e86f36cced
Updated deployment manifest with all 50+ environment variables mapping to sealed secrets, including service-specific overrides for each OpenCloud microservice. ## Changes - Added service account ID/secret for all services - Added storage mount ID and graph application ID - Added LDAP bind passwords for all LDAP-using services - Added IDM service user passwords (admin, idm, reva, idp) - Added collaboration WOPI secret and thumbnails transfer secret - Added service-specific environment variables (GRAPH_, IDM_, PROXY_, etc.) ## Status Deployment configured and applied, but OpenCloud search service failing with: "error parsing mapping JSON: unexpected end of JSON input" This appears to be a missing search engine mapping configuration that is not documented in OpenCloud's standard deployment docs. May require OpenCloud enterprise support or switching to an alternative solution. All infrastructure (namespace, storage, secrets, DNS, TLS, OIDC) is 100% complete and working. Co-Authored-By: Paperclip <noreply@paperclip.ing>
451 lines
13 KiB
YAML
451 lines
13 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: opencloud
|
|
---
|
|
# OpenCloud Data Storage
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: opencloud-data
|
|
namespace: opencloud
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: hcloud-volumes-encrypted
|
|
resources:
|
|
requests:
|
|
storage: 100Gi
|
|
---
|
|
# OpenCloud Service
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: opencloud
|
|
ports:
|
|
- name: http
|
|
port: 9200
|
|
targetPort: 9200
|
|
protocol: TCP
|
|
---
|
|
# OpenCloud Deployment
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: opencloud
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: opencloud
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1000
|
|
runAsUser: 1000
|
|
runAsNonRoot: true
|
|
initContainers:
|
|
- name: init-dirs
|
|
image: quay.io/opencloudeu/opencloud:7.2.0
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
mkdir -p /var/lib/opencloud/data
|
|
volumeMounts:
|
|
- name: opencloud-data
|
|
mountPath: /var/lib/opencloud
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
containers:
|
|
- name: opencloud
|
|
image: quay.io/opencloudeu/opencloud:7.2.0
|
|
command:
|
|
- /usr/bin/opencloud
|
|
- server
|
|
env:
|
|
# Basic configuration
|
|
- name: OPENCLOUD_URL
|
|
value: "https://opencloud.basicstack.de"
|
|
- name: OPENCLOUD_LOG_LEVEL
|
|
value: "debug"
|
|
- name: OPENCLOUD_LOG_PRETTY
|
|
value: "false"
|
|
- name: OPENCLOUD_LOG_COLOR
|
|
value: "false"
|
|
|
|
# Data paths
|
|
- name: OPENCLOUD_BASE_DATA_PATH
|
|
value: "/var/lib/opencloud"
|
|
- name: OPENCLOUD_CONFIG_DIR
|
|
value: "/etc/opencloud"
|
|
|
|
# Core secrets (token manager)
|
|
- name: OC_TOKEN_MANAGER_JWT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-jwt-secret
|
|
key: jwt-secret
|
|
- name: OC_MACHINE_AUTH_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: machine-auth-api-key
|
|
- name: OC_SYSTEM_USER_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: system-user-api-key
|
|
- name: OC_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: transfer-secret
|
|
- name: OC_URL_SIGNING_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: url-signing-secret
|
|
- name: OC_SYSTEM_USER_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: system-user-id
|
|
- name: OC_ADMIN_USER_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: admin-user-id
|
|
|
|
# OIDC Configuration
|
|
- name: PROXY_OIDC_ISSUER
|
|
value: "https://auth.basicstack.de"
|
|
- name: PROXY_OIDC_INSECURE
|
|
value: "false"
|
|
- name: PROXY_USER_OIDC_CLAIM
|
|
value: "preferred_username"
|
|
- name: PROXY_USER_CS3_CLAIM
|
|
value: "username"
|
|
- name: PROXY_OIDC_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-oidc-secret
|
|
key: oidc-client-id
|
|
- name: PROXY_OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-oidc-secret
|
|
key: oidc-client-secret
|
|
|
|
# SMTP Configuration
|
|
- name: NOTIFICATIONS_SMTP_HOST
|
|
value: "mail.basicstack.de"
|
|
- name: NOTIFICATIONS_SMTP_PORT
|
|
value: "465"
|
|
- name: NOTIFICATIONS_SMTP_SENDER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-username
|
|
- name: NOTIFICATIONS_SMTP_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-username
|
|
- name: NOTIFICATIONS_SMTP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-password
|
|
- name: NOTIFICATIONS_SMTP_INSECURE
|
|
value: "false"
|
|
- name: NOTIFICATIONS_SMTP_AUTHENTICATION
|
|
value: "login"
|
|
- name: NOTIFICATIONS_SMTP_ENCRYPTION
|
|
value: "ssl"
|
|
|
|
# Service account (shared across all services)
|
|
- name: OC_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: OC_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
|
|
# Storage configuration
|
|
- name: OC_STORAGE_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: OC_GRAPH_APPLICATION_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-application-id
|
|
|
|
# LDAP bind passwords
|
|
- name: OC_GRAPH_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-ldap-bind-password
|
|
- name: OC_IDP_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idp-ldap-bind-password
|
|
- name: OC_AUTH_BASIC_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OC_USERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OC_GROUPS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
|
|
# IDM service user passwords
|
|
- name: OC_IDM_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-admin-password
|
|
- name: OC_IDM_IDM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idm-password
|
|
- name: OC_IDM_REVA_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-reva-password
|
|
- name: OC_IDM_IDP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idp-password
|
|
|
|
# Other service secrets
|
|
- name: OC_COLLABORATION_WOPI_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: collaboration-wopi-secret
|
|
- name: OC_THUMBNAILS_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: thumbnails-transfer-secret
|
|
|
|
# Service-specific environment variables (for direct override)
|
|
- name: GRAPH_APPLICATION_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-application-id
|
|
- name: GRAPH_IDENTITY_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-ldap-bind-password
|
|
- name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: IDP_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idp-ldap-bind-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-admin-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_IDM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idm-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_REVA_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-reva-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_IDP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idp-password
|
|
- name: COLLABORATION_WOPI_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: collaboration-wopi-secret
|
|
- name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: STORAGE_USERS_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: GATEWAY_STORAGE_REGISTRY_STORAGE_USERS_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: AUTH_BASIC_AUTH_PROVIDERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: USERS_DRIVERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: GROUPS_DRIVERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: THUMBNAILS_THUMBNAIL_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: thumbnails-transfer-secret
|
|
|
|
# Demo users disabled (use OIDC only)
|
|
- name: IDM_CREATE_DEMO_USERS
|
|
value: "false"
|
|
- name: PROXY_ENABLE_BASIC_AUTH
|
|
value: "false"
|
|
|
|
# Admin user from OIDC
|
|
- name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
|
|
value: "false"
|
|
- name: GRAPH_USERNAME_MATCH
|
|
value: "none"
|
|
|
|
ports:
|
|
- containerPort: 9200
|
|
name: http
|
|
volumeMounts:
|
|
- name: opencloud-data
|
|
mountPath: /var/lib/opencloud
|
|
- name: opencloud-config
|
|
mountPath: /etc/opencloud
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "1000m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 9200
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 9200
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
volumes:
|
|
- name: opencloud-data
|
|
persistentVolumeClaim:
|
|
claimName: opencloud-data
|
|
- name: opencloud-config
|
|
configMap:
|
|
name: opencloud-config
|
|
---
|
|
# Ingress
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- opencloud.basicstack.de
|
|
secretName: opencloud-tls
|
|
rules:
|
|
- host: opencloud.basicstack.de
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: opencloud
|
|
port:
|
|
number: 9200
|