From f1806fb0ca05f5997caeb30e9a426550a8e1b281 Mon Sep 17 00:00:00 2001 From: sagit <36596628+Sagit-chu@users.noreply.github.com> Date: Fri, 1 Apr 2022 01:40:09 +0800 Subject: [PATCH] feat(meshcentral): Add meshcentral (#2303) * add-meshcentral * add-meshcentral * starting space in comment * starting space in comment * change port * add config * mongodb * Update charts/incubator/meshcentral/Chart.yaml * Update charts/incubator/meshcentral/Chart.yaml * fix path * Update charts/incubator/meshcentral/Chart.yaml * indentation * Update Chart.yaml * Update Chart.yaml * update * update question * test * trailing-whitespace * Update charts/incubator/meshcentral/Chart.yaml * fix question boolean * Update charts/incubator/meshcentral/templates/_configmap.tpl * Update charts/incubator/meshcentral/templates/_configmap.tpl Co-authored-by: Kjeld Schouten-Lebbing * Update charts/incubator/meshcentral/values.yaml * Update charts/incubator/meshcentral/templates/common.yaml * Update charts/incubator/meshcentral/templates/_configmap.tpl * Update charts/incubator/meshcentral/values.yaml * Apply suggestions from code review Co-authored-by: Kjeld Schouten-Lebbing --- charts/incubator/meshcentral/.helmignore | 26 ++ charts/incubator/meshcentral/Chart.yaml | 33 ++ charts/incubator/meshcentral/questions.yaml | 410 ++++++++++++++++++ .../meshcentral/templates/_configmap.tpl | 66 +++ .../meshcentral/templates/common.yaml | 10 + charts/incubator/meshcentral/values.yaml | 70 +++ docs/manual/default-ports.md | 1 + 7 files changed, 616 insertions(+) create mode 100644 charts/incubator/meshcentral/.helmignore create mode 100644 charts/incubator/meshcentral/Chart.yaml create mode 100644 charts/incubator/meshcentral/questions.yaml create mode 100644 charts/incubator/meshcentral/templates/_configmap.tpl create mode 100644 charts/incubator/meshcentral/templates/common.yaml create mode 100644 charts/incubator/meshcentral/values.yaml diff --git a/charts/incubator/meshcentral/.helmignore b/charts/incubator/meshcentral/.helmignore new file mode 100644 index 00000000000..4379e2b3014 --- /dev/null +++ b/charts/incubator/meshcentral/.helmignore @@ -0,0 +1,26 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# OWNERS file for Kubernetes +OWNERS +# helm-docs templates +*.gotmpl diff --git a/charts/incubator/meshcentral/Chart.yaml b/charts/incubator/meshcentral/Chart.yaml new file mode 100644 index 00000000000..f03de9a87f3 --- /dev/null +++ b/charts/incubator/meshcentral/Chart.yaml @@ -0,0 +1,33 @@ +apiVersion: v2 +kubeVersion: ">=1.16.0-0" +name: meshcentral +version: 0.0.1 +appVersion: "1.0.0" +description: MeshCentral is a full computer management web site +type: application +deprecated: false +home: https://github.com/truecharts/apps/tree/master/charts/stable/meshcentral +icon: https://truecharts.org/_static/img/appicons/meshcentral.png +keywords: + - meshcentral + - teamviewer + - rdp +sources: + - https://github.com/Ylianst/MeshCentral +dependencies: +- name: common + repository: https://library-charts.truecharts.org + version: 9.2.6 +- condition: mongodb.enabled + name: mongodb + repository: https://charts.truecharts.org/ + version: 0.0.13 +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +annotations: + truecharts.org/catagories: | + - cloud + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/meshcentral/questions.yaml b/charts/incubator/meshcentral/questions.yaml new file mode 100644 index 00000000000..f99ca036107 --- /dev/null +++ b/charts/incubator/meshcentral/questions.yaml @@ -0,0 +1,410 @@ +# Include{groups} +portals: + open: + protocols: + - "$kubernetes-resource_configmap_portal_protocol" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" +questions: + - variable: portal + group: "Container Image" + label: "Configure Portal Button" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable" + description: "enable the portal button" + schema: + hidden: true + editable: false + type: boolean + default: true +# Include{global} + - variable: controller + group: "Controller" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced Controller Settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: type + description: "Please specify type of workload to deploy" + label: "(Advanced) Controller Type" + schema: + type: string + default: "deployment" + required: true + enum: + - value: "deployment" + description: "Deployment" + - value: "statefulset" + description: "Statefulset" + - value: "daemonset" + description: "Daemonset" + - variable: replicas + description: "Number of desired pod replicas" + label: "Desired Replicas" + schema: + type: int + default: 1 + required: true + - variable: strategy + description: "Please specify type of workload to deploy" + label: "(Advanced) Update Strategy" + schema: + type: string + default: "Recreate" + required: true + enum: + - value: "Recreate" + description: "Recreate: Kill existing pods before creating new ones" + - value: "RollingUpdate" + description: "RollingUpdate: Create new pods and then kill old ones" + - value: "OnDelete" + description: "(Legacy) OnDelete: ignore .spec.template changes" +# Include{controllerExpert} + - variable: env + group: "Container Configuration" + label: "Image Environment" + schema: + additional_attrs: true + type: dict + attrs: + - variable: HOSTNAME + label: "HOSTNAME" + description: "your hostname" + schema: + type: string + default: "my.domain.com" + - variable: REVERSE_PROXY + label: "REVERSE_PROXY" + description: "set to your reverse proxy IP if you want to put meshcentral behind a reverse proxy" + schema: + type: string + default: "" + - variable: REVERSE_PROXY_TLS_PORT + label: "REVERSE_PROXY_TLS_PORT" + description: "REVERSE_PROXY_TLS_PORT" + schema: + type: string + default: "" + - variable: IFRAME + label: "IFRAME" + description: "set to true if you wish to enable iframe support" + schema: + type: boolean + default: false + - variable: ALLOW_NEW_ACCOUNTS + label: "ALLOW_NEW_ACCOUNTS" + description: "set to false if you want disable self-service creation of new accounts besides the first (admin)" + schema: + type: boolean + default: true + - variable: WEBRTC + label: "WEBRTC" + description: "set to true to enable WebRTC - per documentation it is not officially released with meshcentral, but is solid enough to work with. Use with caution" + schema: + type: boolean + default: false + - variable: ALLOWPLUGINS + label: "ALLOWPLUGINS" + description: "et to true to allow plugins" + schema: + type: boolean + default: false + - variable: LOCALSESSIONRECORDING + label: "LOCALSESSIONRECORDING" + description: "set to true to allow session recording" + schema: + type: boolean + default: false + - variable: MINIFY + label: "MINIFY" + description: "set to enable or disable minification of json, reduces traffic" + schema: + type: boolean + default: true +# Include{containerConfig} + + - variable: service + group: "Networking and Services" + label: "Configure Service(s)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10205 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 443 + + - variable: serviceexpert + group: "Networking and Services" + label: "Show Expert Config" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + group: "Networking and Services" + label: "Host-Networking (Complicated)" + schema: + type: boolean + default: false + +# Include{serviceExpert} + +# Include{serviceList} + + - variable: persistence + label: "Integrated Persistent Storage" + description: "Integrated Persistent Storage" + group: "Storage and Persistence" + schema: + additional_attrs: true + type: dict + attrs: + - variable: data + label: "App Data Storage" + description: "Stores the Application Data." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} + - variable: user + label: "user Storage" + description: "Stores uploading for users live" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} +# Include{persistenceList} + + - variable: ingress + label: "" + group: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} + +# Include{ingressTLS} + +# Include{ingressTraefik} + +# Include{ingressExpert} + +# Include{ingressList} + +# Include{security} + + - variable: advancedSecurity + label: "Show Advanced Security Settings" + group: "Security and Permissions" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: securityContext + label: "Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: false + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} + +# Include{resources} + +# Include{advanced} + +# Include{addons} diff --git a/charts/incubator/meshcentral/templates/_configmap.tpl b/charts/incubator/meshcentral/templates/_configmap.tpl new file mode 100644 index 00000000000..7fb3864ba44 --- /dev/null +++ b/charts/incubator/meshcentral/templates/_configmap.tpl @@ -0,0 +1,66 @@ +{{/* Define the configmap */}} +{{- define "meshcentral.configmap" -}} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: meshcentral-init +data: + init.sh: |- + #!/bin/sh + if test -f "/opt/meshcentral/meshcentral-data/config.json"; then + echo "config.json exists." + else + cp /init/meshcentral/config.json.template /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"cert\": \"myserver.mydomain.com\"/\"cert\": \"$HOSTNAME\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"NewAccounts\": true/\"NewAccounts\": \"$ALLOW_NEW_ACCOUNTS\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"enabled\": false/\"enabled\": \"$ALLOWPLUGINS\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"localSessionRecording\": false/\"localSessionRecording\": \"$LOCALSESSIONRECORDING\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"minify\": true/\"minify\": \"$MINIFY\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"WebRTC\": false/\"WebRTC\": \"$WEBRTC\"/" /opt/meshcentral/meshcentral-data/config.json + sed -i "s/\"AllowFraming\": false/\"AllowFraming\": \"$IFRAME\"/" /opt/meshcentral/meshcentral-data/config.json + if [ "$REVERSE_PROXY" != "false" ]; then + sed -i "s/\"_certUrl\": \"my\.reverse\.proxy\"/\"certUrl\": \"https:\/\/$REVERSE_PROXY:$REVERSE_PROXY_TLS_PORT\"/" /opt/meshcentral/meshcentral-data/config.json + fi + fi + config.json.template: |- + { + "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json", + "settings": { + "plugins":{"enabled": false}, + "cert": "myserver.mydomain.com", + "_WANonly": true, + "_LANonly": true, + "_sessionKey": "MyReallySecretPassword1", + "port": 443, + "_aliasPort": 443, + "redirPort": 80, + "_redirAliasPort": 80, + "AgentPong": 300, + "TLSOffload": false, + "SelfUpdate": false, + "AllowFraming": false, + "WebRTC": false, + "mongodbcol": "meshcentral", + "mongodb": {{ ( printf "%s?client_encoding=utf8" ( .Values.mongodb.url.complete | trimAll "\"" ) ) | quote }} + }, + "domains": { + "": { + "_title": "MyServer", + "_title2": "Servername", + "minify": true, + "NewAccounts": true, + "localSessionRecording": false, + "_userNameIsEmail": true, + "_certUrl": "my.reverse.proxy" + } + }, + "_letsencrypt": { + "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before>", + "_email": "myemail@mydomain.com", + "_names": "myserver.mydomain.com", + "production": false + } + } + +{{- end -}} diff --git a/charts/incubator/meshcentral/templates/common.yaml b/charts/incubator/meshcentral/templates/common.yaml new file mode 100644 index 00000000000..284f6ce7e1c --- /dev/null +++ b/charts/incubator/meshcentral/templates/common.yaml @@ -0,0 +1,10 @@ +{{/* Make sure all variables are set properly */}} +{{- include "common.setup" . }} + +{{/* Render configmap for meshcentral */}} +{{- include "meshcentral.configmap" . }} + + + +{{/* Render the templates */}} +{{ include "common.postSetup" . }} diff --git a/charts/incubator/meshcentral/values.yaml b/charts/incubator/meshcentral/values.yaml new file mode 100644 index 00000000000..581b5e2cf8d --- /dev/null +++ b/charts/incubator/meshcentral/values.yaml @@ -0,0 +1,70 @@ +image: + repository: einar/meshcentral + pullPolicy: IfNotPresent + tag: latest@sha256:b9cb18a54d610a6b0b43442f1d05f0a05a9e6fa4ad52e2394240c85434c5f35e + +securityContext: + readOnlyRootFilesystem: false + runAsNonRoot: false + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + +env: + HOSTNAME: "my.domain.com" + # your hostname + REVERSE_PROXY: false + # set to your reverse proxy IP if you want to put meshcentral behind a reverse proxy + REVERSE_PROXY_TLS_PORT: "" + IFRAME: false + # set to true if you wish to enable iframe support + ALLOW_NEW_ACCOUNTS: true + # set to false if you want disable self-service creation of new accounts besides the first (admin) + WEBRTC: false + # set to true to enable WebRTC - per documentation it is not officially released with meshcentral, but is solid enough to work with. Use with caution + ALLOWPLUGINS: false + # set to true to allow plugins + LOCALSESSIONRECORDING: false + # set to true to allow session recording + MINIFY: true + # set to enable or disable minification of json, reduces traffic + +service: + main: + ports: + main: + targetPort: 443 + port: 10205 + +initContainers: + init: + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + command: ["/init/meshcentral/init.sh"] + volumeMounts: + - name: init + mountPath: "/init/meshcentral" + +mongodb: + enabled: true + mongodbUsername: meshcentral + mongodbDatabase: meshcentral + existingSecret: "mongodbcreds" + +persistence: + data: + enabled: true + mountPath: "/opt/meshcentral/meshcentral-data" + user: + enabled: true + mountPath: "/opt/meshcentral/meshcentral-files" + init: + enabled: "true" + mountPath: "/init/meshcentral" + noMount: true + readOnly: true + type: "custom" + volumeSpec: + configMap: + name: meshcentral-init + defaultMode: 0777 diff --git a/docs/manual/default-ports.md b/docs/manual/default-ports.md index 4efc85af04d..c4cd5d49eae 100644 --- a/docs/manual/default-ports.md +++ b/docs/manual/default-ports.md @@ -367,6 +367,7 @@ These defaults can of course be changed, but as we guarantee "sane, working defa | technitium | dns-https | dns-https | 10203 | TCP | | | technitium | dns-https-proxy | dns-https-proxy | 10204 | TCP | | | wekan | main | main | 10204 | TCP | | +| meshcentral | main | main | 10205 | TCP | | | storj-node | main | main | 14002 | TCP | | | satisfactory | beacon | beacon | 15000 | UDP | | | satisfactory | query | query | 15777 | UDP | |