7 @@ Formats volume for MinIO TLS keys and trusted certs
|
||||
Returns the available value for certain key in an existing secret (if it exists),
|
||||
otherwise it generates a random value.
|
||||
*/}}
|
||||
{{- define "minio.getValueFromSecret" }}
|
||||
{{- define "silo.getValueFromSecret" }}
|
||||
{{- $len := (default 16 .Length) | int -}}
|
||||
{{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}}
|
||||
{{- if $obj }}
|
||||
@@ -199,18 +199,18 @@ otherwise it generates a random value.
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- define "minio.root.username" -}}
|
||||
{{- define "silo.root.username" -}}
|
||||
{{- if .Values.rootUser }}
|
||||
{{- .Values.rootUser | toString }}
|
||||
{{- else }}
|
||||
{{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 20 "Key" "rootUser") }}
|
||||
{{- include "silo.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "silo.fullname" .) "Length" 20 "Key" "rootUser") }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "minio.root.password" -}}
|
||||
{{- define "silo.root.password" -}}
|
||||
{{- if .Values.rootPassword }}
|
||||
{{- .Values.rootPassword | toString }}
|
||||
{{- else }}
|
||||
{{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 40 "Key" "rootPassword") }}
|
||||
{{- include "silo.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "silo.fullname" .) "Length" 40 "Key" "rootPassword") }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
+5
-5
@@ -2,16 +2,16 @@
|
||||
kind: CiliumNetworkPolicy
|
||||
apiVersion: cilium.io/v2
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
endpointSelector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
ingress:
|
||||
- toPorts:
|
||||
@@ -23,7 +23,7 @@ spec:
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
fromEndpoints:
|
||||
- matchLabels:
|
||||
{{ template "minio.name" . }}-client: "true"
|
||||
{{ template "silo.name" . }}-client: "true"
|
||||
{{- end }}
|
||||
egress:
|
||||
{{- range $entity := .Values.networkPolicy.egressEntities }}
|
||||
@@ -1,10 +1,10 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
data:
|
||||
+4
-4
@@ -1,14 +1,14 @@
|
||||
{{- if .Values.consoleIngress.enabled -}}
|
||||
{{- $fullName := printf "%s-console" (include "minio.fullname" .) -}}
|
||||
{{- $fullName := printf "%s-console" (include "silo.fullname" .) -}}
|
||||
{{- $servicePort := .Values.consoleService.port -}}
|
||||
{{- $ingressPath := .Values.consoleIngress.path -}}
|
||||
apiVersion: {{ template "minio.consoleIngress.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.consoleIngress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.consoleIngress.labels }}
|
||||
+4
-4
@@ -2,10 +2,10 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}-console
|
||||
name: {{ template "silo.fullname" . }}-console
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.consoleService.annotations }}
|
||||
@@ -41,5 +41,5 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
@@ -1,13 +1,13 @@
|
||||
{{- if eq .Values.mode "standalone" }}
|
||||
{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
|
||||
{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
|
||||
apiVersion: {{ template "minio.deployment.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.additionalLabels }}
|
||||
@@ -27,13 +27,13 @@ spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{- toYaml .Values.podLabels | nindent 8 }}
|
||||
@@ -61,15 +61,15 @@ spec:
|
||||
serviceAccountName: {{ .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
- name: {{ include "silo.name" . }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- "/bin/sh"
|
||||
- "-ce"
|
||||
- "/usr/bin/docker-entrypoint.sh minio server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "minio.extraArgs" . }}"
|
||||
- "/usr/bin/docker-entrypoint.sh silo server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "silo.extraArgs" . }}"
|
||||
volumeMounts:
|
||||
- name: minio-user
|
||||
- name: silo-user
|
||||
mountPath: "/tmp/credentials"
|
||||
readOnly: true
|
||||
- name: export
|
||||
@@ -79,9 +79,9 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.extraSecret }}
|
||||
- name: extra-secret
|
||||
mountPath: "/tmp/minio-config-env"
|
||||
mountPath: "/tmp/silo-config-env"
|
||||
{{- end }}
|
||||
{{- include "minio.tlsKeysVolumeMount" . | indent 12 }}
|
||||
{{- include "silo.tlsKeysVolumeMount" . | indent 12 }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -94,16 +94,16 @@ spec:
|
||||
- name: MINIO_ROOT_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
key: rootUser
|
||||
- name: MINIO_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
key: rootPassword
|
||||
{{- if .Values.extraSecret }}
|
||||
- name: MINIO_CONFIG_ENV_FILE
|
||||
value: "/tmp/minio-config-env/config.env"
|
||||
value: "/tmp/silo-config-env/config.env"
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.public }}
|
||||
- name: MINIO_PROMETHEUS_AUTH_TYPE
|
||||
@@ -183,7 +183,7 @@ spec:
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "minio.imagePullSecrets" . | indent 6 }}
|
||||
{{- include "silo.imagePullSecrets" . | indent 6 }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -194,7 +194,7 @@ spec:
|
||||
- name: export
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }}
|
||||
claimName: {{ .Values.persistence.existingClaim | default (include "silo.fullname" .) }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
@@ -203,10 +203,10 @@ spec:
|
||||
secret:
|
||||
secretName: {{ .Values.extraSecret }}
|
||||
{{- end }}
|
||||
- name: minio-user
|
||||
- name: silo-user
|
||||
secret:
|
||||
secretName: {{ template "minio.secretName" . }}
|
||||
{{- include "minio.tlsKeysVolume" . | indent 8 }}
|
||||
secretName: {{ template "silo.secretName" . }}
|
||||
{{- include "silo.tlsKeysVolume" . | indent 8 }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{ toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -1,14 +1,14 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "minio.fullname" . -}}
|
||||
{{- $fullName := include "silo.fullname" . -}}
|
||||
{{- $servicePort := .Values.service.port -}}
|
||||
{{- $ingressPath := .Values.ingress.path -}}
|
||||
apiVersion: {{ template "minio.ingress.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- with .Values.ingress.labels }}
|
||||
@@ -1,17 +1,17 @@
|
||||
{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "kubernetes") }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ template "minio.networkPolicy.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
ingress:
|
||||
- ports:
|
||||
@@ -23,7 +23,7 @@ spec:
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "minio.name" . }}-client: "true"
|
||||
{{ template "silo.name" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.egress.enabled }}
|
||||
egress:
|
||||
@@ -36,18 +36,18 @@ spec:
|
||||
{{- end }}
|
||||
---
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ template "minio.networkPolicy.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}-post-job
|
||||
name: {{ template "silo.fullname" . }}-post-job
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}-post-job
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}-post-job
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}-job
|
||||
app: {{ template "silo.name" . }}-job
|
||||
release: {{ .Release.Name }}
|
||||
egress:
|
||||
- ports:
|
||||
+3
-3
@@ -6,12 +6,12 @@ apiVersion: policy/v1
|
||||
{{- end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: minio
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
spec:
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
{{- end }}
|
||||
@@ -2,10 +2,10 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}-post-job
|
||||
name: {{ template "silo.fullname" . }}-post-job
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}-post-job
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}-post-job
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
annotations:
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}-job
|
||||
app: {{ template "silo.name" . }}-job
|
||||
release: {{ .Release.Name }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{- toYaml .Values.podLabels | nindent 8 }}
|
||||
@@ -28,7 +28,7 @@ spec:
|
||||
{{- end }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
{{- include "minio.imagePullSecrets" . | indent 6 }}
|
||||
{{- include "silo.imagePullSecrets" . | indent 6 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -46,13 +46,13 @@ spec:
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
projected:
|
||||
sources:
|
||||
- configMap:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
- secret:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
{{- range (concat .Values.users (default (list) .Values.svcaccts)) }}
|
||||
{{- if .existingSecret }}
|
||||
- secret:
|
||||
@@ -87,7 +87,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.policies }}
|
||||
initContainers:
|
||||
- name: minio-make-policy
|
||||
- name: silo-make-policy
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
{{- if .Values.makePolicyJob.securityContext.enabled }}
|
||||
{{- with .Values.makePolicyJob.containerSecurityContext }}
|
||||
@@ -103,15 +103,15 @@ spec:
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MINIO_ENDPOINT
|
||||
value: {{ template "minio.fullname" . }}
|
||||
value: {{ template "silo.fullname" . }}
|
||||
- name: MINIO_PORT
|
||||
value: {{ .Values.service.port | quote }}
|
||||
volumeMounts:
|
||||
- name: etc-path
|
||||
mountPath: /etc/minio/mc
|
||||
mountPath: /etc/silo/mc
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
mountPath: /config
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume-mc
|
||||
@@ -121,7 +121,7 @@ spec:
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.buckets }}
|
||||
- name: minio-make-bucket
|
||||
- name: silo-make-bucket
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
{{- if .Values.makeBucketJob.securityContext.enabled }}
|
||||
{{- with .Values.makeBucketJob.containerSecurityContext }}
|
||||
@@ -137,15 +137,15 @@ spec:
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MINIO_ENDPOINT
|
||||
value: {{ template "minio.fullname" . }}
|
||||
value: {{ template "silo.fullname" . }}
|
||||
- name: MINIO_PORT
|
||||
value: {{ .Values.service.port | quote }}
|
||||
volumeMounts:
|
||||
- name: etc-path
|
||||
mountPath: /etc/minio/mc
|
||||
mountPath: /etc/silo/mc
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
mountPath: /config
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume-mc
|
||||
@@ -154,7 +154,7 @@ spec:
|
||||
resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.users }}
|
||||
- name: minio-make-user
|
||||
- name: silo-make-user
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
{{- if .Values.makeUserJob.securityContext.enabled }}
|
||||
{{- with .Values.makeUserJob.containerSecurityContext }}
|
||||
@@ -170,15 +170,15 @@ spec:
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MINIO_ENDPOINT
|
||||
value: {{ template "minio.fullname" . }}
|
||||
value: {{ template "silo.fullname" . }}
|
||||
- name: MINIO_PORT
|
||||
value: {{ .Values.service.port | quote }}
|
||||
volumeMounts:
|
||||
- name: etc-path
|
||||
mountPath: /etc/minio/mc
|
||||
mountPath: /etc/silo/mc
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
mountPath: /config
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume-mc
|
||||
@@ -187,7 +187,7 @@ spec:
|
||||
resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.customCommands }}
|
||||
- name: minio-custom-command
|
||||
- name: silo-custom-command
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
{{- if .Values.customCommandJob.securityContext.enabled }}
|
||||
{{- with .Values.customCommandJob.containerSecurityContext }}
|
||||
@@ -203,15 +203,15 @@ spec:
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MINIO_ENDPOINT
|
||||
value: {{ template "minio.fullname" . }}
|
||||
value: {{ template "silo.fullname" . }}
|
||||
- name: MINIO_PORT
|
||||
value: {{ .Values.service.port | quote }}
|
||||
volumeMounts:
|
||||
- name: etc-path
|
||||
mountPath: /etc/minio/mc
|
||||
mountPath: /etc/silo/mc
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
mountPath: /config
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume-mc
|
||||
@@ -223,7 +223,7 @@ spec:
|
||||
resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.svcaccts }}
|
||||
- name: minio-make-svcacct
|
||||
- name: silo-make-svcacct
|
||||
image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
|
||||
{{- if .Values.makeServiceAccountJob.securityContext.enabled }}
|
||||
{{- with .Values.makeServiceAccountJob.containerSecurityContext }}
|
||||
@@ -239,15 +239,15 @@ spec:
|
||||
{{- end }}
|
||||
env:
|
||||
- name: MINIO_ENDPOINT
|
||||
value: {{ template "minio.fullname" . }}
|
||||
value: {{ template "silo.fullname" . }}
|
||||
- name: MINIO_PORT
|
||||
value: {{ .Values.service.port | quote }}
|
||||
volumeMounts:
|
||||
- name: etc-path
|
||||
mountPath: /etc/minio/mc
|
||||
mountPath: /etc/silo/mc
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: minio-configuration
|
||||
- name: silo-configuration
|
||||
mountPath: /config
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume-mc
|
||||
@@ -3,10 +3,10 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.persistence.annotations }}
|
||||
@@ -2,16 +2,16 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
type: Opaque
|
||||
data:
|
||||
rootUser: {{ include "minio.root.username" . | b64enc | quote }}
|
||||
rootPassword: {{ include "minio.root.password" . | b64enc | quote }}
|
||||
rootUser: {{ include "silo.root.username" . | b64enc | quote }}
|
||||
rootPassword: {{ include "silo.root.password" . | b64enc | quote }}
|
||||
{{- if .Values.etcd.clientCert }}
|
||||
etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }}
|
||||
{{- end }}
|
||||
+3
-3
@@ -2,10 +2,10 @@
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
allowHostDirVolumePlugin: false
|
||||
@@ -2,10 +2,10 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
monitoring: "true"
|
||||
@@ -42,5 +42,5 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
+14
-14
@@ -2,13 +2,13 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
{{- if .Values.metrics.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.metrics.serviceMonitor.additionalLabels }}
|
||||
@@ -27,7 +27,7 @@ spec:
|
||||
secret:
|
||||
name: {{ .Values.tls.certSecret }}
|
||||
key: {{ .Values.tls.publicCrt }}
|
||||
serverName: {{ template "minio.fullname" . }}
|
||||
serverName: {{ template "silo.fullname" . }}
|
||||
{{- else }}
|
||||
- port: http
|
||||
scheme: http
|
||||
@@ -44,7 +44,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if not .Values.metrics.serviceMonitor.public }}
|
||||
bearerTokenSecret:
|
||||
name: {{ template "minio.fullname" . }}-prometheus
|
||||
name: {{ template "silo.fullname" . }}-prometheus
|
||||
key: token
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
@@ -52,7 +52,7 @@ spec:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ include "minio.name" . }}
|
||||
app: {{ include "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
monitoring: "true"
|
||||
{{- end }}
|
||||
@@ -61,30 +61,30 @@ spec:
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: Probe
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}-cluster
|
||||
name: {{ template "silo.fullname" . }}-cluster
|
||||
{{- if .Values.metrics.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
jobName: {{ template "minio.fullname" . }}
|
||||
jobName: {{ template "silo.fullname" . }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
tlsConfig:
|
||||
ca:
|
||||
secret:
|
||||
name: {{ .Values.tls.certSecret }}
|
||||
key: {{ .Values.tls.publicCrt }}
|
||||
serverName: {{ template "minio.fullname" . }}
|
||||
serverName: {{ template "silo.fullname" . }}
|
||||
{{- end }}
|
||||
prober:
|
||||
url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}
|
||||
url: {{ template "silo.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}
|
||||
path: /minio/v2/metrics/cluster
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme: https
|
||||
@@ -97,7 +97,7 @@ spec:
|
||||
targets:
|
||||
staticConfig:
|
||||
static:
|
||||
- {{ template "minio.fullname" . }}.{{ .Release.Namespace }}
|
||||
- {{ template "silo.fullname" . }}.{{ .Release.Namespace }}
|
||||
{{- if not .Values.metrics.serviceMonitor.public }}
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
@@ -106,7 +106,7 @@ spec:
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
bearerTokenSecret:
|
||||
name: {{ template "minio.fullname" . }}-prometheus
|
||||
name: {{ template "silo.fullname" . }}-prometheus
|
||||
key: token
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -14,10 +14,10 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}-svc
|
||||
name: {{ template "silo.fullname" . }}-svc
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
@@ -29,16 +29,16 @@ spec:
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.minioAPIPort }}
|
||||
selector:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
---
|
||||
apiVersion: {{ template "minio.statefulset.apiVersion" . }}
|
||||
apiVersion: {{ template "silo.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
chart: {{ template "minio.chart" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
chart: {{ template "silo.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- if .Values.additionalLabels }}
|
||||
@@ -51,17 +51,17 @@ spec:
|
||||
updateStrategy:
|
||||
type: {{ .Values.statefulSetUpdate.updateStrategy }}
|
||||
podManagementPolicy: "Parallel"
|
||||
serviceName: {{ template "minio.fullname" . }}-svc
|
||||
serviceName: {{ template "silo.fullname" . }}-svc
|
||||
replicas: {{ $replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
name: {{ template "minio.fullname" . }}
|
||||
name: {{ template "silo.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "minio.name" . }}
|
||||
app: {{ template "silo.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{- toYaml .Values.podLabels | nindent 8 }}
|
||||
@@ -89,13 +89,13 @@ spec:
|
||||
serviceAccountName: {{ .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
- name: {{ include "silo.name" . }}
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: [
|
||||
"/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `minio.extraArgs` . }}"
|
||||
"/usr/bin/docker-entrypoint.sh silo server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `silo.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `silo.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `silo.extraArgs` . }}"
|
||||
]
|
||||
volumeMounts:
|
||||
{{- if $penabled }}
|
||||
@@ -117,9 +117,9 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.extraSecret }}
|
||||
- name: extra-secret
|
||||
mountPath: "/tmp/minio-config-env"
|
||||
mountPath: "/tmp/silo-config-env"
|
||||
{{- end }}
|
||||
{{- include "minio.tlsKeysVolumeMount" . | indent 12 }}
|
||||
{{- include "silo.tlsKeysVolumeMount" . | indent 12 }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -132,16 +132,16 @@ spec:
|
||||
- name: MINIO_ROOT_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
key: rootUser
|
||||
- name: MINIO_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "minio.secretName" . }}
|
||||
name: {{ template "silo.secretName" . }}
|
||||
key: rootPassword
|
||||
{{- if .Values.extraSecret }}
|
||||
- name: MINIO_CONFIG_ENV_FILE
|
||||
value: "/tmp/minio-config-env/config.env"
|
||||
value: "/tmp/silo-config-env/config.env"
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.public }}
|
||||
- name: MINIO_PROMETHEUS_AUTH_TYPE
|
||||
@@ -201,7 +201,7 @@ spec:
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "minio.imagePullSecrets" . | indent 6 }}
|
||||
{{- include "silo.imagePullSecrets" . | indent 6 }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -214,15 +214,15 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: minio-user
|
||||
- name: silo-user
|
||||
secret:
|
||||
secretName: {{ template "minio.secretName" . }}
|
||||
secretName: {{ template "silo.secretName" . }}
|
||||
{{- if .Values.extraSecret }}
|
||||
- name: extra-secret
|
||||
secret:
|
||||
secretName: {{ .Values.extraSecret }}
|
||||
{{- end }}
|
||||
{{- include "minio.tlsKeysVolume" . | indent 8 }}
|
||||
{{- include "silo.tlsKeysVolume" . | indent 8 }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -1,4 +1,5 @@
|
||||
## Provide a name in place of minio for `app:` labels
|
||||
## Override the Silo name used for resource names and `app:` labels. Existing
|
||||
## releases can set this to `minio` to retain their current resource identity.
|
||||
##
|
||||
nameOverride: ""
|
||||
|
||||
@@ -6,29 +7,29 @@ nameOverride: ""
|
||||
##
|
||||
fullnameOverride: ""
|
||||
|
||||
## set kubernetes cluster domain where minio is running
|
||||
## Set the Kubernetes cluster domain where Silo is running.
|
||||
##
|
||||
clusterDomain: cluster.local
|
||||
|
||||
## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
|
||||
##
|
||||
image:
|
||||
repository: pgsty/minio
|
||||
repository: pgsty/silo
|
||||
tag: RELEASE.2026-08-04T00-00-00Z
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
# - name: "image-pull-secret"
|
||||
|
||||
## Image used by post-install jobs. The pgsty/minio image bundles mcli and
|
||||
## Image used by post-install jobs. The pgsty/silo image bundles mcli and
|
||||
## provides /usr/bin/mc as a compatibility link.
|
||||
##
|
||||
mcImage:
|
||||
repository: pgsty/minio
|
||||
repository: pgsty/silo
|
||||
tag: RELEASE.2026-08-04T00-00-00Z
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## minio mode, i.e. standalone or distributed
|
||||
## Silo mode, i.e. standalone or distributed.
|
||||
mode: distributed ## other supported values are "standalone"
|
||||
|
||||
## Additional labels to include with deployment or statefulset
|
||||
@@ -43,26 +44,26 @@ additionalAnnotations: {}
|
||||
## flux, so set to "true" to disable this behaviour.
|
||||
ignoreChartChecksums: false
|
||||
|
||||
## Additional arguments to pass to minio binary
|
||||
## Additional arguments to pass to the Silo binary.
|
||||
extraArgs: []
|
||||
# example for enabling FTP:
|
||||
# - --ftp=\"address=:8021\"
|
||||
# - --ftp=\"passive-port-range=10000-10010\"
|
||||
|
||||
## Additional volumes to minio container
|
||||
## Additional volumes for the Silo container.
|
||||
extraVolumes: []
|
||||
|
||||
## Additional volumeMounts to minio container
|
||||
## Additional volume mounts for the Silo container.
|
||||
extraVolumeMounts: []
|
||||
|
||||
## Additional sidecar containers
|
||||
extraContainers: []
|
||||
|
||||
## Internal port number for MinIO S3 API container
|
||||
## Internal port number for the Silo S3 API container.
|
||||
## Change service.port to change external port number
|
||||
minioAPIPort: "9000"
|
||||
|
||||
## Internal port number for MinIO Browser Console container
|
||||
## Internal port number for the Silo Console container.
|
||||
## Change consoleService.port to change external port number
|
||||
minioConsolePort: "9001"
|
||||
|
||||
@@ -88,7 +89,7 @@ runtimeClassName: ""
|
||||
|
||||
## Set default rootUser, rootPassword
|
||||
## rootUser and rootPassword is generated when not set
|
||||
## Distributed MinIO ref: https://silo.pgsty.com/operations/deployments/baremetal/
|
||||
## Distributed Silo reference: https://silo.pgsty.com/operations/deployments/baremetal/
|
||||
##
|
||||
rootUser: ""
|
||||
rootPassword: ""
|
||||
@@ -105,13 +106,13 @@ rootPassword: ""
|
||||
## others depend on enabled status of corresponding sections.
|
||||
existingSecret: ""
|
||||
|
||||
## Directory on the MinIO pof
|
||||
certsPath: "/etc/minio/certs/"
|
||||
configPathmc: "/etc/minio/mc/"
|
||||
## Certificate and mcli configuration paths inside the Silo pod.
|
||||
certsPath: "/etc/silo/certs/"
|
||||
configPathmc: "/etc/silo/mc/"
|
||||
|
||||
## Path where PV would be mounted on the MinIO Pod
|
||||
## Path where the PV is mounted on the Silo pod.
|
||||
mountPath: "/export"
|
||||
## Override the root directory which the minio server should serve from.
|
||||
## Override the root directory which the Silo server should serve from.
|
||||
## If left empty, it defaults to the value of {{ .Values.mountPath }}
|
||||
## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
|
||||
##
|
||||
@@ -119,22 +120,22 @@ bucketRoot: ""
|
||||
|
||||
# Number of drives attached to a node
|
||||
drivesPerNode: 1
|
||||
# Number of MinIO containers running
|
||||
# Number of Silo containers running
|
||||
replicas: 16
|
||||
# Number of expanded MinIO clusters
|
||||
# Number of expanded Silo clusters
|
||||
pools: 1
|
||||
|
||||
## TLS Settings for MinIO
|
||||
## TLS settings for Silo.
|
||||
tls:
|
||||
enabled: false
|
||||
## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
## Create a Secret with private.key and public.crt and pass its name here.
|
||||
certSecret: ""
|
||||
publicCrt: public.crt
|
||||
privateKey: private.key
|
||||
|
||||
## Trusted Certificates Settings for MinIO. Ref: https://silo.pgsty.com/operations/network-encryption/#third-party-certificate-authorities
|
||||
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
|
||||
## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt.
|
||||
## Trusted certificate settings for Silo. Ref: https://silo.pgsty.com/operations/network-encryption/#third-party-certificate-authorities
|
||||
## Bundle multiple trusted certificates into one Secret and pass that here.
|
||||
## With self-signed certificates, include Silo's own certificate under public.crt.
|
||||
## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
|
||||
trustedCertsSecret: ""
|
||||
|
||||
@@ -150,7 +151,7 @@ persistence:
|
||||
## If defined, PVC must be created manually before volume will be bound
|
||||
existingClaim: ""
|
||||
|
||||
## minio data Persistent Volume Storage Class
|
||||
## Silo data PersistentVolume storage class.
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
@@ -169,7 +170,7 @@ persistence:
|
||||
##
|
||||
subPath: ""
|
||||
|
||||
## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service).
|
||||
## Expose Silo outside the cluster with a LoadBalancer Service.
|
||||
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
|
||||
## ref: http://kubernetes.io/docs/user-guide/services/
|
||||
##
|
||||
@@ -189,7 +190,7 @@ service:
|
||||
# - 10.10.10.0/24
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
## service.externalTrafficPolicy minio service external traffic policy
|
||||
## service.externalTrafficPolicy controls Silo Service traffic handling.
|
||||
## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
@@ -214,7 +215,7 @@ ingress:
|
||||
# nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
|
||||
path: /
|
||||
hosts:
|
||||
- minio-example.local
|
||||
- silo-example.local
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
@@ -235,7 +236,7 @@ consoleService:
|
||||
# - 10.10.10.0/24
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
## servconsoleServiceice.externalTrafficPolicy minio service external traffic policy
|
||||
## consoleService.externalTrafficPolicy controls Console traffic handling.
|
||||
## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
##
|
||||
externalTrafficPolicy: Cluster
|
||||
@@ -257,7 +258,7 @@ consoleIngress:
|
||||
# nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
|
||||
path: /
|
||||
hosts:
|
||||
- console.minio-example.local
|
||||
- console.silo-example.local
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
@@ -271,7 +272,7 @@ tolerations: []
|
||||
affinity: {}
|
||||
topologySpreadConstraints: []
|
||||
|
||||
## Add stateful containers to have security context, if enabled MinIO will run as this
|
||||
## Configure the security context used by stateful Silo containers.
|
||||
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
|
||||
securityContext:
|
||||
enabled: true
|
||||
@@ -296,7 +297,7 @@ resources:
|
||||
requests:
|
||||
memory: 16Gi
|
||||
|
||||
## List of policies to be created after minio install
|
||||
## Policies to create after installing Silo.
|
||||
##
|
||||
## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
|
||||
## you can define additional policies with custom supported actions and resources
|
||||
@@ -364,11 +365,11 @@ makePolicyJob:
|
||||
# Command to run after the main command on exit
|
||||
exitCommand: ""
|
||||
|
||||
## List of users to be created after minio install
|
||||
## Users to create after installing Silo.
|
||||
## Username, password and policy to be assigned to the user.
|
||||
## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics].
|
||||
## Add new policies as explained here https://silo.pgsty.com/administration/identity-access-management/#access-management
|
||||
## NOTE: this will fail if LDAP is enabled in your MinIO deployment.
|
||||
## NOTE: this will fail if LDAP is enabled in the Silo deployment.
|
||||
##
|
||||
## Example:
|
||||
## users:
|
||||
@@ -394,7 +395,7 @@ makeUserJob:
|
||||
# Command to run after the main command on exit
|
||||
exitCommand: ""
|
||||
|
||||
## List of service accounts to be created after minio install
|
||||
## Service accounts to create after installing Silo.
|
||||
##
|
||||
svcaccts:
|
||||
[]
|
||||
@@ -434,7 +435,7 @@ makeServiceAccountJob:
|
||||
# Command to run after the main command on exit
|
||||
exitCommand: ""
|
||||
|
||||
## List of buckets to be created after minio install
|
||||
## Buckets to create after installing Silo.
|
||||
##
|
||||
buckets:
|
||||
[]
|
||||
@@ -471,10 +472,11 @@ makeBucketJob:
|
||||
# Command to run after the main command on exit
|
||||
exitCommand: ""
|
||||
|
||||
## List of command to run after minio install
|
||||
## NOTE: the mc command TARGET is always "myminio"
|
||||
## Commands to run after installing Silo.
|
||||
## The preferred mc command TARGET is "mysilo". The legacy "myminio" target
|
||||
## remains registered so existing customCommands values continue to work.
|
||||
customCommands:
|
||||
# - command: "admin policy attach myminio consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'"
|
||||
# - command: "admin policy attach mysilo consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'"
|
||||
|
||||
## Additional Annotations for the Kubernetes Job customCommandJob
|
||||
customCommandJob:
|
||||
@@ -513,11 +515,10 @@ postJob:
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s)
|
||||
## when Chart is deployed
|
||||
## Add environment variables for Silo. The MINIO_* names remain the stable
|
||||
## configuration interface and are passed to the Silo container(s).
|
||||
environment:
|
||||
## Please refer for comprehensive list https://silo.pgsty.com/reference/minio-server/minio-server/
|
||||
## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io"
|
||||
## MINIO_BROWSER: "off"
|
||||
|
||||
## The name of a secret in the same kubernetes namespace which contain secret values
|
||||
@@ -532,7 +533,7 @@ extraSecret: ~
|
||||
oidc:
|
||||
enabled: false
|
||||
configUrl: "https://identity-provider-url/.well-known/openid-configuration"
|
||||
clientId: "minio"
|
||||
clientId: "silo"
|
||||
clientSecret: ""
|
||||
# Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret``
|
||||
existingClientSecretName: ""
|
||||
@@ -551,12 +552,12 @@ networkPolicy:
|
||||
# Specifies whether the policies created will be standard Network Policies (flavor: kubernetes)
|
||||
# or Cilium Network Policies (flavor: cilium)
|
||||
flavor: kubernetes
|
||||
# allows external access to the minio api
|
||||
# Allow external access to the Silo API.
|
||||
allowExternal: true
|
||||
## @params networkPolicy.egress configuration of the egress traffic
|
||||
egress:
|
||||
## @param networkPolicy.egress.enabled When enabled, an egress network policy will be
|
||||
## created allowing minio to connect to external data sources from kubernetes cluster.
|
||||
## created allowing Silo to connect to external data sources from the cluster.
|
||||
##
|
||||
enabled: false
|
||||
## @param networkPolicy.egress.ports Add individual ports to be allowed by the egress
|
||||
@@ -574,7 +575,7 @@ networkPolicy:
|
||||
## to:
|
||||
## - namespaceSelector:
|
||||
## matchExpressions:
|
||||
## - {key: role, operator: In, values: [minio]}
|
||||
## - {key: role, operator: In, values: [silo]}
|
||||
##
|
||||
to: []
|
||||
# only when using flavor: cilium
|
||||
@@ -588,13 +589,13 @@ podDisruptionBudget:
|
||||
enabled: false
|
||||
maxUnavailable: 1
|
||||
|
||||
## Specify the service account to use for the MinIO pods. If 'create' is set to 'false'
|
||||
## Specify the service account to use for Silo pods. If 'create' is set to 'false'
|
||||
## and 'name' is left unspecified, the account 'default' will be used.
|
||||
serviceAccount:
|
||||
create: true
|
||||
## The name of the service account to use. If 'create' is 'true', a service account with that name
|
||||
## will be created.
|
||||
name: "minio-sa"
|
||||
name: "silo-sa"
|
||||
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
@@ -618,7 +619,7 @@ metrics:
|
||||
# Scrape timeout, for example `scrapeTimeout: 10s`
|
||||
scrapeTimeout: ~
|
||||
|
||||
## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
|
||||
## ETCD settings. The existing MINIO_ETCD_* configuration interface is retained.
|
||||
## Define endpoints to enable this section.
|
||||
etcd:
|
||||
endpoints: []
|
||||
Reference in New Issue
Block a user