diff --git a/contrib/helm/README.md b/contrib/helm/README.md index 078d38df1..87e797d6c 100644 --- a/contrib/helm/README.md +++ b/contrib/helm/README.md @@ -16,38 +16,8 @@ Before deploying Probo, ensure you have: 3. **PostgreSQL Database** - Managed service (AWS RDS, GCP Cloud SQL, Azure Database, etc.) 4. **S3 Storage** - AWS S3 or S3-compatible storage (GCS, DigitalOcean Spaces, MinIO, etc.) -## Quick Start - -### 1. Generate Secrets - -```bash -export ENCRYPTION_KEY=$(openssl rand -base64 32) -export COOKIE_SECRET=$(openssl rand -base64 32) -export PASSWORD_PEPPER=$(openssl rand -base64 32) -export TRUST_TOKEN_SECRET=$(openssl rand -base64 32) - -echo "Save these secrets securely!" -``` - -### 2. Install - ## Install -#### Using Official Chart Repository -> Have Helm 3 [installed](https://helm.sh/docs/intro/install). - -```sh -helm repo add probo https://getprobo.github.io/probo-helm-charts/ -helm install probo probo/probo -n probo --create-namespace --values values.yaml -``` - -To update versions: - -``` -helm repo update probo -helm upgrade probo probo/probo -n probo --values values.yaml -``` - #### Using Local Chart ##### Generate Secrets @@ -59,6 +29,12 @@ export PASSWORD_PEPPER=$(openssl rand -base64 32) export TRUST_TOKEN_SECRET=$(openssl rand -base64 32) ``` +#### Download remote dependencies + +```bash +helm dependency update ./charts/probo +``` + ##### Install using Chart and set values ```bash @@ -69,9 +45,9 @@ helm install my-probo ./charts/probo \ --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \ --set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \ --set postgresql.enabled=true \ - --set postgres.auth.postgresUser="probod" \ - --set postgres.auth.postgresPassword="your-db-password" \ - --set postgres.auth.database="probod" \ + --set postgresql.auth.postgresUser="probod" \ + --set postgresql.auth.postgresPassword="your-db-password" \ + --set postgresql.auth.database="probod" \ --set minio.enabled=true \ --set s3.bucket="your-bucket-name" \ --set s3.accessKeyId="your-access-key" \ @@ -87,6 +63,11 @@ helm install my-probo ./charts/probo \ --set probo.auth.cookieSecret="$COOKIE_SECRET" \ --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \ --set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \ + --set probo.mailer.smtp.password="smtp-password" \ + --set postgresql.enabled=true \ + --set postgresql.auth.postgresPassword="probod" \ + --set s3.accessKeyId="your-access-key" \ + --set s3.secretAccessKey="your-secret-key" \ -f ./charts/probo/values.yaml ``` diff --git a/contrib/helm/charts/probo/templates/deployment.yaml b/contrib/helm/charts/probo/templates/deployment.yaml index 63cf8d1a8..15b9edd67 100644 --- a/contrib/helm/charts/probo/templates/deployment.yaml +++ b/contrib/helm/charts/probo/templates/deployment.yaml @@ -38,6 +38,8 @@ spec: image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} env: + - name: CONFIG_FILE + value: "/data/probod/config.yml" # Observability - Metrics - name: METRICS_ADDR value: "0.0.0.0:{{ .Values.probo.metrics.port }}" @@ -71,7 +73,7 @@ spec: value: {{ join "," .Values.probo.cors.allowedOrigins | quote }} # PostgreSQL Database - name: PG_ADDR - value: {{ printf "%s:%s" (include "probo.postgresql.host" .) (include "probo.postgresql.port" .) | quote }} + value: {{ if .Values.postgresql.enabled }}{{ printf "%s-postgresql-demo:5432" .Release.Name | quote }}{{ else }}{{ .Values.probo.pg.addr | required "probo.pg.addr is required when postgresql.enabled=false" | quote }}{{ end }} - name: PG_USERNAME value: {{ include "probo.postgresql.username" . | quote }} - name: PG_PASSWORD diff --git a/contrib/helm/charts/probo/templates/postgresql-demo-app.yml b/contrib/helm/charts/probo/templates/postgresql-demo-app.yml index 19068ac0c..7b723a91f 100644 --- a/contrib/helm/charts/probo/templates/postgresql-demo-app.yml +++ b/contrib/helm/charts/probo/templates/postgresql-demo-app.yml @@ -20,7 +20,10 @@ spec: - name: POSTGRES_USER value: {{ .Values.postgresql.auth.postgresUser }} - name: POSTGRES_PASSWORD - value: {{ .Values.postgresql.auth.postgresPassword | quote }} + valueFrom: + secretKeyRef: + name: {{ include "probo.fullname" . }} + key: db-password - name: POSTGRES_DB value: {{ .Values.postgresql.auth.database }} ports: @@ -62,7 +65,7 @@ data: psql -v ON_ERROR_STOP=1 -U $POSTGRES_USER <<-EOF ALTER USER probod WITH SUPERUSER; - ALTER USER probod PASSWORD '{{ .Values.postgresql.auth.postgresPassword | squote }}'; + ALTER USER probod PASSWORD {{ .Values.postgresql.auth.postgresPassword | squote }}; GRANT ALL PRIVILEGES ON DATABASE probod TO probod; CREATE DATABASE probod_test; GRANT ALL PRIVILEGES ON DATABASE probod_test TO probod; diff --git a/contrib/helm/charts/probo/templates/secret.yaml b/contrib/helm/charts/probo/templates/secret.yaml index 94a53ca1b..736ed2612 100644 --- a/contrib/helm/charts/probo/templates/secret.yaml +++ b/contrib/helm/charts/probo/templates/secret.yaml @@ -7,7 +7,7 @@ metadata: type: Opaque stringData: # Database credentials - db-password: {{ include "probo.postgresql.password" . | quote }} + db-password: {{ if .Values.postgresql.enabled }}{{ .Values.postgresql.auth.postgresPassword | quote }}{{ else }}{{ required "postgresql.password is required when postgresql.enabled=false" .Values.postgresql.password | quote }}{{ end }} # S3 credentials s3-access-key: {{ include "probo.s3.accessKeyId" . | quote }} diff --git a/contrib/helm/charts/probo/values.yaml b/contrib/helm/charts/probo/values.yaml index 79cc65392..07442e216 100644 --- a/contrib/helm/charts/probo/values.yaml +++ b/contrib/helm/charts/probo/values.yaml @@ -171,10 +171,6 @@ probo: # This should match your ingress host baseUrl: probo.example.com - # Base64-encoded encryption key (REQUIRED) - # Generate with: openssl rand -base64 32 - encryptionKey: "" - service: port: 8080 @@ -212,13 +208,7 @@ probo: invitationTokenValidity: 3600 cookieName: "SSID" cookieDomain: "probo.example.com" - # Cookie signing secret (REQUIRED, at least 32 bytes) - # Generate with: openssl rand -base64 32 - cookieSecret: "" cookieDuration: 24 - # Password hashing pepper (REQUIRED, at least 32 bytes) - # Generate with: openssl rand -base64 32 - passwordPepper: "" passwordIterations: 1000000 # SAML authentication (optional) @@ -246,7 +236,6 @@ probo: tlsHttpServer: 443 # Trust token signing secret (REQUIRED, at least 32 bytes) # Generate with: openssl rand -base64 32 - tokenSecret: "" scope: "trust_center_readonly" tokenType: "trust_center_access" @@ -308,6 +297,13 @@ postgresql: postgresUser: probod postgresPassword: probod database: probod + # External PostgreSQL configuration (used when enabled=false) + host: "" # REQUIRED when enabled=false: PostgreSQL host + port: 5432 + username: probod + password: "" # REQUIRED when enabled=false: PostgreSQL password + database: probod + poolSize: 100 # S3 storage configuration # For production: Use external S3 (AWS S3, GCS, etc.)