akshay
/
collabora-online
1
0
Fork 0
Code Issues 0 Pull Requests 0 Projects 0 Releases 0 Wiki Activity
Browse Source

Collabora online kubernetes

master
Akshay 11 months ago
parent
d91609cfcc
commit
8d08ae8902
25 changed files with 6620 additions and 2 deletions
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +36
    -0
      Chart.yaml
  2. +329
    -2
      README.md
  3. +2902
    -0
      grafana_dashboards/ha-allocation.json
  4. +1701
    -0
      grafana_dashboards/overview.json
  5. BIN
      templates/.configmap.yaml.swp
  6. +62
    -0
      templates/_helpers.tpl
  7. +311
    -0
      templates/configmap.yaml
  8. +16
    -0
      templates/configmap_grafana_dashboards.yaml
  9. +140
    -0
      templates/deployment.yaml
  10. +12
    -0
      templates/dynamicConfig/configmap.yaml
  11. +103
    -0
      templates/dynamicConfig/deployment.yaml
  12. +43
    -0
      templates/dynamicConfig/ingress.yaml
  13. +43
    -0
      templates/dynamicConfig/ingress_upload.yaml
  14. +25
    -0
      templates/dynamicConfig/service.yaml
  15. +118
    -0
      templates/dynamicConfig/statefulset.yaml
  16. +11
    -0
      templates/dynamicConfig/upload_secret.yaml
  17. +32
    -0
      templates/hpa.yaml
  18. +43
    -0
      templates/ingress.yaml
  19. +163
    -0
      templates/prometheus-rules.yaml
  20. +12
    -0
      templates/secret.yaml
  21. +21
    -0
      templates/service.yaml
  22. +12
    -0
      templates/serviceaccount.yaml
  23. +36
    -0
      templates/servicemonitor.yaml
  24. +133
    -0
      templates/statefulset.yaml
  25. +316
    -0
      values.yaml

+ 36
- 0
Chart.yaml View File

@ -0,0 +1,36 @@
annotations:
artifacthub.io/images: |
- name: collabora
image: docker.io/collabora/code:23.05.5.4.1
- name: nginx
image: docker.io/nginx:1.25
- name: twostoryrobot/simple-file-upload
image: docker.io/twostoryrobot/simple-file-upload@sha256:547fc4360b31d8604b7a26202914e87cd13609cc938fd83f412c77eb44aa1cc4
apiVersion: v2
appVersion: 23.05.5.4.1
description: Collabora Online helm chart
home: https://www.collaboraoffice.com/code/
icon: https://avatars0.githubusercontent.com/u/22418908?s=200&v=4
keywords:
- collabora-online
- collabora
- code
- nextcloud
- office
maintainers:
- email: k.erber@erber-freelance.de
name: Klaus Erber
url: https://www.erber-freelance.de/
- email: martin.mueller@dataport.de
name: Martin Müller
url: https://dphoenixsuite.de
- email: geno+dev@fireorbit.de
name: Geno
url: https://fireorbit.de
name: collabora-online
sources:
- https://github.com/CollaboraOnline/online
- https://github.com/CollaboraOnline/online/tree/master/docker
- https://github.com/CollaboraOnline/online/tree/master/kubernetes/helm/collabora-online
type: application
version: 1.1.5

+ 329
- 2
README.md View File

@ -1,3 +1,330 @@
# collabora-online
# Collabora Online for Kubernetes
helm collabora kubernetes
In order for Collaborative Editing and copy/paste to function correctly on kubernetes, it is vital to ensure that all users editing the same document and all the clipboard request end up being served by the same pod. Using the WOPI protocol, the https URL includes a unique identifier (WOPISrc) for use with this document. Thus load balancing can be done by using WOPISrc -- ensuring that all URLs that contain the same WOPISrc are sent to the same pod.
## Deploying Collabora Online in Kubernetes
1. Install [helm](https://helm.sh/docs/intro/install/)
2. Setting up Kubernetes Ingress Controller
A. Nginx:
Install [Nginx Ingress
Controller](https://kubernetes.github.io/ingress-nginx/deploy/)
B. HAProxy:
Install [HAProxy Ingress
Controller](https://www.haproxy.com/documentation/kubernetes-ingress/)
---
**Note:**
**Openshift** uses minimized version of HAproxy called
[Router](https://docs.openshift.com/container-platform/3.11/install_config/router) that doesn\'t support all functionality of HAProxy but for COOL we need advance annotations Therefore it is recommended deploy [HAproxy Kubernetes Ingress](https://artifacthub.io/packages/helm/haproxytech/kubernetes-ingress) in `collabora` namespace
---
3. Create an `my_values.yaml` (if your setup differs e.g. take an look in then `values.yaml ./collabora-online/values.yaml`) of the
helmchart
A. HAproxy:
``` yaml
replicaCount: 3
ingress:
enabled: true
className: "haproxy"
annotations:
haproxy.org/timeout-tunnel: "3600s"
haproxy.org/backend-config-snippet: |
balance url_param WOPISrc check_post
hash-type consistent
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
image:
tag: "latest"
autoscaling:
enabled: false
collabora:
aliasgroups:
- host: "https://example.integrator.com:443"
extra_params: --o:ssl.enable=false --o:ssl.termination=true
resources:
limits:
cpu: "1800m"
memory: "2000Mi"
requests:
cpu: "1800m"
memory: "2000Mi"
```
B. Nginx:
``` yaml
replicaCount: 3
ingress:
enabled: true
className: "nginx"
annotations:
nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
image:
tag: "latest"
autoscaling:
enabled: false
collabora:
aliasgroups:
- host: "https://example.integrator.com:443"
extra_params: --o:ssl.enable=false --o:ssl.termination=true
resources:
limits:
cpu: "1800m"
memory: "2000Mi"
requests:
cpu: "1800m"
memory: "2000Mi"
```
---
**Note:**
- **Horizontal Pod Autoscaling(HPA) is disabled for now. Because after scaling it breaks the collaborative editing and copy/paste
Therefore please set replicaCount as per your needs**
- If you have multiple host and aliases setup set aliasgroups in `my_values.yaml`:
``` yaml
collabora:
- host: "<protocol>://<host-name>:<port>"
# if there are no aliases you can ignore the below line
aliases: ["<protocol>://<its-first-alias>:<port>, <protocol>://<its-second-alias>:<port>"]
# more host and aliases list is possible
```
- Specify `server_name` when the hostname is not reachable directly for example behind reverse-proxy
``` yaml
collabora:
server_name: <hostname>:<port>
```
- In **Openshift** , it is recommended to use HAproxy deployment instead of default router. And add `className` in ingress block
so that Openshift uses HAProxy Ingress Controller instead of `Router`:
``` yaml
ingress:
className: "haproxy"
```
---
4. Install helm-chart using below command, it should deploy the collabora-online
``` bash
helm repo add collabora https://collaboraonline.github.io/online/
helm install --create-namespace --namespace collabora collabora-online collabora/collabora-online -f my_values.yaml
```
5. Follow only if you are using `NodePort` service type in HAProxy and/or using minikube to setup, otherwise skip
A. HAProxy service is deployed as NodePort so we can access it with node's ip address. To get node ip
```bash
minikube ip
```
Example output:
```
192.168.0.106
```
B. Each container port is mapped to a `NodePort` port via the `Service` object. To find those ports
```
kubectl get svc --namespace=haproxy-controller
```
Example output:
```
|----------------|---------|--------------|------------|------------------------------------------|
|NAME |TYPE |CLUSTER-IP |EXTERNAL-IP |PORT(S) |
|----------------|---------|--------------|------------|------------------------------------------|
|haproxy-ingress |NodePort |10.108.214.98 |<none> |80:30536/TCP,443:31821/TCP,1024:30480/TCP |
|----------------|---------|--------------|------------|------------------------------------------|
```
In this instance, the following ports were mapped:
- Container port 80 to NodePort 30536
- Container port 443 to NodePort 31821
- Container port 1024 to NodePort 30480
6. Additional step if deploying on minikube for testing:
1. Get minikube ip:
``` bash
minikube ip
```
Example output:
``` bash
192.168.0.106
```
2. Add hostname to `/etc/hosts`
``` bash
192.168.0.106 chart-example.local
```
3. To check if everything is setup correctly you can run:
``` bash
curl -I -H 'Host: chart-example.local' 'http://192.168.0.106:30536/'
```
It should return a similar output as below:
``` bash
HTTP/1.1 200 OK
last-modified: Tue, 18 May 2021 10:46:29
user-agent: COOLWSD WOPI Agent 6.4.8
content-length: 2
content-type: text/plain
```
## Kubernetes cluster monitoring
1. Install [kube-prometheus-stack](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack), a collection of [Grafana](http://grafana.com/) dashboards, and [Prometheus rules](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/) combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with
[Prometheus](https://prometheus.io/) using the [Prometheus Operator](https://prometheus-operator.dev/).
2. Enable prometheus service monitor, rules and grafana in your
`my_values.yaml`
``` yaml
prometheus:
servicemonitor:
enabled: true
labels:
release: "kube-prometheus-stack"
rules:
enabled: true # will deploy alert rules
additionalLabels:
release: "kube-prometheus-stack"
grafana:
dashboards:
enabled: true # will deploy default dashboards
```
---
**Note:**
Use `kube-prometheus-stack` as release name when installing [kube-prometheus-stack](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack) helm chart because we have passed `release=kube-prometheus-stack` label in our `my_values.yaml`. For Grafana Dashboards you may need to enable scan in correct namespaces (or ALL), enabled by `sidecar.dashboards.searchNamespace` in [Helmchart of grafana](https://artifacthub.io/packages/helm/grafana/grafana) (which is part of PrometheusOperator, so `grafana.sidecar.dashboards.searchNamespace`)
---
## Dynamic/Remote configuration in kubernetes
For big setups, you may not want to restart every pod to modify WOPI
hosts, therefore it is possible to setup an additional webserver to
serve a ConfigMap for using [Remote/Dynamic
Configuration](https://sdk.collaboraonline.com/docs/installation/Configuration.html#remote-dynamic-configuration)
``` yaml
collabora:
env:
- name: remoteconfigurl
value: https://dynconfig.public.example.com/config/config.json
dynamicConfig:
enabled: true
ingress:
enabled: true
annotations:
"cert-manager.io/issuer": letsencrypt-zprod
hosts:
- host: "dynconfig.public.example.com"
tls:
- secretName: "collabora-online-dynconfig-tls"
hosts:
- "dynconfig.public.example.com"
configuration:
kind: "configuration"
storage:
wopi:
alias_groups:
groups:
- host: "https://domain1\\.xyz\\.abc\\.com/"
allow: true
- host: "https://domain2\\.pqr\\.def\\.com/"
allow: true
aliases:
- "https://domain2\\.ghi\\.leno\\.de/"
```
---
**Note:**
In current state of COOL remoteconfigurl for [Remote/DynamicConfiguration](https://sdk.collaboraonline.com/docs/installation/Configuration.html#remote-dynamic-configuration) only uses HTTPS. see [here in wsd/COOLWSD.cpp](https://github.com/CollaboraOnline/online/blob/8591d323c6db99e592ac8ac8ebef0e3a95f2e6ba/wsd/COOLWSD.cpp#L1069-L1096)
---
## Useful commands to check what is happening
Where is this pods, are they ready?
``` bash
kubectl -n collabora get pod
```
example output :
``` bash
NAME READY STATUS RESTARTS AGE
collabora-online-5fb4869564-dnzmk 1/1 Running 0 28h
collabora-online-5fb4869564-fb4cf 1/1 Running 0 28h
collabora-online-5fb4869564-wbrv2 1/1 Running 0 28h
```
What is the outside host that multiple coolwsd servers actually
answering?
``` bash
kubectl get ingress -n collabora
```
example output :
``` bash
|-----------|------------------|--------------------------|------------------------|-------|
| NAMESPACE | NAME | HOSTS | ADDRESS | PORTS |
|-----------|------------------|--------------------------|------------------------|-------|
| collabora | collabora-online |chart-example.local | | 80 |
|-----------|------------------|--------------------------|------------------------|-------|
```
To uninstall the helm chart
``` bash
helm uninstall collabora-online -n collabora
```

+ 2902
- 0
grafana_dashboards/ha-allocation.json
File diff suppressed because it is too large
View File


+ 1701
- 0
grafana_dashboards/overview.json
File diff suppressed because it is too large
View File


BIN
templates/.configmap.yaml.swp View File


+ 62
- 0
templates/_helpers.tpl View File

@ -0,0 +1,62 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "collabora-online.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "collabora-online.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "collabora-online.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "collabora-online.labels" -}}
helm.sh/chart: {{ include "collabora-online.chart" . }}
{{ include "collabora-online.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "collabora-online.selectorLabels" -}}
app.kubernetes.io/name: {{ include "collabora-online.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "collabora-online.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "collabora-online.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

+ 311
- 0
templates/configmap.yaml View File

@ -0,0 +1,311 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "collabora-online.fullname" . }}
annotations:
confighash: config-{{ .Values.collabora | toYaml | sha256sum | trunc 32 }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
data:
coolwsd.xml: |
<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- -->
<config>
<!-- For more detailed documentation on typical configuration options please see:
https://sdk.collaboraonline.com/docs/installation/Configuration.html -->
<!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
<!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
<accessibility desc="Accessibility settings">
<enable type="bool" desc="Controls whether accessibility support should be enabled or not." default="false">false</enable>
</accessibility>
<allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages>
<!--
These are the settings of external (remote) spellchecker and grammar checker services. Currently LanguageTool and Duden Korrekturserver APIs are supported, you can
set either of them. By default they are disabled. To turn the support on, please set "enabled" property to true. It works with self hosted or cloud services, free
and premium as well. The "base_url" may be https://api.languagetoolplus.com/v2 if the cloud version of LanguageTool is used. Please note that your data in the
document e.g. the text part of it will be sent to the cloud API. Please read the respective privacy policies, e.g. https://languagetool.org/legal/privacy.
-->
<languagetool desc="Remote API settings for spell and grammar checking">
<enabled desc="Enable Remote Spell and Grammar Checker" type="bool" default="false"></enabled>
<base_url desc="HTTP endpoint for the API server, without /check or /languages postfix at the end." type="string" default=""></base_url>
<user_name desc="LanguageTool or Duden account username for premium usage." type="string" default=""></user_name>
<api_key desc="API key provided by LanguageTool or Duden account for premium usage." type="string" default=""></api_key>
<ssl_verification desc="Enable or disable SSL verification. You may have to disable it in test environments with self-signed certificates." type="string" default="true"></ssl_verification>
<rest_protocol desc="REST API protocol. For LanguageTool leave it blank, for Duden Korrekturserver use the string 'duden'." type="string" default=""></rest_protocol>
</languagetool>
<deepl desc="DeepL API settings for translation service">
<enabled desc="If true, shows translate option as a menu entry in the compact view and as an icon in the tabbed view." type="bool" default="false">false</enabled>
<api_url desc="URL for the API" type="string" default=""></api_url>
<auth_key desc="Auth Key generated by your account" type="string" default=""></auth_key>
</deepl>
<sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
<child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
<mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree>
<server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default=""></server_name>
<file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path>
<hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls>
<experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features>
<memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
<num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children>
<!-- <fetch_update_check desc="Every number of hours will fetch latest version data. Defaults to 10 hours." type="uint" default="10">10</fetch_update_check> -->
<per_document desc="Document-specific settings, including LO Core settings.">
<max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
<batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority>
<redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments>
<pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi>
<idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
<idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs>
<autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs>
<always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit>
<limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb>
<limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
<limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
<limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
<limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs>
<limit_store_failures desc="Maximum number of consecutive save-and-upload to storage failures when unloading the document. 0 for unlimited (not recommended)." type="uint" default="5">5</limit_store_failures>
<limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs>
<min_time_between_saves_ms desc="Minimum number of milliseconds between saving the document on disk." type="uint" default="500">500</min_time_between_saves_ms>
<min_time_between_uploads_ms desc="Minimum number of milliseconds between uploading the document to storage." type="uint" default="5000">5000</min_time_between_uploads_ms>
<cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="true">
<cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms>
<bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs>
<idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs>
<limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb>
<limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per>
<lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by coolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs>
</cleanup>
</per_document>
<per_view desc="View-specific settings.">
<group_download_as desc="If set to true, groups download as icons into a dropdown for the notebookbar view." type="bool" default="true">true</group_download_as>
<out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint" default="120">120</out_of_focus_timeout_secs>
<idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs>
</per_view>
<ver_suffix desc="Appended to etags to allow easy refresh of changed files during development" type="string" default=""></ver_suffix>
<logging>
<color type="bool">true</color>
<!--
Note to developers: When you do "make run", the logging.level will be set on the
coolwsd command line, so if you want to change it for your testing, do it in
Makefile.am, not here.
-->
<level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level>
<level_startup type="string" desc="As for level - but for the initial startup phase which is most problematic, logging reverts to level configured above when startup is complete" default="trace">trace</level_startup>
<most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client>
<least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client>
<protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol>
<!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav"
See also: https://docs.libreoffice.org/sal/html/sal_log.html -->
<lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log>
<file enable="false">
<!-- If you use other path than /var/log and you run coolwsd from systemd, make sure that you enable that path in coolwsd.service (ReadWritePaths). -->
<property name="path" desc="Log file path.">/var/log/coolwsd.log</property>
<property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
<property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
<property name="compress" desc="Enable/disable log file compression.">true</property>
<property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
<property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
<property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
<property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
</file>
<anonymize>
<anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data>
<anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt>
</anonymize>
<docstats type="bool" desc="Enable to see document handling information in logs." default="false">false</docstats>
<userstats desc="Enable user stats. i.e: logs the details of a file and user" type="bool" default="false">false</userstats>
</logging>
<!--
Note to developers: When you do "make run", the trace_event[@enable] will be set on the
coolwsd command line, so if you want to change it for your testing, do it in Makefile.am,
not here.
-->
<trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false">
<path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/coolwsd.trace.json">/var/log/coolwsd.trace.json</path>
</trace_event>
<browser_logging desc="Logging in the browser console" default="false">false</browser_logging>
<trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false">
<path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/cooltrace-%.gz" compress="true" snapshot="false"></path>
<filter>
<message desc="Regex pattern of messages to exclude"></message>
</filter>
<outgoing>
<record desc="Whether or not to record outgoing messages" default="false">false</record>
</outgoing>
</trace>
<net desc="Network settings">
<!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, coolwsd unexpectedly listens on [::1] only.
You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
<proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
<listen type="string" default="any" desc="Listen address that coolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
<!-- this allows you to shift all of our URLs into a sub-path from
https://my.com/browser/a123... to https://my.com/my/sub/path/browser/a123... -->
<service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root>
<post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
<host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
<host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
<host desc="The IPv6 loopback (localhost) address.">::1</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
</post_allow>
<content_security_policy desc="Customize the CSP header by specifying one or more policy-directive, separated by semicolons. See w3.org/TR/CSP2"></content_security_policy>
<frame_ancestors desc="OBSOLETE: Use content_security_policy. Specify who is allowed to embed the Collabora Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
<connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>
<!-- this setting radically changes how online works, it should not be used in a production environment -->
<proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix>
</net>
<ssl desc="SSL settings">
<!-- switches from https:// + wss:// to http:// + ws:// -->
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
<!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination>
<cert_file_path desc="Path to the cert file" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
<key_file_path desc="Path to the key file" relative="false">/etc/coolwsd/key.pem</key_file_path>
<ca_file_path desc="Path to the ca file" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
<cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
<hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
<max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
<report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
<pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
<pin></pin>
</pins>
</hpkp>
<sts desc="Strict-Transport-Security settings, per rfc6797. Subdomains are always included.">
<enabled desc="Whether or not Strict-Transport-Security is enabled. Enable only when ready for production. Cannot be disabled without resetting the browsers." type="bool" default="false">false</enabled>
<max_age desc="Strict-Transport-Security max-age directive, in seconds. 0 is allowed; please see rfc6797 for details. Defaults to 1 year." type="int" default="31536000">31536000</max_age>
</sts>
</ssl>
<security desc="Altering these defaults potentially opens you to significant risk">
<seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp>
<capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities>
<jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs>
<enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">false</enable_macros_execution>
<macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">1</macro_security_level>
<enable_websocket_urp desc="Should we enable URP (UNO remote protocol) communication over the websocket. This allows full control of the Kit child server to anyone with access to the websocket including executing macros without confirmation or running arbitrary shell commands in the jail." type="bool" default="false">false</enable_websocket_urp>
<enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated>
</security>
<certificates>
<database_path type="string" desc="Path to the NSS certificates that are used for signing documents" default=""></database_path>
</certificates>
<watermark>
<opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity>
<text desc="Watermark text to be displayed on the document if entered" type="string"></text>
</watermark>
<user_interface>
<mode type="string" desc="Controls the user interface style. The 'default' means: Take the value from ui_defaults, or decide for one of compact or tabbed (default|compact|tabbed)" default="default">default</mode>
<use_integration_theme desc="Use theme from the integrator" type="bool" default="true">true</use_integration_theme>
</user_interface>
<storage desc="Backend storage">
<filesystem allow="false" />
<wopi desc="Allow/deny wopi storage." allow="true">
<max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
<locking desc="Locking settings">
<refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh>
</locking>
<alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="first">
<host allow="true">https://amogha.labnetwork.in:443</host>
</alias_groups>
</wopi>
<ssl desc="SSL settings">
<as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">false</as_scheme>
<enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and coolwsd. When empty this defaults to following the ssl.enable setting"></enable>
<cert_file_path desc="Path to the cert file" relative="false"></cert_file_path>
<key_file_path desc="Path to the key file" relative="false"></key_file_path>
<ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path>
<cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overridden only if absolutely needed."></cipher_list>
</ssl>
</storage>
<admin_console desc="Web admin console settings.">
<enable desc="Enable the admin console functionality" type="bool" default="true">true</enable>
<enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam>
<username desc="The username of the admin console. Ignored if PAM is enabled."></username>
<password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password."></password>
<logging desc="Log admin activities irrespective of logging.level">
<admin_login desc="log when an admin logged into the console" type="bool" default="true">true</admin_login>
<metrics_fetch desc="log when metrics endpoint is accessed and metrics endpoint authentication is enabled" type="bool" default="true">true</metrics_fetch>
<monitor_connect desc="log when external monitor gets connected" type="bool" default="true">true</monitor_connect>
<admin_action desc="log when admin does some action for example killing a process" type="bool" default="true">true</admin_action>
</logging>
</admin_console>
<monitors desc="Addresses of servers we connect to on start for monitoring">
<!-- <monitor desc="Address of the monitor and interval after which it should try reconnting after disconnect" retryInterval="20">wss://foobar:234/ws</monitor> -->
</monitors>
<quarantine_files desc="Files are stored here to be examined later in cases of crashes or similar situation." default="false" enable="false">
<limit_dir_size_mb desc="Maximum directory size. On exceeding the specified limit, older files will be deleted." default="250" type="uint"></limit_dir_size_mb>
<max_versions_to_maintain desc="How many versions of the same file to keep." default="2" type="uint"></max_versions_to_maintain>
<path desc="Path to directory under which quarantined files will be stored" type="path" relative="true" default="quarantine"></path>
<expiry_min desc="Time in mins after quarantined files will be deleted." type="int" default="30"></expiry_min>
</quarantine_files>
<remote_config>
<remote_url desc="remote server to which you will send resquest to get remote config in response" type="string" default=""></remote_url>
</remote_config>
<stop_on_config_change desc="Stop coolwsd whenever config files change." type="bool" default="false">false</stop_on_config_change>
<remote_font_config>
<url desc="URL of optional JSON file that lists fonts to be included in Online" type="string" default=""></url>
</remote_font_config>
<home_mode>
<enable desc="Enable more configuration options for home users" type="bool" default="false">false</enable>
</home_mode>
<fonts_missing>
<handling desc="How to handle fonts mising in a document: 'report', 'log', 'both', or 'ignore'" type="string" default="log">log</handling>
</fonts_missing>
<indirection_endpoint>
<url desc="URL endpoint to server which servers routeToken in json format" default=""></url>
</indirection_endpoint>
<zotero desc="Zotero plugin configuration. For more details about Zotero visit https://www.zotero.org/">
<enable desc="Enable Zotero plugin." type="bool" default="true">true</enable>
</zotero>
<help_url desc="The Help root URL, or empty for no help (hides the Help buttons)" type="string" default="https://help.collaboraoffice.com/help.html?">https://help.collaboraoffice.com/help.html?</help_url>
<overwrite_mode>
<enable desc="Enable overwrite mode (user can use insert key)" type="bool" default="true">true</enable>
</overwrite_mode>
</config>

+ 16
- 0
templates/configmap_grafana_dashboards.yaml View File

@ -0,0 +1,16 @@
{{- if .Values.grafana.dashboards.enabled }}
{{- range $path, $bytes := .Files.Glob "grafana_dashboards/*.json" }}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "collabora-online.fullname" $ }}-grafana-dashboards-{{ base $path }}
labels:
{{- include "collabora-online.labels" $ | nindent 4 }}
{{- toYaml $.Values.grafana.dashboards.labels | nindent 4 }}
annotations:
{{- toYaml $.Values.grafana.dashboards.annotations | nindent 4 }}
data:
{{- ($.Files.Glob $path ).AsConfig | nindent 2 }}
{{- end }}
{{- end }}

+ 140
- 0
templates/deployment.yaml View File

@ -0,0 +1,140 @@
{{- if eq .Values.deployment.kind "Deployment" -}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
spec:
minReadySeconds: {{ .Values.deployment.minReadySeconds }}
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
strategy:
type: {{ .Values.deployment.type }}
{{- if eq .Values.deployment.type "RollingUpdate"}}
rollingUpdate:
maxSurge: {{ .Values.deployment.maxSurge }}
maxUnavailable: {{ .Values.deployment.maxUnavailable }}
{{- end}}
selector:
matchLabels:
{{- include "collabora-online.selectorLabels" . | nindent 6 }}
type: main
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
confighash: config-{{ .Values.collabora | toYaml | sha256sum | trunc 32 }}
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
labels:
{{- include "collabora-online.selectorLabels" . | nindent 8 }}
type: main
spec:
{{- with .Values.deployment.hostAliases }}
hostAliases:
{{- toYaml . | nindent 8 }}
{{- end }}
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "collabora-online.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: {{ .Values.deployment.containerPort }}
protocol: TCP
{{- if .Values.probes.startup.enabled }}
startupProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
{{- end }}
{{- if .Values.probes.liveness.enabled }}
livenessProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
successThreshold: {{ .Values.probes.liveness.successThreshold }}
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
{{- end }}
{{- if .Values.probes.readiness.enabled }}
readinessProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
successThreshold: {{ .Values.probes.readiness.successThreshold }}
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "collabora-online.fullname" . }}
env:
- name: username
valueFrom:
secretKeyRef:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.usernameKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: username
{{- end }}
- name: password
valueFrom:
secretKeyRef:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.passwordKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: password
{{- end }}
{{- with .Values.collabora.env }}
{{ toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- name: tmp
mountPath: /tmp
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: tmp
emptyDir: {}
{{- end }}

+ 12
- 0
templates/dynamicConfig/configmap.yaml View File

@ -0,0 +1,12 @@
{{- if and .Values.dynamicConfig.enabled (not .Values.dynamicConfig.upload.enabled) (not .Values.dynamicConfig.existingConfigMap.enabled) -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "collabora-online.fullname" . }}-dynconfig
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
data:
config.json: |
{{- .Values.dynamicConfig.configuration | nindent 4 }}
{{- end}}

+ 103
- 0
templates/dynamicConfig/deployment.yaml View File

@ -0,0 +1,103 @@
{{- if and .Values.dynamicConfig.enabled (not .Values.dynamicConfig.upload.enabled) -}}
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "collabora-online.fullname" . }}-dynconfig
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.dynamicConfig.replicaCount }}
selector:
matchLabels:
{{- include "collabora-online.selectorLabels" . | nindent 6 }}
type: dynconfig
template:
metadata:
{{- with .Values.dynamicConfig.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "collabora-online.selectorLabels" . | nindent 8 }}
type: dynconfig
# confighash: config-{{ .Values | toYaml | sha256sum | trunc 32 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "collabora-online.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.dynamicConfig.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}-dynconfig
securityContext:
{{- toYaml .Values.dynamicConfig.securityContext | nindent 12 }}
image: "{{ .Values.dynamicConfig.image.repository }}:{{ .Values.dynamicConfig.image.tag }}"
imagePullPolicy: {{ .Values.dynamicConfig.image.pullPolicy }}
ports:
- name: http
containerPort: {{ .Values.dynamicConfig.containerPort }}
protocol: TCP
{{- if .Values.probes.startup.enabled }}
startupProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
failureThreshold: {{ .Values.dynamicConfig.probes.startup.failureThreshold }}
periodSeconds: {{ .Values.dynamicConfig.probes.startup.periodSeconds }}
{{- end }}
{{- if .Values.dynamicConfig.probes.liveness.enabled }}
livenessProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.dynamicConfig.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.dynamicConfig.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.dynamicConfig.probes.liveness.timeoutSeconds }}
successThreshold: {{ .Values.dynamicConfig.probes.liveness.successThreshold }}
failureThreshold: {{ .Values.dynamicConfig.probes.liveness.failureThreshold }}
{{- end }}
{{- if .Values.dynamicConfig.probes.readiness.enabled }}
readinessProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.dynamicConfig.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.dynamicConfig.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.dynamicConfig.probes.readiness.timeoutSeconds }}
successThreshold: {{ .Values.dynamicConfig.probes.readiness.successThreshold }}
failureThreshold: {{ .Values.dynamicConfig.probes.readiness.failureThreshold }}
{{- end }}
{{- with .Values.dynamicConfig.env }}
{{ toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.dynamicConfig.resources | nindent 12 }}
volumeMounts:
- name: config
mountPath: /usr/share/nginx/html/config
{{- with .Values.dynamicConfig.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.dynamicConfig.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.dynamicConfig.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: config
configMap:
{{- if .Values.dynamicConfig.existingConfigMap.enabled }}
name: {{ .Values.dynamicConfig.existingConfigMap.name }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}-dynconfig
{{- end }}
{{- end }}

+ 43
- 0
templates/dynamicConfig/ingress.yaml View File

@ -0,0 +1,43 @@
{{- if and .Values.dynamicConfig.enabled .Values.dynamicConfig.ingress.enabled -}}
{{- $fullName := include "collabora-online.fullname" . -}}
{{- $svcPort := .Values.dynamicConfig.service.port -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ $fullName }}-dynconfig
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- with .Values.dynamicConfig.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.dynamicConfig.ingress.className }}
ingressClassName: {{ .Values.dynamicConfig.ingress.className }}
{{- end }}
{{- if .Values.dynamicConfig.ingress.tls }}
tls:
{{- range .Values.dynamicConfig.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.dynamicConfig.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ $fullName }}-dynconfig
port:
number: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}

+ 43
- 0
templates/dynamicConfig/ingress_upload.yaml View File

@ -0,0 +1,43 @@
{{- if and .Values.dynamicConfig.enabled .Values.dynamicConfig.upload.enabled .Values.dynamicConfig.upload.ingress.enabled -}}
{{- $fullName := include "collabora-online.fullname" . -}}
{{- $svcPort := .Values.dynamicConfig.upload.service.port -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ $fullName }}-dynconfig-upload
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- with .Values.dynamicConfig.upload.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.dynamicConfig.upload.ingress.className }}
ingressClassName: {{ .Values.dynamicConfig.upload.ingress.className }}
{{- end }}
{{- if .Values.dynamicConfig.upload.ingress.tls }}
tls:
{{- range .Values.dynamicConfig.upload.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.dynamicConfig.upload.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ $fullName }}-dynconfig
port:
number: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}

+ 25
- 0
templates/dynamicConfig/service.yaml View File

@ -0,0 +1,25 @@
{{- if .Values.dynamicConfig.enabled -}}
apiVersion: v1
kind: Service
metadata:
name: {{ include "collabora-online.fullname" . }}-dynconfig
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
type: dynconfig
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.dynamicConfig.service.port }}
targetPort: http
protocol: TCP
name: http
{{- if .Values.dynamicConfig.upload.enabled }}
- port: {{ .Values.dynamicConfig.upload.service.port }}
targetPort: upload-http
protocol: TCP
name: upload-http
{{- end }}
selector:
{{- include "collabora-online.selectorLabels" . | nindent 4 }}
type: dynconfig
{{- end }}

+ 118
- 0
templates/dynamicConfig/statefulset.yaml View File

@ -0,0 +1,118 @@
{{- if and .Values.dynamicConfig.enabled .Values.dynamicConfig.upload.enabled -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ include "collabora-online.fullname" . }}-dynconfig
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
spec:
serviceName: {{ include "collabora-online.fullname" . }}-dynconfig
replicas: 1
selector:
matchLabels:
{{- include "collabora-online.selectorLabels" . | nindent 6 }}
type: dynconfig
template:
metadata:
{{- with .Values.dynamicConfig.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "collabora-online.selectorLabels" . | nindent 8 }}
type: dynconfig
# confighash: config-{{ .Values | toYaml | sha256sum | trunc 32 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "collabora-online.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.dynamicConfig.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}-dynconfig
securityContext:
{{- toYaml .Values.dynamicConfig.securityContext | nindent 12 }}
image: "{{ .Values.dynamicConfig.image.repository }}:{{ .Values.dynamicConfig.image.tag }}"
imagePullPolicy: {{ .Values.dynamicConfig.image.pullPolicy }}
ports:
- name: http
containerPort: {{ .Values.dynamicConfig.containerPort }}
protocol: TCP
{{- if .Values.probes.startup.enabled }}
startupProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
failureThreshold: {{ .Values.dynamicConfig.probes.startup.failureThreshold }}
periodSeconds: {{ .Values.dynamicConfig.probes.startup.periodSeconds }}
{{- end }}
{{- if .Values.dynamicConfig.probes.liveness.enabled }}
livenessProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.dynamicConfig.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.dynamicConfig.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.dynamicConfig.probes.liveness.timeoutSeconds }}
successThreshold: {{ .Values.dynamicConfig.probes.liveness.successThreshold }}
failureThreshold: {{ .Values.dynamicConfig.probes.liveness.failureThreshold }}
{{- end }}
{{- if .Values.dynamicConfig.probes.readiness.enabled }}
readinessProbe:
httpGet:
path: /
port: {{ .Values.dynamicConfig.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.dynamicConfig.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.dynamicConfig.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.dynamicConfig.probes.readiness.timeoutSeconds }}
successThreshold: {{ .Values.dynamicConfig.probes.readiness.successThreshold }}
failureThreshold: {{ .Values.dynamicConfig.probes.readiness.failureThreshold }}
{{- end }}
{{- with .Values.dynamicConfig.env }}
{{ toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.dynamicConfig.resources | nindent 12 }}
volumeMounts:
- name: config
mountPath: /usr/share/nginx/html/config
- name: {{ .Chart.Name }}-dynconfig-upload
image: {{ .Values.dynamicConfig.upload.image.repository }}@sha256:{{ .Values.dynamicConfig.upload.image.digest }}
envFrom:
- secretRef:
name: {{ include "collabora-online.fullname" . }}-upload-env
ports:
- name: "upload-http"
containerPort: 3000
volumeMounts:
- name: "config"
mountPath: "/config"
{{- with .Values.dynamicConfig.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.dynamicConfig.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.dynamicConfig.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
volumeClaimTemplates:
- metadata:
name: config
spec:
accessModes: [ "{{ .Values.dynamicConfig.upload.pvc.accessMode }}" ]
resources:
requests:
storage: {{ .Values.dynamicConfig.upload.pvc.size }}
{{- if .Values.dynamicConfig.upload.pvc.storageClassName }}
storageClassName: {{ .Values.dynamicConfig.upload.pvc.storageClassName }}
{{- end }}
{{- end }}

+ 11
- 0
templates/dynamicConfig/upload_secret.yaml View File

@ -0,0 +1,11 @@
{{- if .Values.dynamicConfig.upload.enabled }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "collabora-online.fullname" . }}-upload-env
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
data:
KEY_{{ .Values.dynamicConfig.upload.key }}: {{ "/config/config.json" | b64enc }}
{{- end }}

+ 32
- 0
templates/hpa.yaml View File

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: {{ .Values.deployment.kind }}
name: {{ include "collabora-online.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- with .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ . }}
{{- end }}
{{- with .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ . }}
{{- end }}
{{- end }}

+ 43
- 0
templates/ingress.yaml View File

@ -0,0 +1,43 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "collabora-online.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.className }}
ingressClassName: {{ .Values.ingress.className }}
{{- end }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ $fullName }}
port:
number: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}

+ 163
- 0
templates/prometheus-rules.yaml View File

@ -0,0 +1,163 @@
{{- if and ( .Values.prometheus.rules.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) }}
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: {{ include "collabora-online.fullname" . }}
{{- with .Values.prometheus.rules.namespace }}
namespace: {{ . | quote }}
{{- end }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- toYaml .Values.prometheus.rules.additionalLabels | nindent 4 }}
spec:
groups:
{{- if .Values.prometheus.rules.defaults.enabled }}
- name: {{ template "collabora-online.name" . }}-Defaults
rules:
- alert: "Collabora NoProcess"
expr: 'coolwsd_count < 1'
for: "1m"
labels:
severity: "critical"
{{`
annotations:
summary: "no coolwsd process running: in namespace {{ $labels.namespace }}"
`}}
{{- range $key, $value := .Values.prometheus.rules.defaults.docs.pod }}
- alert: "Collabora Open Docs by Pod"
expr: 'kit_assigned_count > {{ $value }}'
for: "1m"
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "Too many Docs are open on a pod in namespace: {{ $labels.namespace }}"
`}}
{{- end }}
{{- range $key, $value := .Values.prometheus.rules.defaults.docs.sum }}
- alert: "Collabora Open Docs by Namespace"
expr: 'sum(kit_assigned_count) without (instance, pod) > {{ $value }}'
for: "1m"
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "Too many Docs are open on namespace"
`}}
{{- end }}
{{- range $key, $value := .Values.prometheus.rules.defaults.viewers.pod }}
- alert: "Collabora Viewers by Pod"
expr: 'document_active_views_active_count_total > {{ $value }}'
for: "1m"
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "Too many Viewers on a pod in namespace: {{ $labels.namespace }}"
`}}
{{- end }}
{{- range $key, $value := .Values.prometheus.rules.defaults.viewers.doc }}
- alert: "Collabora Viewers by Document"
expr: 'doc_views_active > {{ $value }}'
for: "1m"
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "Too many Viewers on a document in namespace: {{ $labels.namespace }}"
`}}
{{- end }}
{{- range $key, $value := .Values.prometheus.rules.defaults.viewers.sum }}
- alert: "Collabora Viewers by Namespace"
expr: 'sum(document_active_views_active_count_total) without (instance, pod) > {{ $value }}'
for: "1m"
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "Too many Viewers on namespace"
`}}
{{- end }}
- alert: "Collabora same Document open Multiple time"
expr: 'count(doc_pid) by (key) > 1'
labels:
severity: "warning"
{{`
annotations:
summary: "a key/document is open multiple times in namespace: {{ $labels.namespace }}"
`}}
- alert: "Collabora same Document open Multiple time"
expr: 'count(count(doc_pid)by(key)>1) > {{ .Values.prometheus.rules.defaults.docs.duplicated }}'
labels:
severity: "critical"
{{`
annotations:
summary: "too many document are open multiple times in namespace: {{ $labels.namespace }}"
`}}
- alert: "Collabora Error StorageSpaceLow"
expr: 'increase(error_storage_space_low[1m]) > 0'
labels:
severity: "warning"
{{`
annotations:
summary: "local storage space too low to operate in namespace: {{ $labels.namespace }}"
`}}
{{- range $key, $value := .Values.prometheus.rules.defaults.errorStorageConnections }}
- alert: "Collabora Error StorageConnection"
expr: 'increase(error_storage_connection[1m]) > {{ $value }}'
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "unable to connect to storage in namespace {{ $labels.namespace }} on pod {{ $labels.pod }}."
`}}
{{- end }}
- alert: "Collabora Error BadRequest"
expr: 'increase(error_bad_request[1m]) > 0'
labels:
severity: "warning"
{{`
annotations:
summary: "we returned an HTTP bad request to a caller in namespace: {{ $labels.namespace }}"
`}}
- alert: "Collabora Error BadArgument"
expr: 'increase(error_bad_argument[1m]) > 0'
labels:
severity: "warning"
{{`
annotations:
summary: "we returned an HTTP bad argument to a caller in namespace: {{ $labels.namespace }}"
`}}
- alert: "Collabora Error UnauthorizedRequest"
expr: 'increase(error_unauthorized_request[1m]) > 0'
labels:
severity: "warning"
{{`
annotations:
summary: "an authorization exception usually on CheckFileInfo in namespace: {{ $labels.namespace }}"
`}}
{{- range $key, $value := .Values.prometheus.rules.defaults.errorServiceUnavailable }}
- alert: "Collabora Error ServiceUnavailable"
expr: 'increase(error_service_unavailable[1m]) > {{ $value }}'
labels:
severity: "{{ $key }}"
{{`
annotations:
summary: "internal error, service is unavailable in namespace {{ $labels.namespace }} on pod {{ $labels.pod }}."
`}}
{{- end }}
- alert: "Collabora Error ParseError"
expr: 'increase(error_parse_error[1m]) > 0'
labels:
severity: "warning"
{{`
annotations:
summary: "badly formed data provided for us to parse in namespace: {{ $labels.namespace }}"
`}}
{{- end }}
{{- if .Values.prometheus.rules.additionalRules }}
- name: {{ template "collabora-online.name" . }}-Additional
rules: {{- toYaml .Values.prometheus.rules.additionalRules | nindent 4 }}
{{- end }}
{{- end }}

+ 12
- 0
templates/secret.yaml View File

@ -0,0 +1,12 @@
{{- if not (.Values.collabora.existingSecret).enabled }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
data:
username: {{ .Values.collabora.username | b64enc }}
password: {{ .Values.collabora.password | b64enc }}
{{- end }}

+ 21
- 0
templates/service.yaml View File

@ -0,0 +1,21 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
type: main
{{- with .Values.service.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "collabora-online.selectorLabels" . | nindent 4 }}
type: main

+ 12
- 0
templates/serviceaccount.yaml View File

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "collabora-online.serviceAccountName" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

+ 36
- 0
templates/servicemonitor.yaml View File

@ -0,0 +1,36 @@
{{- if .Values.prometheus.servicemonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
{{- with .Values.prometheus.servicemonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
endpoints:
- port: http
path: "/cool/getMetrics"
basicAuth:
username:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.usernameKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: username
{{- end }}
password:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.passwordKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: password
{{- end }}
selector:
matchLabels:
{{- include "collabora-online.selectorLabels" . | nindent 6 }}
type: main
{{- end }}

+ 133
- 0
templates/statefulset.yaml View File

@ -0,0 +1,133 @@
{{- if eq .Values.deployment.kind "StatefulSet" -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ include "collabora-online.fullname" . }}
labels:
{{- include "collabora-online.labels" . | nindent 4 }}
spec:
serviceName: {{ include "collabora-online.fullname" . }}
minReadySeconds: {{ .Values.deployment.minReadySeconds }}
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "collabora-online.selectorLabels" . | nindent 6 }}
type: main
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
confighash: config-{{ .Values.collabora | toYaml | sha256sum | trunc 32 }}
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
labels:
{{- include "collabora-online.selectorLabels" . | nindent 8 }}
type: main
spec:
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
{{- with .Values.deployment.hostAliases }}
hostAliases:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "collabora-online.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: {{ .Values.deployment.containerPort }}
protocol: TCP
{{- if .Values.probes.startup.enabled }}
startupProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
{{- end }}
{{- if .Values.probes.liveness.enabled }}
livenessProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
successThreshold: {{ .Values.probes.liveness.successThreshold }}
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
{{- end }}
{{- if .Values.probes.readiness.enabled }}
readinessProbe:
httpGet:
path: /
port: {{ .Values.deployment.containerPort }}
scheme: HTTP
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
successThreshold: {{ .Values.probes.readiness.successThreshold }}
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
{{- end }}
envFrom:
- configMapRef:
name: {{ include "collabora-online.fullname" . }}
env:
- name: username
valueFrom:
secretKeyRef:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.usernameKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: username
{{- end }}
- name: password
valueFrom:
secretKeyRef:
{{- if (.Values.collabora.existingSecret).enabled }}
name: {{ .Values.collabora.existingSecret.secretName | quote }}
key: {{ .Values.collabora.existingSecret.passwordKey | quote }}
{{- else }}
name: {{ include "collabora-online.fullname" . }}
key: password
{{- end }}
{{- with .Values.collabora.env }}
{{ toYaml . | nindent 12 }}
{{- end }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- name: tmp
mountPath: /tmp
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: tmp
emptyDir: {}
{{- end }}

+ 316
- 0
values.yaml View File

@ -0,0 +1,316 @@
---
# Default values for newchart.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
image:
repository: collabora/code
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
terminationGracePeriodSeconds: 60
serviceAccount:
# Specifies whether a service account should be created
create: false
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
collabora:
# example to add aliasgroups
# - host: "<protocol>://<host-name>:<port>"
# aliases: ["<protocol>://<its-first-alias>:<port>, <protocol>://<its-second-alias>:<port>"]
aliasgroups: []
extra_params: --o:ssl.enable=false
# External hostname:port of the server running coolwsd.
# If empty, it's derived from the request (please set it if this doesn't work).
# May be specified when behind a reverse-proxy or when the hostname is not reachable directly.
server_name: null
existingSecret:
enabled: false
secretName: ""
usernameKey: "username"
passwordKey: "password"
password: examplepass
username: admin
env: []
prometheus:
servicemonitor:
enabled: false
labels: {}
rules:
enabled: false
additionalLabels: {}
defaults:
enabled: true
errorServiceUnavailable:
critical: 50
warning: 2
info: 0
errorStorageConnections:
critical: 50
warning: 2
info: 0
docs:
duplicated: 50
pod:
critical: 10
warning: 8
info: 5
sum:
critical: 500
warning: 200
info: 50
viewers:
pod:
critical: 100
warning: 80
info: 60
doc:
critical: 50
warning: 40
info: 30
sum:
critical: 15000
warning: 12000
info: 5000
additionalRules: []
grafana:
dashboards:
enabled: false
labels:
grafana_dashboard: "1"
annotations: {}
podAnnotations: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# readOnlyRootFilesystem: false
# privileged: true
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
service:
type: ClusterIP
port: 9980
annotations: {}
deployment:
# Use StatefulSet or Deployment
kind: Deployment
containerPort: 9980
type: RollingUpdate
minReadySeconds: 0
maxUnavailable: 0
maxSurge: 1
# info on how to use hostAliases: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
# note: different from aliasgroups
hostAliases: null
probes:
startup:
enabled: true
failureThreshold: 30
periodSeconds: 3
readiness:
enabled: true
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 30
successThreshold: 1
failureThreshold: 2
liveness:
enabled: true
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 30
successThreshold: 1
failureThreshold: 4
ingress:
enabled: false
className: ""
annotations: {}
# # nginx
# nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
# # block admin urls from outside
# nginx.ingress.kubernetes.io/server-snippet: |
# location /cool/getMetrics { deny all; return 403; }
# location /cool/adminws/ { deny all; return 403; }
# location /browser/dist/admin/admin.html { deny all; return 403; }
#
# # HAProxy
# haproxy.org/timeout-tunnel: "3600s"
# haproxy.org/backend-config-snippet: |
# mode http
# balance leastconn
# stick-table type string len 2048 size 1k store conn_cur
# http-request set-var(txn.wopisrcconns) url_param(WOPISrc),table_conn_cur()
# http-request track-sc1 url_param(WOPISrc)
# stick match url_param(WOPISrc) if { var(txn.wopisrcconns) -m int gt 0 }
# stick store-request url_param(WOPISrc)
#
# # HAProxy - Community: https://haproxy-ingress.github.io/
# haproxy-ingress.github.io/timeout-tunnel: 3600s
# haproxy-ingress.github.io/balance-algorithm: url_param WOPISrc check_post
# haproxy-ingress.github.io/config-backend:
# hash-type consistent
# # block admin urls from outside
# acl admin_url path_beg /cool/getMetrics
# acl admin_url path_beg /cool/adminws/
# acl admin_url path_beg /browser/dist/admin/admin.html
# http-request deny if admin_url
#
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
resources: {}
# limits:
# cpu: 100m
# memory: 128Mi
# requests:
# cpu: 100m
# memory: 128Mi
replicaCount: 1
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 100
targetCPUUtilizationPercentage: 70
targetMemoryUtilizationPercentage: 50
dynamicConfig:
enabled: false
image:
repository: nginx
tag: 1.25
pullPolicy: IfNotPresent
replicaCount: 1
podAnnotations: []
podSecurityContext: {}
securityContext: {}
# configVolumeType: configMap # configMap or pvc
existingConfigMap:
enabled: false
name: ""
upload:
enabled: false
image:
repository: "twostoryrobot/simple-file-upload"
digest: 547fc4360b31d8604b7a26202914e87cd13609cc938fd83f412c77eb44aa1cc4
key: TESTKEY
pvc:
size: 1Gi
accessMode: "ReadWriteOnce"
# storageClassName: ""
service:
port: 8090
ingress:
enabled: false
className: ""
annotations: {}
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
containerPort: 80
probes:
startup:
enabled: true
failureThreshold: 30
periodSeconds: 2
readiness:
enabled: true
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 30
successThreshold: 1
failureThreshold: 2
liveness:
enabled: true
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 30
successThreshold: 1
failureThreshold: 4
env: []
resources: {}
nodeSelector: {}
tolerations: []
affinity: {}
service:
port: 8080
ingress:
enabled: false
className: ""
annotations: {}
hosts:
- host: chart-example.local
paths:
- path: /
pathType: ImplementationSpecific
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
configuration: |
{}
trusted_certs_install:
enabled: false
trusted_certs: []
nodeSelector: {}
tolerations: []
affinity: {}

Write Preview
Loading…
Cancel
Save