ChartMuseum

ChartMuseum

ChartMuseum is an open-source Helm Chart Repository server written in Go (Golang), with support for cloud storage backends, including Google Cloud Storage, Amazon S3, Microsoft Azure Blob Storage, Alibaba Cloud OSS Storage, Openstack Object Storage, Oracle Cloud Infrastructure Object Storage, Baidu Cloud BOS Storage, Tencent Cloud Object Storage, Netease Cloud NOS Storage, DigitalOcean Spaces, Minio, and etcd.

In addition to using ChartMuseum as you regular Helm Chart registry, you can also store your custom KubeVela addons in it.

$ vela addon enable chartmuseum

To customize addon parameters, either:

use VelaUX and fill out the form when enabling addon
or check out what parameters are available using vela addon status chartmuseum -v, and specify it using vela addon enable chartmuseum externalPort=80

This tutorial will assume you used the default parameters.

After successfully enabling the addon, we need to make sure ChartMuseum is accessible to you by forwarding the default port (8080):

vela port-forward -n vela-system addon-chartmuseum 8080:8080 --address 0.0.0.0

Typically, you would configure ingress (achievable using addon parameters) to make the addon accessible to the outside.

Use your newly created ChartMuseum repository (or any other Helm Chart repository) as an addon registry. We will name it localcm:

$ vela addon registry add localcm --type helm --endpoint=http://localhost:8080 
# If username and password is required, you can specify them with --username and --password

You should see it in the list now:

$ vela addon registry list
Name        Type    URL                        
...
localcm     helm    http://localhost:8080

Prepare your addon. We will create a new one named sample-addon here:

$ vela addon init sample-addon
# A conventional addon directory will be created
# ./sample-addon
# ├── definitions
# ├── metadata.yaml
# ├── readme.md
# ├── resources
# ├── schemas
# └── template.yaml

(Optional) Package your addon:

Feel free to skip ahead. We will do this automatically for you if you don’t want to package it manually.

$ vela addon package sample-addon
# You should see a package named sample-addon-1.0.0.tgz

Push your addon (sample-addon) to the registry (localcm) that you just added:

# Notice how we automatically package the addon for you. 
$ vela addon push sample-addon localcm
Pushing sample-addon-1.0.0.tgz to localcm(http://localhost:8080)... Done
# If you packaged it yourself, just replace `sample-addon` with `sample-addon-1.0.0.tgz`
# In addition to registry names (localcm, as we saw earlier), URLs are also supported.
# If you use URLs, you don't even have to add it as an addon registry.
$ vela addon push sample-addon-1.0.0.tgz http://localhost:8080 -f
Pushing sample-addon-1.0.0.tgz to http://localhost:8080... Done
# Notice the `-f` option.
# This is because we already pushed the exact same addon to the same registry earlier.
# We need to use `-f` to overwrite it.

Your addon is available in the registry now!

$ vela addon list
NAME          REGISTRY   DESCRIPTION             AVAILABLE-VERSIONS  STATUS  
...
sample-addon  localcm    An addon for KubeVela.  [1.0.0]             disabled

Warning: to prevent anonymous uploads, do any of the following:

set disableAPI to true
enable authentication

By default this addon does not have any authentication configured and allows anyone to fetch or upload charts (unless the API is disabled with disableAPI).

To enable Basic Auth to protect APIs, configure basicAuth parameters:

// +usage=Basic auth settings
basicAuth: {
    // +usage=Username for basic http authentication
    username: "user"
    // +usage=Password for basic http authentication
    password: "pswd"
}

By default ChartMuseum uses local filesystem storage. But on pod recreation it will lose all charts, to prevent that, enable persistent storage.

enablePersistence: true
persistentSize:    "8Gi"

Make sure your environment is properly setup to access my-oss-bucket.

To do so, you must set the following parameters:

accessKeyID
accessKeySecret

// +usage=Storage backend, can be one of: local(default), alibaba, amazon, google, microsoft
storge: "alibaba"
// +usage=Alibaba Cloud storage backend settings
alibaba: {
    // +usage=OSS bucket to store charts for alibaba storage backend, e.g. my-oss-bucket
    bucket: "my-oss-bucket"
    // +usage=OSS endpoint to store charts for alibaba storage backend, e.g. oss-cn-beijing.aliyuncs.com
    endpoint: "oss-cn-beijing.aliyuncs.com"
    // +usage=Alibaba OSS access key id
    accessKeyID: "accessKeyID"
    // +usage=Alibaba OSS access key secret
    accessKeySecret: "accessKeySecret"
}

Make sure your environment is properly setup to access mycontainer.

To do so, you must set the following parameters:

account
accessKey

Specify custom.yaml with such values

// +usage=Storage backend, can be one of: local(default), alibaba, amazon, google, microsoft
storage: "microsoft"
// +usage=Microsoft Azure storage backend settings
microsoft: {
    // +usage=Container to store charts for microsoft storage backend
    container: "mycontainer"
    // +usage=Azure storage account
    account: "account"
    // +usage=Azure storage account access key
    accessKey: "key"
}

// +usage=Storage backend, can be one of: local(default), alibaba, amazon, google, microsoft
storage: "google"
// +usage=GCP storage backend settings
google: {
    // +usage=GCS bucket to store charts for google storage backend, e.g. my-gcs-bucket
    bucket: "my-gcs-bucket"
    // +usage=GCP service account json file
    googleCredentialsJSON: "json"
}

Make sure your environment is properly setup to access my-s3-bucket

You need at least the following permissions inside your IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowListObjects",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::my-s3-bucket"
    },
    {
      "Sid": "AllowObjectsCRUD",
      "Effect": "Allow",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-s3-bucket/*"
    }
  ]
}

Grant permissions to special user and use it’s access keys for auth on aws

// +usage=Storage backend, can be one of: local(default), alibaba, amazon, google, microsoft
storage: "amazon"
// +usage=AWS storage backend settings
amazon: {
    // +usage=S3 bucket to store charts for amazon storage backend, e.g. my-s3-bucket
    bucket: "my-s3-bucket"
    // +usage=Region of s3 bucket to store charts, e.g. us-east-1
    region: "us-east-1"
    // +usage=AWS access key id
    accessKeyID: "keyid"
    // +usage=AWS access key secret
    accessKeySecret: "secret"
}

Last updated on Aug 4, 2023 by Daniel Higuero