From 2d57d386448c31dd53565e3da95e610d00932cf3 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Fri, 6 Mar 2026 17:13:25 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A8(helm)=20update=20helm=20chart=20fo?= =?UTF-8?q?r=20custom=20background=20image?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add media_files_svc and ingress_media_files to helm chart for serving medias related to the new files. This setup is more straightforward than merging the existing recording related media ones. Also updated values to enable file upload by default in dev. Mostly done by @lebaudantoine. --- .../dev-keycloak/values.meet.yaml.gotmpl | 18 ++++ .../meet/templates/ingress_media_files.yaml | 83 +++++++++++++++++++ src/helm/meet/templates/media_files_svc.yaml | 14 ++++ src/helm/meet/values.yaml | 45 ++++++++++ 4 files changed, 160 insertions(+) create mode 100644 src/helm/meet/templates/ingress_media_files.yaml create mode 100644 src/helm/meet/templates/media_files_svc.yaml diff --git a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl index 5641137d..0d21dcfc 100644 --- a/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl +++ b/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl @@ -64,6 +64,7 @@ backend: AWS_S3_SECRET_ACCESS_KEY: password AWS_STORAGE_BUCKET_NAME: meet-media-storage AWS_S3_REGION_NAME: local + AWS_S3_SIGNATURE_VERSION: s3v4 MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io RECORDING_ENABLE: True RECORDING_STORAGE_EVENT_ENABLE: True @@ -80,6 +81,8 @@ backend: APPLICATION_JWT_AUDIENCE: https://meet.127.0.0.1.nip.io/external-api/v1.0/ APPLICATION_JWT_SECRET_KEY: devKeyApplication APPLICATION_BASE_URL: https://meet.127.0.0.1.nip.io + FILE_UPLOAD_ENABLED: True + AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io migrate: @@ -311,3 +314,18 @@ ingressMedia: serviceMedia: host: minio.meet.svc.cluster.local port: 9000 + + +ingressMediaFiles: + enabled: true + host: meet.127.0.0.1.nip.io + + annotations: + nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/ + nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" + nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 + nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1 + +serviceMediaFiles: + host: minio.meet.svc.cluster.local + port: 9000 diff --git a/src/helm/meet/templates/ingress_media_files.yaml b/src/helm/meet/templates/ingress_media_files.yaml new file mode 100644 index 00000000..b69d2409 --- /dev/null +++ b/src/helm/meet/templates/ingress_media_files.yaml @@ -0,0 +1,83 @@ +{{- if .Values.ingressMediaFiles.enabled -}} +{{- $fullName := include "meet.fullname" . -}} +{{- if and .Values.ingressMediaFiles.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingressMediaFiles.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingressMediaFiles.annotations "kubernetes.io/ingress.class" .Values.ingressMediaFiles.className }} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }}-media-files + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "meet.labels" . | nindent 4 }} + {{- with .Values.ingressMediaFiles.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingressMediaFiles.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingressMediaFiles.className }} + {{- end }} + {{- if .Values.ingressMediaFiles.tls.enabled }} + tls: + {{- if .Values.ingressMediaFiles.host }} + - secretName: {{ .Values.ingressMediaFiles.tls.secretName | default (printf "%s-tls" $fullName) | quote }} + hosts: + - {{ .Values.ingressMediaFiles.host | quote }} + {{- end }} + {{- range .Values.ingressMediaFiles.tls.additional }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- if .Values.ingressMediaFiles.host }} + - host: {{ .Values.ingressMediaFiles.host | quote }} + http: + paths: + - path: {{ .Values.ingressMediaFiles.path | quote }} + {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: ImplementationSpecific + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }}-media-files + port: + number: {{ .Values.serviceMediaFiles.port }} + {{- else }} + serviceName: {{ $fullName }}-media-files + servicePort: {{ .Values.serviceMediaFiles.port }} + {{- end }} + {{- end }} + {{- range .Values.ingressMediaFiles.hosts }} + - host: {{ . | quote }} + http: + paths: + - path: {{ $.Values.ingressMediaFiles.path | quote }} + {{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: ImplementationSpecific + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }}-media-files + port: + number: {{ .Values.serviceMediaFiles.port }} + {{- else }} + serviceName: {{ $fullName }}-media-files + servicePort: {{ .Values.serviceMediaFiles.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/src/helm/meet/templates/media_files_svc.yaml b/src/helm/meet/templates/media_files_svc.yaml new file mode 100644 index 00000000..51aab59c --- /dev/null +++ b/src/helm/meet/templates/media_files_svc.yaml @@ -0,0 +1,14 @@ +{{- $fullName := include "meet.fullname" . -}} +{{- $component := "media-files" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ $fullName }}-media-files + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "meet.common.labels" (list . $component) | nindent 4 }} + annotations: + {{- toYaml $.Values.serviceMediaFiles.annotations | nindent 4 }} +spec: + type: ExternalName + externalName: {{ $.Values.serviceMediaFiles.host }} diff --git a/src/helm/meet/values.yaml b/src/helm/meet/values.yaml index 3193aac7..c5f0aec9 100644 --- a/src/helm/meet/values.yaml +++ b/src/helm/meet/values.yaml @@ -125,6 +125,7 @@ ingressMedia: ## @param ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost ## @param ingressMedia.annotations.nginx.ingress.kubernetes.io/configuration-snippet annotations: + nginx.ingress.kubernetes.io/use-regex: "true" nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/recordings/media-auth/ nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 @@ -140,6 +141,50 @@ serviceMedia: annotations: {} +## @param ingressMediaFiles.enabled whether to enable the Ingress or not +## @param ingressMediaFiles.className IngressClass to use for the Ingress +## @param ingressMediaFiles.host Host for the Ingress +## @param ingressMediaFiles.path Path to use for the Ingress +ingressMediaFiles: + enabled: false + className: null + host: meet.example.com + path: /media/files/(.*) + ## @param ingressMediaFiles.hosts Additional host to configure for the Ingress + hosts: [ ] + # - chart-example.local + ## @param ingressMediaFiles.tls.enabled Weather to enable TLS for the Ingress + ## @param ingressMediaFiles.tls.secretName Secret name for TLS config + ## @skip ingressMediaFiles.tls.additional + ## @extra ingressMediaFiles.tls.additional[].secretName Secret name for additional TLS config + ## @extra ingressMediaFiles.tls.additional[].hosts[] Hosts for additional TLS config + tls: + secretName: null + enabled: true + additional: [] + + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/auth-url + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/auth-response-headers + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/upstream-vhost + ## @param ingressMediaFiles.annotations.nginx.ingress.kubernetes.io/configuration-snippet + annotations: + nginx.ingress.kubernetes.io/use-regex: "true" + nginx.ingress.kubernetes.io/auth-url: https://meet.example.com/api/v1.0/files/media-auth/ + nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256" + nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000 + nginx.ingress.kubernetes.io/configuration-snippet: | + add_header Content-Security-Policy "default-src 'none'" always; + add_header Content-Disposition "attachment"; + +## @param serviceMediaFiles.host +## @param serviceMediaFiles.port +## @param serviceMediaFiles.annotations +serviceMediaFiles: + host: minio.meet.svc.cluster.local + port: 9000 + annotations: {} + + ## @section backend