From 182c270b4c59b2de0dd0e9a65f68d2297e834993 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sat, 4 Jul 2026 20:33:12 +0000 Subject: [PATCH] Add OpenCloud v7.2.0 deployment to Kubernetes cluster Deployed OpenCloud file-sharing platform at opencloud.basicstack.de with: - Namespace: opencloud - Encrypted hcloud volumes (100Gi PVC) - Pocket ID OIDC integration (opencloud_admins group) - SMTP notifications via opencloud@basicstack.de - All credentials stored as SealedSecrets - Search service excluded due to v7.2.0 bug (GitHub #1740) Configuration follows official docker-compose pattern: - Image: opencloudeu/opencloud-rolling:7.2.0 - Command: opencloud init || true; opencloud server - External IDP mode with auto-provisioning - OC_EXCLUDE_RUN_SERVICES: search Files: - opencloud-deployment.yaml: Main deployment with OIDC, SMTP config - opencloud-configmap.yaml: OpenCloud config (search disabled) - tika-deployment.yaml: Apache Tika for future search enablement Co-Authored-By: Paperclip --- apps/opencloud/opencloud-configmap.yaml | 23 ++++++--- apps/opencloud/opencloud-deployment.yaml | 64 +++++++++++++++--------- apps/opencloud/tika-deployment.yaml | 60 ++++++++++++++++++++++ 3 files changed, 115 insertions(+), 32 deletions(-) create mode 100644 apps/opencloud/tika-deployment.yaml diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml index db6d69b..a21f3db 100644 --- a/apps/opencloud/opencloud-configmap.yaml +++ b/apps/opencloud/opencloud-configmap.yaml @@ -112,13 +112,22 @@ data: webdav_allow_insecure: true cs3_allow_insecure: true - # Search service - search: - events: - tls_insecure: true - service_account: - service_account_id: ${OC_SERVICE_ACCOUNT_ID} - service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET} + # Search service - DISABLED due to crashes in v7.2.0 + # See: https://github.com/opencloud-eu/opencloud/issues/1740 + # search: + # engine: + # type: bleve + # bleve: + # data_path: /var/lib/opencloud/search + # extractor: + # type: tika + # tika: + # tika_url: http://tika:9998 + # events: + # tls_insecure: true + # service_account: + # service_account_id: ${OC_SERVICE_ACCOUNT_ID} + # service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET} # Audit service audit: diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 9ac0471..ca12206 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -56,7 +56,7 @@ spec: runAsNonRoot: true initContainers: - name: init-dirs - image: quay.io/opencloudeu/opencloud:7.2.0 + image: opencloudeu/opencloud-rolling:7.2.0 command: - sh - -c @@ -71,20 +71,29 @@ spec: runAsNonRoot: true containers: - name: opencloud - image: quay.io/opencloudeu/opencloud:7.2.0 + image: opencloudeu/opencloud-rolling:7.2.0 command: - - /usr/bin/opencloud - - server + - /bin/sh + - -c + - "opencloud init || true; opencloud server" env: # Basic configuration - - name: OPENCLOUD_URL + - name: OC_URL value: "https://opencloud.basicstack.de" - - name: OPENCLOUD_LOG_LEVEL - value: "debug" - - name: OPENCLOUD_LOG_PRETTY + - name: OC_LOG_LEVEL + value: "info" + - name: OC_LOG_PRETTY value: "false" - - name: OPENCLOUD_LOG_COLOR + - name: OC_LOG_COLOR value: "false" + - name: OC_INSECURE + value: "false" + - name: PROXY_TLS + value: "false" + + # Exclude broken search service (GitHub issue #1740) + - name: OC_EXCLUDE_RUN_SERVICES + value: "search" # Data paths - name: OPENCLOUD_BASE_DATA_PATH @@ -129,25 +138,26 @@ spec: name: opencloud-config-secrets key: admin-user-id - # OIDC Configuration - - name: PROXY_OIDC_ISSUER + # OIDC Configuration (External IDP - Pocket ID) + - name: OC_OIDC_ISSUER value: "https://auth.basicstack.de" - - name: PROXY_OIDC_INSECURE - value: "false" - - name: PROXY_USER_OIDC_CLAIM - value: "preferred_username" - - name: PROXY_USER_CS3_CLAIM - value: "username" - - name: PROXY_OIDC_CLIENT_ID + - name: OC_OIDC_CLIENT_ID valueFrom: secretKeyRef: name: opencloud-oidc-secret key: oidc-client-id - - name: PROXY_OIDC_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: opencloud-oidc-secret - key: oidc-client-secret + - name: PROXY_OIDC_REWRITE_WELLKNOWN + value: "true" + - name: PROXY_USER_OIDC_CLAIM + value: "preferred_username" + - name: PROXY_USER_CS3_CLAIM + value: "username" + - name: PROXY_AUTOPROVISION_ACCOUNTS + value: "true" + - name: PROXY_ROLE_ASSIGNMENT_DRIVER + value: "oidc" + - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM + value: "groups" # SMTP Configuration - name: NOTIFICATIONS_SMTP_HOST @@ -373,17 +383,21 @@ spec: name: opencloud-config-secrets key: thumbnails-transfer-secret - # Demo users disabled (use OIDC only) + # Demo users disabled (use external OIDC) - name: IDM_CREATE_DEMO_USERS value: "false" - name: PROXY_ENABLE_BASIC_AUTH value: "false" - # Admin user from OIDC + # Admin user and role assignment (external IDP mode) - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE value: "false" - name: GRAPH_USERNAME_MATCH value: "none" + - name: OC_ADMIN_USER_ID + value: "" + - name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS + value: "false" ports: - containerPort: 9200 diff --git a/apps/opencloud/tika-deployment.yaml b/apps/opencloud/tika-deployment.yaml new file mode 100644 index 0000000..317648b --- /dev/null +++ b/apps/opencloud/tika-deployment.yaml @@ -0,0 +1,60 @@ +--- +# Apache Tika Service for OpenCloud full-text search +apiVersion: v1 +kind: Service +metadata: + name: tika + namespace: opencloud +spec: + type: ClusterIP + selector: + app: tika + ports: + - name: http + port: 9998 + targetPort: 9998 + protocol: TCP +--- +# Apache Tika Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tika + namespace: opencloud +spec: + replicas: 1 + selector: + matchLabels: + app: tika + template: + metadata: + labels: + app: tika + spec: + containers: + - name: tika + image: apache/tika:latest + ports: + - containerPort: 9998 + name: http + resources: + requests: + memory: "256Mi" + cpu: "100m" + limits: + memory: "1Gi" + cpu: "500m" + livenessProbe: + httpGet: + path: /tika + port: 9998 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /tika + port: 9998 + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5