mirror of https://github.com/requarks/wiki
NGPixel
1 day ago
parent
44188e8f10
commit
e4e5762032
@ -0,0 +1,11 @@
|
||||
.DS_Store
|
||||
.git/
|
||||
.gitignore
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
.idea/
|
||||
.vscode/
|
||||
*.tgz
|
||||
@ -0,0 +1,25 @@
|
||||
apiVersion: v2
|
||||
name: wiki
|
||||
description: Wiki.js 3.x, the next-generation open source wiki
|
||||
type: application
|
||||
# Both overwritten by the build workflow with the release version (`3.0.0-beta.<run>`) before the
|
||||
# chart is published, so that every chart version pins exactly the image built alongside it and
|
||||
# upgrading the wiki is `helm upgrade --version <newer>`. Placeholders here, never bumped by hand.
|
||||
version: 3.0.0-beta
|
||||
# The image tag deployed when `image.tag` is left empty.
|
||||
appVersion: 3.0.0-beta
|
||||
# `lifecycle.preStop.sleep` (the default drain delay) is a native action from 1.30 on.
|
||||
kubeVersion: '>=1.30.0-0'
|
||||
home: https://js.wiki
|
||||
icon: https://cdn.js.wiki/images/wikijs-butterfly.svg
|
||||
sources:
|
||||
- https://github.com/requarks/wiki
|
||||
keywords:
|
||||
- wiki
|
||||
- documentation
|
||||
- knowledge base
|
||||
maintainers:
|
||||
- name: Nicolas Giard
|
||||
url: https://github.com/NGPixel
|
||||
annotations:
|
||||
licenses: AGPL-3.0-only
|
||||
@ -0,0 +1,159 @@
|
||||
# Wiki.js Helm chart
|
||||
|
||||
Deploys Wiki.js 3.x, with a bundled PostgreSQL 18 or an existing PostgreSQL 16+ server.
|
||||
|
||||
## Installing
|
||||
|
||||
The chart is published as an OCI artifact, so no `helm repo add` is needed:
|
||||
|
||||
```sh
|
||||
helm install wiki oci://ghcr.io/requarks/charts/wiki --version 3.0.0-beta.<build>
|
||||
```
|
||||
|
||||
Pass `--version` explicitly while the chart is a pre-release, because Helm skips pre-release
|
||||
versions unless you name one or pass `--devel`. With no values set, you get one wiki replica
|
||||
reachable inside the cluster only, backed by a bundled PostgreSQL on an 8 GiB claim. The first
|
||||
start runs the database migrations; `kubectl rollout status deployment/wiki` shows when it is done.
|
||||
|
||||
Unless `admin.password` is set, the first login is `admin@example.com` / `12345678`, and it has to be
|
||||
changed.
|
||||
|
||||
## Database
|
||||
|
||||
### Bundled
|
||||
|
||||
`postgresql.enabled: true` (the default) runs the official `postgres:18` image as a single
|
||||
StatefulSet replica. The wiki connects as `postgresql.auth.username`, an ordinary role that owns its
|
||||
own database. The `postgres` superuser is never handed to the wiki.
|
||||
|
||||
- **Passwords** are generated on first install and kept in the `<release>-postgresql` Secret, which
|
||||
survives `helm uninstall`. Tools that render without cluster access, Argo CD among them, would
|
||||
generate new passwords on every sync, so set `postgresql.auth.password` and `postgresPassword`, or
|
||||
point `postgresql.auth.existingSecret` at a Secret with `password` and `postgres-password` keys.
|
||||
- **Everything under `postgresql.auth` is applied once**, when the data directory is initialised.
|
||||
Changing it afterwards changes what the wiki is told, not the database; alter the role to match.
|
||||
- **Server settings** go in `postgresql.parameters` (passed as `-c key=value`), first-run SQL or
|
||||
shell in `postgresql.initdbScripts`.
|
||||
- **Major upgrades** (18 → 19) need a dump and restore, as they would anywhere. Pin a minor tag
|
||||
(`postgresql.image.tag: "18.4"`) if you want upgrades to happen only when you choose.
|
||||
|
||||
For replication, backups and failover, run PostgreSQL with an operator (CloudNativePG, for example)
|
||||
and use it as an external database.
|
||||
|
||||
### External
|
||||
|
||||
Set `postgresql.enabled: false`, then say where the server is in **one** of two ways. Fill in
|
||||
`externalDatabase.connectionString` or `externalDatabase.parameters` and leave the other empty; the
|
||||
chart refuses to render with both. `externalDatabase.schema` (`wiki` by default) and
|
||||
`externalDatabase.ssl` apply to either.
|
||||
|
||||
The database user needs to own the database, or at least be allowed to create a schema in it.
|
||||
|
||||
#### Option 1: a connection string
|
||||
|
||||
Passed to the wiki as `DATABASE_URL`, so an operator's generated Secret can be used as it is. For
|
||||
CloudNativePG:
|
||||
|
||||
```yaml
|
||||
postgresql:
|
||||
enabled: false
|
||||
externalDatabase:
|
||||
connectionString:
|
||||
existingSecret: mycluster-app # created by CloudNativePG for the cluster's app database
|
||||
existingSecretKey: uri
|
||||
ssl:
|
||||
enabled: true
|
||||
existingSecret: mycluster-ca # key: ca.crt
|
||||
```
|
||||
|
||||
`connectionString.value` takes the string itself instead, and the chart stores it in a Secret.
|
||||
Either way, percent-encode special characters in the password. TLS parameters in the string
|
||||
(`sslmode`, `sslrootcert`, …) replace everything under `externalDatabase.ssl`. CloudNativePG's
|
||||
`uri` has none, which is why it is paired with `ssl` and the cluster's CA above.
|
||||
|
||||
#### Option 2: individual parameters
|
||||
|
||||
```yaml
|
||||
postgresql:
|
||||
enabled: false
|
||||
externalDatabase:
|
||||
parameters:
|
||||
host: pg.databases.svc
|
||||
database: wiki
|
||||
user: wiki
|
||||
existingSecret: wiki-db # key: password
|
||||
ssl:
|
||||
enabled: true
|
||||
existingSecret: pg-ca # key: ca.crt, and optionally tls.crt / tls.key
|
||||
```
|
||||
|
||||
## Exposing it
|
||||
|
||||
Both can be on at once, which is useful while moving from one to the other.
|
||||
|
||||
- **Gateway API**: `httpRoute.enabled`, with `parentRefs` naming your Gateway and `hostnames`.
|
||||
`rules` are passed through as written, and the chart adds the `backendRefs`.
|
||||
- **Ingress**: `ingress.enabled`, `className`, `hosts`, `tls`. Most controllers cap request body
|
||||
size, which also caps uploads; raise the limit with the controller's own annotation
|
||||
(`nginx.ingress.kubernetes.io/proxy-body-size` for ingress-nginx).
|
||||
|
||||
Behind either one, turn on **Admin → Security → Trust Proxy**, so the wiki records the visitor's
|
||||
address rather than the proxy's.
|
||||
|
||||
## Replicas
|
||||
|
||||
`replicaCount` can be raised freely. Replicas coordinate through the database, collaborative editing
|
||||
included, so no sticky sessions are needed.
|
||||
|
||||
The data directory (`/wiki/data`) is per replica unless `persistence` points every replica at one
|
||||
ReadWriteMany claim. That does not matter for the caches it normally holds, which are rebuilt from
|
||||
the database. It does matter for a **Local Disk** or **Git** storage target left at its default
|
||||
location under `data/`, which would otherwise be a separate copy on each replica.
|
||||
|
||||
With one replica on a ReadWriteOnce claim, set `strategy.type: Recreate`. Otherwise a rolling
|
||||
update's new pod may land on a node the volume cannot be attached to.
|
||||
|
||||
## Hardening
|
||||
|
||||
Both workloads run as non-root, with a read-only root filesystem, every capability dropped, no
|
||||
privilege escalation, `RuntimeDefault` seccomp and no service account token. The wiki writes only to
|
||||
`/wiki/data`, `/tmp` and `/home/node`; PostgreSQL writes only to its data volume,
|
||||
`/var/run/postgresql`, `/tmp` and `/dev/shm`.
|
||||
|
||||
The one thing the read-only root filesystem rules out is installing an extension from
|
||||
**Admin → Extensions**, which runs `npm install` inside the image. Puppeteer is already in the
|
||||
image; to add anything else, build an image `FROM` this one.
|
||||
|
||||
## Health and shutdown
|
||||
|
||||
`/_live` backs the startup and liveness probes, `/_ready` the readiness probe. The startup probe
|
||||
allows five minutes for migrations before liveness takes over. `KUBERNETES_SERVICE_HOST` is set on
|
||||
the container. It switches the wiki's shutdown to Kubernetes semantics: on SIGTERM `/_ready` turns
|
||||
503 while in-flight and still-routed requests keep being served. The default `preStop` sleep gives
|
||||
load balancers five seconds to drop the pod first.
|
||||
|
||||
## Upgrading
|
||||
|
||||
Every build of the wiki publishes a chart of the same version, `3.0.0-beta.<build>`, whose
|
||||
`appVersion` is that build's image. Upgrading the wiki is therefore upgrading the chart:
|
||||
|
||||
```sh
|
||||
helm upgrade wiki oci://ghcr.io/requarks/charts/wiki --version 3.0.0-beta.<newer> -f my-values.yaml
|
||||
```
|
||||
|
||||
`helm rollback` returns to the previous image along with everything else. Leave `image.tag` unset,
|
||||
since setting it pins the image no matter which chart version is installed.
|
||||
|
||||
## Publishing
|
||||
|
||||
The build workflow (`.github/workflows/build.yml`) publishes the chart. It writes the release
|
||||
version into `version` and `appVersion` in `Chart.yaml`, and pushes the chart to
|
||||
`oci://ghcr.io/requarks/charts` once the image is up. The two values committed in `Chart.yaml` are
|
||||
placeholders, so nothing is bumped by hand.
|
||||
|
||||
To try a change locally:
|
||||
|
||||
```sh
|
||||
helm lint --strict dev/chart
|
||||
helm template wiki dev/chart -f my-values.yaml
|
||||
```
|
||||
@ -0,0 +1,54 @@
|
||||
Wiki.js {{ .Values.image.tag | default .Chart.AppVersion }} is being deployed as {{ include "wiki.fullname" . }}.
|
||||
|
||||
{{- if .Values.httpRoute.enabled }}
|
||||
|
||||
It is routed through {{ range $i, $p := .Values.httpRoute.parentRefs }}{{ if $i }}, {{ end }}Gateway {{ $p.name }}{{ end }} for:
|
||||
{{- range .Values.httpRoute.hostnames }}
|
||||
{{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
|
||||
It is served through the Ingress at:
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (or .Values.httpRoute.enabled .Values.ingress.enabled) }}
|
||||
|
||||
It is reachable inside the cluster only. To open it from this machine:
|
||||
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward service/{{ include "wiki.fullname" . }} 8080:{{ .Values.service.port }}
|
||||
|
||||
and browse to http://localhost:8080.
|
||||
{{- end }}
|
||||
|
||||
The first start runs the database migrations, which takes a little while:
|
||||
|
||||
kubectl --namespace {{ .Release.Namespace }} rollout status deployment/{{ include "wiki.fullname" . }}
|
||||
|
||||
{{- if not (or .Values.admin.password .Values.admin.existingSecret) }}
|
||||
|
||||
Sign in as {{ .Values.admin.email | default "admin@example.com" }} with the password 12345678; you will be asked to change it.
|
||||
{{- end }}
|
||||
{{- if or .Values.httpRoute.enabled .Values.ingress.enabled }}
|
||||
|
||||
Behind a Gateway or an Ingress, turn on Admin → Security → Trust Proxy, so that the wiki sees the
|
||||
visitor's address rather than the proxy's.
|
||||
{{- end }}
|
||||
{{- if and .Values.postgresql.enabled (not .Values.postgresql.auth.existingSecret) (not .Values.postgresql.auth.password) }}
|
||||
|
||||
The database passwords were generated and are kept in Secret {{ include "wiki.postgresql.fullname" . }}.
|
||||
{{- end }}
|
||||
{{- if and (gt (int .Values.replicaCount) 1) .Values.persistence.enabled (not (has "ReadWriteMany" .Values.persistence.accessModes)) }}
|
||||
|
||||
WARNING: {{ .Values.replicaCount }} replicas share a data claim that is not ReadWriteMany. Replicas scheduled
|
||||
on different nodes will not be able to mount it.
|
||||
{{- end }}
|
||||
{{- if and (gt (int .Values.replicaCount) 1) (not .Values.persistence.enabled) }}
|
||||
|
||||
Note: each of the {{ .Values.replicaCount }} replicas has a data directory of its own. That is fine for the caches it
|
||||
holds, but a Local Disk or Git storage target would be a separate copy on each replica.
|
||||
{{- end }}
|
||||
@ -0,0 +1,253 @@
|
||||
{{/* Chart name, truncated to fit a DNS label. */}}
|
||||
{{- define "wiki.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Fully qualified app name. Truncated to 49 rather than 63 so that the longest suffix added to it
|
||||
(`-postgresql-hl`) still fits in a DNS label.
|
||||
*/}}
|
||||
{{- define "wiki.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 49 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 49 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 49 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.commonLabels" -}}
|
||||
helm.sh/chart: {{ include "wiki.chart" . }}
|
||||
app.kubernetes.io/name: {{ include "wiki.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: wiki
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
The component is part of both selectors on purpose: without it, the wiki's Service and Deployment
|
||||
would select the PostgreSQL pod too, which carries the same name and instance labels.
|
||||
*/}}
|
||||
{{- define "wiki.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "wiki.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: wiki
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.labels" -}}
|
||||
{{ include "wiki.commonLabels" . }}
|
||||
app.kubernetes.io/component: wiki
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "wiki.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* `repository:tag`, or `repository@digest` when a digest is given. Takes the image dict and a default tag. */}}
|
||||
{{- define "wiki.imageRef" -}}
|
||||
{{- $img := index . 0 }}
|
||||
{{- if $img.digest }}
|
||||
{{- printf "%s@%s" $img.repository $img.digest }}
|
||||
{{- else }}
|
||||
{{- printf "%s:%s" $img.repository (toString (index . 1)) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.image" -}}
|
||||
{{- include "wiki.imageRef" (list .Values.image (.Values.image.tag | default .Chart.AppVersion)) }}
|
||||
{{- end }}
|
||||
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
{{/* PostgreSQL */}}
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
|
||||
{{- define "wiki.postgresql.fullname" -}}
|
||||
{{- printf "%s-postgresql" (include "wiki.fullname" .) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.postgresql.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "wiki.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.postgresql.labels" -}}
|
||||
helm.sh/chart: {{ include "wiki.chart" . }}
|
||||
app.kubernetes.io/name: {{ include "wiki.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/version: {{ .Values.postgresql.image.tag | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
app.kubernetes.io/part-of: wiki
|
||||
app.kubernetes.io/component: postgresql
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.postgresql.image" -}}
|
||||
{{- include "wiki.imageRef" (list .Values.postgresql.image .Values.postgresql.image.tag) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.postgresql.secretName" -}}
|
||||
{{- .Values.postgresql.auth.existingSecret | default (include "wiki.postgresql.fullname" .) }}
|
||||
{{- end }}
|
||||
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
{{/* The database the wiki connects to, bundled or external */}}
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
|
||||
{{- define "wiki.db.host" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- include "wiki.postgresql.fullname" . }}
|
||||
{{- else }}
|
||||
{{- .Values.externalDatabase.parameters.host }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.port" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- .Values.postgresql.service.port }}
|
||||
{{- else }}
|
||||
{{- .Values.externalDatabase.parameters.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.name" -}}
|
||||
{{- ternary .Values.postgresql.auth.database .Values.externalDatabase.parameters.database .Values.postgresql.enabled }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.user" -}}
|
||||
{{- ternary .Values.postgresql.auth.username .Values.externalDatabase.parameters.user .Values.postgresql.enabled }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.schema" -}}
|
||||
{{- ternary .Values.postgresql.schema .Values.externalDatabase.schema .Values.postgresql.enabled }}
|
||||
{{- end }}
|
||||
|
||||
{{/* The Secret and key the wiki reads its database password from. */}}
|
||||
{{- define "wiki.db.secretName" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- include "wiki.postgresql.secretName" . }}
|
||||
{{- else if .Values.externalDatabase.parameters.existingSecret }}
|
||||
{{- .Values.externalDatabase.parameters.existingSecret }}
|
||||
{{- else }}
|
||||
{{- printf "%s-db" (include "wiki.fullname" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.secretKey" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- .Values.postgresql.auth.secretKeys.userPasswordKey }}
|
||||
{{- else if .Values.externalDatabase.parameters.existingSecret }}
|
||||
{{- .Values.externalDatabase.parameters.existingSecretPasswordKey }}
|
||||
{{- else -}}
|
||||
password
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Whether the wiki is handed a connection string (DATABASE_URL) rather than individual parameters.
|
||||
Truthy or empty, for `if`.
|
||||
*/}}
|
||||
{{- define "wiki.db.useUrl" -}}
|
||||
{{- $url := .Values.externalDatabase.connectionString }}
|
||||
{{- if and (not .Values.postgresql.enabled) (or $url.value $url.existingSecret) }}true{{ end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* The Secret and key the connection string is read from. */}}
|
||||
{{- define "wiki.db.urlSecretName" -}}
|
||||
{{- .Values.externalDatabase.connectionString.existingSecret | default (printf "%s-db" (include "wiki.fullname" .)) }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.urlSecretKey" -}}
|
||||
{{- if .Values.externalDatabase.connectionString.existingSecret }}
|
||||
{{- .Values.externalDatabase.connectionString.existingSecretKey }}
|
||||
{{- else -}}
|
||||
url
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "wiki.db.tlsEnabled" -}}
|
||||
{{- if and (not .Values.postgresql.enabled) .Values.externalDatabase.ssl.enabled }}true{{ end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
{{/* Generated secrets */}}
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
|
||||
{{/*
|
||||
A password: the value given, else the one already stored in the Secret, else a new random one. The
|
||||
lookup is what keeps a generated password across `helm upgrade`; it returns nothing to a render that
|
||||
has no cluster access (`helm template`, Argo CD), which is why those should be given passwords.
|
||||
Takes (list $ secretName key value).
|
||||
*/}}
|
||||
{{- define "wiki.secretValue" -}}
|
||||
{{- $ctx := index . 0 }}
|
||||
{{- $name := index . 1 }}
|
||||
{{- $key := index . 2 }}
|
||||
{{- $given := index . 3 }}
|
||||
{{- if $given }}
|
||||
{{- $given | b64enc }}
|
||||
{{- else }}
|
||||
{{- $existing := lookup "v1" "Secret" $ctx.Release.Namespace $name }}
|
||||
{{- if and $existing (hasKey (default dict $existing.data) $key) }}
|
||||
{{- index $existing.data $key }}
|
||||
{{- else }}
|
||||
{{- randAlphaNum 32 | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
{{/* Validation */}}
|
||||
{{/* ---------------------------------------------------------------------------------------------- */}}
|
||||
|
||||
{{- define "wiki.validate" -}}
|
||||
{{- if hasKey .Values.config "db" }}
|
||||
{{- fail "config.db is set by the chart: configure the database under postgresql or externalDatabase instead" }}
|
||||
{{- end }}
|
||||
{{- range $key := list "port" "bindIP" "dataPath" }}
|
||||
{{- if hasKey $.Values.config $key }}
|
||||
{{- fail (printf "config.%s is set by the chart and cannot be overridden" $key) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.postgresql.enabled (eq .Values.postgresql.auth.username "postgres") }}
|
||||
{{- fail "postgresql.auth.username must not be \"postgres\": the wiki connects as its own role, not as the superuser" }}
|
||||
{{- end }}
|
||||
{{- if not .Values.postgresql.enabled }}
|
||||
{{- $url := .Values.externalDatabase.connectionString }}
|
||||
{{- $params := .Values.externalDatabase.parameters }}
|
||||
{{- if and $url.value $url.existingSecret }}
|
||||
{{- fail "externalDatabase.connectionString: set value or existingSecret, not both" }}
|
||||
{{- end }}
|
||||
{{- $hasUrl := or $url.value $url.existingSecret }}
|
||||
{{- $hasParams := or $params.host $params.password $params.existingSecret }}
|
||||
{{- if and $hasUrl $hasParams }}
|
||||
{{- fail "externalDatabase: use connectionString or parameters, not both — empty the one you are not using" }}
|
||||
{{- end }}
|
||||
{{- if not (or $hasUrl $hasParams) }}
|
||||
{{- fail "externalDatabase: set either connectionString or parameters when postgresql.enabled is false" }}
|
||||
{{- end }}
|
||||
{{- if $hasParams }}
|
||||
{{- if not $params.host }}
|
||||
{{- fail "externalDatabase.parameters.host is required" }}
|
||||
{{- end }}
|
||||
{{- if not (or $params.password $params.existingSecret) }}
|
||||
{{- fail "externalDatabase.parameters: password or existingSecret is required" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.externalDatabase.ssl.existingSecret (ne (empty .Values.externalDatabase.ssl.certKey) (empty .Values.externalDatabase.ssl.keyKey)) }}
|
||||
{{- fail "externalDatabase.ssl.certKey and externalDatabase.ssl.keyKey go together: set both for a client certificate, or neither" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,48 @@
|
||||
{{- include "wiki.validate" . }}
|
||||
{{- $config := deepCopy .Values.config }}
|
||||
{{- $_ := set $config "port" 3000 }}
|
||||
{{- $_ := set $config "bindIP" "0.0.0.0" }}
|
||||
{{- $_ := set $config "dataPath" "/wiki/data" }}
|
||||
{{- $ssl := .Values.externalDatabase.ssl }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yml: |
|
||||
{{- toYaml $config | nindent 4 }}
|
||||
db:
|
||||
{{- if include "wiki.db.useUrl" . }}
|
||||
# Connecting through DATABASE_URL, which takes the place of host, port, user, pass and db.
|
||||
{{- else }}
|
||||
host: {{ include "wiki.db.host" . | toJson }}
|
||||
port: {{ include "wiki.db.port" . }}
|
||||
user: {{ include "wiki.db.user" . | toJson }}
|
||||
# Substituted from the environment when the file is read. A block scalar rather than a quoted
|
||||
# string, so that no character a password may contain can end it early.
|
||||
pass: |2-
|
||||
$(DB_PASS)
|
||||
db: {{ include "wiki.db.name" . | toJson }}
|
||||
{{- end }}
|
||||
schema: {{ include "wiki.db.schema" . | toJson }}
|
||||
{{- if include "wiki.db.tlsEnabled" . }}
|
||||
ssl: true
|
||||
sslOptions:
|
||||
{{- if or $ssl.existingSecret (not $ssl.rejectUnauthorized) }}
|
||||
auto: false
|
||||
rejectUnauthorized: {{ $ssl.rejectUnauthorized }}
|
||||
{{- if $ssl.existingSecret }}
|
||||
ca: /etc/wiki/db-tls/{{ $ssl.caKey }}
|
||||
{{- if $ssl.certKey }}
|
||||
cert: /etc/wiki/db-tls/{{ $ssl.certKey }}
|
||||
key: /etc/wiki/db-tls/{{ $ssl.keyKey }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
auto: true
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
ssl: false
|
||||
{{- end }}
|
||||
@ -0,0 +1,228 @@
|
||||
{{- $ssl := .Values.externalDatabase.ssl }}
|
||||
{{- $adminSecret := .Values.admin.existingSecret | default (printf "%s-admin" (include "wiki.fullname" .)) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
{{- with .Values.strategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "wiki.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
# Rolls the pods when config.yml changes, since nothing in the pod spec would otherwise.
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "wiki.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
|
||||
# Load-bearing, not tidiness: service links put `<SERVICE>_PORT=tcp://…` in the environment of
|
||||
# every pod for every service in the namespace, and the wiki reads `WIKI_PORT` as the port to
|
||||
# listen on — so a Service named `wiki` would take the whole pod down.
|
||||
enableServiceLinks: false
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.waitForDatabase.enabled }}
|
||||
initContainers:
|
||||
# The wiki image is used rather than a second one, and asked only whether the port accepts a
|
||||
# connection: a bundled server opens it only once initialisation is over.
|
||||
- name: wait-for-db
|
||||
image: {{ include "wiki.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- node
|
||||
- -e
|
||||
- |
|
||||
const net = require('node:net')
|
||||
// Only the host and port of a connection string are ever read or printed; it carries the password.
|
||||
const url = process.env.DATABASE_URL ? new URL(process.env.DATABASE_URL) : null
|
||||
const host = url ? url.hostname.replace(/^\[|\]$/g, '') : process.env.DB_HOST
|
||||
const port = Number(url ? url.port || 5432 : process.env.DB_PORT)
|
||||
const attempt = () => {
|
||||
const socket = net.connect({ host, port, timeout: 3000 })
|
||||
socket.once('connect', () => { console.info(`${host}:${port} is accepting connections`); socket.destroy(); process.exit(0) })
|
||||
const retry = (err) => { console.info(`Waiting for ${host}:${port}... (${err?.code ?? 'timeout'})`); socket.destroy(); setTimeout(attempt, 2000) }
|
||||
socket.once('error', retry)
|
||||
socket.once('timeout', retry)
|
||||
}
|
||||
attempt()
|
||||
env:
|
||||
{{- if include "wiki.db.useUrl" . }}
|
||||
- name: DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "wiki.db.urlSecretName" . }}
|
||||
key: {{ include "wiki.db.urlSecretKey" . }}
|
||||
{{- else }}
|
||||
- name: DB_HOST
|
||||
value: {{ include "wiki.db.host" . | quote }}
|
||||
- name: DB_PORT
|
||||
value: {{ include "wiki.db.port" . | quote }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- with .Values.waitForDatabase.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: wiki
|
||||
image: {{ include "wiki.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG_FILE
|
||||
value: /etc/wiki/config.yml
|
||||
# Switches the health endpoints to Kubernetes semantics: a replica shutting down reports
|
||||
# not ready but keeps serving what is still routed to it. The kubelet normally provides this
|
||||
# variable already; it is set here so the behaviour does not rest on that, and to a name
|
||||
# that still reaches the API server should anything in the pod ever use it.
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: kubernetes.default.svc
|
||||
{{- if include "wiki.db.useUrl" . }}
|
||||
- name: DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "wiki.db.urlSecretName" . }}
|
||||
key: {{ include "wiki.db.urlSecretKey" . }}
|
||||
{{- else }}
|
||||
- name: DB_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "wiki.db.secretName" . }}
|
||||
key: {{ include "wiki.db.secretKey" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.admin.email }}
|
||||
- name: ADMIN_EMAIL
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.admin.password .Values.admin.existingSecret }}
|
||||
- name: ADMIN_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $adminSecret }}
|
||||
key: {{ ternary .Values.admin.existingSecretPasswordKey "password" (not (empty .Values.admin.existingSecret)) }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnvFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupProbe }}
|
||||
startupProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.lifecycle }}
|
||||
lifecycle:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/wiki
|
||||
readOnly: true
|
||||
- name: data
|
||||
mountPath: /wiki/data
|
||||
# The root filesystem is read-only; these are what the wiki, git, ssh and Chromium write to
|
||||
# besides the data directory.
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: home
|
||||
mountPath: /home/node
|
||||
{{- if and (include "wiki.db.tlsEnabled" .) $ssl.existingSecret }}
|
||||
- name: db-tls
|
||||
mountPath: /etc/wiki/db-tls
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "wiki.fullname" .)) }}
|
||||
{{- else }}
|
||||
{{- with .Values.persistence.sizeLimit }}
|
||||
emptyDir:
|
||||
sizeLimit: {{ . }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: home
|
||||
emptyDir: {}
|
||||
{{- if and (include "wiki.db.tlsEnabled" .) $ssl.existingSecret }}
|
||||
- name: db-tls
|
||||
secret:
|
||||
secretName: {{ $ssl.existingSecret }}
|
||||
# Owned by root and readable through fsGroup, which 0400 would shut out.
|
||||
defaultMode: 0440
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,29 @@
|
||||
{{- if .Values.httpRoute.enabled }}
|
||||
{{- $fullname := include "wiki.fullname" . }}
|
||||
{{- $port := .Values.service.port }}
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: {{ $fullname }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
{{- with .Values.httpRoute.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.httpRoute.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
parentRefs:
|
||||
{{- toYaml (required "httpRoute.parentRefs needs at least one Gateway" .Values.httpRoute.parentRefs) | nindent 4 }}
|
||||
{{- with .Values.httpRoute.hostnames }}
|
||||
hostnames:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.httpRoute.rules }}
|
||||
{{- $rule := merge (dict "backendRefs" (list (dict "name" $fullname "port" $port))) (omit (default dict .) "backendRefs") }}
|
||||
- {{ toYaml $rule | nindent 6 | trim }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,41 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- $fullname := include "wiki.fullname" . }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullname }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.ingress.className }}
|
||||
ingressClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType | default "Prefix" }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ $fullname }}
|
||||
port:
|
||||
name: http
|
||||
{{- end }}
|
||||
{{- with .host }}
|
||||
host: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,17 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
{{- else }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "wiki.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,26 @@
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "wiki.postgresql.fullname" . }}-initdb
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 4 }}
|
||||
data:
|
||||
# The wiki's own role and database, owned by it so that it can create its schema — and nothing more.
|
||||
# Values reach psql as variables, quoted by psql itself, so none of them is ever spliced into SQL.
|
||||
00-wiki.sh: |
|
||||
#!/bin/bash
|
||||
set -Eeo pipefail
|
||||
psql -v ON_ERROR_STOP=1 --no-psqlrc --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
|
||||
--set app_user="$WIKI_DB_USER" \
|
||||
--set app_password="$WIKI_DB_PASSWORD" \
|
||||
--set app_db="$WIKI_DB_NAME" <<'EOSQL'
|
||||
CREATE ROLE :"app_user" LOGIN PASSWORD :'app_password';
|
||||
CREATE DATABASE :"app_db" OWNER :"app_user";
|
||||
REVOKE ALL ON DATABASE :"app_db" FROM PUBLIC;
|
||||
EOSQL
|
||||
{{- range $file, $content := .Values.postgresql.initdbScripts }}
|
||||
{{ $file }}: |
|
||||
{{- $content | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,18 @@
|
||||
{{- if and .Values.postgresql.enabled (not .Values.postgresql.auth.existingSecret) }}
|
||||
{{- $name := include "wiki.postgresql.fullname" . }}
|
||||
{{- $keys := .Values.postgresql.auth.secretKeys }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $name }}
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# Deleting this with the release would lose the only record of a generated password, for a
|
||||
# database whose claim outlives the release.
|
||||
helm.sh/resource-policy: keep
|
||||
type: Opaque
|
||||
data:
|
||||
{{ $keys.userPasswordKey }}: {{ include "wiki.secretValue" (list . $name $keys.userPasswordKey .Values.postgresql.auth.password) | quote }}
|
||||
{{ $keys.adminPasswordKey }}: {{ include "wiki.secretValue" (list . $name $keys.adminPasswordKey .Values.postgresql.auth.postgresPassword) | quote }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,44 @@
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- $svc := .Values.postgresql.service }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "wiki.postgresql.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 4 }}
|
||||
{{- with $svc.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $svc.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ $svc.type }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
port: {{ $svc.port }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "wiki.postgresql.selectorLabels" . | nindent 4 }}
|
||||
---
|
||||
# The StatefulSet's governing service, which gives the pod its stable DNS name.
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "wiki.postgresql.fullname" . }}-hl
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: postgresql
|
||||
port: {{ $svc.port }}
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "wiki.postgresql.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,195 @@
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- $pg := .Values.postgresql }}
|
||||
{{- $secret := include "wiki.postgresql.secretName" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "wiki.postgresql.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 4 }}
|
||||
spec:
|
||||
# One server. A replicated PostgreSQL is a job for an operator (CloudNativePG and the like), used
|
||||
# through `externalDatabase`.
|
||||
replicas: 1
|
||||
serviceName: {{ include "wiki.postgresql.fullname" . }}-hl
|
||||
{{- with $pg.updateStrategy }}
|
||||
updateStrategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and $pg.persistence.enabled (not $pg.persistence.existingClaim) }}
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
{{- toYaml $pg.persistence.retentionPolicy | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "wiki.postgresql.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/initdb: {{ include (print $.Template.BasePath "/postgresql/configmap.yaml") . | sha256sum }}
|
||||
{{- with $pg.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "wiki.postgresql.labels" . | nindent 8 }}
|
||||
{{- with $pg.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
enableServiceLinks: false
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $pg.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml $pg.podSecurityContext | nindent 8 }}
|
||||
# The official image declares SIGINT as its stop signal, which the container runtime sends in
|
||||
# place of SIGTERM: a fast shutdown, where SIGTERM would wait for every client to disconnect.
|
||||
terminationGracePeriodSeconds: {{ $pg.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: {{ include "wiki.postgresql.image" . }}
|
||||
imagePullPolicy: {{ $pg.image.pullPolicy }}
|
||||
args:
|
||||
- postgres
|
||||
{{- range $key, $value := $pg.parameters }}
|
||||
- -c
|
||||
- {{ printf "%s=%v" $key $value | quote }}
|
||||
{{- end }}
|
||||
{{- range $pg.extraArgs }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
value: postgres
|
||||
- name: POSTGRES_DB
|
||||
value: postgres
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret }}
|
||||
key: {{ $pg.auth.secretKeys.adminPasswordKey }}
|
||||
{{- with $pg.initdbArgs }}
|
||||
- name: POSTGRES_INITDB_ARGS
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
# Read by the first-run script that creates the wiki's role and database.
|
||||
- name: WIKI_DB_USER
|
||||
value: {{ $pg.auth.username | quote }}
|
||||
- name: WIKI_DB_NAME
|
||||
value: {{ $pg.auth.database | quote }}
|
||||
- name: WIKI_DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $secret }}
|
||||
key: {{ $pg.auth.secretKeys.userPasswordKey }}
|
||||
{{- with $pg.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with $pg.startupProbe }}
|
||||
startupProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with $pg.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with $pg.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml $pg.securityContext | nindent 12 }}
|
||||
{{- with $pg.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# The parent of PGDATA rather than PGDATA itself, as the image expects from 18 on
|
||||
# (/var/lib/postgresql/18/docker): the version is part of the path, and the data directory
|
||||
# is never the root of the volume, where a lost+found would make initdb refuse it.
|
||||
- name: data
|
||||
mountPath: /var/lib/postgresql
|
||||
- name: run
|
||||
mountPath: /var/run/postgresql
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: initdb
|
||||
mountPath: /docker-entrypoint-initdb.d
|
||||
readOnly: true
|
||||
{{- if $pg.shm.enabled }}
|
||||
- name: shm
|
||||
mountPath: /dev/shm
|
||||
{{- end }}
|
||||
{{- with $pg.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: run
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: initdb
|
||||
configMap:
|
||||
name: {{ include "wiki.postgresql.fullname" . }}-initdb
|
||||
defaultMode: 0555
|
||||
{{- if $pg.shm.enabled }}
|
||||
- name: shm
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
{{- with $pg.shm.sizeLimit }}
|
||||
sizeLimit: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $pg.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if $pg.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ $pg.persistence.existingClaim }}
|
||||
{{- end }}
|
||||
{{- with $pg.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $pg.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $pg.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $pg.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $pg.persistence.enabled (not $pg.persistence.existingClaim) }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
labels:
|
||||
{{- include "wiki.postgresql.selectorLabels" . | nindent 10 }}
|
||||
{{- with $pg.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- toYaml $pg.persistence.accessModes | nindent 10 }}
|
||||
{{- if $pg.persistence.storageClass }}
|
||||
storageClassName: {{ ternary "" $pg.persistence.storageClass (eq $pg.persistence.storageClass "-") | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ $pg.persistence.size }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,25 @@
|
||||
{{- $p := .Values.persistence }}
|
||||
{{- if and $p.enabled (not $p.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}-data
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# Uninstalling the release leaves the claim behind, since it may be the only copy of a Local Disk
|
||||
# or Git storage target.
|
||||
helm.sh/resource-policy: keep
|
||||
{{- with $p.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- toYaml $p.accessModes | nindent 4 }}
|
||||
{{- if $p.storageClass }}
|
||||
storageClassName: {{ ternary "" $p.storageClass (eq $p.storageClass "-") | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ $p.size }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,32 @@
|
||||
{{- $ext := .Values.externalDatabase }}
|
||||
{{- $useUrl := include "wiki.db.useUrl" . }}
|
||||
{{- $dbUrl := and $useUrl $ext.connectionString.value }}
|
||||
{{- $dbPassword := and (not .Values.postgresql.enabled) (not $useUrl) (not $ext.parameters.existingSecret) }}
|
||||
{{- $adminPassword := and .Values.admin.password (not .Values.admin.existingSecret) }}
|
||||
{{- if or $dbUrl $dbPassword }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}-db
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if $dbUrl }}
|
||||
url: {{ $ext.connectionString.value | b64enc | quote }}
|
||||
{{- else }}
|
||||
password: {{ $ext.parameters.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $adminPassword }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}-admin
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
password: {{ .Values.admin.password | b64enc | quote }}
|
||||
{{- end }}
|
||||
@ -0,0 +1,39 @@
|
||||
{{- $svc := .Values.service }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
{{- with $svc.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $svc.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ $svc.type }}
|
||||
{{- if and (eq $svc.type "LoadBalancer") $svc.loadBalancerClass }}
|
||||
loadBalancerClass: {{ $svc.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if and (eq $svc.type "LoadBalancer") $svc.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml $svc.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (has $svc.type (list "NodePort" "LoadBalancer")) $svc.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ $svc.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
{{- with $svc.sessionAffinity }}
|
||||
sessionAffinity: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ $svc.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- if and (has $svc.type (list "NodePort" "LoadBalancer")) $svc.nodePort }}
|
||||
nodePort: {{ $svc.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "wiki.selectorLabels" . | nindent 4 }}
|
||||
@ -0,0 +1,39 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}-test
|
||||
labels:
|
||||
{{- include "wiki.commonLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: test
|
||||
annotations:
|
||||
helm.sh/hook: test
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
automountServiceAccountToken: false
|
||||
enableServiceLinks: false
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 4 }}
|
||||
containers:
|
||||
# Asked through the Service, so that it tests the selector as well as the wiki.
|
||||
- name: ready
|
||||
image: {{ include "wiki.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- node
|
||||
- -e
|
||||
- |
|
||||
const url = 'http://{{ include "wiki.fullname" . }}:{{ .Values.service.port }}/_ready'
|
||||
fetch(url).then((res) => {
|
||||
console.info(`${url} → ${res.status}`)
|
||||
process.exit(res.ok ? 0 : 1)
|
||||
}, (err) => {
|
||||
console.error(`${url} → ${err.cause?.code ?? err.message}`)
|
||||
process.exit(1)
|
||||
})
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||
@ -0,0 +1,462 @@
|
||||
# Wiki.js 3.x
|
||||
#
|
||||
# Every key below is optional. With none of them set, the chart runs one wiki replica against a
|
||||
# bundled PostgreSQL 18, reachable inside the cluster only — turn on `ingress` or `httpRoute` to
|
||||
# expose it.
|
||||
|
||||
nameOverride: ''
|
||||
fullnameOverride: ''
|
||||
|
||||
image:
|
||||
repository: ghcr.io/requarks/wiki
|
||||
# Defaults to the chart's appVersion.
|
||||
tag: ''
|
||||
# Pins the image by digest (`sha256:…`), taking precedence over the tag.
|
||||
digest: ''
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
# Replicas share the database and find each other through it (LISTEN/NOTIFY), collaborative editing
|
||||
# included, so no sticky sessions are needed. Anything kept on the data volume is per replica unless
|
||||
# `persistence` points them all at one ReadWriteMany claim.
|
||||
replicaCount: 1
|
||||
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
# Deployment strategy. Leave empty for the default RollingUpdate; use `{ type: Recreate }` with a
|
||||
# single replica on a ReadWriteOnce `persistence` claim, which a second pod on another node could
|
||||
# not attach while the old one still holds it.
|
||||
strategy: {}
|
||||
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
# Wiki.js configuration
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
|
||||
# Rendered as the instance's config.yml. Any key the file accepts can be added here (see
|
||||
# config.sample.yml), except the ones the chart owns: `port`, `bindIP` and `dataPath` follow the
|
||||
# container, and `db` is built from `postgresql` / `externalDatabase` below.
|
||||
#
|
||||
# Everything else about the wiki is configured in its administration area and kept in the database.
|
||||
config:
|
||||
# error, warn, info or debug
|
||||
logLevel: info
|
||||
# default or json
|
||||
logFormat: default
|
||||
# Stops every outbound request the wiki would otherwise make (Iconify, update checks, …).
|
||||
offline: false
|
||||
# Largest API request body accepted, in bytes. File uploads are not bound by it.
|
||||
bodyParserLimit: 5242880
|
||||
icons:
|
||||
apiUrl: https://api.iconify.design
|
||||
scheduler:
|
||||
# Most worker threads for CPU-heavy background jobs. `auto` is one fewer than the CPUs the pod
|
||||
# may use: its `limits.cpu`, rounded down, or every core of the node when no limit is set.
|
||||
workers: auto
|
||||
|
||||
# The administrator account created the first time the wiki starts against an empty database. Never
|
||||
# read again afterwards. Left empty, the account is admin@example.com / 12345678 and must change its
|
||||
# password on first login.
|
||||
admin:
|
||||
email: ''
|
||||
password: ''
|
||||
# A Secret holding the password, in place of `password`.
|
||||
existingSecret: ''
|
||||
existingSecretPasswordKey: password
|
||||
|
||||
# Waits for the database port to open before the wiki starts. The wiki itself gives up after ~30s of
|
||||
# failed connections, which a bundled PostgreSQL initialising its data directory can outlast.
|
||||
waitForDatabase:
|
||||
enabled: true
|
||||
resources: {}
|
||||
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: bar
|
||||
|
||||
extraEnvFrom: []
|
||||
# - secretRef:
|
||||
# name: wiki-extra-env
|
||||
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
# Pod
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
# Generated from the release name when empty.
|
||||
name: ''
|
||||
annotations: {}
|
||||
# The wiki never talks to the Kubernetes API, so the pod gets no token unless asked for.
|
||||
automount: false
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# `readOnlyRootFilesystem` holds everything except installing an extension from Admin → Extensions,
|
||||
# which runs `npm install` inside the image. The image already carries Puppeteer, the extension that
|
||||
# needs it most; anything else would be added by building an image FROM this one.
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 250m
|
||||
# memory: 512Mi
|
||||
# limits:
|
||||
# memory: 2Gi
|
||||
|
||||
# The probes are merged with what is given here, so a single field can be overridden. To swap the
|
||||
# handler, null the default one out: `livenessProbe: { httpGet: null, exec: { … } }`.
|
||||
#
|
||||
# `/_live` answers only once the HTTP server is listening, which is after migrations have run — the
|
||||
# startup probe is what covers that, and allows 5 minutes by default.
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /_live
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 60
|
||||
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /_live
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
|
||||
# `/_ready` turns 503 as soon as a replica starts shutting down, while it goes on serving the requests
|
||||
# still reaching it until the endpoint removal has propagated.
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /_ready
|
||||
port: http
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
|
||||
# The pause before SIGTERM, so a replica being replaced is out of every load balancer before it stops
|
||||
# accepting connections.
|
||||
lifecycle:
|
||||
preStop:
|
||||
sleep:
|
||||
seconds: 5
|
||||
|
||||
terminationGracePeriodSeconds: 30
|
||||
|
||||
priorityClassName: ''
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# Added to the pod, next to the chart's own (config, data, tmp, home).
|
||||
volumes: []
|
||||
# - name: git-known-hosts
|
||||
# configMap:
|
||||
# name: git-known-hosts
|
||||
|
||||
# Added to the wiki container.
|
||||
volumeMounts: []
|
||||
# - name: git-known-hosts
|
||||
# mountPath: /home/node/.ssh/known_hosts
|
||||
# subPath: known_hosts
|
||||
# readOnly: true
|
||||
|
||||
# The wiki's data directory, /wiki/data. Holds the caches (icons, served files, blocks), which rebuild
|
||||
# themselves from the database, plus the default locations of the Local Disk (`data/content`) and Git
|
||||
# (`data/repo`) storage targets. An emptyDir is enough unless one of those two is in use.
|
||||
persistence:
|
||||
enabled: false
|
||||
# Use an existing claim instead of creating one.
|
||||
existingClaim: ''
|
||||
# `-` for the cluster's default class, empty to leave it unset.
|
||||
storageClass: ''
|
||||
# ReadWriteMany is what lets several replicas share one Local Disk or Git storage target.
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 10Gi
|
||||
annotations: {}
|
||||
# Caps the emptyDir used while persistence is off.
|
||||
sizeLimit: ''
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
minAvailable: 1
|
||||
# Used instead of `minAvailable` when set.
|
||||
maxUnavailable: ''
|
||||
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
# Networking
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
# For NodePort / LoadBalancer.
|
||||
nodePort: ''
|
||||
annotations: {}
|
||||
labels: {}
|
||||
loadBalancerClass: ''
|
||||
loadBalancerSourceRanges: []
|
||||
# Cluster or Local, for NodePort / LoadBalancer.
|
||||
externalTrafficPolicy: ''
|
||||
sessionAffinity: ''
|
||||
|
||||
# Behind either of these, turn on Admin → Security → Trust Proxy so the wiki sees the visitor's
|
||||
# address rather than the proxy's.
|
||||
|
||||
# Gateway API. The recommended way in; it needs a Gateway to attach to.
|
||||
httpRoute:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
parentRefs:
|
||||
- name: gateway
|
||||
# namespace: gateway-system
|
||||
# sectionName: https
|
||||
hostnames:
|
||||
- wiki.example.com
|
||||
# HTTPRoute rules, passed through as given (matches, filters, timeouts, …) except for `backendRefs`,
|
||||
# which the chart fills in with the wiki's Service.
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
# filters: []
|
||||
# timeouts:
|
||||
# request: 300s
|
||||
|
||||
# networking.k8s.io/v1 Ingress. Most controllers cap request bodies (ingress-nginx at 1m by default),
|
||||
# which is also the ceiling for uploads — raise it with the controller's own annotation.
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ''
|
||||
annotations: {}
|
||||
labels: {}
|
||||
hosts:
|
||||
- host: wiki.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls: []
|
||||
# - secretName: wiki-tls
|
||||
# hosts:
|
||||
# - wiki.example.com
|
||||
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
# Database
|
||||
# ---------------------------------------------------------------------------------------------------
|
||||
|
||||
# A PostgreSQL server of the chart's own: one StatefulSet replica, the official image. Turn it off to
|
||||
# use `externalDatabase` instead.
|
||||
postgresql:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
repository: docker.io/library/postgres
|
||||
# Pin a minor release (e.g. `18.4`) for reproducible upgrades. Moving to a new MAJOR needs a
|
||||
# dump and restore, as it would anywhere — the data directory is per major.
|
||||
tag: '18'
|
||||
digest: ''
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# The wiki connects as `username`, an ordinary role owning `database`; the `postgres` superuser is
|
||||
# kept for administration and never handed to the wiki. Both passwords are generated and kept across
|
||||
# upgrades when left empty — except under a tool that renders without cluster access (Argo CD), which
|
||||
# would generate new ones on every sync: set them, or use `existingSecret`, there.
|
||||
#
|
||||
# All of this is applied when the data directory is first initialised. Changing it afterwards
|
||||
# changes what the wiki is told, not the database: alter the role by hand to match.
|
||||
auth:
|
||||
username: wiki
|
||||
database: wiki
|
||||
password: ''
|
||||
postgresPassword: ''
|
||||
existingSecret: ''
|
||||
secretKeys:
|
||||
userPasswordKey: password
|
||||
adminPasswordKey: postgres-password
|
||||
|
||||
# The schema the wiki creates its tables in.
|
||||
schema: wiki
|
||||
|
||||
# Server settings, passed as `-c key=value`.
|
||||
parameters: {}
|
||||
# max_connections: 200
|
||||
# shared_buffers: 256MB
|
||||
|
||||
extraArgs: []
|
||||
|
||||
# Extra arguments for `initdb`, used on first start only.
|
||||
initdbArgs: ''
|
||||
|
||||
# Scripts run once, after the data directory is initialised and the wiki's role and database exist,
|
||||
# in file name order. `.sh`, `.sql` and `.sql.gz` are understood.
|
||||
initdbScripts: {}
|
||||
# 10-extensions.sql: |
|
||||
# \connect wiki
|
||||
# CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
||||
|
||||
extraEnv: []
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
# 999 is the `postgres` user of the official Debian image (70 on -alpine tags).
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
runAsGroup: 999
|
||||
fsGroup: 999
|
||||
# Anything else lets the kubelet re-own the data directory on every start, with group write,
|
||||
# which PostgreSQL refuses to start on.
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
runAsGroup: 999
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 250m
|
||||
# memory: 256Mi
|
||||
# limits:
|
||||
# memory: 1Gi
|
||||
|
||||
startupProbe:
|
||||
exec:
|
||||
command: ['pg_isready', '-h', '127.0.0.1', '-p', '5432']
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 60
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ['pg_isready', '-h', '127.0.0.1', '-p', '5432']
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ['pg_isready', '-h', '127.0.0.1', '-p', '5432']
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
|
||||
# A shutdown checkpoint on a busy server takes a while; SIGKILL before it finishes means crash
|
||||
# recovery on the next start.
|
||||
terminationGracePeriodSeconds: 60
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
priorityClassName: ''
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
volumes: []
|
||||
volumeMounts: []
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: ''
|
||||
# `-` for the cluster's default class, empty to leave it unset.
|
||||
storageClass: ''
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 8Gi
|
||||
annotations: {}
|
||||
# What happens to the claim when the StatefulSet is deleted or scaled down.
|
||||
retentionPolicy:
|
||||
whenDeleted: Retain
|
||||
whenScaled: Retain
|
||||
|
||||
# /dev/shm, which parallel queries use for shared memory; a container's default is 64 MiB. Counted
|
||||
# against the pod's memory.
|
||||
shm:
|
||||
enabled: true
|
||||
sizeLimit: 256Mi
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 5432
|
||||
annotations: {}
|
||||
labels: {}
|
||||
|
||||
# An existing PostgreSQL 16+ server, used when `postgresql.enabled` is false. The user needs to own the
|
||||
# database, or at least be able to create a schema in it.
|
||||
#
|
||||
# Say where it is in ONE of two ways — `connectionString` or `parameters` — and leave the other empty.
|
||||
# `schema` and `ssl` apply to both.
|
||||
externalDatabase:
|
||||
# ── Option 1: a connection string ───────────────────────────────────────────────────────────────
|
||||
# `postgresql://user:password@host:5432/database`, with special characters in the password
|
||||
# percent-encoded as in any URL. Give it inline or, better, as a Secret: CloudNativePG's
|
||||
# `<cluster>-app` Secret carries one under `uri`.
|
||||
#
|
||||
# TLS parameters in the string (`sslmode`, `sslrootcert`, …) replace everything under `ssl` below.
|
||||
# CloudNativePG's has none, so pair it with `ssl` and the `<cluster>-ca` Secret to verify the server.
|
||||
connectionString:
|
||||
value: ''
|
||||
existingSecret: ''
|
||||
existingSecretKey: uri
|
||||
|
||||
# ── Option 2: individual parameters ─────────────────────────────────────────────────────────────
|
||||
parameters:
|
||||
host: ''
|
||||
port: 5432
|
||||
database: wiki
|
||||
user: wiki
|
||||
password: ''
|
||||
# A Secret holding the password, in place of `password`.
|
||||
existingSecret: ''
|
||||
existingSecretPasswordKey: password
|
||||
|
||||
# ── Either way ──────────────────────────────────────────────────────────────────────────────────
|
||||
# The schema the wiki creates its tables in.
|
||||
schema: wiki
|
||||
ssl:
|
||||
enabled: false
|
||||
# Verify the server's certificate. Only for testing when off.
|
||||
rejectUnauthorized: true
|
||||
# A Secret with the CA to verify against and, for client certificate authentication, a
|
||||
# certificate and key. Without one, the system CAs are used.
|
||||
existingSecret: ''
|
||||
caKey: ca.crt
|
||||
# Both empty unless the server asks for a client certificate.
|
||||
certKey: ''
|
||||
keyKey: ''
|
||||
@ -1,23 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@ -1,6 +0,0 @@
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 8.10.14
|
||||
digest: sha256:db7c1e0bc9ec0ed45520521bd76bb390d04711fd0f04affaadafa1dc498ce68b
|
||||
generated: "2020-07-21T20:34:41.41180748-04:00"
|
||||
@ -1,42 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: wiki
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
version: 2.2.0
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application.
|
||||
AppVersion: latest
|
||||
description: The most powerful and extensible open source Wiki software.
|
||||
keywords:
|
||||
- wiki
|
||||
- documentation
|
||||
- knowledge base
|
||||
- docs
|
||||
- reference
|
||||
- editor
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
version: 8.10.14
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
condition: postgresql.enabled
|
||||
home: https://wiki.js.org
|
||||
icon: https://cdn.js.wiki/images/wikijs-butterfly.svg
|
||||
sources:
|
||||
- https://github.com/Requarks/wiki
|
||||
maintainers:
|
||||
- name: Nicolas Giard
|
||||
email: github@ngpixel.com
|
||||
url: https://github.com/NGPixel
|
||||
- name: James Greenhill
|
||||
email: james@fuziontech.net
|
||||
url: https://github.com/fuziontech
|
||||
engine: gotpl
|
||||
@ -1,177 +0,0 @@
|
||||
<div align="center">
|
||||
|
||||
<img src="https://static.requarks.io/logo/wikijs-full.svg" alt="Wiki.js" width="600" />
|
||||
|
||||
[](https://github.com/Requarks/wiki/releases)
|
||||
[](https://github.com/requarks/wiki/blob/master/LICENSE)
|
||||
[](http://standardjs.com/)
|
||||
[](https://github.com/Requarks/wiki/releases)
|
||||
[](https://hub.docker.com/r/requarks/wiki/)
|
||||
[](https://github.com/Requarks/wiki/actions/workflows/build.yml)
|
||||
[](https://huntr.dev/bounties/disclose)
|
||||
[](https://github.com/users/NGPixel/sponsorship)
|
||||
[](https://opencollective.com/wikijs)
|
||||
[](https://wiki.requarks.io/slack)
|
||||
[](https://twitter.com/requarks)
|
||||
[](https://www.reddit.com/r/wikijs/)
|
||||
[](https://blog.js.wiki/subscribe)
|
||||
|
||||
##### A modern, lightweight and powerful wiki app built on NodeJS
|
||||
|
||||
</div>
|
||||
|
||||
- **[Official Website](https://wiki.js.org/)**
|
||||
- **[Documentation](https://docs.requarks.io/)**
|
||||
|
||||
<h2 align="center">Donate</h2>
|
||||
|
||||
<div align="center">
|
||||
|
||||
Wiki.js is an open source project that has been made possible due to the generous contributions by community [backers](https://wiki.js.org/about). If you are interested in supporting this project, please consider [becoming a sponsor](https://github.com/users/NGPixel/sponsorship), [becoming a patron](https://www.patreon.com/requarks), donating to our [OpenCollective](https://opencollective.com/wikijs), via [Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=FLV5X255Z9CJU&source=url) or via Ethereum (`0xe1d55c19ae86f6bcbfb17e7f06ace96bdbb22cb5`).
|
||||
|
||||
[](https://github.com/users/NGPixel/sponsorship)
|
||||
[](https://www.patreon.com/requarks)
|
||||
[](https://opencollective.com/wikijs)
|
||||
[](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=FLV5X255Z9CJU&source=url)
|
||||
[](https://etherscan.io/address/0xe1d55c19ae86f6bcbfb17e7f06ace96bdbb22cb5)
|
||||
[](https://checkout.opennode.com/p/2553c612-f863-4407-82b3-1a7685268747)
|
||||
[](https://wikijs.threadless.com)
|
||||
|
||||
</div>
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a Wiki.js deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
It also optionally packages the [PostgreSQL](https://github.com/kubernetes/charts/tree/master/stable/postgresql) as the database but you are free to bring your own.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- PV provisioner support in the underlying infrastructure (with persistence storage enabled) if you want data persistance
|
||||
|
||||
## Adding the Wiki.js Helm Repository
|
||||
|
||||
```console
|
||||
$ helm repo add requarks https://charts.js.wiki
|
||||
```
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release` run the following:
|
||||
|
||||
### Using Helm 3:
|
||||
```console
|
||||
$ helm install my-release requarks/wiki
|
||||
```
|
||||
### Using Helm 2:
|
||||
```console
|
||||
$ helm install --name my-release requarks/wiki
|
||||
```
|
||||
|
||||
The command deploys Wiki.js on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
> **Warning**: Persistant Volume Claims for the database are not deleted automatically. They need to be manually deleted
|
||||
|
||||
```console
|
||||
$ kubectl delete pvc/data-wiki-postgresql-0
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the Wiki.js chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| ------------------------------- | ------------------------------- | ---------------------------------------------------------- |
|
||||
| `image.repository` | Wiki.js image | `requarks/wiki` |
|
||||
| `image.tag` | Wiki.js image tag | `latest` |
|
||||
| `imagePullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `replicacount` | Amount of wiki.js service pods to run | `1` |
|
||||
| `revisionHistoryLimit` | Total amount of revision history points | `10` |
|
||||
| `resources.limits` | wiki.js service resource limits | `nil` |
|
||||
| `resources.requests` | wiki.js service resource requests | `nil` |
|
||||
| `nodeSelector` | Node labels for wiki.js pod assignment | `{}` |
|
||||
| `affinity` | Affinity settings for wiki.js pod assignment | `{}` |
|
||||
| `schedulerName` | Name of an alternate scheduler for wiki.js pod | `nil` |
|
||||
| `tolerations` | Toleration labels for wiki.jsk pod assignment | `[]` |
|
||||
| `volumeMounts` | Volume mounts for Wiki.js container | `[]` |
|
||||
| `volumes` | Volumes for Wiki.js Pod | `[]` |
|
||||
| `ingress.enabled` | Enable ingress controller resource | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.annotations` | Ingress annotations | `{}` |
|
||||
| `ingress.hosts` | List of ingress rules | `[{"host": "wiki.local", "paths": ["/"]}]` |
|
||||
| `ingress.tls` | Ingress TLS configuration | `[]` |
|
||||
| `sideload.enabled` | Enable sideloading of locale files from git | `false` |
|
||||
| `sideload.repoURL` | Git repository URL containing locale files | `https://github.com/Requarks/wiki-localization` |
|
||||
| `sideload.env` | Environment variables for sideload Container | `{}` |
|
||||
| `postgresql.enabled` | Deploy postgres server (see below) | `true` |
|
||||
| `postgresql.postgresqlDatabase` | Postgres database name | `wiki` |
|
||||
| `postgresql.postgresqlUser` | Postgres username | `postgres` |
|
||||
| `postgresql.postgresqlHost` | External postgres host | `nil` |
|
||||
| `postgresql.postgresqlPassword` | External postgres password | `nil` |
|
||||
| `postgresql.existingSecret` | Provide an existing `Secret` for postgres | `nil` |
|
||||
| `postgresql.existingSecretKey` | The postgres password key in the existing `Secret` | `postgresql-password` |
|
||||
| `postgresql.postgresqlPort` | External postgres port | `5432` |
|
||||
| `postgresql.ssl` | Enable external postgres SSL connection | `false` |
|
||||
| `postgresql.ca` | Certificate of Authority content for postgres | `nil` |
|
||||
| `postgresql.persistence.enabled` | Enable postgres persistence using PVC | `true` |
|
||||
| `postgresql.persistence.existingClaim` | Provide an existing `PersistentVolumeClaim` for postgres | `nil` |
|
||||
| `postgresql.persistence.storageClass` | Postgres PVC Storage Class (example: `nfs`) | `nil` |
|
||||
| `postgresql.persistence.size` | Postgers PVC Storage Request | `8Gi` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release \
|
||||
--set postgresql.persistence.enabled=false \
|
||||
requarks/wiki
|
||||
```
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release -f values.yaml requarks/wiki
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
|
||||
## PostgresSQL
|
||||
|
||||
By default, PostgreSQL is installed as part of the chart.
|
||||
|
||||
### Using an external PostgreSQL server
|
||||
|
||||
To use an external PostgreSQL server, set `postgresql.enabled` to `false` and then set `postgresql.postgresqlHost` and `postgresql.postgresqlPassword`. To use an existing `Secret`, set `postgresql.existingSecret`. The other options (`postgresql.postgresqlDatabase`, `postgresql.postgresqlUser`, `postgresql.postgresqlPort` and `postgresql.existingSecretKey`) may also want changing from their default values.
|
||||
|
||||
To use an SSL connection you can set `postgresql.ssl` to `true` and if needed the path to a Certificate of Authority can be set using `postgresql.ca` to `/path/to/ca`. Default `postgresql.ssl` value is `false`.
|
||||
|
||||
If `postgresql.existingSecret` is not specified, you also need to add the following Helm template to your deployment in order to create the postgresql `Secret`:
|
||||
|
||||
```yaml
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ template "wiki.postgresql.secret" . }}
|
||||
data:
|
||||
{{ template "wiki.postgresql.secretKey" . }}: "{{ .Values.postgresql.postgresqlPassword | b64enc }}"
|
||||
```
|
||||
|
||||
## Persistence
|
||||
|
||||
Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube.
|
||||
See the [Configuration](#configuration) section to configure the PVC or to disable persistence.
|
||||
|
||||
## Ingress
|
||||
|
||||
This chart provides support for Ingress resource. If you have an available Ingress Controller such as Nginx or Traefik you maybe want to set `ingress.enabled` to true and add `ingress.hosts` for the URL. Then, you should be able to access the installation using that address.
|
||||
Binary file not shown.
@ -1,21 +0,0 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "wiki.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "wiki.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "wiki.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "wiki.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
|
||||
{{- end }}
|
||||
@ -1,108 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "wiki.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "wiki.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "wiki.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "wiki.labels" -}}
|
||||
helm.sh/chart: {{ include "wiki.chart" . }}
|
||||
{{ include "wiki.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "wiki.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "wiki.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "wiki.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "wiki.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "wiki.postgresql.fullname" -}}
|
||||
{{- if .Values.postgresql.fullnameOverride -}}
|
||||
{{- .Values.postgresql.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{ printf "%s-%s" .Release.Name "postgresql"}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set postgres host
|
||||
*/}}
|
||||
{{- define "wiki.postgresql.host" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- template "wiki.postgresql.fullname" . -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.postgresqlHost | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set postgres secret
|
||||
*/}}
|
||||
{{- define "wiki.postgresql.secret" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- template "wiki.postgresql.fullname" . -}}
|
||||
{{- else -}}
|
||||
{{- template "wiki.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Set postgres secretKey
|
||||
*/}}
|
||||
{{- define "wiki.postgresql.secretKey" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
"postgresql-password"
|
||||
{{- else -}}
|
||||
{{- default "postgresql-password" .Values.postgresql.existingSecretKey | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -1,96 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "wiki.fullname" . }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "wiki.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "wiki.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "wiki.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.sideload.enabled }}
|
||||
initContainers:
|
||||
- name: {{ .Chart.Name }}-sideload
|
||||
image: "{{ .Values.image.repository }}:{{ default "latest" .Values.image.tag }}"
|
||||
imagePullPolicy: {{ default "IfNotPresent" .Values.image.imagePullPolicy }}
|
||||
env:
|
||||
{{- toYaml .Values.sideload.env | nindent 12 }}
|
||||
command: [ "sh", "-c" ]
|
||||
args: [ "mkdir -p /wiki/data/sideload && git clone --depth=1 {{ .Values.sideload.repoURL }} /wiki/data/sideload/" ]
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ default "latest" .Values.image.tag }}"
|
||||
imagePullPolicy: {{ default "IfNotPresent" .Values.image.imagePullPolicy }}
|
||||
env:
|
||||
- name: DB_TYPE
|
||||
value: postgres
|
||||
- name: DB_HOST
|
||||
value: {{ template "wiki.postgresql.host" . }}
|
||||
- name: DB_PORT
|
||||
value: "{{ default "5432" .Values.postgresql.postgresqlPort }}"
|
||||
- name: DB_NAME
|
||||
value: {{ default "wiki" .Values.postgresql.postgresqlDatabase }}
|
||||
- name: DB_USER
|
||||
value: {{ default "wiki" .Values.postgresql.postgresqlUser }}
|
||||
- name: DB_SSL
|
||||
value: "{{ default "false" .Values.postgresql.ssl }}"
|
||||
- name: DB_SSL_CA
|
||||
value: "{{ default "" .Values.postgresql.ca }}"
|
||||
- name: DB_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
{{- if .Values.postgresql.existingSecret }}
|
||||
name: {{ .Values.postgresql.existingSecret }}
|
||||
{{- else }}
|
||||
name: {{ template "wiki.postgresql.secret" . }}
|
||||
{{- end }}
|
||||
key: {{ template "wiki.postgresql.secretKey" . }}
|
||||
- name: HA_ACTIVE
|
||||
value: {{ .Values.replicaCount | int | le 2 | quote }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
readinessProbe:
|
||||
{{- toYaml .Values.readinessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,61 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "wiki.fullname" . -}}
|
||||
{{- $svcPort := .Values.service.port -}}
|
||||
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
||||
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
|
||||
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
{{- end }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
|
||||
pathType: {{ .pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $svcPort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $svcPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,23 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{include "wiki.fullname" .}}
|
||||
labels: {{- include "wiki.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{.Values.service.type}}
|
||||
ports:
|
||||
- port: {{ default "80" .Values.service.port}}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: {{ default "443" .Values.service.httpsPort}}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: https
|
||||
selector: {{- include "wiki.selectorLabels" . | nindent 4}}
|
||||
@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "wiki.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "wiki.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "wiki.fullname" . }}:{{ .Values.service.port }}']
|
||||
restartPolicy: Never
|
||||
@ -1,163 +0,0 @@
|
||||
# Default values for wiki.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
image:
|
||||
repository: requarks/wiki
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
# Annotations applied for services such as externalDNS or
|
||||
# service type LoadBalancer
|
||||
# type: LoadBalancer
|
||||
# httpsPort: 443
|
||||
# annotations: {}
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: ""
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
hosts:
|
||||
- host: wiki.minikube.local
|
||||
paths:
|
||||
- path: "/"
|
||||
pathType: Prefix
|
||||
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
volumeMounts: []
|
||||
|
||||
volumes: []
|
||||
|
||||
# This will allow us to install locales even without internet access using a initContainer & wikjs "sideloading"
|
||||
sideload:
|
||||
enabled: false
|
||||
# Git-Repo containing all locales.json-files you need:
|
||||
repoURL: https://github.com/Requarks/wiki-localization
|
||||
|
||||
## This can be helpfull if you have internet access over a http proxy:
|
||||
env: []
|
||||
# - name: HTTPS_PROXY
|
||||
# value: http://my.proxy.com:3128
|
||||
|
||||
## Configuration values for the postgresql dependency.
|
||||
## ref: https://github.com/kubernetes/charts/blob/master/stable/postgresql/README.md
|
||||
##
|
||||
postgresql:
|
||||
## Use the PostgreSQL chart dependency.
|
||||
## Set to false if bringing your own PostgreSQL, and set secret value postgresql-uri.
|
||||
##
|
||||
enabled: true
|
||||
## ssl enforce SSL communication with PostgresSQL
|
||||
## Default to false
|
||||
##
|
||||
# ssl: false
|
||||
## ca Certificate of Authority
|
||||
## Default to empty, point to location of CA
|
||||
##
|
||||
# ca: "path to ca"
|
||||
## postgresqlHost override postgres database host
|
||||
## Default to postgres
|
||||
##
|
||||
# postgresqlHost: postgres
|
||||
## postgresqlPort port for postgres
|
||||
## Default to 5432
|
||||
##
|
||||
# postgresqlPort: 5432
|
||||
## PostgreSQL fullname Override
|
||||
## Default to wiki-postgresql unless fullname override is set for Chart
|
||||
##
|
||||
fullnameOverride: ""
|
||||
## PostgreSQL User to create.
|
||||
##
|
||||
postgresqlUser: postgres
|
||||
## PostgreSQL Database to create.
|
||||
##
|
||||
postgresqlDatabase: wiki
|
||||
## Persistent Volume Storage configuration.
|
||||
## ref: https://kubernetes.io/docs/user-guide/persistent-volumes
|
||||
##
|
||||
replication:
|
||||
## Enable PostgreSQL replication (primary/secondary)
|
||||
##
|
||||
enabled: false
|
||||
persistence:
|
||||
## Enable PostgreSQL persistence using Persistent Volume Claims.
|
||||
##
|
||||
enabled: true
|
||||
## concourse data Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
# storageClass: "-"
|
||||
## Persistent Volume Access Mode.
|
||||
##
|
||||
accessMode: ReadWriteOnce
|
||||
## Persistent Volume Storage Size.
|
||||
##
|
||||
size: 8Gi
|
||||
Loading…
Reference in new issue