diff --git a/incubator/chartmuseum/Chart.yaml b/incubator/chartmuseum/Chart.yaml index fb29c47305..a731029bd9 100644 --- a/incubator/chartmuseum/Chart.yaml +++ b/incubator/chartmuseum/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Helm Chart Repository with support for Amazon S3 and Google Cloud Storage name: chartmuseum -version: 0.4.5 +version: 0.4.6 appVersion: 0.4.2 home: https://github.com/chartmuseum/chartmuseum icon: https://raw.githubusercontent.com/chartmuseum/chartmuseum/master/logo.png diff --git a/incubator/chartmuseum/README.md b/incubator/chartmuseum/README.md index 337762ec2b..4b05f203da 100644 --- a/incubator/chartmuseum/README.md +++ b/incubator/chartmuseum/README.md @@ -1,8 +1,32 @@ + # ChartMuseum Helm Chart Deploy your own private ChartMuseum. -Please also see https://github.com/kubernetes-helm/chartmuseum +Please also see https://github.com/kubernetes-helm/chartmuseum + +## Table of Content + + + + + +- [Prerequisites](#prerequisites) +- [Configuration](#configuration) +- [Installation](#installation) + - [Using with Amazon S3](#using-with-amazon-s3) + - [permissions grant with access keys](#permissions-grant-with-access-keys) + - [permissions grant with IAM instance profile](#permissions-grant-with-iam-instance-profile) + - [permissions grant with IAM assumed role](#permissions-grant-with-iam-assumed-role) + - [Using with Google Cloud Storage](#using-with-google-cloud-storage) + - [Using with Microsoft Azure Blob Storage](#using-with-microsoft-azure-blob-storage) + - [Using with Alibaba Cloud OSS Storage](#using-with-alibaba-cloud-oss-storage) + - [Using with local filesystem storage](#using-with-local-filesystem-storage) + - [Example storage class](#example-storage-class) +- [Uninstall](#uninstall) + + + ## Prerequisites @@ -85,21 +109,218 @@ Specify each parameter using the `--set key=value[,key=value]` argument to helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum ``` -## Uninstall +### Using with Amazon S3 +Make sure your environment is properly setup to access `my-s3-bucket` -By default, a deliberate uninstall will result in the persistent volume -claim being deleted. - -```shell -helm delete my-chartmuseum +You need at least the following permissions inside your IAM Policy +```yaml +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowListObjects", + "Effect": "Allow", + "Action": [ + "s3:ListBucket" + ], + "Resource": "arn:aws:s3:::my-s3-bucket" + }, + { + "Sid": "AllowObjectsCRUD", + "Effect": "Allow", + "Action": [ + "s3:DeleteObject", + "s3:GetObject", + "s3:PutObject" + ], + "Resource": "arn:aws:s3:::my-s3-bucket/*" + } + ] +} ``` -To delete the deployment and its history: -```shell -helm delete --purge my-chartmuseum +You can grant it to `chartmuseum` by several ways: + +#### permissions grant with access keys + +Grant permissions to `special user` and us it's access keys for auth on aws + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: amazon + STORAGE_AMAZON_BUCKET: my-s3-bucket + STORAGE_AMAZON_PREFIX: + STORAGE_AMAZON_REGION: us-east-1 + secret: + AWS_ACCESS_KEY_ID: "********" ## aws access key id value + AWS_SECRET_ACCESS_KEY: "********" ## aws access key secret value ``` -## Example storage +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +#### permissions grant with IAM instance profile + +You can grant permissions to k8s node IAM instance profile. +For more information read this [article](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html) + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: amazon + STORAGE_AMAZON_BUCKET: my-s3-bucket + STORAGE_AMAZON_PREFIX: + STORAGE_AMAZON_REGION: us-east-1 +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +#### permissions grant with IAM assumed role + +To provide access with assumed role you need to install [kube2iam](https://github.com/kubernetes/charts/tree/master/stable/kube2iam) +and create role with granded permissions. + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: amazon + STORAGE_AMAZON_BUCKET: my-s3-bucket + STORAGE_AMAZON_PREFIX: + STORAGE_AMAZON_REGION: us-east-1 +replica: + annotations: + iam.amazonaws.com/role: "{assumed role name}" +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +### Using with Google Cloud Storage +Make sure your environment is properly setup to access `my-gcs-bucket` + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: google + STORAGE_GOOGLE_BUCKET: my-gcs-bucket + STORAGE_GOOGLE_PREFIX: +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +### Using with Microsoft Azure Blob Storage + +Make sure your environment is properly setup to access `mycontainer`. + +To do so, you must set the following env vars: +- `AZURE_STORAGE_ACCOUNT` +- `AZURE_STORAGE_ACCESS_KEY` + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: microsoft + STORAGE_MICROSOFT_CONTAINER: mycontainer + # prefix to store charts for microsoft storage backend + STORAGE_MICROSOFT_PREFIX: + secret: + AZURE_STORAGE_ACCOUNT: "********" ## azure storage account + AZURE_STORAGE_ACCESS_KEY: "********" ## azure storage account access key +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +### Using with Alibaba Cloud OSS Storage + +Make sure your environment is properly setup to access `my-oss-bucket`. + +To do so, you must set the following env vars: +- `ALIBABA_CLOUD_ACCESS_KEY_ID` +- `ALIBABA_CLOUD_ACCESS_KEY_SECRET` + +Specify `custom.yaml` with such values + +```yaml +env: + open: + STORAGE: alibaba + STORAGE_ALIBABA_BUCKET: my-oss-bucket + STORAGE_ALIBABA_PREFIX: + STORAGE_ALIBABA_ENDPOINT: oss-cn-beijing.aliyuncs.com + secret: + ALIBABA_CLOUD_ACCESS_KEY_ID: "********" ## alibaba OSS access key id + ALIBABA_CLOUD_ACCESS_KEY_SECRET: "********" ## alibaba OSS access key secret +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +### Using with local filesystem storage +By default chartmuseum use local filesystem storage. +But on pod recreation if will lose all charts, to prevent that enable persistent storage. + +```yaml +env: + open: + STORAGE: local +persistence: + Enabled: true + AccessMode: ReadWriteOnce + Size: 8Gi + ## A manually managed Persistent Volume and Claim + ## Requires Persistence.Enabled: true + ## If defined, PVC must be created manually before volume will be bound + # ExistingClaim: + + ## Chartmuseum data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # StorageClass: "-" +``` + +Run command to install + +```shell +helm install --name my-chartmuseum -f custom.yaml incubator/chartmuseum +``` + +#### Example storage class Example storage-class.yaml provided here for use with a Ceph cluster. @@ -118,3 +339,19 @@ parameters: userId: user userSecretName: thesecret ``` + +## Uninstall + +By default, a deliberate uninstall will result in the persistent volume +claim being deleted. + +```shell +helm delete my-chartmuseum +``` + +To delete the deployment and its history: +```shell +helm delete --purge my-chartmuseum +``` + +