add kms environment variables support in helm chart (#2552)

Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: houseme <housemecn@gmail.com>

helm/README.md

@@ -47,6 +47,13 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m
 | config.rustfs.obs_endpoint.logs.endpoint | string | `""` | Remote endpoint url for logs. |
 | config.rustfs.obs_endpoint.profiling.enabled | bool | `false` | Whether to send profiling to remote endpoint. |
 | config.rustfs.obs_endpoint.profiling.endpoint | string | `""` | Remote endpoint url for profiling. |
+| config.rustfs.kms.enabled | bool | `false`| Whether to enable kms. |
+| config.rustfs.kms.type | string | `vault`| The kms type that RustFS supported. |
+| config.rustfs.kms.vault.vault_backend | string | `""`| The vault backend, `vault-kv2` or `vault-transit`. |
+| config.rustfs.kms.vault.vault_address | string | `""`| The vault address. |
+| config.rustfs.kms.vault.vault_token | string | `""`| The vault token. |
+| config.rustfs.kms.vault.vault_mount_path | string | `"transit"`| The vault mount path, only works if `vault_backend` equals `vault-transit` . |
+| config.rustfs.kms.vault.default_key | string | `"transit"`| The master key id for RustFS. |
 | extraEnv | map | `[]` |  Extra environment variables for RustFS container. |
 | containerSecurityContext.capabilities.drop[0] | string | `"ALL"` |  |
 | containerSecurityContext.readOnlyRootFilesystem | bool | `true` |  |

helm/rustfs/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: rustfs
 description: RustFS helm chart to deploy RustFS on kubernetes cluster.
 type: application
-version: 0.0.91
+version: 0.0.93
-appVersion: "1.0.0-alpha.91"
+appVersion: "1.0.0-alpha.93"
 home: https://rustfs.com
 icon: https://media.sys.truenas.net/apps/rustfs/icons/icon.svg
 maintainers:

helm/rustfs/templates/configmap.yaml

@@ -82,3 +82,17 @@ data:
   RUSTFS_SCANNER_IDLE_MODE: {{ .idle_mode | quote }}
     {{- end }}
   {{- end }}
+  {{- if .Values.config.rustfs.kms.enabled }}
+    {{- if eq .Values.config.rustfs.kms.type "vault" }}
+      {{- with .Values.config.rustfs.kms.vault }}
+  RUSTFS_KMS_ENABLE: "true"
+  RUSTFS_KMS_BACKEND: {{ .vault_backend | quote }}
+  RUSTFS_KMS_VAULT_ADDRESS: {{ .vault_address | quote }}
+  RUSTFS_KMS_VAULT_TOKEN: {{ .vault_token | quote }}
+  RUSTFS_KMS_DEFAULT_KEY_ID: {{ .default_key | quote }}
+        {{- if eq .vault_backend "vault-transit" }}
+  RUSTFS_KMS_VAULT_MOUNT_PATH: {{ .vault_mount_path | quote }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+  {{- end }}

helm/rustfs/values.yaml

@@ -97,6 +97,16 @@ config:
       profiling:
         enabled: false
         endpoint: "" # If specified, rustfs will export profiling data to this endpoint. e.g. "http://localhost:6060/debug/pprof/profile"
+    kms:
+      enabled: true
+      type: "vault" # Only Support vault currently.
+      vault:
+        vault_backend: "" # Only support vault kv2 and vault transit. 
+        vault_address: ""
+        vault_token: ""
+        vault_mount_path: ""
+        default_key: ""
+
 
 extraEnv: [] # This is for setting extra environment variables in the rustfs container. It should be a list of key value pairs. For example:
 # extraEnv: