gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-27 00:38:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(helm): allow overriding Kubernetes cluster domain (#4259)

Browse Source
This commit is contained in:
Ramakrishna Chilaka
2026-07-06 11:36:44 +05:30
committed by GitHub
parent a9115f729e
commit b09526c0f5
5 changed files with 99 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helm/README.md
+1
View File
@@ -18,6 +18,7 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m
| affinity.nodeAffinity | object | `{}` | |
| affinity.podAntiAffinity.enabled | bool | `true` | |
| affinity.podAntiAffinity.topologyKey | string | `"kubernetes.io/hostname"` | |
| clusterDomain | string | `"cluster.local"` | Kubernetes cluster DNS domain used to build in-cluster FQDNs for `RUSTFS_VOLUMES` (distributed mode) and mTLS server certificate SANs. Override for clusters not using the default `cluster.local`. Provide the DNS root only, without a `svc.` prefix or leading/trailing dots. |
| commonLabels | object | `{}` | Labels to add to all deployed objects. |
| config.rustfs.address | string | `":9000"` | |
| config.rustfs.console_address | string | `":9001"` | |
helm/rustfs/templates/_helpers.tpl
+11 -2
View File
@@ -159,6 +159,15 @@ Merges (in order of increasing precedence):
{{- end }}
{{- end }}
{{/*
Resolve the Kubernetes cluster DNS domain (defaults to cluster.local).
Trims any leading/trailing dots so callers can safely append it after `svc.`,
falling back to cluster.local when the value is empty or only dots.
*/}}
{{- define "rustfs.clusterDomain" -}}
{{- .Values.clusterDomain | default "cluster.local" | trimAll "." | default "cluster.local" -}}
{{- end -}}
{{/*
Render RUSTFS_VOLUMES
*/}}
@@ -170,10 +179,10 @@ Render RUSTFS_VOLUMES
{{- end -}}
{{- if eq (int .Values.replicaCount) 4 }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data/rustfs{0...%d}" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) .Release.Namespace (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.%s:%d/data/rustfs{0...%d}" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" . ) .Release.Namespace (include "rustfs.clusterDomain" .) (.Values.service.endpoint.port | int) (sub (.Values.replicaCount | int) 1) }}
{{- end }}
{{- if eq (int .Values.replicaCount) 16 }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.cluster.local:%d/data" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) .Release.Namespace (.Values.service.endpoint.port | int) }}
{{- printf "%s://%s-{0...%d}.%s-headless.%s.svc.%s:%d/data" $protocol (include "rustfs.fullname" .) (sub (.Values.replicaCount | int) 1) (include "rustfs.fullname" .) .Release.Namespace (include "rustfs.clusterDomain" .) (.Values.service.endpoint.port | int) }}
{{- end }}
{{- end }}
helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml
+2 -2
View File
@@ -19,8 +19,8 @@ spec:
commonName: {{ include "rustfs.fullname" . }}-cluster
dnsNames:
- "*.{{ include "rustfs.fullname" . }}-headless"
- "*.{{ include "rustfs.fullname" . }}-headless.{{ .Release.Namespace }}.svc.cluster.local"
- "{{ include "rustfs.fullname" . }}-svc.{{ .Release.Namespace }}.svc.cluster.local"
- "*.{{ include "rustfs.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ include "rustfs.clusterDomain" . }}"
- "{{ include "rustfs.fullname" . }}-svc.{{ .Release.Namespace }}.svc.{{ include "rustfs.clusterDomain" . }}"
{{- range .Values.ingress.hosts }}
- {{ .host | quote }}
- {{ printf "*.%s" .host | quote }}
helm/rustfs/values.yaml
+7
View File
@@ -5,6 +5,13 @@
# This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
replicaCount: 4
# Kubernetes cluster DNS domain used to build in-cluster FQDNs for
# RUSTFS_VOLUMES (distributed mode) and mTLS server certificate SANs.
# Override this only if your cluster does not use the default `cluster.local`
# (for example, on-premise clusters configured with a custom domain).
# Provide the DNS root only, without a `svc.` prefix or leading/trailing dots.
clusterDomain: cluster.local
# This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
image:
rustfs: # This sets the rustfs image repository and tag.
scripts/test_helm_templates.sh
+78
View File
@@ -36,6 +36,33 @@ render_distributed_statefulset() {
'
}
render_distributed_configmap() {
helm template rustfs "$CHART_DIR" \
--namespace rustfs \
--set secret.rustfs.access_key=test-access-key \
--set secret.rustfs.secret_key=test-secret-key \
"$@" |
awk '
/^# Source: rustfs\/templates\/configmap.yaml$/ { in_configmap = 1 }
in_configmap && /^---$/ { exit }
in_configmap { print }
'
}
render_server_cert() {
helm template rustfs "$CHART_DIR" \
--namespace rustfs \
--set secret.rustfs.access_key=test-access-key \
--set secret.rustfs.secret_key=test-secret-key \
--set mtls.enabled=true \
"$@" |
awk '
/^# Source: rustfs\/templates\/cert-manager-mtls\/04-server-cert.yaml$/ { in_cert = 1 }
in_cert && /^---$/ { exit }
in_cert { print }
'
}
recreate_output=$(render_standalone_deployment --set mode.standalone.strategy.type=Recreate)
grep -q "type: Recreate" <<<"$recreate_output"
if grep -q "rollingUpdate:" <<<"$recreate_output"; then
@@ -225,3 +252,54 @@ assert_extra_volumes_wired "$distributed_extra_output" "distributed StatefulSet"
# Empty extraVolumes must not inject ca-bundle into distributed StatefulSet volumes.
distributed_default_output=$(render_distributed_statefulset)
assert_extra_volumes_absent "$distributed_default_output" "distributed StatefulSet"
# clusterDomain (issue #3857): a custom Kubernetes cluster domain must flow into
# the RUSTFS_VOLUMES FQDN and mTLS server cert SANs, defaulting to cluster.local.
volumes_default=$(render_distributed_configmap | grep 'RUSTFS_VOLUMES:' || true)
if ! grep -q 'svc\.cluster\.local' <<<"$volumes_default"; then
echo "Default RUSTFS_VOLUMES must use svc.cluster.local" >&2
exit 1
fi
volumes_custom=$(render_distributed_configmap --set clusterDomain=cluster.internal | grep 'RUSTFS_VOLUMES:' || true)
if ! grep -q 'svc\.cluster\.internal' <<<"$volumes_custom"; then
echo "Custom clusterDomain must appear in the RUSTFS_VOLUMES FQDN" >&2
exit 1
fi
if grep -q 'cluster\.local' <<<"$volumes_custom"; then
echo "Custom clusterDomain must fully replace cluster.local in RUSTFS_VOLUMES" >&2
exit 1
fi
# An explicit config.rustfs.volumes stays authoritative regardless of clusterDomain.
volumes_explicit=$(render_distributed_configmap \
--set config.rustfs.volumes=http://example.test/data \
--set clusterDomain=cluster.internal | grep 'RUSTFS_VOLUMES:' || true)
if ! grep -q 'RUSTFS_VOLUMES: "http://example.test/data"' <<<"$volumes_explicit"; then
echo "Explicit config.rustfs.volumes must remain authoritative regardless of clusterDomain" >&2
exit 1
fi
# A dot-only clusterDomain must fall back to cluster.local instead of an empty domain.
volumes_dots=$(render_distributed_configmap --set clusterDomain=. | grep 'RUSTFS_VOLUMES:' || true)
if ! grep -q 'svc\.cluster\.local' <<<"$volumes_dots"; then
echo "Dot-only clusterDomain must fall back to cluster.local in RUSTFS_VOLUMES" >&2
exit 1
fi
# mTLS server certificate SANs must honor clusterDomain too.
cert_default=$(render_server_cert)
if ! grep -q 'svc\.cluster\.local"' <<<"$cert_default"; then
echo "Default mTLS server cert SANs must use svc.cluster.local" >&2
exit 1
fi
cert_custom=$(render_server_cert --set clusterDomain=cluster.internal)
if ! grep -q 'svc\.cluster\.internal"' <<<"$cert_custom"; then
echo "Custom clusterDomain must appear in mTLS server cert SANs" >&2
exit 1
fi
if grep -q 'svc\.cluster\.local"' <<<"$cert_custom"; then
echo "Custom clusterDomain must fully replace cluster.local in mTLS server cert SANs" >&2
exit 1
fi