jklein
b190b7e833
smb.conf is rendered from samba.shares and mounted with subPath, so adding, renaming or re-scoping a share rewrote the ConfigMap while the running smbd kept its old share list: the pod template was unchanged, nothing restarted, and the kubelet does not refresh subPath mounts. The share simply did not exist for clients while the release looked healthy - the failure mode from #82. The pod template now carries checksum/config over the rendered ConfigMap. users.conf cannot be covered the same way: it comes from a 1Password-backed Secret whose content Helm never sees, and the operator's auto-restart only handles Deployments, not this StatefulSet. values.yaml now documents that limitation and the manual rollout restart it requires. Major bump: runtime behavior changes - a share change now costs a restart of the samba pod, which drops open SMB sessions (share data lives on PVCs and is unaffected).
100 lines
3.7 KiB
YAML
100 lines
3.7 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
# users.conf is mounted into the samba container from the Secret the 1Password
|
|
# operator materializes from this item.
|
|
#
|
|
# Known limitation (#82): changing the item in the vault does NOT restart
|
|
# samba, so added, removed or re-passworded users stay invisible to the
|
|
# running smbd. Helm cannot hash the content (it never sees it - the operator
|
|
# fills the Secret in-cluster after rendering), so the checksum/config
|
|
# mechanism used for smb.conf does not apply here. The operator's own
|
|
# "operator.1password.io/auto-restart" annotation is no help either: it only
|
|
# ever restarts Deployments, and this workload is a StatefulSet (verified
|
|
# against onepassword-operator 1.12.0). After changing the users item,
|
|
# restart samba by hand:
|
|
# kubectl rollout restart statefulset <release>-samba-sfs
|
|
sambaUsersSecretRef: null
|
|
|
|
samba:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# NodePorts the SMB service is published on (service type NodePort).
|
|
smbNodePort: 30445
|
|
netbiosNodePort: 30139
|
|
shares:
|
|
- name: null
|
|
validUsers: null
|
|
description: null
|
|
size: null
|
|
# Extra environment variables for the samba container. Values are rendered
|
|
# through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
|
|
env: []
|
|
# SMB is not an HTTP protocol, so probe the main SMB TCP port.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: 50Mi
|
|
cpu: 0.1
|
|
ephemeralStorage: 50Mi
|
|
|
|
# Deviations from the repo's hardening baseline, forced by the
|
|
# ghcr.io/dockur/samba image (its entrypoint samba.sh):
|
|
# - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
|
|
# (groupadd/adduser/usermod) and smbd impersonates the authenticated
|
|
# share user per session, both of which require starting as root.
|
|
# - readOnlyRootFilesystem: false: the entrypoint writes to the root
|
|
# filesystem at startup (/etc/passwd + /etc/group for user creation,
|
|
# the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
|
|
# TDB databases under /var/lib/samba).
|
|
# - capabilities: ALL dropped except what a multi-user root file server
|
|
# needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
|
|
# user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
|
|
# on behalf of the users).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- NET_BIND_SERVICE
|
|
- SETGID
|
|
- SETUID
|
|
|
|
globalConfig: null
|
|
storageClass: longhorn
|