diff --git a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl index 5641137d..0d21dcfc 100644 --- a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl +++ b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl @@ -64,6 +64,7 @@ backend: AWS_S3_SECRET_ACCESS_KEY: password AWS_STORAGE_BUCKET_NAME: meet-media-storage AWS_S3_REGION_NAME: local + AWS_S3_SIGNATURE_VERSION: s3v4 MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io RECORDING_ENABLE: True RECORDING_STORAGE_EVENT_ENABLE: True @@ -80,6 +81,8 @@ backend: APPLICATION_JWT_AUDIENCE: https://meet.127.0.0.1.nip.io/external-api/v1.0/ APPLICATION_JWT_SECRET_KEY: devKeyApplication APPLICATION_BASE_URL: https://meet.127.0.0.1.nip.io + FILE_UPLOAD_ENABLED: True + AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io migrate: @@ -311,3 +314,18 @@ ingressMedia: serviceMedia: host: minio.meet.svc.cluster.local port: 9000 + + +ingressMediaFiles: + enabled: true + host: meet.127.0.0.1.nip.io + + annotations: + nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/ + nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" + nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 + nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1 + +serviceMediaFiles: + host: minio.meet.svc.cluster.local + port: 9000 diff --git a/src/helm/meet/templates/ingress_media_files.yaml b/src/helm/meet/templates/ingress_media_files.yaml new file mode 100644 index 00000000..b69d2409 --- /dev/null +++ b/src/helm/meet/templates/ingress_media_files.yaml @@ -0,0 +1,83 @@ +{{- if .Values.ingressMediaFiles.enabled -}} +{{- $fullName := include "meet.fullname" . -}} +{{- if and .Values.ingressMediaFiles.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingressMediaFiles.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingressMediaFiles.annotations "kubernetes.io/ingress.class" .Values.ingressMediaFiles.className }} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }}-media-files + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "meet.labels" . | nindent 4 }} + {{- with .Values.ingressMediaFiles.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingressMediaFiles.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingressMediaFiles.className }} + {{- end }} + {{- if .Values.ingressMediaFiles.tls.enabled }} + tls: + {{- if .Values.ingressMediaFiles.host }} + - secretName: {{ .Values.ingressMediaFiles.tls.secretName | default (printf "%s-tls" $fullName) | quote }} + hosts: + - {{ .Values.ingressMediaFiles.host | quote }} + {{- end }} + {{- range .Values.ingressMediaFiles.tls.additional }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- if .Values.ingressMediaFiles.host }} + - host: {{ .Values.ingressMediaFiles.host | quote }} + http: + paths: + - path: {{ .Values.ingressMediaFiles.path | quote }} + {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: ImplementationSpecific + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }}-media-files + port: + number: {{ .Values.serviceMediaFiles.port }} + {{- else }} + serviceName: {{ $fullName }}-media-files + servicePort: {{ .Values.serviceMediaFiles.port }} + {{- end }} + {{- end }} + {{- range .Values.ingressMediaFiles.hosts }} + - host: {{ . | quote }} + http: + paths: + - path: {{ $.Values.ingressMediaFiles.path | quote }} + {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: ImplementationSpecific + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }}-media-files + port: + number: {{ .Values.serviceMediaFiles.port }} + {{- else }} + serviceName: {{ $fullName }}-media-files + servicePort: {{ .Values.serviceMediaFiles.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/src/helm/meet/templates/media_files_svc.yaml b/src/helm/meet/templates/media_files_svc.yaml new file mode 100644 index 00000000..51aab59c --- /dev/null +++ b/src/helm/meet/templates/media_files_svc.yaml @@ -0,0 +1,14 @@ +{{- $fullName := include "meet.fullname" . -}} +{{- $component := "media-files" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ $fullName }}-media-files + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "meet.common.labels" (list . $component) | nindent 4 }} + annotations: + {{- toYaml $.Values.serviceMediaFiles.annotations | nindent 4 }} +spec: + type: ExternalName + externalName: {{ $.Values.serviceMediaFiles.host }} diff --git a/src/helm/meet/values.yaml b/src/helm/meet/values.yaml index 3193aac7..c5f0aec9 100644 --- a/src/helm/meet/values.yaml +++ b/src/helm/meet/values.yaml @@ -125,6 +125,7 @@ ingressMedia: ## @param ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost ## @param ingressMedia.annotations.nginx.ingress.kubernetes.io/configuration-snippet annotations: + nginx.ingress.kubernetes.io/use-regex: "true" nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/recordings/media-auth/ nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 @@ -140,6 +141,50 @@ serviceMedia: annotations: {} +## @param ingressMediaFiles.enabled whether to enable the Ingress or not +## @param ingressMediaFiles.className IngressClass to use for the Ingress +## @param ingressMediaFiles.host Host for the Ingress +## @param ingressMediaFiles.path Path to use for the Ingress +ingressMediaFiles: + enabled: false + className: null + host: meet.example.com + path: /media/files/(.*) + ## @param ingressMediaFiles.hosts Additional host to configure for the Ingress + hosts: [ ] + # - chart-example.local + ## @param ingressMediaFiles.tls.enabled Weather to enable TLS for the Ingress + ## @param ingressMediaFiles.tls.secretName Secret name for TLS config + ## @skip ingressMediaFiles.tls.additional + ## @extra ingressMediaFiles.tls.additional[].secretName Secret name for additional TLS config + ## @extra ingressMediaFiles.tls.additional[].hosts[] Hosts for additional TLS config + tls: + secretName: null + enabled: true + additional: [] + + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/auth-url + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/auth-response-headers + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/upstream-vhost + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/configuration-snippet + annotations: + nginx.ingress.kubernetes.io/use-regex: "true" + nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/files/media-auth/ + nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" + nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 + nginx.ingress.kubernetes.io/configuration-snippet: | + add_header Content-Security-Policy "default-src 'none'" always; + add_header Content-Disposition "attachment"; + +## @param serviceMediaFiles.host +## @param serviceMediaFiles.port +## @param serviceMediaFiles.annotations +serviceMediaFiles: + host: minio.meet.svc.cluster.local + port: 9000 + annotations: {} + + ## @section backend