Skip to content

Commit cf5862e

Browse files
valeraBrvaleraBr
authored
Merge pull request #206 from memphisdev/master_to_delete
release 1.4.0
2 parents abc8ecf + 7ff1708 commit cf5862e

File tree

8 files changed

+52
-369
lines changed

8 files changed

+52
-369
lines changed

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,9 @@ helm install memphis memphis/memphis --create-namespace --namespace memphis --wa
137137
| restGateway.enabled | **\*Optional\*** <br>Memphis Rest Gateway can be disabled if not in use | "true" | "false" |
138138
| restGateway.jwtSecret | **\*Optional\*** <br>Manual Jwt Token configurtion | "" | "" |
139139
| restGateway.refreshJwtSecret | **\*Optional\*** <br>Manual Refresh Jwt Token configurtion | "" | "" |
140-
140+
| auth.enabled | **\*Optional\*** <br>Enable using predefined parameters | "false" | "true" |
141+
| auth.enabled.mgmt | **\*Optional\*** <br>Management users that will be created at first deployment | "" | "" |
142+
| auth.enabled.client | **\*Optional\*** <br>Client users that will be created at first deployment | "" | "" |
141143
Here is how to run an installation command with additional options -&#x20;
142144

143145
```

‎examples/initial_config_values.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
auth:
2+
enabled: true
3+
users:
4+
mgmt:
5+
- user: admin
6+
password: Admin123456!
7+
- user: test_mgmt
8+
password: Test123456!
9+
- user: test
10+
password: Test123456@
11+
client:
12+
- user: test_app
13+
password: Test123456!@
14+
- user: test_app2
15+
password: Test123456@!

‎memphis/README.md‎

Lines changed: 7 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,8 @@ Memphis is cloud-native and cloud-agnostic to any Kubernetes on **any cloud**.
4444
Production-grade Memphis with three memphis brokers configured in cluster-mode
4545

4646
```bash
47-
helm repo add memphis https://k8s.memphis.dev/charts/ --force-update && helm install memphis memphis/memphis --set global.cluster.enabled="true" --create-namespace --namespace memphis --wait
47+
helm repo add memphis https://k8s.memphis.dev/charts/ --force-update &&
48+
helm install memphis memphis/memphis --set global.cluster.enabled="true" --create-namespace --namespace memphis --wait
4849
```
4950

5051
**Dev**
@@ -56,6 +57,8 @@ helm repo add memphis https://k8s.memphis.dev/charts/ --force-update &&
5657
helm install memphis memphis/memphis --create-namespace --namespace memphis --wait
5758
```
5859

60+
For more information, please visit the [Memphis Documentation](https://docs.memphis.dev/memphis/open-source-installation/kubernetes/1-installation).
61+
5962
#### Helm deployment options
6063

6164
| Option | Description | Default Value | Example |
@@ -114,12 +117,11 @@ helm install memphis memphis/memphis --create-namespace --namespace memphis --wa
114117
| restGateway.enabled | **\*Optional\*** <br>Memphis Rest Gateway can be disabled if not in use | "true" | "false" |
115118
| restGateway.jwtSecret | **\*Optional\*** <br>Manual Jwt Token configurtion | "" | "" |
116119
| restGateway.refreshJwtSecret | **\*Optional\*** <br>Manual Refresh Jwt Token configurtion | "" | "" |
117-
120+
| auth.enabled | **\*Optional\*** <br>Enable initial configuration import | "false" | "true" |
121+
| auth.enabled.mgmt | **\*Optional\*** <br>Management users that will be created at first deployment | "" | "" |
122+
| auth.enabled.client | **\*Optional\*** <br>Client users that will be created at first deployment | "" | "" |
118123
Here is how to run an installation command with additional options -&#x20;
119124

120-
```
121-
helm install memphis --set cluster.replicas=3,memphis.creds.rootPwd=rootpassword" memphis/memphis --create-namespace --namespace memphis
122-
```
123125

124126
### Deployed pods
125127

@@ -130,98 +132,6 @@ helm install memphis --set cluster.replicas=3,memphis.creds.rootPwd=rootpassword
130132

131133
For more information on each component, please head to the [architecture section](../../memphis/architecture.md#key-components).
132134

133-
## Deploy Memphis with TLS (encrypted communication via SSL)
134-
135-
### 0. Optional: Create self-signed certificates
136-
137-
a) Generate a self-signed certificate using `mkcert`
138-
139-
```bash
140-
$ mkcert -client \
141-
-cert-file memphis_client.pem \
142-
-key-file memphis-key_client.pem \
143-
"127.0.0.1" "localhost" "*.memphis.dev" ::1 \
144-
email@localhost [email protected]
145-
```
146-
147-
b) Find the `rootCA`
148-
149-
```
150-
$ mkcert -CAROOT
151-
```
152-
153-
c) Create self-signed certificates for client
154-
155-
```bash
156-
$ mkcert -client -cert-file client.pem -key-file key-client.pem localhost ::1
157-
```
158-
159-
### 1. Create namespace + secret for the TLS certs
160-
161-
a) Create a dedicated namespace for memphis
162-
163-
```bash
164-
kubectl create namespace memphis
165-
```
166-
167-
b) Create a k8s secret with the required certs
168-
169-
170-
```bash
171-
kubectl create secret generic memphis-client-tls-secret \
172-
--from-file=memphis_client.pem \
173-
--from-file=memphis-key_client.pem \
174-
--from-file=rootCA.pem -n memphis
175-
```
176-
177-
```yaml
178-
tls:
179-
secret:
180-
name: memphis-client-tls-secret
181-
ca: "rootCA.pem"
182-
cert: "memphis_client.pem"
183-
key: "memphis-key_client.pem"
184-
```
185-
186-
### 2. Deploy Memphis with the generated certificate
187-
188-
```bash
189-
helm install memphis memphis \
190-
--create-namespace --namespace memphis --wait \
191-
--set \
192-
global.cluster.enabled="true",\
193-
memphis.tls.verify="true",\
194-
memphis.tls.cert="memphis_client.pem",\
195-
memphis.tls.key="memphis-key_client.pem",\
196-
memphis.tls.secret.name="memphis-client-tls-secret",\
197-
memphis.tls.ca="rootCA.pem"
198-
```
199-
200-
## Upgrade existing deployment
201-
202-
### For adding TLS support
203-
204-
1. Create a k8s secret with the provided TLS certs
205-
206-
```
207-
kubectl create secret generic memphis-client-tls-secret \
208-
--from-file=memphis_client.pem \
209-
--from-file=memphis-key_client.pem \
210-
--from-file=rootCA.pem -n memphis
211-
```
212-
213-
2. Upgrade Memphis to use the TLS certs
214-
215-
```bash
216-
helm upgrade memphis memphis -n memphis --reuse-values \
217-
--set \
218-
memphis.tls.verify="true",\
219-
memphis.tls.cert="memphis_client.pem",\
220-
memphis.tls.key="memphis-key_client.pem",\
221-
memphis.tls.secret.name="tls-client-secret",\
222-
memphis.tls.ca="rootCA.pem"
223-
```
224-
225135
## Deployment diagram
226136

227137
![Memphis Architecture (1)](https://user-images.githubusercontent.com/70286779/229374721-963cd3e6-e425-44cd-8467-233e6fc5e680.jpeg)

‎memphis/templates/memphis-rest-gateway.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: /v1
1+
apiVersion: v1
22
kind: Service
33
metadata:
44
name: memphis-rest-gateway

‎memphis/templates/memphis_configmap.yaml‎

Lines changed: 8 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -261,114 +261,11 @@ data:
261261
}
262262
{{- end }}
263263
264-
{{- if .Values.auth.enabled }}
265-
##################
266-
# #
267-
# Authorization #
268-
# #
269-
##################
270-
{{- if .Values.auth.resolver }}
271-
{{- if eq .Values.auth.resolver.type "memory" }}
272-
resolver: MEMORY
273-
include "accounts/{{ .Values.auth.resolver.configMap.key }}"
274-
{{- end }}
275-
276-
{{- if eq .Values.auth.resolver.type "full" }}
277-
{{- if .Values.auth.resolver.configMap }}
278-
include "accounts/{{ .Values.auth.resolver.configMap.key }}"
279-
{{- else }}
280-
{{- with .Values.auth.resolver }}
281-
{{- if $.Values.auth.timeout }}
282-
authorization {
283-
timeout: {{ $.Values.auth.timeout }}
284-
}
285-
{{- end }}
286-
287-
{{- if .operator }}
288-
operator: {{ .operator }}
289-
{{- end }}
290-
291-
{{- if .systemAccount }}
292-
system_account: {{ .systemAccount | quote }}
293-
{{- end }}
294-
{{- end }}
295-
296-
resolver: {
297-
type: full
298-
{{- with .Values.auth.resolver }}
299-
dir: {{ .store.dir | quote }}
300-
301-
allow_delete: {{ .allowDelete }}
302-
303-
interval: {{ .interval | quote }}
304-
{{- end }}
305-
}
306-
{{- end }}
307-
{{- end }}
308-
309-
{{- if .Values.auth.resolver.resolverPreload }}
310-
resolver_preload: {{ toRawJson .Values.auth.resolver.resolverPreload }}
311-
{{- end }}
312-
313-
{{- if eq .Values.auth.resolver.type "URL" }}
314-
{{- with .Values.auth.resolver.url }}
315-
resolver: URL({{ . }})
316-
{{- end }}
317-
operator: /etc/memphis-config/operator/{{ .Values.auth.operatorjwt.configMap.key }}
318-
{{- end }}
319-
{{- end }}
320-
321-
{{- with .Values.auth.systemAccount }}
322-
system_account: {{ . | quote }}
323-
{{- end }}
324-
325-
326-
{{- with .Values.auth.nkeys }}
327-
{{- with .users }}
328-
authorization {
329-
{{- if $.Values.auth.timeout }}
330-
timeout: {{ $.Values.auth.timeout }}
331-
{{- end }}
332-
333-
users: [
334-
{{- range . }}
335-
{{- toRawJson . | nindent 4 }},
336-
{{- end }}
337-
]
338-
}
339-
{{- end }}
340-
{{- end }}
341-
342-
{{- with .Values.auth.basic }}
343-
344-
{{- with .noAuthUser }}
345-
no_auth_user: {{ . }}
346-
{{- end }}
347-
348-
{{- with .users }}
349-
authorization {
350-
{{- if $.Values.auth.timeout }}
351-
timeout: {{ $.Values.auth.timeout }}
352-
{{- end }}
353-
354-
users: [
355-
{{- range . }}
356-
{{- toRawJson . | nindent 4 }},
357-
{{- end }}
358-
]
359-
}
360-
{{- end }}
361-
362-
{{- with .accounts }}
363-
authorization {
364-
{{- if $.Values.auth.timeout }}
365-
timeout: {{ $.Values.auth.timeout }}
366-
{{- end }}
367-
}
368-
369-
accounts: {{- toRawJson . }}
370-
{{- end }}
371-
372-
{{- end }}
373-
374-
{{- end }}
264+
{{- if .Values.auth.enabled }}
265+
initial.conf: |
266+
users:
267+
mgmt:
268+
{{- .Values.auth.users.mgmt | toYaml | nindent 6 }}
269+
client:
270+
{{- .Values.auth.users.client | toYaml | nindent 6 }}
271+
{{- end }}

‎memphis/templates/memphis_statefulset.yaml‎

Lines changed: 2 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -112,13 +112,10 @@ spec:
112112
# Common volumes for the containers.
113113
volumes:
114114
- name: config-volume
115-
{{ if .Values.memphis.secretConfig }}
116-
secret:
117-
secretName: {{ .Values.memphis.secretConfig.name }}
118-
{{ else }}
119115
configMap:
120116
name: {{ include "memphis.fullname" . }}-config
121-
{{ end }}
117+
118+
122119

123120
{{/* User extended config volumes*/}}
124121
{{- if .Values.memphis.config }}
@@ -132,20 +129,6 @@ spec:
132129
- name: pid
133130
emptyDir: {}
134131

135-
{{- if and .Values.auth.enabled .Values.auth.resolver }}
136-
{{- if .Values.auth.resolver.configMap }}
137-
- name: resolver-volume
138-
configMap:
139-
name: {{ .Values.auth.resolver.configMap.name }}
140-
{{- end }}
141-
142-
{{- if eq .Values.auth.resolver.type "URL" }}
143-
- name: operator-jwt-volume
144-
configMap:
145-
name: {{ .Values.auth.operatorjwt.configMap.name }}
146-
{{- end }}
147-
{{- end }}
148-
149132
{{- if and .Values.memphis.storageEngine.fileStorage.enabled .Values.memphis.storageEngine.fileStorage.existingClaim }}
150133
# Persistent volume for storageEngine running with file storage option
151134
- name: {{ include "memphis.fullname" . }}-js-pvc
@@ -402,30 +385,6 @@ spec:
402385
mountPath: /etc/nats-config/{{ .name }}
403386
{{- end }}
404387

405-
406-
{{- if and .Values.auth.enabled .Values.auth.resolver }}
407-
{{- if eq .Values.auth.resolver.type "memory" }}
408-
- name: resolver-volume
409-
mountPath: /etc/nats-config/accounts
410-
{{- end }}
411-
412-
{{- if eq .Values.auth.resolver.type "full" }}
413-
{{- if .Values.auth.resolver.configMap }}
414-
- name: resolver-volume
415-
mountPath: /etc/nats-config/accounts
416-
{{- end }}
417-
{{- if and .Values.auth.resolver .Values.auth.resolver.store }}
418-
- name: memphis-jwt-pvc
419-
mountPath: {{ .Values.auth.resolver.store.dir }}
420-
{{- end }}
421-
{{- end }}
422-
423-
{{- if eq .Values.auth.resolver.type "URL" }}
424-
- name: operator-jwt-volume
425-
mountPath: /etc/nats-config/operator
426-
{{- end }}
427-
{{- end }}
428-
429388
{{- if .Values.memphis.storageEngine.fileStorage.enabled }}
430389
- name: {{ include "memphis.fullname" . }}-js-pvc
431390
mountPath: {{ .Values.memphis.storageEngine.fileStorage.storageDirectory }}
@@ -609,23 +568,6 @@ spec:
609568

610569

611570
volumeClaimTemplates:
612-
{{- if eq .Values.auth.resolver.type "full" }}
613-
{{- if and .Values.auth.resolver .Values.auth.resolver.store }}
614-
#####################################
615-
# #
616-
# Account Server Embedded JWT #
617-
# #
618-
#####################################
619-
- metadata:
620-
name: nats-jwt-pvc
621-
spec:
622-
accessModes:
623-
- ReadWriteOnce
624-
resources:
625-
requests:
626-
storage: {{ .Values.auth.resolver.store.size }}
627-
{{- end }}
628-
{{- end }}
629571

630572
{{- if and .Values.memphis.storageEngine.fileStorage.enabled (not .Values.memphis.storageEngine.fileStorage.existingClaim) }}
631573
#########################################

0 commit comments

Comments
 (0)