{"id":51601286,"url":"https://github.com/rustfs/operator-helm-package","last_synced_at":"2026-07-11T22:30:39.199Z","repository":{"id":370176856,"uuid":"1293018538","full_name":"rustfs/operator-helm-package","owner":"rustfs","description":null,"archived":false,"fork":false,"pushed_at":"2026-07-08T14:07:46.000Z","size":58,"stargazers_count":0,"open_issues_count":2,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-08T14:11:28.778Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rustfs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-08T03:35:48.000Z","updated_at":"2026-07-08T14:08:21.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/rustfs/operator-helm-package","commit_stats":null,"previous_names":["rustfs/operator-helm-package"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/rustfs/operator-helm-package","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Foperator-helm-package","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Foperator-helm-package/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Foperator-helm-package/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Foperator-helm-package/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rustfs","download_url":"https://codeload.github.com/rustfs/operator-helm-package/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rustfs%2Foperator-helm-package/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35377012,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-11T22:30:38.460Z","updated_at":"2026-07-11T22:30:39.182Z","avatar_url":"https://github.com/rustfs.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RustFS Operator Helm Chart\n\nHelm chart for deploying the RustFS Kubernetes operator.\n\n## Prerequisites\n\n- Kubernetes v1.30+\n- Helm 3.0+\n\n## Installing the Chart\n\nTo install the chart with the release name `rustfs-operator`:\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/\n```\n\nTo install in a specific namespace:\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ --namespace rustfs-system --create-namespace\n```\n\n## Uninstalling the Chart\n\nTo uninstall/delete the `rustfs-operator` deployment:\n\n```bash\nhelm uninstall rustfs-operator --namespace rustfs-system\n```\n\n## Configuration\n\nThe following table lists the configurable parameters of the RustFS Operator chart and their default values.\n\n### Operator Configuration\n\n| Parameter | Description | Default |\n|-----------|-------------|---------|\n| `operator.replicas` | Number of operator replicas | `1` |\n| `operator.image.repository` | Operator image repository | `rustfs/operator` |\n| `operator.image.tag` | Operator image tag | `latest` |\n| `operator.image.pullPolicy` | Image pull policy | `IfNotPresent` |\n| `operator.imagePullSecrets` | Image pull secrets | `[]` |\n| `operator.leaderElect` | Enable leader election override (`null`/unset for auto by replicas) | `null` |\n| `operator.resources.requests.cpu` | CPU resource requests | `100m` |\n| `operator.resources.requests.memory` | Memory resource requests | `128Mi` |\n| `operator.resources.limits.cpu` | CPU resource limits | `500m` |\n| `operator.resources.limits.memory` | Memory resource limits | `512Mi` |\n| `operator.metrics.enabled` | Enable operator `/metrics`, `/healthz`, and `/readyz` endpoint | `true` |\n| `operator.metrics.port` | Operator observability container port | `8080` |\n| `operator.serviceMonitor.enabled` | Create a Prometheus Operator ServiceMonitor | `false` |\n| `operator.prometheusRule.enabled` | Create Prometheus alert rules for operator and tenant storage health | `false` |\n| `operator.tenantMonitor.enabled` | Poll RustFS tenant storage health and capacity metrics | `true` |\n| `operator.tenantMonitor.intervalSeconds` | Tenant storage monitor interval | `300` |\n| `operator.env` | Environment variables | `[{name: RUST_LOG, value: info}]` |\n| `operator.nodeSelector` | Node selector for pod placement | `{}` |\n| `operator.tolerations` | Tolerations for pod scheduling | `[]` |\n| `operator.affinity` | Affinity rules for pod scheduling | `{}` |\n\n### Operator STS Configuration\n\n| Parameter | Description | Default |\n|-----------|-------------|---------|\n| `sts.enabled` | Enable the operator STS endpoint | `true` |\n| `sts.audience` | Kubernetes TokenReview audience expected by the operator STS endpoint | `sts.rustfs.com` |\n| `sts.port` | Operator container port for STS | `4223` |\n| `sts.tls.enabled` | Serve the operator STS endpoint over TLS | `true` |\n| `sts.tls.auto` | Create the operator STS TLS Secret when missing | `true` |\n| `sts.service.type` | Kubernetes Service type for STS | `ClusterIP` |\n| `sts.service.port` | Kubernetes Service port for STS | `4223` |\n\nThe RustFS operator STS endpoint intentionally uses an explicit Tenant route:\n\n```text\nPOST /sts/{tenantNamespace}/{tenantName}\n```\n\nThis differs from MinIO Operator's namespace-only route. A `PolicyBinding` still lives in the Tenant namespace, but the workload must call STS with both the Tenant namespace and the Tenant name.\n\nThe STS service is HTTPS by default. When `sts.tls.auto=true`, the operator creates the fixed `sts-tls` Secret in the operator namespace with `tls.crt`, `tls.key`, and `ca.crt`. Workloads must trust that CA. To use an externally issued certificate, pre-create `sts-tls` with a certificate signed by a CA already trusted by the workload and set `sts.tls.auto=false`.\n\nSTS only issues credentials for TLS-enabled Tenants. For Tenant upstream calls, the operator selects the Tenant HTTPS service endpoint and trusts the CA recorded in `status.certificates.tls.caSecretRef`.\n\nOperator STS does not present a client certificate when calling the Tenant. Tenants configured with `spec.tls.certManager.caTrust.clientCaSecretRef` continue to run with server-side mTLS enabled, but Operator STS rejects those Tenants with HTTP 400 and `TenantTlsClientCertificateUnsupported`.\n\nWhen `operator.serviceMonitor.enabled=true`, the chart creates scrape targets for both the operator observability endpoint and the Console API `/metrics` endpoint.\n\n### Tenant Provisioning\n\nTenants can declare RustFS canned policies, regular users, and buckets directly in `spec.policies`, `spec.users`, and `spec.buckets`. Provisioning starts only after the Tenant workload is ready, uses `spec.credsSecret` as the RustFS admin credential source, and reports progress under `status.provisioning`.\n\nUser provisioning requires a non-empty direct policy mapping:\n\n```yaml\nspec:\n  credsSecret:\n    name: rustfs-admin-creds\n  policies:\n    - name: app-readwrite\n      document:\n        configMapKeyRef:\n          name: app-policy\n          key: policy.json\n  users:\n    - name: app-user\n      policies:\n        - app-readwrite\n  buckets:\n    - name: app-data\n      objectLock: true\n```\n\nPolicy ConfigMaps and user Secrets must live in the Tenant namespace. If they are created outside the Operator Console, add `rustfs.tenant=\u003ctenant-name\u003e` so changes to those resources enqueue the owning Tenant. Provisioned resources are retained when removed from the Tenant spec.\n\n### RBAC Configuration\n\n| Parameter | Description | Default |\n|-----------|-------------|---------|\n| `rbac.create` | Create RBAC resources | `true` |\n| `serviceAccount.create` | Create service account | `true` |\n| `serviceAccount.name` | Service account name | `\"\"` (auto-generated) |\n| `serviceAccount.annotations` | Service account annotations | `{}` |\n\n### Other Configuration\n\n| Parameter | Description | Default |\n|-----------|-------------|---------|\n| `namespace` | Namespace to deploy to | `\"\"` (uses release namespace) |\n| `commonLabels` | Labels to add to all resources | `{}` |\n| `commonAnnotations` | Annotations to add to all resources | `{}` |\n\n## Examples\n\n### Custom Image and Tag\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ \\\n  --set operator.image.repository=myregistry/operator \\\n  --set operator.image.tag=v0.2.0\n```\n\n### Increased Resources\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ \\\n  --set operator.resources.requests.cpu=200m \\\n  --set operator.resources.requests.memory=256Mi \\\n  --set operator.resources.limits.cpu=1000m \\\n  --set operator.resources.limits.memory=1Gi\n```\n\n### Leader Election for Helm Deployments\n\nWith the chart default behavior, `leaderElect` is automatically enabled when\n`operator.replicas \u003e 1` and disabled when `operator.replicas \u003c= 1`:\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ \\\n  --set operator.replicas=3\n```\n\nOverride explicitly if needed (for example, to force single-leader mode in all cases):\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ \\\n  --set operator.replicas=3 \\\n  --set operator.leaderElect=false\n```\n\n### Using a Values File\n\nCreate a custom `values.yaml`:\n\n```yaml\noperator:\n  replicas: 2\n  image:\n    repository: myregistry/rustfs-operator\n    tag: v0.2.0\n  resources:\n    requests:\n      cpu: 200m\n      memory: 256Mi\n    limits:\n      cpu: 1000m\n      memory: 1Gi\n  env:\n    - name: RUST_LOG\n      value: debug\n  leaderElect:\n```\n\nInstall with your custom values:\n\n```bash\nhelm install rustfs-operator deploy/rustfs-operator/ -f custom-values.yaml\n```\n\n### STS PolicyBinding and Workload Token\n\nCreate a `PolicyBinding` in the target Tenant namespace. The binding authorizes one workload ServiceAccount to request temporary credentials for policies already defined in RustFS:\n\n```yaml\napiVersion: sts.rustfs.com/v1alpha1\nkind: PolicyBinding\nmetadata:\n  name: reports-readonly\n  namespace: storage\nspec:\n  application:\n    namespace: reports\n    serviceaccount: reports-api\n  policies:\n    - readonly\n```\n\nThe workload should mount a projected ServiceAccount token with an audience matching `sts.audience`:\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: reports-api\n  namespace: reports\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: reports-api\n  namespace: reports\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: reports-api\n  template:\n    metadata:\n      labels:\n        app: reports-api\n    spec:\n      serviceAccountName: reports-api\n      containers:\n        - name: app\n          image: example/reports-api:latest\n          volumeMounts:\n            - name: rustfs-sts-token\n              mountPath: /var/run/secrets/rustfs-sts\n              readOnly: true\n      volumes:\n        - name: rustfs-sts-token\n          projected:\n            sources:\n              - serviceAccountToken:\n                  path: token\n                  audience: sts.rustfs.com\n                  expirationSeconds: 3600\n```\n\nThe workload then calls the operator STS service with the target Tenant namespace and Tenant name:\n\n```bash\nTOKEN=\"$(cat /var/run/secrets/rustfs-sts/token)\"\n\ncurl -sS -X POST \\\n  --cacert /var/run/secrets/rustfs-sts-ca/ca.crt \\\n  \"https://rustfs-operator-sts.rustfs-system.svc:4223/sts/storage/rustfs-a\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode \"Version=2011-06-15\" \\\n  --data-urlencode \"Action=AssumeRoleWithWebIdentity\" \\\n  --data-urlencode \"WebIdentityToken=${TOKEN}\" \\\n  --data-urlencode \"DurationSeconds=3600\"\n```\n\n## Creating Tenant Resources\n\nAfter installing the operator, you can create Tenant resources. See the project root `examples/` directory for sample manifests:\n\n```bash\nkubectl apply -f examples/simple-tenant.yaml\n```\n\n## Upgrading\n\nTo upgrade the operator:\n\n```bash\nhelm upgrade rustfs-operator deploy/rustfs-operator/\n```\n\n## Console UI\n\nThe published `rustfs/operator` image contains both the Console backend (Rust API,\n`/api/v1/*`) and the exported `console-web` static frontend. By default the chart\ndeploys one Console service that serves both `/` and `/api/v1` from the same pod,\nso browser requests are same-origin and do not need CORS.\n\n### Same-origin deployment (recommended)\n\nServe the Console service under **one HTTPS host**:\n\n1. Enable the Console and Ingress in `values.yaml`:\n\n   ```yaml\n   console:\n     enabled: true\n     ingress:\n       enabled: true\n       className: nginx\n       hosts:\n         - host: console.example.com\n   ```\n\n2. Install/upgrade the chart. The Ingress routes `/` and `/api/v1` to the Console\n   service. The embedded frontend is built with `NEXT_PUBLIC_API_BASE_URL=/api/v1`\n   by default. If you intentionally test over plain HTTP, set\n   `CONSOLE_COOKIE_SECURE=false` in `console.env`; do not use that setting for\n   production.\n\nNo CORS configuration is needed on the backend for this setup.\n\nConsole sessions are encrypted stateless cookies. Users paste a Kubernetes\nServiceAccount bearer token only during login; after validation, the Console\nstores that token inside an encrypted `session` cookie for later API requests.\nIf you run multiple Console replicas, keep `console.jwtSecret` stable and shared\nacross all replicas. The chart reuses the existing generated Secret on upgrade\nwhen `console.jwtSecret` is not set.\n\n### Backend CORS (when frontend is on a different host)\n\nIf the frontend is served from another host (e.g. `https://ui.example.com`) and the API at `https://api.example.com`, set allowed origins on the console backend:\n\n```yaml\nconsole:\n  env:\n    - name: CORS_ALLOWED_ORIGINS\n      value: \"https://ui.example.com\"\n    # Required when the frontend and API are cross-site, so browsers send the\n    # encrypted session cookie on credentialed CORS requests.\n    - name: CONSOLE_COOKIE_SAME_SITE\n      value: \"None\"\n```\n\nMultiple origins (e.g. dev + prod): comma-separated, e.g. `\"https://ui.example.com,http://localhost:3000\"`.\n\n### Legacy Split Frontend\n\n`console.frontend.enabled=true` still deploys a separate `console-web` image for\ninstallations that intentionally keep frontend and backend images separate. In\nthat mode the Ingress routes `/api` to the Console backend and `/` to the split\nfrontend service.\n\n### Console login token\n\nThe Console login form expects a Kubernetes ServiceAccount bearer token. For\nthe chart-managed Console ServiceAccount, generate a short-lived token with:\n\n```bash\nkubectl -n rustfs-system create token rustfs-operator-console --duration=24h\n```\n\nPaste the printed token into the Console login form. Use the namespace and\nServiceAccount name from your Helm release if they differ from the defaults.\n\n## Verifying the Installation\n\nCheck that the operator is running:\n\n```bash\nkubectl get pods -n rustfs-system -l app.kubernetes.io/name=rustfs-operator\n```\n\nView operator logs:\n\n```bash\nkubectl logs -n rustfs-system -l app.kubernetes.io/name=rustfs-operator -f\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frustfs%2Foperator-helm-package","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frustfs%2Foperator-helm-package","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frustfs%2Foperator-helm-package/lists"}