me/glitchier-soc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

helm: add support for S3 storage (#15748)

Browse source
This commit is contained in:
Alex Dunn 2021-02-19 00:52:32 -08:00 committed by GitHub
parent e31ed27485
commit fca4fd1daa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
14 changed files with 55 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
chart/Chart.yaml
View file

@ -15,7 +15,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 1.0.0
version: 1.1.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to

1
chart/readme.md
View file

@ -24,7 +24,6 @@ The variables that _must_ be configured are:
Currently this chart does _not_ support:
- Hidden services
- S3/Minio/GCS
- Single Sign-On
- Swift
- configurations using `WEB_DOMAIN`

10
chart/templates/configmap-env.yaml
View file

@ -27,6 +27,16 @@ data:
RAILS_ENV: "production"
REDIS_HOST: {{ template "mastodon.redis.fullname" . }}-master
REDIS_PORT: "6379"
{{- if .Values.mastodon.s3.enabled }}
S3_BUCKET: {{ .Values.mastodon.s3.bucket }}
S3_ENABLED: "true"
S3_ENDPOINT: {{ .Values.mastodon.s3.endpoint }}
S3_HOSTNAME: {{ .Values.mastodon.s3.hostname }}
S3_PROTOCOL: "https"
{{- if .Values.mastodon.s3.region }}
S3_REGION: {{ .Values.mastodon.s3.region }}
{{- end }}
{{- end }}
{{- if .Values.mastodon.smtp.auth_method }}
SMTP_AUTH_METHOD: {{ .Values.mastodon.smtp.auth_method }}
{{- end }}

4
chart/templates/cronjob-media-remove.yaml
View file

@ -14,6 +14,7 @@ spec:
name: {{ include "mastodon.fullname" . }}-media-remove
spec:
restartPolicy: OnFailure
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -35,6 +36,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ include "mastodon.fullname" . }}-media-remove
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@ -65,9 +67,11 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}
{{- end }}

4
chart/templates/deployment-sidekiq.yaml
View file

@ -31,6 +31,7 @@ spec:
serviceAccountName: {{ include "mastodon.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -52,6 +53,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ .Chart.Name }}
securityContext:
@ -84,11 +86,13 @@ spec:
secretKeyRef:
name: {{ .Release.Name }}-redis
key: redis-password
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}

4
chart/templates/deployment-web.yaml
View file

@ -31,6 +31,7 @@ spec:
serviceAccountName: {{ include "mastodon.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumes:
- name: assets
persistentVolumeClaim:
@ -38,6 +39,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ .Chart.Name }}
securityContext:
@ -72,11 +74,13 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}
ports:
- name: http
containerPort: {{ .Values.mastodon.web.port }}

4
chart/templates/job-assets-precompile.yaml
View file

@ -14,6 +14,7 @@ spec:
name: {{ include "mastodon.fullname" . }}-assets-precompile
spec:
restartPolicy: Never
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -35,6 +36,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ include "mastodon.fullname" . }}-assets-precompile
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@ -66,8 +68,10 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}

4
chart/templates/job-chewy-upgrade.yaml
View file

@ -15,6 +15,7 @@ spec:
name: {{ include "mastodon.fullname" . }}-chewy-upgrade
spec:
restartPolicy: Never
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -36,6 +37,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ include "mastodon.fullname" . }}-chewy-setup
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@ -67,9 +69,11 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}
{{- end }}

4
chart/templates/job-create-admin.yaml
View file

@ -15,6 +15,7 @@ spec:
name: {{ include "mastodon.fullname" . }}-create-admin
spec:
restartPolicy: Never
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -36,6 +37,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ include "mastodon.fullname" . }}-create-admin
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@ -72,9 +74,11 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}
{{- end }}

4
chart/templates/job-db-migrate.yaml
View file

@ -14,6 +14,7 @@ spec:
name: {{ include "mastodon.fullname" . }}-db-migrate
spec:
restartPolicy: Never
{{- if (not .Values.mastodon.s3.enabled) }}
# ensure we run on the same node as the other rails components; only
# required when using PVCs that are ReadWriteOnce
{{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
@ -35,6 +36,7 @@ spec:
- name: system
persistentVolumeClaim:
claimName: {{ template "mastodon.fullname" . }}-system
{{- end }}
containers:
- name: {{ include "mastodon.fullname" . }}-db-migrate
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@ -66,8 +68,10 @@ spec:
key: redis-password
- name: "PORT"
value: {{ .Values.mastodon.web.port | quote }}
{{- if (not .Values.mastodon.s3.enabled) }}
volumeMounts:
- name: assets
mountPath: /opt/mastodon/public/assets
- name: system
mountPath: /opt/mastodon/public/system
{{- end }}

3
chart/templates/pvc-assets.yaml
View file

@ -1,4 +1,4 @@
---
{{- if (not .Values.mastodon.s3.enabled) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
@ -11,3 +11,4 @@ spec:
resources:
{{- toYaml .Values.mastodon.persistence.assets.resources | nindent 4}}
storageClassName: {{ .Values.mastodon.persistence.assets.storageClassName }}
{{- end }}

3
chart/templates/pvc-system.yaml
View file

@ -1,4 +1,4 @@
---
{{- if (not .Values.mastodon.s3.enabled) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
@ -11,3 +11,4 @@ spec:
resources:
{{- toYaml .Values.mastodon.persistence.system.resources | nindent 4}}
storageClassName: {{ .Values.mastodon.persistence.system.storageClassName }}
{{- end }}

4
chart/templates/secrets.yaml
View file

@ -6,6 +6,10 @@ metadata:
{{- include "mastodon.labels" . | nindent 4 }}
type: Opaque
data:
{{- if .Values.mastodon.s3.enabled }}
AWS_ACCESS_KEY_ID: "{{ .Values.mastodon.s3.access_key | b64enc }}"
AWS_SECRET_ACCESS_KEY: "{{ .Values.mastodon.s3.access_secret | b64enc }}"
{{- end }}
{{- if not (empty .Values.mastodon.secrets.secret_key_base) }}
SECRET_KEY_BASE: "{{ .Values.mastodon.secrets.secret_key_base | b64enc }}"
{{- else }}

8
chart/values.yaml
View file

@ -41,6 +41,14 @@ mastodon:
resources:
requests:
storage: 100Gi
s3:
enabled: false
access_key: ""
access_secret: ""
bucket: ""
endpoint: https://us-east-1.linodeobjects.com
hostname: us-east-1.linodeobjects.com
region: ""
# these must be set manually; autogenerated keys are rotated on each upgrade
secrets:
secret_key_base: ""