Create helm chart for the cdn component

We also use a global back-end object store via a public hostname and
using SSL to secure the connection (the backend can now be in a
different cluster to the cache).

Author: stevekeay

components/understack-cdn/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: understack-cdn
+description: HTTP service to serve firmware images from central store
+type: application
+version: 0.1.0

components/understack-cdn/README.md

@@ -12,16 +12,15 @@ cluster-local tendot IP address.
 
 The proxy edge service caches files locally on a persistent volume.
 
-Nginx configuration contains:
-- the service address for rook-ceph
-- the name of our bucket
-
-All files are proxied to that object bucket.  Anonymous credentials are used,
+All files are proxied to our object bucket.  Anonymous credentials are used,
 therefore we need to make the files in our bucket readable by anonymous if they
 are to be accessible via HTTP.
 
 ## Uploading file to object storage
 
+We have an ObjectBucket provisioned via rook/ceph.  The operator for our
+ObjectBucketClaim creates credentials for us to access this bucket.
+
 Our credentials and bucket info is in a secret and a configmap both named after
 the bucketclaim:
 

components/understack-cdn/kustomization.yaml

@@ -43,8 +43,8 @@ data:
         proxy_cache_path /var/cache/nginx/cdn
             levels=1:2
             keys_zone=cdn_cache:50m
-            max_size=5g
-            inactive=7d
+            max_size={{ .Values.cdn.cacheSize }}
+            inactive={{ .Values.cdn.inactive }}
             use_temp_path=off;
 
         # Don't buffer large files to disk before sending — stream them
@@ -64,11 +64,8 @@ data:
         include /etc/nginx/conf.d/*.conf;
     }
   default.conf: |
-    # Upstream: your S3 S3 origin
-    # In production this points at your S3 service endpoint.
-    # Can also point at R2/S3 by changing the server and Host header.
     upstream s3_origin {
-        server rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80;
+        server {{ .Values.cdn.objectStorageServerHostname }}:443;
         keepalive 32;
     }
 
@@ -102,11 +99,11 @@ data:
         proxy_no_cache 0;
         proxy_ignore_headers Cache-Control Expires Set-Cookie;
 
-        location /firmware-images/ {
+        location /{{ .Values.cdn.bucketName }}/ {
             # Forward to Object Storage.
-            # S3-compatible API expects requests in the form: /bucket/key
-            # Our bucket is called firmware-images
-            proxy_pass http://s3_origin$request_uri;
+            # S3-compatible API expects requests in the form: /bucket-name/key
+            # Our clients are using URL paths in the exact same format.
+            proxy_pass https://s3_origin$request_uri;
 
             proxy_http_version 1.1;
             proxy_set_header Connection "";           # keepalive to upstream
@@ -117,6 +114,10 @@ data:
             # Don't forward auth headers downstream
             proxy_set_header Authorization "";
 
+            # SSL settings for upstream connection
+            proxy_ssl_server_name on;
+            proxy_ssl_protocols TLSv1.2 TLSv1.3;
+
             # Tell clients files are immutable — they should cache forever
             add_header Cache-Control "public, max-age=31536000, immutable" always;
 

components/understack-cdn/deployment.yaml …rstack-cdn/templates/deployment.yaml.tplcomponents/understack-cdn/deployment.yaml renamed to components/understack-cdn/templates/deployment.yaml.tpl components/understack-cdn/deployment.yaml renamed to components/understack-cdn/templates/deployment.yaml.tpl

@@ -1,11 +1,13 @@
+{{- if .Values.cdn.objectBucketIsLocal }}
 apiVersion: objectbucket.io/v1alpha1
 kind: ObjectBucketClaim
 metadata:
-  name: firmware-images
+  name: {{ .Values.cdn.bucketName }}
   namespace: understack-cdn
 spec:
-  bucketName: firmware-images
+  bucketName: {{ .Values.cdn.bucketName }}
   storageClassName: ceph-bucket
   additionalConfig:
     maxObjects: "1000"
-    maxSize: "5G"
+    maxSize: {{ .Values.cdn.bucketMaxSize }}
+{{- end }}

components/understack-cdn/namespace.yaml …erstack-cdn/templates/namespace.yaml.tplcomponents/understack-cdn/namespace.yaml renamed to components/understack-cdn/templates/namespace.yaml.tpl components/understack-cdn/namespace.yaml renamed to components/understack-cdn/templates/namespace.yaml.tpl

@@ -0,0 +1,16 @@
+cdn:
+  # Cache is limited to this size.  We will provision a volume this size so
+  # changing it would require the filesystem to be rebuilt/resized:
+  cacheSize: 10g
+  # Files are evicted from the cache if they have not been accessed in:
+  inactive: 7d
+
+  # The location of our object bucket (s3-compatible object store) providing us
+  # with anonymous access to our image files:
+  objectStorageServerHostname: object-storage.dev.undercloud.rackspace.net
+  bucketName: firmware-images
+
+  # Whether to create a local ObjectBucketClaim on this cluster
+  objectBucketIsLocal: false
+  # If above is true, how much space to claim for this object bucket:
+  bucketMaxSize: 40g