Merge pull request #34 from truenas/minio-tls

Add support for TLS in minio chart

features_capability.json

@@ -22,5 +22,13 @@
   "definitions/nodeIP": {
     "stable": {"min":  "20.12-ALPHA"},
     "nightlies": {"min":  "20.12-MASTER"}
+  },
+  "definitions/certificate": {
+    "stable": {"min": "21.02-ALPHA"},
+    "nightlies": {"min": "21.02-MASTER"}
+  },
+  "definitions/certificateAuthority": {
+    "stable": {"min": "21.02-ALPHA"},
+    "nightlies": {"min": "21.02-MASTER"}
   }
-}
+}

library/common/2101.0.0/templates/lib/resources/_certs.tpl

@@ -0,0 +1,26 @@
+{{/*
+Retrieve true/false if certificate is available in ixCertificates
+*/}}
+{{- define "common.resources.cert_present" -}}
+{{- $values := . -}}
+{{- include "common.schema.validateKeys" (dict "values" . "checkKeys" (list "commonCertOptions")) -}}
+{{- hasKey $values.Values.ixCertificates ($values.commonCertOptions.certKeyName | toString) -}}
+{{- end -}}
+
+
+{{/*
+Retrieve certificate from variable name
+*/}}
+{{- define "common.resources.cert" -}}
+{{- $values := . -}}
+{{- include "common.schema.validateKeys" (dict "values" . "checkKeys" (list "commonCertOptions")) -}}
+{{- $certKey := ($values.commonCertOptions.certKeyName | toString) -}}
+{{- if hasKey $values.Values.ixCertificates $certKey -}}
+{{- $cert := get $values.Values.ixCertificates $certKey -}}
+{{- if $values.commonCertOptions.publicKey -}}
+{{ $cert.certificate }}
+{{- else -}}
+{{ $cert.privatekey }}
+{{- end -}}
+{{- end -}}
+{{- end -}}

test/minio/1.2.0/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+# OWNERS file for Kubernetes
+OWNERS

test/minio/1.2.0/Chart.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+description: High Performance, Kubernetes Native Object Storage
+name: minio
+version: 1.2.0
+appVersion: master
+keywords:
+- storage
+- object-storage
+- S3
+home: https://min.io
+icon: https://min.io/resources/img/logo/MINIO_wordmark.png
+sources:
+- https://github.com/minio/minio
+- https://github.com/minio/charts
+upstream_version: 8.0.5
+dependencies:
+  - name: common
+    repository: file://../../../library/common/2101.0.0
+    version: 2101.0.0

test/minio/1.2.0/README.md

@@ -0,0 +1,48 @@
+MinIO
+=====
+
+[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.
+
+MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server.
+
+For more detailed documentation please visit [here](https://docs.minio.io/)
+
+Introduction
+------------
+
+This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+
+Configuration
+-------------
+
+The following table lists the configurable parameters of the MinIO chart and their default values.
+
+| Parameter                                        | Description                                                                                                                             | Default                          |
+|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------|
+| `image.repository`                               | Image repository                                                                                                                        | `minio/minio`                    |
+| `image.tag`                                      | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/).                                             | `RELEASE.2020-11-06T23-17-07Z`   |
+| `image.pullPolicy`                               | Image pull policy                                                                                                                       | `IfNotPresent`                   |
+| `extraArgs`                                      | Additional command line arguments to pass to the MinIO server                                                                           | `[]`                             |
+| `accessKey`                                      | Default access key (5 to 20 characters)                                                                                                 | random 20 chars                  |
+| `secretKey`                                      | Default secret key (8 to 40 characters)                                                                                                 | random 40 chars                  |
+| `persistence.enabled`                            | Use persistent volume to store data                                                                                                     | `true`                           |
+| `persistence.size`                               | Size of persistent volume claim                                                                                                         | `500Gi`                          |
+| `persistence.existingClaim`                      | Use an existing PVC to persist data                                                                                                     | `nil`                            |
+| `persistence.storageClass`                       | Storage class name of PVC                                                                                                               | `nil`                            |
+| `persistence.accessMode`                         | ReadWriteOnce or ReadOnly                                                                                                               | `ReadWriteOnce`                  |
+| `persistence.subPath`                            | Mount a sub directory of the persistent volume if set                                                                                   | `""`                             |
+| `environment`                                    | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` |
+
+Some parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/).
+
+Pass environment variables to MinIO containers
+----------------------------------------------
+
+To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format
+
+```bash
+$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio
+```
+
+You can add as many environment variables as required, using the above format. Just add `environment.<VARIABLE_NAME>=<value>` under `set` flag.

test/minio/1.2.0/app-readme.md

@@ -0,0 +1 @@
+[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.

test/minio/1.2.0/default_values.yaml

@@ -0,0 +1,22 @@
+## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
+##
+image:
+  repository: minio/minio
+  tag: RELEASE.2020-11-19T23-48-16Z
+  pullPolicy: IfNotPresent
+
+## Additional arguments to pass to minio binary
+extraArgs: []
+
+updateStrategy: RollingUpdate
+
+service:
+  nodePort: 9000
+
+environment:
+  ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html
+
+appVolumeMounts:
+  export:
+    emptyDir: true
+    mountPath: "/export"

test/minio/1.2.0/migrations/migrate

@@ -0,0 +1,28 @@
+#!/usr/bin/python3
+import json
+import os
+import sys
+
+
+def migrate(values):
+    if values.get('appVolumeMounts'):
+        return values
+
+    values.update({
+        'appVolumeMounts': {
+            'export': {
+                'hostPathEnabled': values['minioHostPathEnabled'],
+                **({'hostPath': values['minioHostPath']} if values.get('minioHostPath') else {})
+            },
+        },
+    })
+    return values
+
+
+if __name__ == '__main__':
+    if len(sys.argv) != 2:
+        exit(1)
+
+    if os.path.exists(sys.argv[1]):
+        with open(sys.argv[1], 'r') as f:
+            print(json.dumps(migrate(json.loads(f.read()))))

test/minio/1.2.0/questions.yaml

@@ -0,0 +1,190 @@
+groups:
+  - name: "Container Images"
+    description: "Image to be used for container"
+  - name: "Workload Configuration"
+    description: "Configure workload deployment"
+  - name: "Storage"
+    description: "Configure Storage for Nextcloud"
+  - name: "Minio Configuration"
+    description: "Configure Minio credentials"
+
+portals:
+  web_portal:
+    protocols:
+      - "$kubernetes-resource_configmap_minio-config_protocol"
+    host:
+      - "$node_ip"
+    ports:
+      - "$variable-service.nodePort"
+
+questions:
+  # Image related
+  - variable: image
+    description: "Docker Image Details"
+    label: "Docker Image"
+    group: "Container Images"
+    schema:
+      type: dict
+      required: true
+      attrs:
+        - variable: repository
+          description: "Docker image repository"
+          label: "Image repository"
+          schema:
+            type: string
+            default: "minio/minio"
+            required: true
+        - variable: tag
+          description: "Tag to use for specified image"
+          label: "Image Tag"
+          schema:
+            type: string
+            default: "RELEASE.2020-11-19T23-48-16Z"
+        - variable: pullPolicy
+          description: "Docker Image Pull Policy"
+          label: "Image Pull Policy"
+          schema:
+            type: string
+            default: "IfNotPresent"
+            enum:
+              - value: "IfNotPresent"
+                description: "Only pull image if not present on host"
+              - value: "Always"
+                description: "Always pull image even if present on host"
+              - value: "Never"
+                description: "Never pull image even if it's not present on host"
+
+  - variable: updateStrategy
+    label: "Minio update strategy"
+    group: "Workload Configuration"
+    schema:
+      type: string
+      default: "RollingUpdate"
+      enum:
+        - value: "RollingUpdate"
+          description: "Create new pods and then kill old ones"
+        - value: "Recreate"
+          description: "Kill existing pods before creating new ones"
+
+  - variable: extraArgs
+    label: "Minio Extra Arguments"
+    group: "Minio Configuration"
+    schema:
+      type: list
+      default: []
+      items:
+        - variable: arg
+          label: "Argument"
+          schema:
+            type: string
+
+  - variable: accessKey
+    label: "Access Key"
+    group: "Minio Configuration"
+    description: "Enter the S3 access ID"
+    schema:
+      type: string
+      private: true
+      required: true
+      min_length: 5
+      max_length: 20
+
+  - variable: secretKey
+    label: "Secret Key"
+    group: "Minio Configuration"
+    description: "Enter the S3 secret access key"
+    schema:
+      type: string
+      private: true
+      required: true
+      min_length: 8
+      max_length: 40
+
+  - variable: environmentVariables
+    label: "Minio image environment"
+    group: "Minio Configuration"
+    schema:
+      type: list
+      default: []
+      items:
+        - variable: environmentVariable
+          label: "Environment Variable"
+          schema:
+            type: dict
+            attrs:
+              - variable: name
+                label: "Name"
+                schema:
+                  type: string
+              - variable: value
+                label: "Value"
+                schema:
+                  type: string
+
+  - variable: service
+    description: "Minio Service Configuration"
+    label: "Minio Service Configuration"
+    group: "Minio Configuration"
+    schema:
+      type: dict
+      required: true
+      attrs:
+        - variable: nodePort
+          label: "Node Port to use for Minio"
+          schema:
+            type: int
+            min: 9000
+            max: 65535
+            default: 9000
+            required: true
+
+  - variable: certificate
+    description: "Minio Certificate"
+    label: "Minio Certificate"
+    group: "Minio Configuration"
+    schema:
+      type: int
+      $ref:
+        - "definitions/certificate"
+
+  - variable: appVolumeMounts
+    label: "Minio Storage"
+    group: "Storage"
+    schema:
+      type: dict
+      attrs:
+        - variable: export
+          label: "Data Volume"
+          schema:
+            type: dict
+            attrs:
+              - variable: datasetName
+                label: "Minio Data Volume Name"
+                schema:
+                  type: string
+                  hidden: true
+                  $ref:
+                    - "normalize/ixVolume"
+                  show_if: [["hostPathEnabled", "=", false]]
+                  default: "ix-minio"
+                  editable: false
+              - variable: mountPath
+                label: "Minio Data Mount Path"
+                description: "Path where the volume will be mounted inside the pod"
+                schema:
+                  type: path
+                  hidden: true
+                  editable: false
+                  default: "/export"
+              - variable: hostPathEnabled
+                label: "Enable Host Path for Minio Data Volume"
+                schema:
+                  type: boolean
+                  default: false
+                  show_subquestions_if: true
+                  subquestions:
+                    - variable: hostPath
+                      label: "Host Path for Minio Data Volume"
+                      schema:
+                        type: hostpath
+                        required: true

test/minio/1.2.0/requirements.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: file://../../../library/common/2101.0.0
+  version: 2101.0.0
+digest: sha256:6ab46f958de11ae6a24d8f7e18417aa9852a8d968d5b0cc94ffa4700449931d6
+generated: "2021-02-04T01:15:55.416388+05:00"

test/minio/1.2.0/templates/NOTES.txt

@@ -0,0 +1,2 @@
+Minio can be accessed from the following URL:
+http://$node_ip:{{ .Values.service.nodePort }}/

test/minio/1.2.0/templates/_cert.tpl

@@ -0,0 +1,33 @@
+{{/*
+Formats volumeMount for Minio tls keys and trusted certs
+*/}}
+{{- define "minio.tlsKeysVolumeMount" -}}
+{{- if eq (include "minio.certAvailable" .) "true" -}}
+- name: cert-secret-volume
+  mountPath: "/etc/minio/certs"
+- name: trusted-cert-secret-volume
+  mountPath: "/etc/minio/certs/CAs"
+{{- end }}
+{{- end -}}
+
+{{/*
+Formats volume for Minio tls keys and trusted certs
+*/}}
+{{- define "minio.tlsKeysVolume" -}}
+{{- if eq (include "minio.certAvailable" .) "true" -}}
+- name: cert-secret-volume
+  secret:
+    secretName: {{ include "minio.secretName" . }}
+    items:
+    - key: certPublicKey
+      path: public.crt
+    - key: certPrivateKey
+      path: private.key
+- name: trusted-cert-secret-volume
+  secret:
+    secretName: {{ include "minio.secretName" . }}
+    items:
+    - key: certPublicKey
+      path: public.crt
+{{- end }}
+{{- end -}}

test/minio/1.2.0/templates/_helpers.tpl

@@ -0,0 +1,40 @@
+{{/*
+Determine secret name.
+*/}}
+{{- define "minio.secretName" -}}
+{{- include "common.names.fullname" . -}}
+{{- end -}}
+
+
+{{/*
+Retrieve true/false if minio certificate is configured
+*/}}
+{{- define "minio.certAvailable" -}}
+{{- if .Values.certificate -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}}
+{{- template "common.resources.cert_present" $values -}}
+{{- else -}}
+{{- false -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Retrieve public key of minio certificate
+*/}}
+{{- define "minio.cert.publicKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate "publicKey" true) -}}
+{{ include "common.resources.cert" $values }}
+{{- end -}}
+
+
+{{/*
+Retrieve private key of minio certificate
+*/}}
+{{- define "minio.cert.privateKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}}
+{{ include "common.resources.cert" $values }}
+{{- end -}}

test/minio/1.2.0/templates/configmap.yaml

@@ -0,0 +1,10 @@
+{{ $scheme := "http" }}
+{{ if eq (include "minio.certAvailable" .) "true" }}
+{{ $scheme = "https" }}
+{{ end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: minio-config
+data:
+  protocol: {{ $scheme }}

test/minio/1.2.0/templates/deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: {{ template "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  labels:
+    app: {{ template "common.names.name" . }}
+    chart: {{ template "common.names.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ (default 1 .Values.replicas) }}
+  strategy:
+    type: {{ (default "Recreate" .Values.updateStrategy ) }}
+  selector:
+    matchLabels:
+      app: {{ template "common.names.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      name: {{ template "common.names.fullname" . }}
+      labels:
+        app: {{ template "common.names.name" . }}
+        release: {{ .Release.Name }}
+        {{- include "common.labels.selectorLabels" . | nindent 8 }}
+      annotations: {{ include "common.annotations" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "common.names.serviceAccountName" . | quote }}
+      containers:
+        - name: {{ .Chart.Name }}
+          {{ include "common.containers.imageConfig" .Values.image | nindent 10 }}
+          volumeMounts: {{ include "common.storage.configureAppVolumeMountsInContainer" .Values | nindent 12 }}
+          {{- include "minio.tlsKeysVolumeMount" . | nindent 12 }}
+          command:
+            - "/bin/sh"
+            - "-ce"
+            - "/usr/bin/docker-entrypoint.sh minio -S /etc/minio/certs server /export {{ (.Values.extraArgs | default list) | join " " }}"
+          ports:
+            - name: http
+              containerPort: 9000
+          env:
+            {{ $secretName := (include "minio.secretName" .) }}
+            {{ $envList := (default list .Values.environment) }}
+            {{ $envList = mustAppend $envList (dict "name" "MINIO_ACCESS_KEY" "valueFromSecret" true "secretName" $secretName "secretKey" "accesskey") }}
+            {{ $envList = mustAppend $envList (dict "name" "MINIO_SECRET_KEY" "valueFromSecret" true "secretName" $secretName "secretKey" "secretkey") }}
+            {{ include "common.containers.environmentVariables" (dict "environmentVariables" $envList) | nindent 12 }}
+{{ include "common.storage.allAppVolumes" .Values | nindent 6 }}
+{{- include "minio.tlsKeysVolume" . | nindent 8 }}

test/minio/1.2.0/templates/secrets.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "minio.secretName" . }}
+  labels: {{ include "common.labels" . | nindent 4 }}
+type: Opaque
+data:
+  accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }}
+  secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }}
+  {{ if eq (include "minio.certAvailable" .) "true" }}
+  certPublicKey: {{ (include "minio.cert.publicKey" .) | toString | b64enc | quote }}
+  certPrivateKey: {{ (include "minio.cert.privateKey" .) | toString | b64enc | quote }}
+  {{ end }}

test/minio/1.2.0/templates/service.yaml

@@ -0,0 +1,10 @@
+{{ $svc := .Values.service }}
+{{ $selectors := list }}
+{{ $selectors = mustAppend $selectors (dict "key" "app" "value" (include "common.names.name" .) ) }}
+{{ $selectors = mustAppend $selectors (dict "key" "release" "value" .Release.Name ) }}
+{{ $ports := list }}
+{{ $ports = mustAppend $ports (dict "name" "http" "port" $svc.nodePort "nodePort" $svc.nodePort "targetPort" 9000) }}
+{{ $params := . }}
+{{ $_ := set $params "commonService" (dict "type" "NodePort" "ports" $ports ) }}
+{{ $_1 := set .Values "extraSelectorLabels" $selectors }}
+{{ include "common.classes.service" $params }}

test/minio/1.2.0/templates/serviceaccount.yaml

@@ -0,0 +1 @@
+{{ include "common.serviceaccount" . }}

test/minio/1.2.0/test_values.yaml

@@ -0,0 +1,23 @@
+## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
+##
+image:
+  repository: minio/minio
+  tag: RELEASE.2020-11-19T23-48-16Z
+  pullPolicy: IfNotPresent
+
+## Additional arguments to pass to minio binary
+extraArgs: []
+
+updateStrategy: RollingUpdate
+
+service:
+  nodePort: 32324
+
+environmentVariables: []
+  ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html
+
+emptyDirVolumes: true
+appVolumeMounts:
+  export:
+    emptyDir: true
+    mountPath: "/export"