☸ Helm chart for deploying AlekSIS on Kubernetes
- Go Template 100%
| .forgejo/workflows | ||
| templates | ||
| .gitignore | ||
| .helmignore | ||
| Chart.yaml | ||
| LICENSE | ||
| README.rst | ||
| renovate.json | ||
| values.yaml | ||
☸ Helm chart for deploying AlekSIS on Kubernetes
================================================
This `Helm <https://helm.sh>`__ chart helps deploying
`AlekSIS <https://aleksis.org>`__ on
`Kubernetes <https://kubernetes.io>`__ clusters.
Kubernetes is a container-based deployment solution, that allows
coordinating containerised applications; and Helm is a utility that
helps generating and applying such deployments.
Chart features
--------------
- Deploy any variant of AlekSIS
- `Core <https://edugit.org/AlekSIS/official/AlekSIS-Core>`__ only
- Any pre-built app container based on Core
- Default distrbution
- Custom distributions
- Deploy PostgreSQL as database service
- Deploy Redis as caching and message broker service
- Scaling and coordination of app and celery workers
- Configuring Ingress to AlekSIS, including TLS
Requirements
------------
- Kubernetes 1.20+
- Persistent volumes and CSI (Container Storage Interface)
- An Ingresss controller, preferrably
`NGINX <https://kubernetes.github.io/ingress-nginx>`__
- `cert-manager <https://cert-manager.io/docs/>`__
Configuration
-------------
The following values are exposed and can (or should) be set:
+-------------+------------------------+------------------------------+
| Value | Description | Default |
+=============+========================+==============================+
| repli | Number of replicas of | 1 |
| caCount.app | app container | |
+-------------+------------------------+------------------------------+
| replicaC | Number of Celery | 1 |
| ount.celery | workers | |
+-------------+------------------------+------------------------------+
| image | Image to install | registry.edugit. |
| .repository | | org/aleksis/official/aleksis |
+-------------+------------------------+------------------------------+
| image.tag | Tag of image to | (from Chart appVersion) |
| | install | |
+-------------+------------------------+------------------------------+
| ingr | Enable the Ingress | true |
| ess.enabled | | |
+-------------+------------------------+------------------------------+
| ingres | Class of Ingress on | nginx |
| s.className | cluster | |
+-------------+------------------------+------------------------------+
| ing | Base domain of ingreee | example.com |
| ress.domain | | |
+-------------+------------------------+------------------------------+
| i | Hostname of ingress | (unset; will use release |
| ngress.host | | name) |
+-------------+------------------------+------------------------------+
| ingress.tls | Enable TLS for ingress | true |
+-------------+------------------------+------------------------------+
| aleksis | Storage source for | volume |
| .storage | (volume or s3) | |
| .src | | |
+-------------+------------------------+------------------------------+
| aleksis | Size of volume for | 10Gi |
| .storage | uplaoded media | |
| .media.size | | |
+-------------+------------------------+------------------------------+
| aleksis | Size of volume for | 10Gi |
| .storage | backups | |
| .backup | | |
| .size | | |
+-------------+------------------------+------------------------------+
| aleksis. | Name of secret | |
| oidcSecret | containing rsa_key.pem | |
| | for OIDC | |
+-------------+------------------------+------------------------------+
| aleksi | Verbatim AlekSIS | |
| s.config.\* | configuration | |
+-------------+------------------------+------------------------------+
| aleksi | Verbatim AlekSIS | |
| s.secret.\* | configuration stored as| |
| | secret | |
+-------------+------------------------+------------------------------+
| aleksis. | List of additional | [] |
| additional | configmaps to mount | |
| Configs | | |
+-------------+------------------------+------------------------------+
| aleksis. | List of additional | [] |
| additional | secrets to mount | |
| Secrets | | |
+-------------+------------------------+------------------------------+
| postgresql. | Enable/disable the | true |
| enabled | postgresql dependency | |
+-------------+------------------------+------------------------------+
| po | Values for the | |
| stgresql.\* | `PostgreSQL <ht | |
| | tps://github.com/bitna | |
| | mi/charts/tree/master/ | |
| | bitnami/postgresql>`__ | |
| | chart | |
+-------------+------------------------+------------------------------+
| valkey. | Enable/disable the | true |
| enabled | valkey dependency | |
+-------------+------------------------+------------------------------+
| valkey.\* | Values for the | |
| | `Redi | |
| | s <https://github.com/ | |
| | bitnami/charts/tree/ma | |
| | ster/bitnami/valkey>`__ | |
| | chart | |
+-------------+------------------------+------------------------------+
| k8s-linkup | Enable/disable the | false |
| enabled | k8s-linkup dependency | |
+-------------+------------------------+------------------------------+
| k8s- | | |
| linkup.\* | Values for the | |
| | `k8s-linkup | |
| | <https://edugit.org/ | |
| | AlekSIS/libs/k8s- | |
| | linkup>`__ chart | |
+-------------+------------------------+------------------------------+
| resources. | Resource requests/ | |
| app.* | limits for app | |
+-------------+------------------------+------------------------------+
| resources. | Resource requests/ | |
| celery.* | limits for celery | |
+-------------+------------------------+------------------------------+
Installation
------------
In the following examples, we will manage an AlekSIS deployment for the
Christoph Biemann Elementary School, with domain ``c-b-e-s.de``. They
want AlekSIS available at ``https://sis.c-b-e-s.de``.
In order to install the chart (from a Git clone), the following examples
will work:
Sane default config
~~~~~~~~~~~~~~~~~~~
.. code:: shell
helm install sis ./ \
--set ingress.domain=c-b-e-s.de
Install core only
~~~~~~~~~~~~~~~~~
.. code:: shell
helm install sis ./ \
--set ingress.domain=c-b-e-s.de \
--set image.repository=repository.edugit.org/aleksis/official/aleksis
Extra large media storage
~~~~~~~~~~~~~~~~~~~~~~~~~
.. code:: shell
helm install sis ./ \
--set ingress.domain=c-b-e-s.de \
--set aleksis.media.size=1000Gi
Enable two-factor authentication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This requires passing configuration to AlekSIS itself.
.. code:: shell
helm install sis ./ \
--set ingress.domain=c-b-e-s.de \
--set aleksis.config.2fa.enabled=true \
--set aleksis.config.2fa.yubikey.enabled=true
Upgrade an existing deployment
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In order to upgrade an existing deployment, care has to be taken to pass
all passwords and secrets as values. To do that, use the same ``helm``
command as for installation, replacing ``install`` with ``upgrade``, and
add the following values:
.. code:: shell
adminPassword=$(kubectl get secret sis-aleksis -o jsonpath='{.data.admin-password}' | base64 -d)
postgresPassword=$(kubectl get secret sis-postgresql -o jsonpath='{.data.postgresql-postgres-password}' | base64 -d)
postgresqlPassword=$(kubectl get secret sis-postgresql -o jsonpath='{.data.postgresql-password}' | base64 -d)
secretKey=$(kubectl get secret sis-aleksis -o jsonpath='{.data.secret-key}' | base64 -d)
helm upgrade sis ./ \
# Original values
--set aleksis.adminPassword= \
--set aleksis.secretKey= \
--set postgresql.postgresqlPassword= \
--set postgresql.postgresqlPostgresPassword= \
License
-------
.. code:: plain
Copyright 2021 Dominik George <dominik.george@teckids.org>
Copyright 2021 Tom Teichler <tom.teichler@teckids.org>
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Alternatively, you are free to use this chart under the terms of the EUPL 1.2 or newer.