mirror of
https://github.com/Noooste/garage-ui.git
synced 2026-07-26 15:58:13 +00:00
Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Noste
|
09e485572a | ||
|
Noste
|
491e083bb4 | ||
|
Noste
|
7f636a451c | ||
|
Noste
|
4656d1bce9 | ||
|
Noste
|
983e6e5fa9 | ||
|
Noste
|
244752c343 | ||
|
Noooste
|
f6e46d4a46 | ||
|
Noooste
|
067e00b474 |
@@ -32,11 +32,8 @@ jobs:
|
||||
with:
|
||||
images: ${{ secrets.DOCKER_REGISTRY }}
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=semver,pattern={{major}}
|
||||
type=semver,pattern={{raw}}
|
||||
type=raw,value=latest
|
||||
|
||||
- name: Build and push Docker image
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
@@ -0,0 +1,37 @@
|
||||
name: Release Charts
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'helm/garage-ui/**'
|
||||
- '!helm/garage-ui/README.md'
|
||||
|
||||
jobs:
|
||||
release:
|
||||
permissions:
|
||||
contents: write
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout Code
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Configure Git
|
||||
run: |
|
||||
git config user.name "$GITHUB_ACTOR"
|
||||
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4.3.1
|
||||
with:
|
||||
version: v3.19.3
|
||||
|
||||
- name: Run chart-releaser
|
||||
uses: helm/chart-releaser-action@v1.7.0
|
||||
with:
|
||||
charts_dir: helm
|
||||
env:
|
||||
CR_TOKEN: "${{ secrets.HELM_RELEASE_TOKEN }}"
|
||||
+2
-1
@@ -59,4 +59,5 @@ data/
|
||||
meta/
|
||||
garage.toml
|
||||
|
||||
backend/docs/
|
||||
backend/docs/
|
||||
config.yaml
|
||||
+1
-1
@@ -4,7 +4,7 @@ WORKDIR /app/frontend
|
||||
|
||||
COPY frontend/package.json frontend/package-lock.json* ./
|
||||
|
||||
RUN npm ci
|
||||
RUN npm install
|
||||
|
||||
COPY frontend/ .
|
||||
|
||||
|
||||
@@ -0,0 +1,647 @@
|
||||
# Garage UI
|
||||
|
||||
A modern, full-stack web interface for managing [Garage](https://garagehq.deuxfleurs.fr/) distributed object storage systems. Built with React, TypeScript, Go, and Fiber for production-ready S3-compatible storage management.
|
||||
|
||||
[](https://github.com/Noooste/garage-ui/actions/workflows/build.yml)
|
||||
[](https://github.com/Noooste/garage-ui/actions/workflows/release.yml)
|
||||
[](https://opensource.org/licenses/MIT)
|
||||
[](https://go.dev/)
|
||||
[](https://nodejs.org/)
|
||||
[](https://artifacthub.io/packages/search?repo=garage-ui)
|
||||
|
||||
Garage UI provides a comprehensive dashboard for managing your Garage S3 storage cluster, featuring bucket management, object operations, user access control, and real-time cluster monitoring—all through an intuitive web interface.
|
||||
|
||||
---
|
||||
|
||||
## Features
|
||||
|
||||
- **Bucket Management** - Create, configure, and delete S3 buckets with visual controls
|
||||
- **Object Operations** - Upload, download, and manage objects with drag-and-drop support
|
||||
- **User & Access Control** - Manage access keys, permissions, and user credentials
|
||||
- **Cluster Monitoring** - Real-time cluster health metrics, node status, and performance statistics
|
||||
- **Multi-Auth Support** - Flexible authentication with None, Basic Auth, and OIDC/OAuth2 modes
|
||||
- **Modern UI/UX** - Responsive React interface with dark mode, built on Tailwind CSS and shadcn/ui
|
||||
- **Production Ready** - Docker/Kubernetes deployment, health checks, and Prometheus metrics
|
||||
- **API-First Design** - RESTful API with Swagger/OpenAPI documentation
|
||||
|
||||
---
|
||||
|
||||
## Quick Start
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- **Garage S3** storage cluster running (v2.0.0+)
|
||||
- **Docker** & Docker Compose (recommended) OR
|
||||
- **Go** 1.25+ and **Node.js** 25+ (for development)
|
||||
|
||||
### Using Docker Compose (Recommended)
|
||||
|
||||
1. **Clone the repository:**
|
||||
|
||||
```bash
|
||||
git clone https://github.com/Noooste/garage-ui.git
|
||||
cd garage-ui
|
||||
```
|
||||
|
||||
2. **Configure the application:**
|
||||
|
||||
```bash
|
||||
cp config.yaml.example config.yaml
|
||||
# Edit config.yaml with your Garage endpoints and credentials
|
||||
```
|
||||
|
||||
3. **Start the services:**
|
||||
|
||||
```bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
4. **Access the UI:**
|
||||
|
||||
Open your browser to [http://localhost:8080](http://localhost:8080)
|
||||
|
||||
> The Docker Compose setup includes both Garage and Garage UI services for quick local development.
|
||||
|
||||
### Using Docker
|
||||
|
||||
```bash
|
||||
docker run -d \
|
||||
-p 8080:8080 \
|
||||
-v $(pwd)/config.yaml:/app/config.yaml \
|
||||
-e GARAGE_UI_GARAGE_ENDPOINT=http://your-garage:3900 \
|
||||
-e GARAGE_UI_GARAGE_ADMIN_ENDPOINT=http://your-garage:3903 \
|
||||
noooste/garage-ui:latest
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Installation
|
||||
|
||||
### Docker Deployment
|
||||
|
||||
**Pull the latest image:**
|
||||
|
||||
```bash
|
||||
docker pull noooste/garage-ui:latest
|
||||
```
|
||||
|
||||
**Available tags:**
|
||||
- `latest` - Latest stable release
|
||||
- `v0.0.4` - Specific version
|
||||
- `0.0` - Minor version track
|
||||
|
||||
The Docker image is multi-platform, supporting `linux/amd64` and `linux/arm64`.
|
||||
|
||||
### Kubernetes Deployment with Helm
|
||||
|
||||
```bash
|
||||
# Add the Helm repository (if available)
|
||||
helm repo add garage-ui https://helm.noste.dev/
|
||||
|
||||
# Install the chart
|
||||
helm install garage-ui garage-ui/garage-ui \
|
||||
--set garage.endpoint=http://garage:3900 \
|
||||
--set garage.adminEndpoint=http://garage:3903 \
|
||||
--set garage.adminToken=your-admin-token
|
||||
```
|
||||
|
||||
Or use the local Helm chart:
|
||||
|
||||
```bash
|
||||
helm install garage-ui ./helm/garage-ui -f custom-values.yaml
|
||||
```
|
||||
|
||||
### Building from Source
|
||||
|
||||
**Backend:**
|
||||
|
||||
```bash
|
||||
cd backend
|
||||
go mod download
|
||||
swag init # Generate API docs
|
||||
go build -o garage-ui .
|
||||
```
|
||||
|
||||
**Frontend:**
|
||||
|
||||
```bash
|
||||
cd frontend
|
||||
npm install
|
||||
npm run build
|
||||
```
|
||||
|
||||
**Run:**
|
||||
|
||||
```bash
|
||||
# From project root
|
||||
./backend/garage-ui --config config.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Configuration
|
||||
|
||||
Garage UI can be configured via YAML file or environment variables.
|
||||
|
||||
### Configuration File
|
||||
|
||||
Create a `config.yaml` based on the provided example:
|
||||
|
||||
```yaml
|
||||
# Server configuration
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
# Garage S3 Configuration
|
||||
garage:
|
||||
endpoint: "http://garage:3900"
|
||||
region: "eu-west-1"
|
||||
admin_endpoint: "http://garage:3903"
|
||||
admin_token: "your-admin-token-here"
|
||||
|
||||
# Authentication (none, basic, oidc)
|
||||
auth:
|
||||
mode: "none"
|
||||
|
||||
# Basic auth example
|
||||
basic:
|
||||
username: "admin"
|
||||
password: "secure-password"
|
||||
|
||||
# OIDC example (Keycloak, Auth0, etc.)
|
||||
oidc:
|
||||
enabled: true
|
||||
provider_name: "Keycloak"
|
||||
client_id: "garage-ui"
|
||||
client_secret: "your-client-secret"
|
||||
issuer_url: "https://auth.example.com/realms/master"
|
||||
auth_url: "https://auth.example.com/realms/master/protocol/openid-connect/auth"
|
||||
token_url: "https://auth.example.com/realms/master/protocol/openid-connect/token"
|
||||
```
|
||||
|
||||
See [`config.yaml.example`](config.yaml.example) for all available options.
|
||||
|
||||
### Environment Variables
|
||||
|
||||
All configuration can be set via environment variables with the prefix `GARAGE_UI_`:
|
||||
|
||||
```bash
|
||||
GARAGE_UI_SERVER_PORT=8080
|
||||
GARAGE_UI_GARAGE_ENDPOINT=http://garage:3900
|
||||
GARAGE_UI_GARAGE_ADMIN_ENDPOINT=http://garage:3903
|
||||
GARAGE_UI_GARAGE_ADMIN_TOKEN=your-token
|
||||
GARAGE_UI_AUTH_MODE=basic
|
||||
GARAGE_UI_AUTH_BASIC_USERNAME=admin
|
||||
GARAGE_UI_AUTH_BASIC_PASSWORD=password
|
||||
GARAGE_UI_LOGGING_LEVEL=info
|
||||
```
|
||||
|
||||
**Configuration Priority:** Environment variables override YAML file settings.
|
||||
|
||||
---
|
||||
|
||||
## Project Structure
|
||||
|
||||
```
|
||||
garage-ui/
|
||||
├── backend/ # Go backend (Fiber framework)
|
||||
│ ├── internal/
|
||||
│ │ ├── auth/ # Authentication services (JWT, OIDC)
|
||||
│ │ ├── config/ # Configuration loading
|
||||
│ │ ├── handlers/ # HTTP request handlers
|
||||
│ │ ├── middleware/ # CORS, auth middleware
|
||||
│ │ ├── models/ # Data models and types
|
||||
│ │ ├── routes/ # API route definitions
|
||||
│ │ └── services/ # Business logic (S3, Garage Admin)
|
||||
│ ├── pkg/ # Shared packages
|
||||
│ ├── main.go # Application entry point
|
||||
│ └── go.mod # Go dependencies
|
||||
│
|
||||
├── frontend/ # React + TypeScript frontend
|
||||
│ ├── src/
|
||||
│ │ ├── components/ # Reusable UI components
|
||||
│ │ │ ├── buckets/ # Bucket-specific components
|
||||
│ │ │ ├── charts/ # Data visualization
|
||||
│ │ │ ├── layout/ # App layout and navigation
|
||||
│ │ │ └── ui/ # shadcn/ui component library
|
||||
│ │ ├── hooks/ # Custom React hooks
|
||||
│ │ ├── lib/ # API client and utilities
|
||||
│ │ ├── pages/ # Page components (Dashboard, Buckets, etc.)
|
||||
│ │ ├── types/ # TypeScript type definitions
|
||||
│ │ └── App.tsx # Main application component
|
||||
│ ├── package.json # Node dependencies
|
||||
│ └── vite.config.ts # Vite build configuration
|
||||
│
|
||||
├── helm/ # Kubernetes Helm chart
|
||||
│ └── garage-ui/
|
||||
│ ├── Chart.yaml # Chart metadata
|
||||
│ ├── values.yaml # Default values
|
||||
│ └── templates/ # K8s resource templates
|
||||
│
|
||||
├── .github/workflows/ # CI/CD pipelines
|
||||
│ ├── build.yml # Docker build and push
|
||||
│ └── release.yml # Helm chart releases
|
||||
│
|
||||
├── Dockerfile # Multi-stage build
|
||||
├── docker-compose.yml # Local development stack
|
||||
└── config.yaml.example # Configuration template
|
||||
```
|
||||
|
||||
**Key Directories:**
|
||||
|
||||
- **`backend/internal/handlers/`** - REST API endpoints for buckets, objects, users, cluster, and monitoring
|
||||
- **`frontend/src/pages/`** - Main application views (Dashboard, Buckets, Cluster, Access Control)
|
||||
- **`backend/internal/services/`** - Core business logic interfacing with Garage Admin API and S3
|
||||
- **`frontend/src/lib/api.ts`** - Axios-based API client with automatic error handling
|
||||
|
||||
---
|
||||
|
||||
## Development
|
||||
|
||||
### Local Development Setup
|
||||
|
||||
**1. Start Garage (using Docker Compose):**
|
||||
|
||||
```bash
|
||||
docker-compose up garage -d
|
||||
```
|
||||
|
||||
**2. Run the backend:**
|
||||
|
||||
```bash
|
||||
cd backend
|
||||
go run main.go --config ../config.yaml
|
||||
```
|
||||
|
||||
The backend will start on `http://localhost:8080` with hot-reload (use [air](https://github.com/cosmtrek/air) for auto-reload).
|
||||
|
||||
**3. Run the frontend:**
|
||||
|
||||
```bash
|
||||
cd frontend
|
||||
npm install
|
||||
npm run dev
|
||||
```
|
||||
|
||||
The frontend dev server starts on `http://localhost:3000` with API proxy to backend.
|
||||
|
||||
### Available Scripts
|
||||
|
||||
**Backend:**
|
||||
|
||||
```bash
|
||||
go run main.go # Start server
|
||||
go test ./... # Run tests
|
||||
swag init # Regenerate API docs
|
||||
go build -o garage-ui . # Build binary
|
||||
```
|
||||
|
||||
**Frontend:**
|
||||
|
||||
```bash
|
||||
npm run dev # Development server (Vite)
|
||||
npm run build # Production build
|
||||
npm run lint # ESLint checks
|
||||
npm run preview # Preview production build
|
||||
```
|
||||
|
||||
### Testing
|
||||
|
||||
```bash
|
||||
# Backend tests
|
||||
cd backend && go test ./internal/...
|
||||
|
||||
# Frontend tests (if available)
|
||||
cd frontend && npm test
|
||||
```
|
||||
|
||||
### Building Docker Image
|
||||
|
||||
```bash
|
||||
docker build -t garage-ui:dev .
|
||||
```
|
||||
|
||||
The Dockerfile uses a multi-stage build:
|
||||
1. **Frontend build** - Node.js Alpine to compile React app
|
||||
2. **Backend build** - Go Alpine to compile binary
|
||||
3. **Runtime** - Minimal Alpine with ca-certificates
|
||||
|
||||
---
|
||||
|
||||
## API Documentation
|
||||
|
||||
Once the backend is running, access the Swagger UI documentation at:
|
||||
|
||||
**http://localhost:8080/api/v1/**
|
||||
|
||||
### API Endpoints Overview
|
||||
|
||||
| Endpoint | Method | Description |
|
||||
|----------|--------|-------------|
|
||||
| `/health` | GET | Health check endpoint |
|
||||
| `/api/v1/buckets` | GET | List all buckets |
|
||||
| `/api/v1/buckets` | POST | Create a new bucket |
|
||||
| `/api/v1/buckets/{name}` | GET | Get bucket details |
|
||||
| `/api/v1/buckets/{name}` | DELETE | Delete a bucket |
|
||||
| `/api/v1/buckets/{name}/objects` | GET | List objects in bucket |
|
||||
| `/api/v1/objects/upload` | POST | Upload object to bucket |
|
||||
| `/api/v1/objects/download` | GET | Download object |
|
||||
| `/api/v1/objects/delete` | DELETE | Delete object |
|
||||
| `/api/v1/users` | GET | List access keys |
|
||||
| `/api/v1/users` | POST | Create access key |
|
||||
| `/api/v1/users/{id}` | DELETE | Delete access key |
|
||||
| `/api/v1/cluster/status` | GET | Cluster node status |
|
||||
| `/api/v1/cluster/health` | GET | Cluster health metrics |
|
||||
| `/api/v1/cluster/statistics` | GET | Storage statistics |
|
||||
| `/api/v1/metrics` | GET | Prometheus metrics |
|
||||
|
||||
**Authentication:** Bearer token in `Authorization` header when using OIDC or session-based auth.
|
||||
|
||||
---
|
||||
|
||||
## Authentication Modes
|
||||
|
||||
Garage UI supports three authentication modes:
|
||||
|
||||
### 1. None (Default)
|
||||
|
||||
No authentication required - suitable for private networks or development.
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
mode: "none"
|
||||
```
|
||||
|
||||
### 2. Basic Authentication
|
||||
|
||||
Simple username/password authentication.
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
mode: "basic"
|
||||
basic:
|
||||
username: "admin"
|
||||
password: "your-secure-password"
|
||||
```
|
||||
|
||||
### 3. OIDC (OpenID Connect)
|
||||
|
||||
Enterprise-grade authentication with providers like Keycloak, Auth0, Okta, etc.
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
mode: "oidc"
|
||||
oidc:
|
||||
enabled: true
|
||||
provider_name: "Keycloak"
|
||||
client_id: "garage-ui"
|
||||
client_secret: "your-client-secret"
|
||||
issuer_url: "https://auth.example.com/realms/master"
|
||||
auth_url: "https://auth.example.com/realms/master/protocol/openid-connect/auth"
|
||||
token_url: "https://auth.example.com/realms/master/protocol/openid-connect/token"
|
||||
userinfo_url: "https://auth.example.com/realms/master/protocol/openid-connect/userinfo"
|
||||
session_max_age: 86400 # 24 hours
|
||||
cookie_secure: true # Enable in production with HTTPS
|
||||
```
|
||||
|
||||
**Role-Based Access (Optional):**
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
oidc:
|
||||
role_attribute_path: "resource_access.garage-ui.roles"
|
||||
admin_role: "admin"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Deployment Best Practices
|
||||
|
||||
### Production Considerations
|
||||
|
||||
1. **Use HTTPS** - Always enable TLS in production:
|
||||
```yaml
|
||||
auth:
|
||||
oidc:
|
||||
cookie_secure: true
|
||||
```
|
||||
|
||||
2. **Set Strong Admin Token** - Generate a secure token for Garage Admin API:
|
||||
```bash
|
||||
openssl rand -base64 32
|
||||
```
|
||||
|
||||
3. **Configure CORS** - Restrict allowed origins:
|
||||
```yaml
|
||||
cors:
|
||||
allowed_origins:
|
||||
- "https://garage-ui.yourdomain.com"
|
||||
```
|
||||
|
||||
4. **Enable Monitoring** - Expose metrics endpoint for Prometheus:
|
||||
```yaml
|
||||
# Metrics available at /api/v1/metrics
|
||||
```
|
||||
|
||||
5. **Resource Limits** - Set appropriate CPU/memory limits in Kubernetes/Docker
|
||||
|
||||
### Health Checks
|
||||
|
||||
The application provides a health check endpoint:
|
||||
|
||||
```bash
|
||||
curl http://localhost:8080/health
|
||||
# Response: {"status":"ok","version":"0.1.0"}
|
||||
```
|
||||
|
||||
Docker health check is configured automatically (every 30s).
|
||||
|
||||
### Kubernetes Deployment
|
||||
|
||||
The Helm chart includes:
|
||||
|
||||
- **Deployment** with configurable replicas
|
||||
- **Service** (ClusterIP/LoadBalancer)
|
||||
- **Ingress** with TLS support
|
||||
- **ConfigMap** for configuration
|
||||
- **NetworkPolicy** for security
|
||||
- **ServiceMonitor** for Prometheus (optional)
|
||||
|
||||
Example custom values:
|
||||
|
||||
```yaml
|
||||
# custom-values.yaml
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: noooste/garage-ui
|
||||
tag: v0.0.4
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage.storage.svc.cluster.local:3900"
|
||||
adminEndpoint: "http://garage.storage.svc.cluster.local:3903"
|
||||
adminToken: "your-secure-token"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
hosts:
|
||||
- host: garage-ui.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: garage-ui-tls
|
||||
hosts:
|
||||
- garage-ui.example.com
|
||||
|
||||
auth:
|
||||
mode: oidc
|
||||
oidc:
|
||||
clientId: garage-ui
|
||||
clientSecret: secret
|
||||
issuerUrl: https://auth.example.com/realms/master
|
||||
```
|
||||
|
||||
Install with:
|
||||
|
||||
```bash
|
||||
helm install garage-ui ./helm/garage-ui -f custom-values.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Technology Stack
|
||||
|
||||
### Backend
|
||||
|
||||
- **[Go](https://go.dev/)** 1.25+ - High-performance backend runtime
|
||||
- **[Fiber v3](https://gofiber.io/)** - Express-inspired web framework
|
||||
- **[Viper](https://github.com/spf13/viper)** - Configuration management
|
||||
- **[Minio Go SDK](https://github.com/minio/minio-go)** - S3 client library
|
||||
- **[go-oidc](https://github.com/coreos/go-oidc)** - OpenID Connect support
|
||||
- **[Zerolog](https://github.com/rs/zerolog)** - Structured logging
|
||||
- **[Swagger/Swag](https://github.com/swaggo/swag)** - API documentation
|
||||
|
||||
### Frontend
|
||||
|
||||
- **[React](https://react.dev/)** 19 - UI framework
|
||||
- **[TypeScript](https://www.typescriptlang.org/)** 5.9+ - Type safety
|
||||
- **[Vite](https://vitejs.dev/)** 7 - Build tool and dev server
|
||||
- **[React Router](https://reactrouter.com/)** 7 - Client-side routing
|
||||
- **[TanStack Query](https://tanstack.com/query)** - Server state management
|
||||
- **[Zustand](https://github.com/pmndrs/zustand)** - Client state management
|
||||
- **[React Hook Form](https://react-hook-form.com/)** + [Zod](https://zod.dev/) - Form validation
|
||||
- **[Tailwind CSS](https://tailwindcss.com/)** 4 - Utility-first styling
|
||||
- **[shadcn/ui](https://ui.shadcn.com/)** - Component library
|
||||
- **[Lucide Icons](https://lucide.dev/)** - Icon library
|
||||
- **[Recharts](https://recharts.org/)** - Data visualization
|
||||
- **[Axios](https://axios-http.com/)** - HTTP client
|
||||
|
||||
---
|
||||
|
||||
## Contributing
|
||||
|
||||
Contributions are welcome! Whether it's bug reports, feature requests, or code contributions, your input helps improve Garage UI.
|
||||
|
||||
### How to Contribute
|
||||
|
||||
1. **Fork the repository**
|
||||
2. **Create a feature branch** (`git checkout -b feature/amazing-feature`)
|
||||
3. **Make your changes**
|
||||
4. **Commit your changes** (`git commit -m 'Add amazing feature'`)
|
||||
5. **Push to the branch** (`git push origin feature/amazing-feature`)
|
||||
6. **Open a Pull Request**
|
||||
|
||||
### Development Guidelines
|
||||
|
||||
- Follow existing code style (use `gofmt` for Go, ESLint for TypeScript)
|
||||
- Add tests for new features when possible
|
||||
- Update documentation for API changes
|
||||
- Keep commits atomic and descriptive
|
||||
- Ensure all tests pass before submitting PR
|
||||
|
||||
### Reporting Issues
|
||||
|
||||
Please open an issue on GitHub with:
|
||||
- Clear description of the problem
|
||||
- Steps to reproduce
|
||||
- Expected vs actual behavior
|
||||
- Environment details (OS, Docker version, etc.)
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
**Issue: "Failed to connect to Garage Admin API"**
|
||||
|
||||
- **Solution:** Verify `garage.admin_endpoint` and `garage.admin_token` in config.yaml
|
||||
- Check Garage Admin API is accessible: `curl http://garage:3903/status -H "Authorization: Bearer your-token"`
|
||||
|
||||
**Issue: "CORS errors in browser console"**
|
||||
|
||||
- **Solution:** Configure CORS in config.yaml to allow frontend origin:
|
||||
```yaml
|
||||
cors:
|
||||
allowed_origins:
|
||||
- "http://localhost:3000" # For dev
|
||||
```
|
||||
|
||||
**Issue: "401 Unauthorized with OIDC"**
|
||||
|
||||
- **Solution:** Verify OIDC configuration, especially `issuer_url`, `client_id`, and `client_secret`
|
||||
- Check provider configuration allows the redirect URL: `http://your-app/auth/callback`
|
||||
|
||||
**Issue: "Objects not appearing after upload"**
|
||||
|
||||
- **Solution:** Check S3 endpoint connectivity and bucket permissions
|
||||
- Verify Garage bucket exists: `garage bucket list`
|
||||
|
||||
### Debug Mode
|
||||
|
||||
Enable debug logging for troubleshooting:
|
||||
|
||||
```yaml
|
||||
logging:
|
||||
level: "debug"
|
||||
format: "json"
|
||||
```
|
||||
|
||||
Or via environment variable:
|
||||
|
||||
```bash
|
||||
GARAGE_UI_LOGGING_LEVEL=debug
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## License
|
||||
|
||||
This project is licensed under the **MIT License** - see the [LICENSE](LICENSE) file for details.
|
||||
|
||||
Copyright (c) 2025 Noste
|
||||
|
||||
---
|
||||
|
||||
## Acknowledgments
|
||||
|
||||
- [Garage](https://garagehq.deuxfleurs.fr/) - The lightweight, geo-distributed S3 storage system
|
||||
- [shadcn/ui](https://ui.shadcn.com/) - Beautiful, accessible React components
|
||||
- [Fiber](https://gofiber.io/) - Fast and lightweight Go web framework
|
||||
- All open-source contributors who made this project possible
|
||||
|
||||
---
|
||||
|
||||
## Support
|
||||
|
||||
- **Documentation:** [GitHub Wiki](https://github.com/Noooste/garage-ui/wiki) (coming soon)
|
||||
- **Issues:** [GitHub Issues](https://github.com/Noooste/garage-ui/issues)
|
||||
- **Discussions:** [GitHub Discussions](https://github.com/Noooste/garage-ui/discussions)
|
||||
|
||||
---
|
||||
|
||||
**Made with ❤️ for the Garage community**
|
||||
@@ -111,25 +111,12 @@ func (h *BucketHandler) CreateBucket(c fiber.Ctx) error {
|
||||
)
|
||||
}
|
||||
|
||||
// Check if bucket already exists
|
||||
bucketInfo, err := h.adminService.GetBucketInfoByAlias(ctx, req.Name)
|
||||
if err != nil {
|
||||
return c.Status(fiber.StatusInternalServerError).JSON(
|
||||
models.ErrorResponse(models.ErrCodeInternalError, "Failed to check bucket existence: "+err.Error()),
|
||||
)
|
||||
}
|
||||
|
||||
if bucketInfo != nil {
|
||||
return c.Status(fiber.StatusConflict).JSON(
|
||||
models.ErrorResponse(models.ErrCodeBucketExists, "Bucket already exists"),
|
||||
)
|
||||
}
|
||||
|
||||
// Create the bucket
|
||||
createBucketReq := models.CreateBucketAdminRequest{
|
||||
GlobalAlias: &req.Name,
|
||||
}
|
||||
if bucketInfo, err = h.adminService.CreateBucket(ctx, createBucketReq); err != nil {
|
||||
|
||||
if _, err := h.adminService.CreateBucket(ctx, createBucketReq); err != nil {
|
||||
return c.Status(fiber.StatusInternalServerError).JSON(
|
||||
models.ErrorResponse(models.ErrCodeInternalError, "Failed to create bucket: "+err.Error()),
|
||||
)
|
||||
|
||||
@@ -251,6 +251,41 @@ func (h *UserHandler) GetUser(c fiber.Ctx) error {
|
||||
return c.JSON(models.SuccessResponse(userInfo))
|
||||
}
|
||||
|
||||
// GetUserSecretKey retrieves the secret key for a specific user/access key
|
||||
//
|
||||
// @Summary Get user secret key
|
||||
// @Description Retrieves the secret access key for a specific user/access key
|
||||
// @Tags Users
|
||||
// @Produce json
|
||||
// @Param access_key path string true "Access key of the user to retrieve secret for"
|
||||
// @Success 200 {object} models.APIResponse{data=map[string]string} "Secret key retrieved successfully"
|
||||
// @Failure 400 {object} models.APIResponse{error=models.APIError} "Access key is required"
|
||||
// @Failure 500 {object} models.APIResponse{error=models.APIError} "Failed to get secret key"
|
||||
// @Router /api/v1/users/{access_key}/secret [get]
|
||||
func (h *UserHandler) GetUserSecretKey(c fiber.Ctx) error {
|
||||
ctx := c.Context()
|
||||
accessKey := c.Params("access_key")
|
||||
|
||||
if accessKey == "" {
|
||||
return c.Status(fiber.StatusBadRequest).JSON(
|
||||
models.ErrorResponse(models.ErrCodeBadRequest, "Access key is required"),
|
||||
)
|
||||
}
|
||||
|
||||
// Get key information WITH secret key
|
||||
keyInfo, err := h.adminService.GetKeyInfo(ctx, accessKey, true)
|
||||
if err != nil {
|
||||
return c.Status(fiber.StatusInternalServerError).JSON(
|
||||
models.ErrorResponse(models.ErrCodeInternalError, "Failed to get secret key: "+err.Error()),
|
||||
)
|
||||
}
|
||||
|
||||
// Return only the secret key
|
||||
return c.JSON(models.SuccessResponse(map[string]string{
|
||||
"secretKey": *keyInfo.SecretAccessKey,
|
||||
}))
|
||||
}
|
||||
|
||||
// UpdateUserPermissions updates user permissions
|
||||
//
|
||||
// @Summary Update user permissions
|
||||
|
||||
@@ -194,7 +194,7 @@ type ClusterHealth struct {
|
||||
KnownNodes int `json:"knownNodes"`
|
||||
ConnectedNodes int `json:"connectedNodes"`
|
||||
StorageNodes int `json:"storageNodes"`
|
||||
StorageNodesUp int `json:"storageNodesUp"`
|
||||
StorageNodesUp int `json:"storageNodesOk"`
|
||||
Partitions int `json:"partitions"`
|
||||
PartitionsQuorum int `json:"partitionsQuorum"`
|
||||
PartitionsAllOk int `json:"partitionsAllOk"`
|
||||
|
||||
@@ -74,6 +74,7 @@ func SetupRoutes(
|
||||
users.Get("/", userHandler.ListUsers) // List all users/keys
|
||||
users.Post("/", userHandler.CreateUser) // Create new user/key
|
||||
users.Get("/:access_key", userHandler.GetUser) // Get user info
|
||||
users.Get("/:access_key/secret", userHandler.GetUserSecretKey) // Get user secret key
|
||||
users.Delete("/:access_key", userHandler.DeleteUser) // Delete user/key
|
||||
users.Patch("/:access_key", userHandler.UpdateUserPermissions) // Update user permissions
|
||||
}
|
||||
@@ -217,10 +218,10 @@ func SetupRoutes(
|
||||
}
|
||||
}
|
||||
|
||||
cfg.Server.FrontendPath = "./frontend/dist"
|
||||
|
||||
// Check if frontend path exists
|
||||
if _, err := os.Stat(cfg.Server.FrontendPath); err == nil {
|
||||
fmt.Println("Serving frontend from:", cfg.Server.FrontendPath)
|
||||
|
||||
// SPA fallback - serve index.html for all non-API routes
|
||||
app.Use(func(c fiber.Ctx) error {
|
||||
path := c.Path()
|
||||
|
||||
@@ -210,7 +210,7 @@ func (s *GarageAdminService) GetBucketInfoByAlias(ctx context.Context, globalAli
|
||||
}
|
||||
|
||||
var result models.GarageBucketInfo
|
||||
if err := decodeResponse(resp, &result); err != nil {
|
||||
if err = decodeResponse(resp, &result); err != nil {
|
||||
return nil, fmt.Errorf("failed to decode response: %w", err)
|
||||
}
|
||||
|
||||
|
||||
+1
-1
@@ -26,7 +26,7 @@ services:
|
||||
- garage
|
||||
environment:
|
||||
# Garage S3 Configuration
|
||||
GARAGE_UI_GARAGE_ENDPOINT: "http://garage:3900"
|
||||
GARAGE_UI_GARAGE_ENDPOINT: "garage:3900"
|
||||
GARAGE_UI_GARAGE_ADMIN_ENDPOINT: "http://garage:3903"
|
||||
|
||||
# Server Configuration
|
||||
|
||||
Generated
+569
-739
File diff suppressed because it is too large
Load Diff
@@ -222,6 +222,11 @@ export const accessApi = {
|
||||
return response.data.data;
|
||||
},
|
||||
|
||||
getSecretKey: async (accessKey: string): Promise<string> => {
|
||||
const response = await api.get(`/v1/users/${accessKey}/secret`);
|
||||
return response.data.data.secretKey;
|
||||
},
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
createKey: async (name: string, permissions?: any[]): Promise<AccessKey> => {
|
||||
const response = await api.post('/v1/users', { name, permissions });
|
||||
|
||||
@@ -46,6 +46,7 @@ export function AccessControl() {
|
||||
const [createPermissionWrite, setCreatePermissionWrite] = useState(false);
|
||||
const [createPermissionOwner, setCreatePermissionOwner] = useState(false);
|
||||
const [createGrantPermissions, setCreateGrantPermissions] = useState(false);
|
||||
const [newlyCreatedKey, setNewlyCreatedKey] = useState<AccessKey | null>(null);
|
||||
|
||||
// Edit permissions state
|
||||
const [editPermissionsDialogOpen, setEditPermissionsDialogOpen] = useState(false);
|
||||
@@ -69,6 +70,11 @@ export function AccessControl() {
|
||||
const [expirationDate, setExpirationDate] = useState<string>('');
|
||||
const [neverExpires, setNeverExpires] = useState(true);
|
||||
|
||||
// Secret key dialog state
|
||||
const [secretKeyDialogOpen, setSecretKeyDialogOpen] = useState(false);
|
||||
const [revealedSecretKey, setRevealedSecretKey] = useState<string>('');
|
||||
const [isLoadingSecretKey, setIsLoadingSecretKey] = useState(false);
|
||||
|
||||
useEffect(() => {
|
||||
const fetchKeys = async () => {
|
||||
try {
|
||||
@@ -120,13 +126,8 @@ export function AccessControl() {
|
||||
}
|
||||
}
|
||||
|
||||
setCreateDialogOpen(false);
|
||||
setNewKeyName('');
|
||||
setCreateSelectedBucket('');
|
||||
setCreatePermissionRead(false);
|
||||
setCreatePermissionWrite(false);
|
||||
setCreatePermissionOwner(false);
|
||||
setCreateGrantPermissions(false);
|
||||
// Store the newly created key to show the secret key
|
||||
setNewlyCreatedKey(newKey);
|
||||
|
||||
// Refresh keys list
|
||||
const data = await accessApi.listKeys();
|
||||
@@ -138,6 +139,17 @@ export function AccessControl() {
|
||||
}
|
||||
};
|
||||
|
||||
const handleCloseCreateDialog = () => {
|
||||
setCreateDialogOpen(false);
|
||||
setNewKeyName('');
|
||||
setCreateSelectedBucket('');
|
||||
setCreatePermissionRead(false);
|
||||
setCreatePermissionWrite(false);
|
||||
setCreatePermissionOwner(false);
|
||||
setCreateGrantPermissions(false);
|
||||
setNewlyCreatedKey(null);
|
||||
};
|
||||
|
||||
const handleOpenCreateDialog = async () => {
|
||||
setCreateDialogOpen(true);
|
||||
setNewKeyName('');
|
||||
@@ -222,6 +234,23 @@ export function AccessControl() {
|
||||
}
|
||||
};
|
||||
|
||||
const handleRevealSecretKey = async (key: AccessKey) => {
|
||||
setSelectedKey(key);
|
||||
setIsLoadingSecretKey(true);
|
||||
setSecretKeyDialogOpen(true);
|
||||
setRevealedSecretKey('');
|
||||
|
||||
try {
|
||||
const secretKey = await accessApi.getSecretKey(key.accessKeyId);
|
||||
setRevealedSecretKey(secretKey);
|
||||
} catch (error) {
|
||||
console.error('Failed to fetch secret key:', error);
|
||||
setSecretKeyDialogOpen(false);
|
||||
} finally {
|
||||
setIsLoadingSecretKey(false);
|
||||
}
|
||||
};
|
||||
|
||||
const handleOpenEditPermissions = async (key: AccessKey) => {
|
||||
setEditingKey(key);
|
||||
setEditPermissionsDialogOpen(true);
|
||||
@@ -466,6 +495,11 @@ export function AccessControl() {
|
||||
</Button>
|
||||
</DropdownMenuTrigger>
|
||||
<DropdownMenuContent align="end">
|
||||
<DropdownMenuItem onClick={() => handleRevealSecretKey(key)}>
|
||||
<Key className="h-4 w-4" />
|
||||
View Secret Key
|
||||
</DropdownMenuItem>
|
||||
<DropdownMenuSeparator />
|
||||
<DropdownMenuItem onClick={() => handleOpenEditPermissions(key)}>
|
||||
<Edit className="h-4 w-4" />
|
||||
Edit Permissions
|
||||
@@ -525,122 +559,200 @@ export function AccessControl() {
|
||||
</div>
|
||||
|
||||
{/* Create Key Dialog */}
|
||||
<Dialog open={createDialogOpen} onOpenChange={setCreateDialogOpen}>
|
||||
<Dialog open={createDialogOpen} onOpenChange={handleCloseCreateDialog}>
|
||||
<DialogContent className="max-w-2xl">
|
||||
<DialogHeader>
|
||||
<DialogTitle>Create API Key</DialogTitle>
|
||||
<DialogDescription>
|
||||
Create a new API key with optional bucket permissions
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
<div className="space-y-4 py-4">
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Key Name</label>
|
||||
<Input
|
||||
placeholder="My Application Key"
|
||||
value={newKeyName}
|
||||
onChange={(e) => setNewKeyName(e.target.value)}
|
||||
/>
|
||||
<p className="text-xs text-muted-foreground">
|
||||
A friendly name to identify this API key
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{/* Optional: Grant permissions during creation */}
|
||||
<div className="space-y-3 border-t pt-4">
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="grant-permissions-on-create"
|
||||
checked={createGrantPermissions}
|
||||
onCheckedChange={(checked) => {
|
||||
setCreateGrantPermissions(checked as boolean);
|
||||
if (!checked) {
|
||||
setCreateSelectedBucket('');
|
||||
setCreatePermissionRead(false);
|
||||
setCreatePermissionWrite(false);
|
||||
setCreatePermissionOwner(false);
|
||||
}
|
||||
}}
|
||||
/>
|
||||
<span className="text-sm font-medium">Grant bucket permissions now</span>
|
||||
</label>
|
||||
<p className="text-xs text-muted-foreground">
|
||||
You can also grant permissions later from the Edit Permissions menu
|
||||
</p>
|
||||
|
||||
{createGrantPermissions && (
|
||||
<div className="space-y-4 pl-6 pt-2">
|
||||
{/* Bucket Selection */}
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Select Bucket</label>
|
||||
<Select
|
||||
value={createSelectedBucket}
|
||||
onChange={(value) => setCreateSelectedBucket(value)}
|
||||
{newlyCreatedKey ? (
|
||||
// Success state - show the secret key
|
||||
<>
|
||||
<DialogHeader>
|
||||
<DialogTitle>API Key Created Successfully</DialogTitle>
|
||||
<DialogDescription>
|
||||
Save your secret access key now. You won't be able to see it again.
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
<div className="space-y-4 py-4">
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Key Name</label>
|
||||
<div className="text-sm text-muted-foreground">{newlyCreatedKey.name}</div>
|
||||
</div>
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Access Key ID</label>
|
||||
<div className="flex items-center gap-2">
|
||||
<code className="text-sm bg-muted px-3 py-2 rounded flex-1">
|
||||
{newlyCreatedKey.accessKeyId}
|
||||
</code>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
onClick={() => {
|
||||
navigator.clipboard.writeText(newlyCreatedKey.accessKeyId);
|
||||
toast.success('Access Key ID copied to clipboard');
|
||||
}}
|
||||
>
|
||||
<SelectOption value="">-- Select a bucket --</SelectOption>
|
||||
{createAvailableBuckets.map((bucket) => (
|
||||
<SelectOption key={bucket.name} value={bucket.name}>
|
||||
{bucket.name}
|
||||
</SelectOption>
|
||||
))}
|
||||
</Select>
|
||||
<Copy className="h-4 w-4" />
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Secret Access Key</label>
|
||||
<div className="flex items-center gap-2">
|
||||
<code className="text-sm bg-muted px-3 py-2 rounded flex-1 break-all">
|
||||
{newlyCreatedKey.secretKey}
|
||||
</code>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
onClick={() => {
|
||||
if (newlyCreatedKey.secretKey) {
|
||||
navigator.clipboard.writeText(newlyCreatedKey.secretKey);
|
||||
toast.success('Secret Access Key copied to clipboard');
|
||||
}
|
||||
}}
|
||||
>
|
||||
<Copy className="h-4 w-4" />
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
<div className="border rounded-lg p-4 bg-yellow-50 dark:bg-yellow-950/20 border-yellow-200 dark:border-yellow-900">
|
||||
<div className="flex gap-2">
|
||||
<ShieldX className="h-5 w-5 text-yellow-600 dark:text-yellow-500 flex-shrink-0" />
|
||||
<div className="space-y-1">
|
||||
<p className="text-sm font-medium text-yellow-800 dark:text-yellow-200">
|
||||
Important: Save This Key Now
|
||||
</p>
|
||||
<p className="text-xs text-yellow-700 dark:text-yellow-300">
|
||||
This is the only time you'll see the secret access key. Make sure to copy and save it securely.
|
||||
If you lose it, you'll need to create a new key.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<DialogFooter>
|
||||
<Button onClick={handleCloseCreateDialog}>
|
||||
Done
|
||||
</Button>
|
||||
</DialogFooter>
|
||||
</>
|
||||
) : (
|
||||
// Creation form
|
||||
<>
|
||||
<DialogHeader>
|
||||
<DialogTitle>Create API Key</DialogTitle>
|
||||
<DialogDescription>
|
||||
Create a new API key with optional bucket permissions
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
<div className="space-y-4 py-4">
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Key Name</label>
|
||||
<Input
|
||||
placeholder="My Application Key"
|
||||
value={newKeyName}
|
||||
onChange={(e) => setNewKeyName(e.target.value)}
|
||||
/>
|
||||
<p className="text-xs text-muted-foreground">
|
||||
A friendly name to identify this API key
|
||||
</p>
|
||||
</div>
|
||||
|
||||
{/* Permissions */}
|
||||
{createSelectedBucket && (
|
||||
<div className="space-y-3">
|
||||
<label className="text-sm font-medium">Permissions</label>
|
||||
<div className="space-y-2 border rounded-lg p-3">
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-read"
|
||||
checked={createPermissionRead}
|
||||
onCheckedChange={(checked) => setCreatePermissionRead(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Read</span>
|
||||
<p className="text-xs text-muted-foreground">GetObject, HeadObject, ListObjects</p>
|
||||
</div>
|
||||
</label>
|
||||
{/* Optional: Grant permissions during creation */}
|
||||
<div className="space-y-3 border-t pt-4">
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="grant-permissions-on-create"
|
||||
checked={createGrantPermissions}
|
||||
onCheckedChange={(checked) => {
|
||||
setCreateGrantPermissions(checked as boolean);
|
||||
if (!checked) {
|
||||
setCreateSelectedBucket('');
|
||||
setCreatePermissionRead(false);
|
||||
setCreatePermissionWrite(false);
|
||||
setCreatePermissionOwner(false);
|
||||
}
|
||||
}}
|
||||
/>
|
||||
<span className="text-sm font-medium">Grant bucket permissions now</span>
|
||||
</label>
|
||||
<p className="text-xs text-muted-foreground">
|
||||
You can also grant permissions later from the Edit Permissions menu
|
||||
</p>
|
||||
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-write"
|
||||
checked={createPermissionWrite}
|
||||
onCheckedChange={(checked) => setCreatePermissionWrite(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Write</span>
|
||||
<p className="text-xs text-muted-foreground">PutObject, DeleteObject</p>
|
||||
</div>
|
||||
</label>
|
||||
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-owner"
|
||||
checked={createPermissionOwner}
|
||||
onCheckedChange={(checked) => setCreatePermissionOwner(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Owner</span>
|
||||
<p className="text-xs text-muted-foreground">DeleteBucket, PutBucketPolicy</p>
|
||||
</div>
|
||||
</label>
|
||||
{createGrantPermissions && (
|
||||
<div className="space-y-4 pl-6 pt-2">
|
||||
{/* Bucket Selection */}
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Select Bucket</label>
|
||||
<Select
|
||||
value={createSelectedBucket}
|
||||
onChange={(value) => setCreateSelectedBucket(value)}
|
||||
>
|
||||
<SelectOption value="">-- Select a bucket --</SelectOption>
|
||||
{createAvailableBuckets.map((bucket) => (
|
||||
<SelectOption key={bucket.name} value={bucket.name}>
|
||||
{bucket.name}
|
||||
</SelectOption>
|
||||
))}
|
||||
</Select>
|
||||
</div>
|
||||
|
||||
{/* Permissions */}
|
||||
{createSelectedBucket && (
|
||||
<div className="space-y-3">
|
||||
<label className="text-sm font-medium">Permissions</label>
|
||||
<div className="space-y-2 border rounded-lg p-3">
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-read"
|
||||
checked={createPermissionRead}
|
||||
onCheckedChange={(checked) => setCreatePermissionRead(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Read</span>
|
||||
<p className="text-xs text-muted-foreground">GetObject, HeadObject, ListObjects</p>
|
||||
</div>
|
||||
</label>
|
||||
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-write"
|
||||
checked={createPermissionWrite}
|
||||
onCheckedChange={(checked) => setCreatePermissionWrite(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Write</span>
|
||||
<p className="text-xs text-muted-foreground">PutObject, DeleteObject</p>
|
||||
</div>
|
||||
</label>
|
||||
|
||||
<label className="flex items-center space-x-2 cursor-pointer">
|
||||
<Checkbox
|
||||
id="create-permission-owner"
|
||||
checked={createPermissionOwner}
|
||||
onCheckedChange={(checked) => setCreatePermissionOwner(checked as boolean)}
|
||||
/>
|
||||
<div>
|
||||
<span className="text-sm font-medium">Owner</span>
|
||||
<p className="text-xs text-muted-foreground">DeleteBucket, PutBucketPolicy</p>
|
||||
</div>
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
<DialogFooter>
|
||||
<Button variant="outline" onClick={() => setCreateDialogOpen(false)}>
|
||||
Cancel
|
||||
</Button>
|
||||
<Button onClick={handleCreateKey} disabled={!newKeyName}>
|
||||
Create Key
|
||||
</Button>
|
||||
</DialogFooter>
|
||||
</div>
|
||||
<DialogFooter>
|
||||
<Button variant="outline" onClick={handleCloseCreateDialog}>
|
||||
Cancel
|
||||
</Button>
|
||||
<Button onClick={handleCreateKey} disabled={!newKeyName}>
|
||||
Create Key
|
||||
</Button>
|
||||
</DialogFooter>
|
||||
</>
|
||||
)}
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
|
||||
@@ -665,6 +777,92 @@ export function AccessControl() {
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
|
||||
{/* Secret Key Dialog */}
|
||||
<Dialog open={secretKeyDialogOpen} onOpenChange={setSecretKeyDialogOpen}>
|
||||
<DialogContent className="max-w-2xl">
|
||||
<DialogHeader>
|
||||
<DialogTitle>Secret Access Key</DialogTitle>
|
||||
<DialogDescription>
|
||||
Copy your secret access key now. For security reasons, it cannot be viewed again.
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
<div className="space-y-4 py-4">
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Key Name</label>
|
||||
<div className="text-sm text-muted-foreground">{selectedKey?.name}</div>
|
||||
</div>
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Access Key ID</label>
|
||||
<div className="flex items-center gap-2">
|
||||
<code className="text-sm bg-muted px-3 py-2 rounded flex-1">
|
||||
{selectedKey?.accessKeyId}
|
||||
</code>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
onClick={() => {
|
||||
if (selectedKey?.accessKeyId) {
|
||||
navigator.clipboard.writeText(selectedKey.accessKeyId);
|
||||
toast.success('Access Key ID copied to clipboard');
|
||||
}
|
||||
}}
|
||||
>
|
||||
<Copy className="h-4 w-4" />
|
||||
</Button>
|
||||
</div>
|
||||
</div>
|
||||
<div className="space-y-2">
|
||||
<label className="text-sm font-medium">Secret Access Key</label>
|
||||
<div className="flex items-center gap-2">
|
||||
{isLoadingSecretKey ? (
|
||||
<div className="flex items-center gap-2 text-muted-foreground flex-1 bg-muted px-3 py-2 rounded">
|
||||
<Loader2 className="h-4 w-4 animate-spin" />
|
||||
<span className="text-sm">Loading secret key...</span>
|
||||
</div>
|
||||
) : (
|
||||
<>
|
||||
<code className="text-sm bg-muted px-3 py-2 rounded flex-1 break-all">
|
||||
{revealedSecretKey}
|
||||
</code>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
onClick={() => {
|
||||
if (revealedSecretKey) {
|
||||
navigator.clipboard.writeText(revealedSecretKey);
|
||||
toast.success('Secret Access Key copied to clipboard');
|
||||
}
|
||||
}}
|
||||
disabled={!revealedSecretKey}
|
||||
>
|
||||
<Copy className="h-4 w-4" />
|
||||
</Button>
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
<div className="border rounded-lg p-4 bg-yellow-50 dark:bg-yellow-950/20 border-yellow-200 dark:border-yellow-900">
|
||||
<div className="flex gap-2">
|
||||
<ShieldX className="h-5 w-5 text-yellow-600 dark:text-yellow-500 flex-shrink-0" />
|
||||
<div className="space-y-1">
|
||||
<p className="text-sm font-medium text-yellow-800 dark:text-yellow-200">
|
||||
Security Warning
|
||||
</p>
|
||||
<p className="text-xs text-yellow-700 dark:text-yellow-300">
|
||||
Keep this secret key secure. Anyone with access to it can perform operations on your behalf.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<DialogFooter>
|
||||
<Button onClick={() => setSecretKeyDialogOpen(false)}>
|
||||
Close
|
||||
</Button>
|
||||
</DialogFooter>
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
|
||||
{/* Key Settings Dialog */}
|
||||
<Dialog open={settingsDialogOpen} onOpenChange={setSettingsDialogOpen}>
|
||||
<DialogContent className="max-w-lg">
|
||||
|
||||
@@ -60,6 +60,7 @@ export interface ObjectMetadata {
|
||||
export interface AccessKey {
|
||||
accessKeyId: string;
|
||||
name: string;
|
||||
secretKey?: string;
|
||||
createdAt: string;
|
||||
lastUsed?: string;
|
||||
status: 'active' | 'inactive';
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v2
|
||||
name: garage-ui
|
||||
description: A Helm chart for Garage UI - Web interface for Garage S3 object storage
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "v0.0.5"
|
||||
keywords:
|
||||
- garage
|
||||
- s3
|
||||
- object-storage
|
||||
- ui
|
||||
- dashboard
|
||||
- web-ui
|
||||
home: https://github.com/Noooste/garage-ui
|
||||
sources:
|
||||
- https://github.com/Noooste/garage-ui
|
||||
maintainers:
|
||||
- name: Noooste
|
||||
kubeVersion: ">=1.19.0-0"
|
||||
@@ -0,0 +1,396 @@
|
||||
# Garage UI Helm Chart
|
||||
|
||||
A Helm chart for deploying Garage UI, a web interface for [Garage](https://garagehq.deuxfleurs.fr/) S3 object storage.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a Garage UI deployment on a Kubernetes cluster using the Helm package manager. Garage UI provides a user-friendly web interface for managing your Garage S3 storage, including buckets, objects, users, and cluster monitoring.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- A running Garage S3 instance with Admin API access
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-garage-ui`:
|
||||
|
||||
```bash
|
||||
helm install my-garage-ui ./helm/garage-ui
|
||||
```
|
||||
|
||||
The command deploys Garage UI on the Kubernetes cluster with default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-garage-ui` deployment:
|
||||
|
||||
```bash
|
||||
helm uninstall my-garage-ui
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Parameters
|
||||
|
||||
### Common Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `replicaCount` | Number of Garage UI replicas | `1` |
|
||||
| `image.repository` | Garage UI image repository | `noooste/garage-ui` |
|
||||
| `image.tag` | Garage UI image tag (overrides Chart appVersion) | `""` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Image pull secrets | `[]` |
|
||||
| `nameOverride` | Override chart name | `""` |
|
||||
| `fullnameOverride` | Override full resource names | `""` |
|
||||
|
||||
### Service Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `80` |
|
||||
|
||||
### Configuration Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `config` | Complete config.yaml content as multiline string | See `values.yaml` |
|
||||
|
||||
**Important:** The `config` parameter contains the entire application configuration including Garage endpoints, authentication settings, CORS, and logging. You must customize this section with your Garage S3 endpoints and admin token.
|
||||
|
||||
### Ingress Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `ingress.enabled` | Enable ingress controller resource | `false` |
|
||||
| `ingress.className` | Ingress class name | `nginx` |
|
||||
| `ingress.annotations` | Ingress annotations | `{}` |
|
||||
| `ingress.hosts` | Ingress hosts configuration | See `values.yaml` |
|
||||
| `ingress.tls` | Ingress TLS configuration | `[]` |
|
||||
|
||||
### Monitoring Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `serviceMonitor.enabled` | Create ServiceMonitor resource (requires Prometheus Operator) | `false` |
|
||||
| `serviceMonitor.interval` | Scrape interval | `30s` |
|
||||
| `serviceMonitor.path` | Metrics endpoint path | `/api/v1/monitoring/metrics` |
|
||||
| `serviceMonitor.labels` | Additional labels for ServiceMonitor | `{}` |
|
||||
|
||||
### Network Policy Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
|
||||
| `networkPolicy.policyTypes` | Policy types | `["Ingress", "Egress"]` |
|
||||
|
||||
### Resource Management Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `resources.limits.cpu` | CPU limit | `500m` |
|
||||
| `resources.limits.memory` | Memory limit | `512Mi` |
|
||||
| `resources.requests.cpu` | CPU request | `100m` |
|
||||
| `resources.requests.memory` | Memory request | `128Mi` |
|
||||
|
||||
### Health Check Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `livenessProbe.enabled` | Enable liveness probe | `true` |
|
||||
| `readinessProbe.enabled` | Enable readiness probe | `true` |
|
||||
|
||||
### Other Parameters
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-----------|-------------|---------|
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `podSecurityContext` | Pod security context | See `values.yaml` |
|
||||
| `securityContext` | Container security context | See `values.yaml` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
|
||||
## Configuration Examples
|
||||
|
||||
### Example 1: Basic Installation with Custom Garage Endpoints
|
||||
|
||||
Create a file named `custom-values.yaml`:
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage-s3.garage.svc.cluster.local:3900"
|
||||
region: "us-east-1"
|
||||
admin_endpoint: "http://garage-admin.garage.svc.cluster.local:3903"
|
||||
admin_token: "YOUR_ADMIN_TOKEN_HERE"
|
||||
|
||||
auth:
|
||||
mode: "none"
|
||||
|
||||
cors:
|
||||
enabled: true
|
||||
allowed_origins:
|
||||
- "*"
|
||||
|
||||
logging:
|
||||
level: "info"
|
||||
format: "json"
|
||||
```
|
||||
|
||||
Install the chart:
|
||||
|
||||
```bash
|
||||
helm install my-garage-ui ./helm/garage-ui -f custom-values.yaml
|
||||
```
|
||||
|
||||
### Example 2: With Ingress and TLS
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage:3900"
|
||||
region: "garage"
|
||||
admin_endpoint: "http://garage:3903"
|
||||
admin_token: "YOUR_ADMIN_TOKEN"
|
||||
|
||||
auth:
|
||||
mode: "none"
|
||||
|
||||
cors:
|
||||
enabled: true
|
||||
|
||||
logging:
|
||||
level: "info"
|
||||
format: "json"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
hosts:
|
||||
- host: garage-ui.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: garage-ui-tls
|
||||
hosts:
|
||||
- garage-ui.example.com
|
||||
```
|
||||
|
||||
### Example 3: With Basic Authentication
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage:3900"
|
||||
region: "garage"
|
||||
admin_endpoint: "http://garage:3903"
|
||||
admin_token: "YOUR_ADMIN_TOKEN"
|
||||
|
||||
auth:
|
||||
mode: "basic"
|
||||
basic:
|
||||
username: "admin"
|
||||
password: "your-secure-password"
|
||||
|
||||
cors:
|
||||
enabled: true
|
||||
|
||||
logging:
|
||||
level: "info"
|
||||
format: "json"
|
||||
```
|
||||
|
||||
### Example 4: With OIDC Authentication (Keycloak)
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage:3900"
|
||||
region: "garage"
|
||||
admin_endpoint: "http://garage:3903"
|
||||
admin_token: "YOUR_ADMIN_TOKEN"
|
||||
|
||||
auth:
|
||||
mode: "oidc"
|
||||
oidc:
|
||||
enabled: true
|
||||
provider_name: "Keycloak"
|
||||
client_id: "garage-ui"
|
||||
client_secret: "YOUR_OIDC_CLIENT_SECRET"
|
||||
scopes:
|
||||
- openid
|
||||
- email
|
||||
- profile
|
||||
issuer_url: "https://keycloak.example.com/realms/master"
|
||||
auth_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/auth"
|
||||
token_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/token"
|
||||
userinfo_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/userinfo"
|
||||
cookie_secure: true
|
||||
|
||||
cors:
|
||||
enabled: true
|
||||
|
||||
logging:
|
||||
level: "info"
|
||||
format: "json"
|
||||
```
|
||||
|
||||
### Example 5: With Prometheus Monitoring
|
||||
|
||||
```yaml
|
||||
config: |
|
||||
server:
|
||||
host: "0.0.0.0"
|
||||
port: 8080
|
||||
environment: "production"
|
||||
|
||||
garage:
|
||||
endpoint: "http://garage:3900"
|
||||
region: "garage"
|
||||
admin_endpoint: "http://garage:3903"
|
||||
admin_token: "YOUR_ADMIN_TOKEN"
|
||||
|
||||
auth:
|
||||
mode: "none"
|
||||
|
||||
cors:
|
||||
enabled: true
|
||||
|
||||
logging:
|
||||
level: "info"
|
||||
format: "json"
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 30s
|
||||
labels:
|
||||
prometheus: kube-prometheus
|
||||
```
|
||||
|
||||
## Accessing the Application
|
||||
|
||||
### Via Port Forward (Development)
|
||||
|
||||
```bash
|
||||
kubectl port-forward svc/my-garage-ui 8080:80
|
||||
```
|
||||
|
||||
Then visit http://localhost:8080 in your browser.
|
||||
|
||||
### Via Ingress (Production)
|
||||
|
||||
If you've enabled Ingress, access the application at the configured hostname (e.g., https://garage-ui.example.com).
|
||||
|
||||
## Upgrading
|
||||
|
||||
To upgrade the `my-garage-ui` deployment:
|
||||
|
||||
```bash
|
||||
helm upgrade my-garage-ui ./helm/garage-ui -f custom-values.yaml
|
||||
```
|
||||
|
||||
## Configuration Details
|
||||
|
||||
### Garage Endpoints
|
||||
|
||||
The application requires two Garage endpoints:
|
||||
|
||||
- **S3 API Endpoint** (`garage.endpoint`): The Garage S3 API endpoint (default port 3900)
|
||||
- **Admin API Endpoint** (`garage.admin_endpoint`): The Garage Admin API endpoint (default port 3903)
|
||||
- **Admin Token** (`garage.admin_token`): Bearer token for Admin API authentication (required)
|
||||
|
||||
### Authentication Modes
|
||||
|
||||
The application supports three authentication modes:
|
||||
|
||||
1. **None** (`auth.mode: "none"`): No authentication required
|
||||
2. **Basic** (`auth.mode: "basic"`): HTTP Basic authentication with username/password
|
||||
3. **OIDC** (`auth.mode: "oidc"`): OpenID Connect for enterprise SSO
|
||||
|
||||
### Health Checks
|
||||
|
||||
The application exposes a health check endpoint at `/health` which is used for:
|
||||
- Kubernetes liveness probes
|
||||
- Kubernetes readiness probes
|
||||
- Manual health verification
|
||||
|
||||
### Metrics
|
||||
|
||||
When ServiceMonitor is enabled, Prometheus will scrape metrics from `/api/v1/monitoring/metrics`. This endpoint proxies metrics from the Garage Admin API.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Pods not starting
|
||||
|
||||
Check if the config is valid:
|
||||
```bash
|
||||
kubectl logs -l app.kubernetes.io/name=garage-ui
|
||||
```
|
||||
|
||||
Common issues:
|
||||
- Missing or invalid `garage.admin_token`
|
||||
- Unreachable Garage endpoints
|
||||
- Invalid OIDC configuration when using `auth.mode: "oidc"`
|
||||
|
||||
### Can't access the UI
|
||||
|
||||
If using Ingress:
|
||||
```bash
|
||||
kubectl get ingress
|
||||
kubectl describe ingress <ingress-name>
|
||||
```
|
||||
|
||||
If using port-forward:
|
||||
```bash
|
||||
kubectl get pods
|
||||
kubectl port-forward <pod-name> 8080:8080
|
||||
```
|
||||
|
||||
### Configuration not updating
|
||||
|
||||
The deployment includes a checksum annotation for the ConfigMap. Changes to the config will automatically trigger a pod restart. If not:
|
||||
|
||||
```bash
|
||||
kubectl rollout restart deployment/my-garage-ui
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
This Helm chart is open source and available under the same license as Garage UI.
|
||||
|
||||
## Support
|
||||
|
||||
For issues and questions:
|
||||
- GitHub Issues: https://github.com/Noooste/garage-ui/issues
|
||||
- Garage Documentation: https://garagehq.deuxfleurs.fr/
|
||||
|
||||
## Contributing
|
||||
|
||||
Contributions are welcome! Please submit pull requests to the Garage UI repository.
|
||||
@@ -0,0 +1,27 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "garage-ui.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "garage-ui.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "garage-ui.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "garage-ui.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
|
||||
echo "Visit http://127.0.0.1:8080 to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
|
||||
{{- end }}
|
||||
|
||||
2. To view logs:
|
||||
kubectl logs -f deployment/{{ include "garage-ui.fullname" . }} -n {{ .Release.Namespace }}
|
||||
|
||||
For more information, see the README at https://github.com/Noooste/garage-ui/blob/main/helm/garage-ui/README.md
|
||||
@@ -0,0 +1,51 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "garage-ui.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "garage-ui.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "garage-ui.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "garage-ui.labels" -}}
|
||||
helm.sh/chart: {{ include "garage-ui.chart" . }}
|
||||
{{ include "garage-ui.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "garage-ui.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "garage-ui.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yaml: |
|
||||
{{- .Values.config | toYaml | nindent 4 }}
|
||||
@@ -0,0 +1,80 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "garage-ui.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "garage-ui.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
{{- if .Values.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.livenessProbe.httpGet.path }}
|
||||
port: {{ .Values.livenessProbe.httpGet.port }}
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ .Values.readinessProbe.httpGet.path }}
|
||||
port: {{ .Values.readinessProbe.httpGet.port }}
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /app/config.yaml
|
||||
subPath: config.yaml
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "garage-ui.fullname" . }}-config
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
- path: {{ .path }}
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "garage-ui.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if .Values.networkPolicy.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "garage-ui.selectorLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
{{- toYaml .Values.networkPolicy.policyTypes | nindent 4 }}
|
||||
ingress:
|
||||
- from: []
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
egress:
|
||||
- to: []
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "garage-ui.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "garage-ui.fullname" . }}
|
||||
labels:
|
||||
{{- include "garage-ui.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "garage-ui.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: http
|
||||
path: {{ .Values.serviceMonitor.path }}
|
||||
interval: {{ .Values.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,553 @@
|
||||
# Default values for garage-ui Helm chart
|
||||
# This file contains configuration values for deploying Garage UI
|
||||
# Customize the values below according to your deployment environment
|
||||
|
||||
# Number of replica pods to run
|
||||
# Increase for high availability (recommended: 2-3 for production)
|
||||
replicaCount: 1
|
||||
|
||||
# Docker image configuration
|
||||
image:
|
||||
# Container registry and image name
|
||||
# Default uses the official Garage UI image from Docker Hub
|
||||
repository: noooste/garage-ui
|
||||
|
||||
# Image pull policy
|
||||
# Options: Always, IfNotPresent, Never
|
||||
# IfNotPresent: Only pull if image is not already present locally
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Image tag to use (defaults to chart appVersion if empty)
|
||||
# Example: "1.0.0" or "latest"
|
||||
tag: ""
|
||||
|
||||
# Credentials for accessing private container registries
|
||||
# Example:
|
||||
# imagePullSecrets:
|
||||
# - name: regcred
|
||||
imagePullSecrets: []
|
||||
|
||||
# Override the default chart name in resource names
|
||||
# Leave empty to use the chart name
|
||||
nameOverride: ""
|
||||
|
||||
# Override the full resource name (includes release name)
|
||||
# Leave empty to use the default naming convention
|
||||
fullnameOverride: ""
|
||||
|
||||
# ============================================================================
|
||||
# APPLICATION CONFIGURATION
|
||||
# ============================================================================
|
||||
# This section contains the main application configuration
|
||||
# Customize according to your Garage deployment and security requirements
|
||||
#
|
||||
# TIP: You can now easily override specific values using --set:
|
||||
# --set config.server.port=9090
|
||||
# --set config.garage.admin_token=your-token
|
||||
# --set config.auth.mode=basic
|
||||
config:
|
||||
# ========================================
|
||||
# Server Configuration
|
||||
# ========================================
|
||||
server:
|
||||
# Network interface to bind to
|
||||
# "0.0.0.0" listens on all interfaces (recommended for containers)
|
||||
host: "0.0.0.0"
|
||||
|
||||
# Port the application listens on
|
||||
# Default: 8080
|
||||
port: 8080
|
||||
|
||||
# Deployment environment
|
||||
# Options: "production", "development", "staging"
|
||||
environment: "production"
|
||||
|
||||
# ========================================
|
||||
# Garage S3 Storage Configuration
|
||||
# ========================================
|
||||
garage:
|
||||
# Garage S3 API endpoint
|
||||
# Format: http(s)://hostname:port
|
||||
# Default port: 3900
|
||||
# Example: "http://garage.example.com:3900" or "http://garage:3900" for in-cluster
|
||||
endpoint: "http://garage:3900"
|
||||
|
||||
# S3 region name
|
||||
# For Garage, this can be any arbitrary value (Garage ignores regions)
|
||||
# Default: "garage"
|
||||
region: "garage"
|
||||
|
||||
# Garage Admin API endpoint
|
||||
# This is used for administrative operations like bucket and key management
|
||||
# Default port: 3903
|
||||
# Example: "http://garage.example.com:3903" or "http://garage:3903" for in-cluster
|
||||
admin_endpoint: "http://garage:3903"
|
||||
|
||||
# Admin API bearer token
|
||||
# REQUIRED: Obtain this from your Garage server configuration
|
||||
# This token grants administrative access - keep it secure!
|
||||
# To generate: See Garage documentation for admin token setup
|
||||
admin_token: ""
|
||||
|
||||
# ========================================
|
||||
# Authentication Configuration
|
||||
# ========================================
|
||||
auth:
|
||||
# Authentication mode
|
||||
# Options:
|
||||
# "none" - No authentication (open access - not recommended for production)
|
||||
# "basic" - Simple username/password authentication
|
||||
# "oidc" - OpenID Connect integration (recommended for production)
|
||||
mode: "none"
|
||||
|
||||
# Basic Authentication Settings
|
||||
# Only used when mode = "basic"
|
||||
# Provides simple username/password protection
|
||||
basic:
|
||||
# Username for basic auth login
|
||||
username: "admin"
|
||||
|
||||
# Password for basic auth login
|
||||
# IMPORTANT: Change this default password immediately!
|
||||
password: "changeme"
|
||||
|
||||
# OpenID Connect (OIDC) Configuration
|
||||
# Only used when mode = "oidc"
|
||||
# Integrates with identity providers like Keycloak, Auth0, Okta, etc.
|
||||
oidc:
|
||||
# Enable/disable OIDC (must be true when mode = "oidc")
|
||||
enabled: false
|
||||
|
||||
# Display name of your OIDC provider
|
||||
# Examples: "Keycloak", "Auth0", "Okta", "Azure AD"
|
||||
provider_name: "Keycloak"
|
||||
|
||||
# OAuth2 client ID registered with your OIDC provider
|
||||
# Obtain this from your OIDC provider's application settings
|
||||
client_id: "garage-ui"
|
||||
|
||||
# OAuth2 client secret registered with your OIDC provider
|
||||
# IMPORTANT: Keep this secret secure! Consider using Kubernetes secrets
|
||||
client_secret: "your-client-secret"
|
||||
|
||||
# OAuth2/OIDC scopes to request during authentication
|
||||
# Standard scopes: openid (required), email, profile
|
||||
# Add custom scopes as needed by your provider
|
||||
scopes:
|
||||
- openid
|
||||
- email
|
||||
- profile
|
||||
|
||||
# OIDC Provider Endpoints
|
||||
# Replace "keycloak.example.com" and realm with your actual values
|
||||
# For Keycloak: https://your-keycloak/realms/your-realm
|
||||
# For Auth0: https://your-tenant.auth0.com
|
||||
# For Okta: https://your-domain.okta.com
|
||||
|
||||
# OIDC issuer URL (base URL for OIDC discovery)
|
||||
issuer_url: "https://keycloak.example.com/realms/master"
|
||||
|
||||
# Authorization endpoint URL
|
||||
auth_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/auth"
|
||||
|
||||
# Token endpoint URL
|
||||
token_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/token"
|
||||
|
||||
# User info endpoint URL
|
||||
userinfo_url: "https://keycloak.example.com/realms/master/protocol/openid-connect/userinfo"
|
||||
|
||||
# Token Validation Settings
|
||||
# Set to true only if you have issuer mismatch issues (not recommended)
|
||||
skip_issuer_check: false
|
||||
|
||||
# Set to true to skip token expiry validation (not recommended for production)
|
||||
skip_expiry_check: false
|
||||
|
||||
# User Attribute Mappings
|
||||
# Map OIDC claims to application user attributes
|
||||
# Adjust these based on your OIDC provider's claim structure
|
||||
|
||||
# Claim containing user's email address
|
||||
email_attribute: "email"
|
||||
|
||||
# Claim containing user's username/login ID
|
||||
username_attribute: "preferred_username"
|
||||
|
||||
# Claim containing user's display name
|
||||
name_attribute: "name"
|
||||
|
||||
# Role-Based Access Control (Optional)
|
||||
# Path to roles in the OIDC token claims
|
||||
# Example for Keycloak: "resource_access.garage-ui.roles"
|
||||
# Example for Auth0: "https://your-app/roles"
|
||||
role_attribute_path: "resource_access.garage-ui.roles"
|
||||
|
||||
# Role name that grants admin privileges
|
||||
# Users with this role will have full administrative access
|
||||
admin_role: "admin"
|
||||
|
||||
# TLS/SSL Configuration
|
||||
# Skip TLS certificate verification (only for testing - never in production!)
|
||||
tls_skip_verify: false
|
||||
|
||||
# Session Management
|
||||
# How long user sessions remain valid without activity
|
||||
# Value in seconds (86400 = 24 hours)
|
||||
session_max_age: 86400
|
||||
|
||||
# Name of the session cookie
|
||||
cookie_name: "garage_session"
|
||||
|
||||
# Only send cookie over HTTPS connections
|
||||
# Set to false only for local development without HTTPS
|
||||
cookie_secure: true
|
||||
|
||||
# Prevent JavaScript access to the cookie (security feature)
|
||||
# Should remain true for security
|
||||
cookie_http_only: true
|
||||
|
||||
# SameSite cookie attribute for CSRF protection
|
||||
# Options: "lax" (recommended), "strict", "none"
|
||||
# Use "lax" for most cases, "strict" for maximum security
|
||||
cookie_same_site: "lax"
|
||||
|
||||
# ========================================
|
||||
# CORS (Cross-Origin Resource Sharing)
|
||||
# ========================================
|
||||
# Configure which origins can access the API from browsers
|
||||
cors:
|
||||
# Enable or disable CORS
|
||||
# Disable if the frontend and backend are served from the same origin
|
||||
enabled: true
|
||||
|
||||
# List of allowed origins
|
||||
# "*" allows all origins (convenient but less secure)
|
||||
# For production, specify exact origins:
|
||||
# Example:
|
||||
# - "https://garage-ui.example.com"
|
||||
# - "https://app.example.com"
|
||||
allowed_origins:
|
||||
- "*"
|
||||
|
||||
# HTTP methods that are allowed in CORS requests
|
||||
# Include all methods your API uses
|
||||
allowed_methods:
|
||||
- GET
|
||||
- POST
|
||||
- PUT
|
||||
- DELETE
|
||||
- OPTIONS
|
||||
|
||||
# HTTP headers that are allowed in CORS requests
|
||||
# Add any custom headers your application requires
|
||||
allowed_headers:
|
||||
- Origin
|
||||
- Content-Type
|
||||
- Accept
|
||||
- Authorization
|
||||
|
||||
# Allow credentials (cookies, authorization headers) in CORS requests
|
||||
# Set to true if your frontend needs to send authentication cookies
|
||||
# NOTE: When true, allowed_origins cannot be "*"
|
||||
allow_credentials: false
|
||||
|
||||
# How long browsers can cache CORS preflight responses (in seconds)
|
||||
# 3600 = 1 hour
|
||||
max_age: 3600
|
||||
|
||||
# ========================================
|
||||
# Logging Configuration
|
||||
# ========================================
|
||||
logging:
|
||||
# Log verbosity level
|
||||
# Options:
|
||||
# "debug" - Verbose logging, useful for troubleshooting
|
||||
# "info" - Standard logging (recommended for production)
|
||||
# "warn" - Only warnings and errors
|
||||
# "error" - Only errors
|
||||
level: "info"
|
||||
|
||||
# Log output format
|
||||
# Options:
|
||||
# "json" - Structured JSON format (recommended for production/log aggregation)
|
||||
# "text" - Human-readable text format (useful for development)
|
||||
format: "json"
|
||||
|
||||
# ============================================================================
|
||||
# KUBERNETES POD CONFIGURATION
|
||||
# ============================================================================
|
||||
|
||||
# Annotations to add to the pod
|
||||
# Use for integrations with service meshes, monitoring, etc.
|
||||
# Example:
|
||||
# podAnnotations:
|
||||
# prometheus.io/scrape: "true"
|
||||
# prometheus.io/port: "8080"
|
||||
podAnnotations: {}
|
||||
|
||||
# Pod-level security context
|
||||
# Defines security settings for all containers in the pod
|
||||
podSecurityContext:
|
||||
# Run containers as non-root user (security best practice)
|
||||
runAsNonRoot: true
|
||||
|
||||
# User ID to run containers as
|
||||
# Default: 1000 (non-privileged user)
|
||||
runAsUser: 1000
|
||||
|
||||
# Group ID for filesystem access
|
||||
# Files created by the pod will have this group ownership
|
||||
fsGroup: 1000
|
||||
|
||||
# Container-level security context
|
||||
# Security settings specific to the application container
|
||||
securityContext:
|
||||
# Prevent privilege escalation (security best practice)
|
||||
# Ensures the container cannot gain more privileges than its parent
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
# Drop all Linux capabilities and only add what's needed
|
||||
# This follows the principle of least privilege
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
# Allow write access to the root filesystem
|
||||
# Set to true for read-only root filesystem (more secure but may require adjustments)
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
# ============================================================================
|
||||
# KUBERNETES SERVICE
|
||||
# ============================================================================
|
||||
service:
|
||||
# Service type determines how the service is exposed
|
||||
# Options:
|
||||
# ClusterIP - Internal only (default, recommended when using Ingress)
|
||||
# NodePort - Expose on each node's IP at a static port
|
||||
# LoadBalancer - Expose using a cloud provider's load balancer
|
||||
type: ClusterIP
|
||||
|
||||
# Port the service listens on
|
||||
# This is the port other services/ingress will connect to
|
||||
# Default: 80
|
||||
port: 80
|
||||
|
||||
# ============================================================================
|
||||
# INGRESS CONFIGURATION
|
||||
# ============================================================================
|
||||
# Ingress exposes HTTP/HTTPS routes from outside the cluster to the service
|
||||
ingress:
|
||||
# Enable or disable ingress
|
||||
# Set to true to make the application accessible from outside the cluster
|
||||
enabled: false
|
||||
|
||||
# Ingress class name
|
||||
# Specifies which ingress controller to use
|
||||
# Common values: "nginx", "traefik", "alb" (AWS)
|
||||
# Ensure the specified controller is installed in your cluster
|
||||
className: "nginx"
|
||||
|
||||
# Additional annotations for the ingress
|
||||
# Use for configuring ingress controller behavior, SSL, authentication, etc.
|
||||
# Examples:
|
||||
# cert-manager.io/cluster-issuer: "letsencrypt-prod" # For automatic SSL certificates
|
||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
# nginx.ingress.kubernetes.io/proxy-body-size: "100m"
|
||||
annotations: {}
|
||||
|
||||
# Hostname and path configuration
|
||||
hosts:
|
||||
# Replace "garage-ui.local" with your actual domain
|
||||
- host: garage-ui.local
|
||||
paths:
|
||||
# Path where the application will be accessible
|
||||
- path: /
|
||||
# pathType options: Prefix, Exact, ImplementationSpecific
|
||||
pathType: Prefix
|
||||
|
||||
# TLS/SSL configuration
|
||||
# Uncomment and configure to enable HTTPS
|
||||
# Requires a TLS certificate stored in a Kubernetes secret
|
||||
tls: []
|
||||
# - secretName: garage-ui-tls
|
||||
# hosts:
|
||||
# - garage-ui.local
|
||||
#
|
||||
# To use cert-manager for automatic certificates:
|
||||
# 1. Install cert-manager in your cluster
|
||||
# 2. Create a ClusterIssuer (e.g., letsencrypt-prod)
|
||||
# 3. Add annotation: cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
# 4. Uncomment the tls section above
|
||||
|
||||
# ============================================================================
|
||||
# RESOURCE LIMITS AND REQUESTS
|
||||
# ============================================================================
|
||||
# Configure CPU and memory allocation for the pods
|
||||
# Requests: Guaranteed resources (used for scheduling)
|
||||
# Limits: Maximum resources the container can use
|
||||
resources:
|
||||
limits:
|
||||
# Maximum CPU cores the container can use
|
||||
# 500m = 0.5 CPU cores
|
||||
# Increase for high-traffic deployments
|
||||
cpu: 500m
|
||||
|
||||
# Maximum memory the container can use
|
||||
# Container will be killed if it exceeds this limit
|
||||
memory: 512Mi
|
||||
|
||||
requests:
|
||||
# Guaranteed CPU allocated to the container
|
||||
# 100m = 0.1 CPU cores
|
||||
# Cluster scheduler ensures this amount is available
|
||||
cpu: 100m
|
||||
|
||||
# Guaranteed memory allocated to the container
|
||||
# Cluster scheduler ensures this amount is available
|
||||
memory: 128Mi
|
||||
|
||||
# ============================================================================
|
||||
# HEALTH CHECKS
|
||||
# ============================================================================
|
||||
|
||||
# Liveness Probe
|
||||
# Kubernetes restarts the container if this probe fails
|
||||
# Detects if the application is running but in a broken state
|
||||
livenessProbe:
|
||||
# Enable or disable the liveness probe
|
||||
enabled: true
|
||||
|
||||
# HTTP endpoint to check
|
||||
httpGet:
|
||||
# Health check endpoint path
|
||||
path: /health
|
||||
# Port name (defined in the container spec)
|
||||
port: http
|
||||
|
||||
# Wait time before starting liveness checks after container starts
|
||||
# Give the application time to initialize
|
||||
initialDelaySeconds: 30
|
||||
|
||||
# How often to perform the probe (in seconds)
|
||||
periodSeconds: 10
|
||||
|
||||
# Maximum time to wait for the probe to complete
|
||||
timeoutSeconds: 3
|
||||
|
||||
# Number of consecutive failures before restarting the container
|
||||
failureThreshold: 3
|
||||
|
||||
# Readiness Probe
|
||||
# Kubernetes stops sending traffic if this probe fails
|
||||
# Determines when the container is ready to accept traffic
|
||||
readinessProbe:
|
||||
# Enable or disable the readiness probe
|
||||
enabled: true
|
||||
|
||||
# HTTP endpoint to check
|
||||
httpGet:
|
||||
# Readiness check endpoint path
|
||||
path: /health
|
||||
# Port name (defined in the container spec)
|
||||
port: http
|
||||
|
||||
# Wait time before starting readiness checks after container starts
|
||||
initialDelaySeconds: 10
|
||||
|
||||
# How often to perform the probe (in seconds)
|
||||
periodSeconds: 5
|
||||
|
||||
# Maximum time to wait for the probe to complete
|
||||
timeoutSeconds: 3
|
||||
|
||||
# Number of consecutive failures before marking as not ready
|
||||
failureThreshold: 3
|
||||
|
||||
# ============================================================================
|
||||
# MONITORING AND OBSERVABILITY
|
||||
# ============================================================================
|
||||
|
||||
# ServiceMonitor for Prometheus Operator
|
||||
# Automatically configure Prometheus to scrape metrics from the application
|
||||
# Requires Prometheus Operator to be installed in the cluster
|
||||
serviceMonitor:
|
||||
# Enable or disable ServiceMonitor creation
|
||||
# Set to true if using Prometheus Operator for monitoring
|
||||
enabled: false
|
||||
|
||||
# How often Prometheus should scrape metrics
|
||||
# Format: duration string (e.g., "30s", "1m", "5m")
|
||||
interval: 30s
|
||||
|
||||
# Metrics endpoint path
|
||||
# The application exposes metrics at this path
|
||||
path: /api/v1/monitoring/metrics
|
||||
|
||||
# Additional labels for the ServiceMonitor
|
||||
# Use to match Prometheus scrape configurations
|
||||
# Example:
|
||||
# labels:
|
||||
# prometheus: kube-prometheus
|
||||
labels: {}
|
||||
|
||||
# ============================================================================
|
||||
# NETWORK POLICY
|
||||
# ============================================================================
|
||||
# Controls network traffic to/from the pods
|
||||
# Requires a network plugin that supports NetworkPolicy (e.g., Calico, Cilium)
|
||||
networkPolicy:
|
||||
# Enable or disable NetworkPolicy creation
|
||||
# Provides network-level security by restricting pod communication
|
||||
enabled: false
|
||||
|
||||
# Types of policies to enforce
|
||||
# Ingress: Controls incoming traffic to the pod
|
||||
# Egress: Controls outgoing traffic from the pod
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
|
||||
# Note: When enabled, by default only allows necessary traffic
|
||||
# Customize the NetworkPolicy template if you need specific rules
|
||||
|
||||
# ============================================================================
|
||||
# POD SCHEDULING
|
||||
# ============================================================================
|
||||
|
||||
# Node Selector
|
||||
# Schedule pods only on nodes with specific labels
|
||||
# Useful for deploying to specific node pools or hardware types
|
||||
# Example:
|
||||
# nodeSelector:
|
||||
# disktype: ssd
|
||||
# environment: production
|
||||
nodeSelector: {}
|
||||
|
||||
# Tolerations
|
||||
# Allow pods to be scheduled on nodes with matching taints
|
||||
# Useful for dedicated node pools or special hardware
|
||||
# Example:
|
||||
# tolerations:
|
||||
# - key: "dedicated"
|
||||
# operator: "Equal"
|
||||
# value: "garage-ui"
|
||||
# effect: "NoSchedule"
|
||||
tolerations: []
|
||||
|
||||
# Affinity Rules
|
||||
# Advanced pod scheduling constraints
|
||||
# Controls which nodes pods can be scheduled on and pod co-location
|
||||
# Example for pod anti-affinity (spread pods across nodes):
|
||||
# affinity:
|
||||
# podAntiAffinity:
|
||||
# preferredDuringSchedulingIgnoredDuringExecution:
|
||||
# - weight: 100
|
||||
# podAffinityTerm:
|
||||
# labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - garage-ui
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user