mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-06 12:03:39 +09:00
myasnikovdaniil
c6739cf95a
## What this PR does Adds a new Cozystack system package `linstor-gui` that ships [LINBIT's LINSTOR web UI](https://github.com/LINBIT/linstor-gui) (GPL-3.0) so operators can manage nodes, resources, volumes and snapshots from a browser instead of the `linstor` CLI. Changes: - `packages/system/linstor-gui/` — umbrella chart with: - `images/linstor-gui/Dockerfile` builds the image from the upstream `pkg.linbit.com` tarball (v2.3.0) on top of `nginxinc/nginx-unprivileged:1.29-alpine`, mirroring the build pattern already used for `piraeus-server` and `linstor-csi`. - `templates/configmap-nginx.yaml` — chart-supplied `nginx.conf` that proxies `/v1` and `/metrics` to `linstor-controller.cozy-linstor.svc:3371` over **mTLS**, using the existing `linstor-client-tls` secret created by the `linstor` package. - `templates/deployment.yaml` — read-only rootfs, non-root (UID 101), `runAsNonRoot`, `RuntimeDefault` seccomp, no SA token mounted, `reloader.stakater.com/auto` on the Deployment. - `templates/service.yaml` — **ClusterIP only**. No Ingress is shipped because the LINSTOR controller API is a privileged cluster-wide storage surface and auth depends on the deployment's OIDC setup; operators wire up ingress + auth explicitly. - `tests/deployment_test.yaml` — `helm-unittest` covering Service shape, TLS secret mount, securityContext, and nginx proxy+mTLS config. - `packages/core/platform/sources/linstor-gui.yaml` — new `PackageSource` depending on `cozystack.linstor`. - `packages/core/platform/templates/bundles/system.yaml` — registers `linstor-gui` as an **optional** system package (controlled via `bundles.enabledPackages`), alongside `velero`, `telepresence`, etc. ### Why standalone (not a sidecar in the controller pod) LINBIT's upstream Dockerfile is designed for this standalone reverse-proxy topology, and keeping the UI as its own Deployment means it scales, upgrades, and restarts independently of `linstor-controller`. The price is the small amount of mTLS config in `nginx.conf`, all of which lives in the chart's ConfigMap. ### Release note ```release-note [linstor-gui] Add an opt-in system package that deploys LINBIT's linstor-gui web UI alongside the LINSTOR controller. Enable via `bundles.enabledPackages: [cozystack.linstor-gui]`, then `kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80` to access. ``` ## Test plan - [ ] `make unit-tests` (requires `helm-unittest` plugin) passes on the new `tests/deployment_test.yaml` - [ ] `make image` in `packages/system/linstor-gui/` builds and pushes the image - [ ] Install the package on a dev cluster with LINSTOR already deployed; confirm the pod comes up - [ ] `kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80` → browser loads the UI at `localhost:3373` - [ ] UI lists LINSTOR nodes, storage pools and resources correctly (proves mTLS proxy to `/v1` works) - [ ] Disable via `bundles.enabledPackages` removal; verify the `Package` resource is cleaned up <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * LINSTOR GUI added as an optional system package deployable to the cozy-linstor namespace. * Web UI serves on port 3373, proxies LINSTOR controller over mTLS, and exposes a /healthz endpoint. * Image build and release targets added to produce multi-arch container images. * **Documentation** * New README with deployment guidance, connection examples, and configurable options (endpoint, client secret, image, replicas). * **Tests** * Helm chart tests validating service, deployment, config and mTLS behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->