Public Access
f.weber
1675ea9a4e
- Updated Chart.yaml to version 0.2.0 and added annotations for changes. - Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases. - Introduced ServiceAccount configuration in values.yaml and related templates. - Adjusted internal container ports to prevent conflicts between nginx and aptly. - Updated README.md and NOTES.txt to reflect new configurations and usage instructions.
90 lines
3.7 KiB
Plaintext
90 lines
3.7 KiB
Plaintext
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $sec := include "aptly.security" . | fromJson -}}
|
|
aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $fullname }}-0 in {{ .Release.Namespace }}.
|
|
|
|
{{- if eq .Values.security.preset "open" }}
|
|
|
|
*** security.preset: open ***
|
|
Both reading AND writing (the mutating /api/ path) are reachable with NO
|
|
authentication from anything that can reach the Service — this is exactly
|
|
the "komplett unabgesichert" mode, working as configured. Nothing further
|
|
to set up; just make sure this is really what you want before exposing it
|
|
beyond your own network.
|
|
{{- end }}
|
|
|
|
--- Check it's up -------------------------------------------------------
|
|
|
|
kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \
|
|
curl -fsS http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready
|
|
|
|
kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile
|
|
# (only present right after install/upgrade in `hook` mode)
|
|
|
|
--- Reach it -------------------------------------------------------------
|
|
|
|
{{- if .Values.ingress.enabled }}
|
|
{{- with .Values.ingress.repo.host }}
|
|
|
|
https://{{ . }}/ (Ingress)
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.gateway.enabled }}
|
|
{{- range .Values.gateway.repo.hostnames }}
|
|
|
|
https://{{ . }}/ (Gateway API)
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if not (or .Values.ingress.enabled .Values.gateway.enabled) }}
|
|
|
|
kubectl port-forward -n {{ .Release.Namespace }} svc/{{ $fullname }} 8080:{{ .Values.service.port }}
|
|
# then use http://127.0.0.1:8080/ below
|
|
{{- end }}
|
|
|
|
--- Configure apt on a client ---------------------------------------------
|
|
|
|
{{- $host := "apt.example.com" }}
|
|
{{- if and .Values.ingress.enabled .Values.ingress.repo.host }}
|
|
{{- $host = .Values.ingress.repo.host }}
|
|
{{- else if and .Values.gateway.enabled .Values.gateway.repo.hostnames }}
|
|
{{- $host = first .Values.gateway.repo.hostnames }}
|
|
{{- end }}
|
|
{{- if .Values.aptly.gpg.enabled }}
|
|
{{- if .Values.aptly.gpg.publishPublicKey.enabled }}
|
|
|
|
curl -fsSL https://{{ $host }}{{ .Values.aptly.gpg.publishPublicKey.path }} \
|
|
| gpg --dearmor | sudo tee /usr/share/keyrings/{{ include "aptly.name" . }}.gpg >/dev/null
|
|
|
|
echo 'deb [signed-by=/usr/share/keyrings/{{ include "aptly.name" . }}.gpg] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- else }}
|
|
|
|
aptly.gpg.enabled=true but aptly.gpg.publishPublicKey.enabled=false — the
|
|
signing key is not being served; distribute it to clients yourself.
|
|
echo 'deb [signed-by=/path/to/your-key.gpg] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- end }}
|
|
{{- else }}
|
|
|
|
echo 'deb [trusted=yes] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- end }}
|
|
{{- if $sec.ra }}
|
|
|
|
Reads require credentials in this preset ({{ .Values.security.preset }}):
|
|
echo 'machine {{ $host }} login <user> password <password>' \
|
|
| sudo tee -a /etc/apt/auth.conf.d/{{ include "aptly.name" . }}.conf
|
|
{{- end }}
|
|
|
|
--- Resizing storage later -------------------------------------------------
|
|
|
|
persistence.size on an already-installed StatefulSet is IMMUTABLE via
|
|
`helm upgrade` (Kubernetes forbids changing volumeClaimTemplates in place).
|
|
For production, set persistence.existingClaim to a PVC you manage yourself
|
|
— resizing that is a plain PVC edit. See docs/operations.md for the
|
|
recovery procedure if you need to resize a chart-managed PVC anyway.
|
|
{{- if and .Values.podDisruptionBudget.enabled (le (int .Values.podDisruptionBudget.maxUnavailable) 0) }}
|
|
|
|
*** podDisruptionBudget.maxUnavailable is 0 with replicas=1 — this blocks
|
|
every voluntary node drain forever. ***
|
|
{{- end }}
|