2b6e20cc3f
ClusterIssuer solver referenced IngressClass "nginx" which does not exist on cozystack clusters — real classes are named after tenant namespaces (e.g. tenant-root). Cert issuance only worked because every requesting Ingress overrode the ClusterIssuer via the legacy acme.cert-manager.io/http01-ingress-class annotation. Switch both sides to the modern cert-manager API (available since cert-manager 1.12; cozystack ships 1.19.3): - ClusterIssuer: http01.ingress.ingressClassName, value parameterized from _cluster.expose-ingress (default "tenant-root") - Ingress annotation: http01-ingress-ingressclassname These must migrate together — mixing ingressClassName (ClusterIssuer) with the old http01-ingress-class annotation triggers cert-manager's "fields ingressClassName and class cannot be set at the same time" validation and breaks issuance. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> |
||
|---|---|---|
| .. | ||
| images/linstor-gui | ||
| templates | ||
| tests | ||
| Chart.yaml | ||
| Makefile | ||
| README.md | ||
| values.yaml | ||
linstor-gui
Cozystack system package for LINBIT/linstor-gui — a web UI for managing LINSTOR nodes, resources, volumes and snapshots.
Installed alongside the linstor package in the cozy-linstor namespace. The UI
proxies the LINSTOR controller REST API at https://linstor-controller.cozy-linstor.svc:3371
using mTLS with the linstor-client-tls secret created by the linstor package.
Exposing the UI
Option 1 — Keycloak-protected Ingress (recommended)
The chart ships an oauth2-proxy based gatekeeper plus a KeycloakClient CRD
so the UI can be published on linstor-gui.<root-host> behind the cluster
Keycloak realm. Access is restricted to members of the
cozystack-cluster-admin Keycloak group — the same group that grants
cluster-admin RBAC on the host cluster. Authenticating against the cozy
realm alone is not sufficient; users outside that group receive a 403 from
oauth2-proxy before any request reaches the UI or the LINSTOR controller.
To turn it on, add linstor-gui to publishing.exposedServices in the core
cozystack values (same list that controls dashboard). OIDC must be
enabled (authentication.oidc.enabled: true) — if it is not, the Ingress and
gatekeeper Deployment are deliberately not rendered, because the LINSTOR
REST API surface must not be exposed unauthenticated.
Once enabled, the UI is reachable at https://linstor-gui.<root-host> and
authentication is delegated to Keycloak via the linstor-gui client
(auto-provisioned through the KeycloakClient CRD; the client secret is
persisted in the linstor-gui-client Secret in cozy-linstor).
Option 2 — Port-forward
If you have not set up Keycloak or want ad-hoc access, use the ClusterIP
Service:
kubectl -n cozy-linstor port-forward svc/linstor-gui 3373:80
then open http://localhost:3373.
Parameters
Image
| Name | Description | Value |
|---|---|---|
image.repository |
LINSTOR GUI container image repository | ghcr.io/cozystack/cozystack/linstor-gui |
image.tag |
LINSTOR GUI container image tag (digest recommended) | 2.3.0 |
Deployment
| Name | Description | Value |
|---|---|---|
replicas |
Number of linstor-gui replicas | 1 |
LINSTOR controller connection
| Name | Description | Value |
|---|---|---|
linstor.endpoint |
In-cluster URL of the LINSTOR controller REST API (HTTPS, mTLS) | https://linstor-controller.cozy-linstor.svc:3371 |
linstor.clientSecret |
Kubernetes Secret with tls.crt, tls.key, ca.crt used as the mTLS client certificate against the LINSTOR controller. Created by the linstor package. |
linstor-client-tls |