gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add support for mtls with kubernetes installation (#1741)

Browse Source
This commit is contained in:
majinghe
2026-02-08 09:31:58 +08:00
committed by GitHub
parent 60793c17d7
commit a574285ab2
12 changed files with 157 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/README.md
+2
View File
@@ -75,6 +75,8 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m
| livenessProbe.timeoutSeconds | int | `3` | |
| mode.distributed.enabled | bool | `true` | RustFS distributed mode support, namely multiple pod multiple pvc. |
| mode.standalone.enabled | bool | `false` | RustFS standalone mode support, namely one pod one pvc. |
| mtls.enabled | bool | `false` | Enable mtls betweens pods. |
| mtls.serverOnly | bool | `false` | Only enable server https. |
| nameOverride | string | `""` | |
| nodeSelector | object | `{}` | |
| pdb.create | bool | `false` | Enable/disable a Pod Disruption Budget creation |
helm/rustfs/templates/_helpers.tpl
+8 -2
View File
@@ -103,11 +103,17 @@ Render imagePullSecrets for workloads - appends registry secret
Render RUSTFS_VOLUMES
*/}}
{{- define "rustfs.volumes" -}}
{{- $protocol := "http" -}}
{{- if .Values.mtls.enabled -}}
{{- $protocol = "https" -}}
{{- end -}}
{{- if eq (int .Values.replicaCount) 4 }}
{{- printf "http://%s-{0...%d}.%s-headless:%d/data/rustfs{0...%d}" (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data/rustfs{0...%d}" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) .Release.Namespace (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }}
{{- end }}
{{- if eq (int .Values.replicaCount) 16 }}
{{- printf "http://%s-{0...%d}.%s-headless:%d/data" (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) (.Values.service.endpoint.port | int) }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) .Release.Namespace (.Values.service.endpoint.port | int) }}
{{- end }}
{{- end }}
helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml
+8
View File
@@ -0,0 +1,8 @@
{{- if .Values.mtls.enabled }}
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: {{ include "rustfs.fullname" . }}-selfsigned-issuer
spec:
selfSigned: {}
{{- end }}
helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml
+13
View File
@@ -0,0 +1,13 @@
{{- if .Values.mtls.enabled }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "rustfs.fullname" . }}-root-ca
spec:
isCA: true
commonName: {{ include "rustfs.fullname" . }}-root-ca
secretName: {{ include "rustfs.fullname" . }}-root-ca-secret
issuerRef:
name: {{ include "rustfs.fullname" . }}-selfsigned-issuer
kind: ClusterIssuer
{{- end }}
helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml
+9
View File
@@ -0,0 +1,9 @@
{{- if .Values.mtls.enabled }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "rustfs.fullname" . }}-ca-issuer
spec:
ca:
secretName: {{ include "rustfs.fullname" . }}-root-ca-secret
{{- end }}
helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml
+22
View File
@@ -0,0 +1,22 @@
{{- if .Values.mtls.enabled }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "rustfs.fullname" . }}-server-tls
spec:
secretName: {{ include "rustfs.fullname" . }}-server-tls
issuerRef:
name: {{ include "rustfs.fullname" . }}-ca-issuer
kind: Issuer
commonName: {{ include "rustfs.fullname" . }}-cluster
dnsNames:
- "*.{{ include "rustfs.fullname" . }}-headless"
- "*.{{ include "rustfs.fullname" . }}-headless.{{ .Release.Namespace }}.svc.cluster.local"
- "{{ include "rustfs.fullname" . }}-svc.{{ .Release.Namespace }}.svc.cluster.local"
{{- range .Values.ingress.hosts }}
- {{ .host | quote }}
- {{ printf "*.%s" .host | quote }}
{{- end }}
usages:
- server auth
{{- end }}
helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.mtls.enabled }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "rustfs.fullname" . }}-client-tls
spec:
secretName: {{ include "rustfs.fullname" . }}-client-tls
issuerRef:
name: {{ include "rustfs.fullname" . }}-ca-issuer
kind: Issuer
commonName: {{ include "rustfs.fullname" . }}-cluster
usages:
- client auth
{{- end }}
helm/rustfs/templates/cert-manager-mtls/servers-transport.yaml
+15
View File
@@ -0,0 +1,15 @@
{{- if and .Values.mtls.enabled (eq .Values.ingress.className "traefik")}}
apiVersion: traefik.io/v1alpha1
kind: ServersTransport
metadata:
name: {{ include "rustfs.fullname" . }}-transport
spec:
rootcas:
- {{ include "rustfs.fullname" . }}-root-ca-secret
certificatesSecrets:
- {{ include "rustfs.fullname" . }}-mtls-secret
insecureSkipVerify: true
{{- range .Values.ingress.hosts }}
serverName: {{ .host | quote }}
{{- end }}
{{- end }}
helm/rustfs/templates/configmap.yaml
+8 -1
View File
@@ -34,4 +34,11 @@ data:
RUSTFS_VOLUMES: {{ .Values.config.rustfs.volumes | default (include "rustfs.volumes" .) | quote }}
{{- else }}
RUSTFS_VOLUMES: "/data"
{{- end }}
{{- end }}
{{- if .Values.mtls.enabled }}
RUSTFS_SERVER_MTLS_ENABLE: "1"
RUSTFS_TLS_KEYLOG: "1"
RUSTFS_TLS_PATH: "/opt/tls"
{{- end }}
# RUSTFS_MTLS_CLIENT_CERT: "/opt/tls/client_cert.pem"
# RUSTFS_MTLS_CLIENT_KEY: "/opt/tls/client_key.pem"
helm/rustfs/templates/service.yaml
+6 -6
View File
@@ -27,13 +27,13 @@ apiVersion: v1
kind: Service
metadata:
name: {{ include "rustfs.fullname" . }}-svc
{{- if .Values.mode.distributed.enabled }}
{{- if eq .Values.ingress.className "traefik" }}
{{- with .Values.ingress.traefikAnnotations }}
{{- if and .Values.mode.distributed.enabled (eq .Values.ingress.className "traefik")}}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
{{- toYaml .Values.ingress.traefikAnnotations | nindent 4 }}
{{- if and .Values.mtls.enabled (eq .Values.ingress.className "traefik") }}
traefik.ingress.kubernetes.io/service.serversscheme: https
traefik.ingress.kubernetes.io/service.serverstransport: {{ .Release.Namespace }}-{{ include "rustfs.fullname" . }}-transport@kubernetescrd
{{- end }}
{{- end }}
labels:
{{- include "rustfs.labels" . | nindent 4 }}
helm/rustfs/templates/statefulset.yaml
+47 -4
View File
@@ -118,11 +118,29 @@ spec:
name: {{ include "rustfs.secretName" . }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
volumeMounts:
{{- if .Values.mtls.enabled }}
{{- if not .Values.mtls.serverOnly }}
- name: client-cert
mountPath: /opt/tls/client_cert.pem
subPath: client_cert.pem
- name: client-cert
mountPath: /opt/tls/client_key.pem
subPath: client_key.pem
- name: client-cert
mountPath: /opt/tls/client_ca.crt
subPath: client_ca.crt
{{- end }}
- name: server-cert
mountPath: /opt/tls/rustfs_cert.pem
subPath: rustfs_cert.pem
- name: server-cert
mountPath: /opt/tls/rustfs_key.pem
subPath: rustfs_key.pem
- name: server-cert
mountPath: /opt/tls/ca.crt
subPath: ca.crt
{{- end }}
- name: logs
mountPath: {{ $logDir }}
subPath: logs
@@ -135,6 +153,31 @@ spec:
- name: data
mountPath: /data
{{- end }}
{{- if .Values.mtls.enabled }}
volumes:
- name: server-cert
secret:
secretName: rustfs-server-tls
items:
- key: tls.crt
path: rustfs_cert.pem
- key: tls.key
path: rustfs_key.pem
- key: ca.crt
path: ca.crt
{{- if not .Values.mtls.serverOnly }}
- name: client-cert
secret:
secretName: rustfs-client-tls
items:
- key: tls.crt
path: client_cert.pem
- key: tls.key
path: client_key.pem
- key: ca.crt
path: client_ca.crt
{{- end }}
{{- end }}
volumeClaimTemplates:
- metadata:
name: logs
helm/rustfs/values.yaml
+5
View File
@@ -160,6 +160,11 @@ gatewayApi:
name: ""
namespace: ""
mtls:
enabled: false
serverOnly: false # If true, only server side TLS will be enabled. If false, both server and client side TLS will be enabled.
# This is for setting up mTLS for ingress.
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little