Fixes and features for restricted environment

charts/cryptpad/Chart.yaml

@@ -33,7 +33,3 @@ maintainers:
     email: guilherme.sautner@xwiki.com
   - name: Arsène Fougerouse
     email: arsene.fougerouse@xwiki.com
-dependencies:
-  - name: common
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 2.x.x

charts/cryptpad/templates/NOTES.txt

@@ -1,10 +1,14 @@
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.mainDomain }}
+  {{- if .Values.sandboxDomain }}
+  http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.sandboxDomain }} (sandbox)
+  {{- end }}
+{{- else if .Values.httpRoute.enabled }}
+  https://{{ .Values.mainDomain }}
+  {{- if .Values.sandboxDomain }}
+  https://{{ .Values.sandboxDomain }} (sandbox)
   {{- end }}
-{{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryptpad-helm.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")

charts/cryptpad/templates/_helpers.tpl

@@ -62,11 +62,11 @@ Create the name of the service account to use
 {{- end }}
 
 {{/*
-Define main domain. Or use first ingress host defined as main domain.
+Define main domain (httpUnsafeOrigin / CPAD_MAIN_DOMAIN).
 */}}
 {{- define "cryptpad-helm.mainDomain" -}}
-{{- if .Values.ingress.enabled }}
-https://{{ (index .Values.ingress.hosts 0).host }}
+{{- if .Values.mainDomain }}
+https://{{ .Values.mainDomain }}
 {{- else if .Values.config.httpUnsafeOrigin }}
 {{- .Values.config.httpUnsafeOrigin }}
 {{- else }}
@@ -75,11 +75,14 @@ http://localhost:3000
 {{- end }}
 
 {{/*
-Define sandbox subdomain. Or use first ingress host defined as main domain.
+Define sandbox domain (httpSafeOrigin / CPAD_SANDBOX_DOMAIN).
+Falls back to mainDomain when sandboxDomain is unset (insecure — same origin).
 */}}
 {{- define "cryptpad-helm.sandboxDomain" -}}
-{{- if .Values.ingress.enabled }}
-https://{{ (index .Values.ingress.hosts 0).host }}
+{{- if .Values.sandboxDomain }}
+https://{{ .Values.sandboxDomain }}
+{{- else if .Values.mainDomain }}
+https://{{ .Values.mainDomain }}
 {{- else if .Values.config.httpSafeOrigin }}
 {{- .Values.config.httpSafeOrigin }}
 {{- else }}

charts/cryptpad/templates/configmap.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -9,21 +10,8 @@ data:
     /* globals module */
 
     module.exports = {
-          {{- if .Values.ingress.enabled}}  
-            httpUnsafeOrigin: 'https://{{ (index .Values.ingress.hosts 0).host }}',
-          {{- else if .Values.config.httpUnsafeOrigin }}
-            httpUnsafeOrigin: {{ .Values.config.httpUnsafeOrigin | quote }}, 
-          {{- else }}
-            httpUnsafeOrigin: 'http://localhost:3000',
-          {{- end}}
-
-          {{- if .Values.ingress.enabled }}
-            httpSafeOrigin: 'https://{{ (index .Values.ingress.hosts 0).host }}',
-          {{- else if .Values.config.httpSafeOrigin }}  
-            httpSafeOrigin: {{ .Values.config.httpSafeOrigin | quote }}, 
-          {{- else }}
-            httpSafeOrigin: 'http://localhost:3000',
-          {{- end}}
+          httpUnsafeOrigin: '{{ include "cryptpad-helm.mainDomain" . | trim }}',
+          httpSafeOrigin: '{{ include "cryptpad-helm.sandboxDomain" . | trim }}',
 
           {{- if .Values.config.adminKeys }}
             adminKeys: [
@@ -41,12 +29,16 @@ data:
           {{- end}}
 
           {{- range $key, $value := .Values.config }}
-            {{- if and (or (ne $key "httpUnsafeOrigin") (ne $key "httpSafeOrigin")) (ne $key "adminKeys")  (ne $key "maxUploadSize")}}
-            {{ $key }}: {{ $value | quote }},
+            {{- if and (ne $key "httpUnsafeOrigin") (ne $key "httpSafeOrigin") (ne $key "adminKeys") (ne $key "maxUploadSize") }}
+              {{- if or (kindIs "bool" $value) (kindIs "float64" $value) (kindIs "int64" $value) }}
+              {{ $key }}: {{ $value }},
+              {{- else if or (kindIs "slice" $value) (kindIs "map" $value) }}
+              {{ $key }}: {{ $value | toJson }},
+              {{- else }}
+              {{ $key }}: {{ $value | quote }},
+              {{- end }}
             {{- end }}
           {{- end }}
-
-
         };
   application_config.js: |
     /*

charts/cryptpad/templates/cryptpad.yaml

@@ -1,8 +1,8 @@
+---
+apiVersion: apps/v1
 {{- if .Values.workloadStateful }}
-apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
 kind: StatefulSet
 {{- else }}
-apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
 kind: Deployment
 {{- end }}
 metadata:
@@ -50,6 +50,8 @@ spec:
           volumeMounts:
             - name: cryptpad-data
               mountPath: /cryptpad/data
+            - mountPath: /tmp
+              name: tmp
           args:
             - |
               FILE=/cryptpad/data/decrees/decree.ndjson
@@ -132,7 +134,7 @@ spec:
           readinessProbe:
           {{- if .Values.probes.readiness.httpGet.enabled }}
             httpGet:
-              path: {{ .Values.probes.liveness.httpGet.path }}
+              path: {{ .Values.probes.readiness.httpGet.path }}
               port: {{ .Values.service.containerPort }}
           {{- else }}
             tcpSocket:
@@ -147,23 +149,25 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
-          {{- if .Values.persistence.enabled }}
-          {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
-            - name: cryptpad-{{ $dir | replace "/" "-" }}
-              mountPath: /cryptpad/{{ $dir }}
-          {{- end }}
-          {{- else if not .Values.workloadStateful }}
           {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
+            {{- $mountPath := printf "/cryptpad/%s" $dir }}
+            {{- $skip := false }}
+            {{- range $.Values.extraVolumeMounts }}
+              {{- if eq .mountPath $mountPath }}{{- $skip = true }}{{- end }}
+            {{- end }}
+            {{- if not $skip }}
             - name: cryptpad-{{ $dir | replace "/" "-" }}
-              mountPath: /cryptpad/{{ $dir }}
-          {{- end }}
+              mountPath: {{ $mountPath }}
+            {{- end }}
           {{- end }}
             - name: configmaps
               mountPath: {{ .Values.cpadConfig }}
               subPath: config.js
             - name: configmaps
               mountPath: /cryptpad/customize/application_config.js
               subPath: application_config.js
+            - mountPath: /tmp
+              name: tmp
             {{- with .Values.extraVolumeMounts }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -183,6 +187,8 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: configmaps
           configMap:
             name: {{ include "cryptpad-helm.fullname" . }}
@@ -239,7 +245,14 @@ spec:
     {{- end }}
   {{- else }}
     {{- range $dir, $dirvalues := .Values.persistence.cryptpad }}
-        - name: cryptpad-{{ $dir | replace "/" "-" }}
+      {{- $volName := printf "cryptpad-%s" ($dir | replace "/" "-") }}
+      {{- $skip := false }}
+      {{- range $.Values.extraVolumes }}
+        {{- if eq .name $volName }}{{- $skip = true }}{{- end }}
+      {{- end }}
+      {{- if not $skip }}
+        - name: {{ $volName }}
           emptyDir: {}
-  {{- end }}
+      {{- end }}
+    {{- end }}
 {{- end }}

charts/cryptpad/templates/hpa.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
+---
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "cryptpad-helm.fullname" . }}
@@ -8,10 +9,10 @@ metadata:
 spec:
   scaleTargetRef:
     {{- if .Values.workloadStateful }}
-    apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
+    apiVersion: apps/v1
     kind: StatefulSet
     {{- else }}
-    apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+    apiVersion: apps/v1
     kind: Deployment
     {{- end }}
     name: {{ include "cryptpad-helm.fullname" . }}
@@ -22,12 +23,16 @@ spec:
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
     {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
 {{- end }}

charts/cryptpad/templates/httpRoute.yaml

@@ -0,0 +1,56 @@
+{{- if .Values.httpRoute.enabled -}}
+{{- $fullName := include "cryptpad-helm.fullname" . -}}
+{{- $svcPort := .Values.service.externalPort -}}
+{{- $svcWsPort := .Values.service.websocket.externalPort -}}
+{{- if not .Values.httpRoute.parentRefs }}
+    {{- fail "A valid .Values.httpRoute.parentRefs entry is required when httpRoute.enabled is true" }}
+{{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "cryptpad-helm.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.httpRoute.parentRefs }}
+  parentRefs:
+  {{- . | toYaml | nindent 2 }}
+  {{- end }}
+  hostnames:
+  - {{ .Values.mainDomain | quote }}
+  {{- if .Values.sandboxDomain }}
+  - {{ .Values.sandboxDomain | quote }}
+  {{- end }}
+  rules:
+  - matches:
+    - path:
+        value: /
+        type: PathPrefix
+    backendRefs:
+    - group: ''
+      kind: Service 
+      name: {{ $fullName }}
+      port: {{ $svcPort }}
+    {{- with .Values.httpRoute.timeouts }}
+    timeouts:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  - matches:
+    - path:
+        value: /cryptpad_websocket
+        type: PathPrefix
+    backendRefs:
+    - group: ''
+      kind: Service 
+      name: {{ $fullName }}
+      port: {{ $svcWsPort }}
+    {{- with .Values.httpRoute.timeouts }}
+    timeouts:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}

charts/cryptpad/templates/ingress.yaml

@@ -2,6 +2,7 @@
 {{- $fullName := include "cryptpad-helm.fullname" . -}}
 {{- $svcPort := .Values.service.externalPort -}}
 {{- $svcWsPort := .Values.service.websocket.externalPort -}}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -20,15 +21,39 @@ spec:
   tls:
     {{- range .Values.ingress.tls }}
     - hosts:
+        {{- if .hosts }}
         {{- range .hosts }}
         - {{ . | quote }}
         {{- end }}
+        {{- else }}
+        - {{ $.Values.mainDomain | quote }}
+        {{- if $.Values.sandboxDomain }}
+        - {{ $.Values.sandboxDomain | quote }}
+        {{- end }}
+        {{- end }}
       secretName: {{ .secretName }}
     {{- end }}
   {{- end }}
   rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
+    - host: {{ .Values.mainDomain | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+          - path: /cryptpad_websocket
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcWsPort }}
+    {{- if .Values.sandboxDomain }}
+    - host: {{ .Values.sandboxDomain | quote }}
       http:
         paths:
           - path: /

charts/cryptpad/templates/pvc.yaml

@@ -7,11 +7,11 @@ metadata:
   name: cryptpad-{{ $dir | replace "/" "-" }}
   {{- with $dirvalues.annotations }}
   annotations:
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- with $dirvalues.labels }}
   labels:
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
   accessModes:
@@ -23,14 +23,14 @@ spec:
   {{- end }}
   {{- with $dirvalues.dataSource }}
   dataSource: 
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   resources:
     requests:
       storage: {{ $dirvalues.size | quote }}
   {{- with $dirvalues.selector }}
   selector: 
-    {{- toYaml . | nindent 10 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- end }}
 {{- end }}

charts/cryptpad/templates/service.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Service
 metadata:

charts/cryptpad/templates/serviceaccount.yaml

@@ -1,4 +1,5 @@
 {{- if .Values.serviceAccount.create -}}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata: