Add OpenCloud v7.2.0 deployment to Kubernetes cluster

Deployed OpenCloud file-sharing platform at opencloud.basicstack.de with:
- Namespace: opencloud
- Encrypted hcloud volumes (100Gi PVC)
- Pocket ID OIDC integration (opencloud_admins group)
- SMTP notifications via opencloud@basicstack.de
- All credentials stored as SealedSecrets
- Search service excluded due to v7.2.0 bug (GitHub #1740)

Configuration follows official docker-compose pattern:
- Image: opencloudeu/opencloud-rolling:7.2.0
- Command: opencloud init || true; opencloud server
- External IDP mode with auto-provisioning
- OC_EXCLUDE_RUN_SERVICES: search

Files:
- opencloud-deployment.yaml: Main deployment with OIDC, SMTP config
- opencloud-configmap.yaml: OpenCloud config (search disabled)
- tika-deployment.yaml: Apache Tika for future search enablement

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/opencloud-configmap.yaml

@@ -112,13 +112,22 @@ data:
         webdav_allow_insecure: true
         cs3_allow_insecure: true
 
-    # Search service
+    # Search service - DISABLED due to crashes in v7.2.0
-    search:
+    # See: https://github.com/opencloud-eu/opencloud/issues/1740
-      events:
+    # search:
-        tls_insecure: true
+    #   engine:
-      service_account:
+    #     type: bleve
-        service_account_id: ${OC_SERVICE_ACCOUNT_ID}
+    #     bleve:
-        service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
+    #       data_path: /var/lib/opencloud/search
+    #   extractor:
+    #     type: tika
+    #     tika:
+    #       tika_url: http://tika:9998
+    #   events:
+    #     tls_insecure: true
+    #   service_account:
+    #     service_account_id: ${OC_SERVICE_ACCOUNT_ID}
+    #     service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
 
     # Audit service
     audit:

apps/opencloud/opencloud-deployment.yaml

@@ -56,7 +56,7 @@ spec:
         runAsNonRoot: true
       initContainers:
       - name: init-dirs
-        image: quay.io/opencloudeu/opencloud:7.2.0
+        image: opencloudeu/opencloud-rolling:7.2.0
         command:
           - sh
           - -c
@@ -71,20 +71,29 @@ spec:
           runAsNonRoot: true
       containers:
       - name: opencloud
-        image: quay.io/opencloudeu/opencloud:7.2.0
+        image: opencloudeu/opencloud-rolling:7.2.0
         command:
-          - /usr/bin/opencloud
+          - /bin/sh
-          - server
+          - -c
+          - "opencloud init || true; opencloud server"
         env:
         # Basic configuration
-        - name: OPENCLOUD_URL
+        - name: OC_URL
           value: "https://opencloud.basicstack.de"
-        - name: OPENCLOUD_LOG_LEVEL
+        - name: OC_LOG_LEVEL
-          value: "debug"
+          value: "info"
-        - name: OPENCLOUD_LOG_PRETTY
+        - name: OC_LOG_PRETTY
           value: "false"
-        - name: OPENCLOUD_LOG_COLOR
+        - name: OC_LOG_COLOR
           value: "false"
+        - name: OC_INSECURE
+          value: "false"
+        - name: PROXY_TLS
+          value: "false"
+
+        # Exclude broken search service (GitHub issue #1740)
+        - name: OC_EXCLUDE_RUN_SERVICES
+          value: "search"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH
@@ -129,25 +138,26 @@ spec:
               name: opencloud-config-secrets
               key: admin-user-id
 
-        # OIDC Configuration
+        # OIDC Configuration (External IDP - Pocket ID)
-        - name: PROXY_OIDC_ISSUER
+        - name: OC_OIDC_ISSUER
           value: "https://auth.basicstack.de"
-        - name: PROXY_OIDC_INSECURE
+        - name: OC_OIDC_CLIENT_ID
-          value: "false"
-        - name: PROXY_USER_OIDC_CLAIM
-          value: "preferred_username"
-        - name: PROXY_USER_CS3_CLAIM
-          value: "username"
-        - name: PROXY_OIDC_CLIENT_ID
           valueFrom:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
-        - name: PROXY_OIDC_CLIENT_SECRET
+        - name: PROXY_OIDC_REWRITE_WELLKNOWN
-          valueFrom:
+          value: "true"
-            secretKeyRef:
+        - name: PROXY_USER_OIDC_CLAIM
-              name: opencloud-oidc-secret
+          value: "preferred_username"
-              key: oidc-client-secret
+        - name: PROXY_USER_CS3_CLAIM
+          value: "username"
+        - name: PROXY_AUTOPROVISION_ACCOUNTS
+          value: "true"
+        - name: PROXY_ROLE_ASSIGNMENT_DRIVER
+          value: "oidc"
+        - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
+          value: "groups"
 
         # SMTP Configuration
         - name: NOTIFICATIONS_SMTP_HOST
@@ -373,17 +383,21 @@ spec:
               name: opencloud-config-secrets
               key: thumbnails-transfer-secret
 
-        # Demo users disabled (use OIDC only)
+        # Demo users disabled (use external OIDC)
         - name: IDM_CREATE_DEMO_USERS
           value: "false"
         - name: PROXY_ENABLE_BASIC_AUTH
           value: "false"
 
-        # Admin user from OIDC
+        # Admin user and role assignment (external IDP mode)
         - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
           value: "false"
         - name: GRAPH_USERNAME_MATCH
           value: "none"
+        - name: OC_ADMIN_USER_ID
+          value: ""
+        - name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS
+          value: "false"
 
         ports:
         - containerPort: 9200

apps/opencloud/tika-deployment.yaml

@@ -0,0 +1,60 @@
+---
+# Apache Tika Service for OpenCloud full-text search
+apiVersion: v1
+kind: Service
+metadata:
+  name: tika
+  namespace: opencloud
+spec:
+  type: ClusterIP
+  selector:
+    app: tika
+  ports:
+    - name: http
+      port: 9998
+      targetPort: 9998
+      protocol: TCP
+---
+# Apache Tika Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tika
+  namespace: opencloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tika
+  template:
+    metadata:
+      labels:
+        app: tika
+    spec:
+      containers:
+      - name: tika
+        image: apache/tika:latest
+        ports:
+        - containerPort: 9998
+          name: http
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "100m"
+          limits:
+            memory: "1Gi"
+            cpu: "500m"
+        livenessProbe:
+          httpGet:
+            path: /tika
+            port: 9998
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /tika
+            port: 9998
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 5