jklein
01336af953
Validate Helm Charts / Detect changed charts (pull_request) Successful in 5s
Validate Helm Charts / Resource quantities (pull_request) Successful in 11s
Validate Helm Charts / Build garage (pull_request) Successful in 7s
Validate Helm Charts / Trivy config garage (pull_request) Successful in 15s
Install-test / Install-test garage (pull_request) Successful in 1m22s
Validate Helm Charts / Install-test (pull_request) Successful in 1m23s
"No admin_token is set" read like "nothing is open", and two parts of that
were wrong. /metrics needs no authentication either, because
metrics_require_token defaults to false - internal metrics on a ClusterIP port.
And a config token is not the only way to reach the authenticated API: Garage
2.x keeps admin tokens in the cluster as well ("garage admin-token create"),
which work without any entry in garage.toml. Both now stated at the ConfigMap
and the Service, plus the way to close /metrics.
46 lines
1.9 KiB
YAML
46 lines
1.9 KiB
YAML
{{- $settings := fromYaml (include "garage.settings" .) }}
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
selector:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
ports:
|
|
# The S3 endpoint. In-cluster consumers reach it at
|
|
# http://<release>-garage-service.<namespace>.svc.cluster.local:3900
|
|
# with path-style addressing (bucket in the path), which needs no
|
|
# root_domain and no DNS wildcard.
|
|
- protocol: TCP
|
|
port: {{ $settings.ports.s3 | int64 }}
|
|
targetPort: s3
|
|
name: s3
|
|
# The admin endpoint. With this chart's configuration it serves exactly two
|
|
# things without authentication - /health (token-free by design) and
|
|
# /metrics (because metrics_require_token defaults to false) - and answers
|
|
# everything else with 401/403 until an admin token exists, whether from
|
|
# the config or from "garage admin-token create". So it is a monitoring
|
|
# surface rather than a management one, and it is a ClusterIP port.
|
|
- protocol: TCP
|
|
port: {{ $settings.ports.admin | int64 }}
|
|
targetPort: admin
|
|
name: admin
|
|
{{- if $settings.web.enabled }}
|
|
- protocol: TCP
|
|
port: {{ $settings.ports.web | int64 }}
|
|
targetPort: web
|
|
name: web
|
|
{{- end }}
|
|
# DELIBERATELY NO RPC PORT. Port 3901 exists on the pod because Garage binds
|
|
# it either way, but nothing should reach it: a single node has no peers, and
|
|
# this chart renders neither bootstrap_peers nor the kubernetes_discovery CRD.
|
|
# A Service port would advertise a cluster interface that is not one.
|
|
#
|
|
# ClusterIP, and no value to change it. The S3 API authenticates every
|
|
# request, but the way out of the cluster is an Ingress with a certificate
|
|
# (ingress.enabled, off by default), not a NodePort that puts an object store
|
|
# on a routable address by accident.
|
|
type: ClusterIP
|