koji-hub

This page documents the usage of koji-hub crd.

Dependencies

Koji-Hub Custom Resource Definition (CRD)

Koji-hub depends the following external components:

  • postgresql
  • fedora messaging

The operator does not deploy those components and it expects those to be are already available/deployed.

Sample deployment files are provided for development/example purposes:

Parameters

Name Default Value Type
image quay.io/fedora/koji-hub:latest string
replicas 1 int
persistent true boolean
host koji-hub string
configmap koji-hub string
ca_cert_secret koji-hub-ca-cert string
service_cert_secret koji-hub-service-cert string
postgres_secret postgres string
http_enabled true boolean
https_enabled true boolean
topic_prefix mbox_dev string
fedora_messaging_url   string
messaging_cert_cm koji-hub-msg string
ingress_backend nginx string
mbox “” string
httpd_pvc_name koji-hub-httpd-pvc string
httpd_pvc_size 1Gi string
mnt_pvc_name koji-hub-mnt-pvc string
mnt_pvc_size 10Gi string
web_client_cert_secret koji-hub-web-client-cert string
web_client_username kojihub string
admin_client_cert koji-hub-admin-cert string
admin_username kojiadmin string

image

The the full qualified image name to pull koji-hub from.

replicas

The amount of koji-hub replicas to deploy.

persistent

A boolean flag to enable/disable pvc creation.

Note: I will not create any external volumes if set to false.

host

The koji-hub hostname to be used on several config files and certificates such as httpd.

This property should be set to the public base url of koji on production environments.

configmap

The configmap name to use when deploying koji-hub.

This configmap object contains configuration files that are mounted in koji-hub pod filesystem.

ca_cert_secret

The root CA secret name to use or create.

It will skip its creation (self signed) if one is already present.

Secret format:

apiVersion: v1
kind: Secret
  metadata:
    name: mysecret
    namespace: default
    labels:
      app: koji-hub
  data:
    csr: -|
      fillme
    cert: -|
      fillme
    key: -|
      fillme

service_cert_secret

The httpd service secret name to use or create.

It will skip its creation (self signed) if one is already present.

It needs to be created and signed using the root CA certificate and private key.

Secret format:

apiVersion: v1
kind: Secret
metadata:
  name: myservice
  namespace: default
  labels:
    app: koji-hub
type: kubernetes.io/tls
data:
  tls.crt: -|
    fillme
  tls.key: -|
    fillme

postgres_secret

Postgresql secret used by koji-hub to connect to a psql instance.

Deployment will fail if this secret is not present.

Secret format:

apiVersion: v1
kind: Secret
metadata:
  name: postgres
  labels:
    app: postgres
data:
  POSTGRES_HOST: fillme
  POSTGRES_DB: fillme
  POSTGRES_USER: fillme
  POSTGRES_PASSWORD: fillme

http_enabled

A boolean flag that enables/disables http connections.

https_enabled

A boolean flag that enables/disables https connections.

topic_prefix

The fedora messaging topic prefix to use koji-hub config.

fedora_messaging_url

The fedora messaging url to use in koji-hub.

This is a required property with no default value.

messaging_cert_cm

A config map that contains fedora messaging certs to be mounted in koji-hub pod filesystem.

Those files are used to authenticate koji-hub to a fedora-messaging instance.

Config map format:

apiVersion: v1
kind: ConfigMap
metadata:
  name: koji-hub-msg
  namespace: default
  labels:
    app: koji-hub
data:
  koji.ca: |-
    fillme
  koji.crt: |-
    fillme
  koji.key: |-
    fillme

ingress_backend

The kubernetes ingress backend to use when creating an ingress resource for koji-hub.

Available choices:

  • nginx
  • openshift

httpd_pvc_name

Name of the PersistentVolumeClaim for httpd server koji-hub will use.

If provided PVC doesn’t exists, it creates its own.

httpd_pvc_size

Size of the PersistentVolumeClaim for httpd server koji-hub will create.

If httpd_pvc_name exists, this value is ignored.

mnt_pvc_name

Name of the PersistentVolumeClaim koji-hub will use.

If provided PVC doesn’t exists, it creates its own.

mnt_pvc_size

Size of the PersistentVolumeClaim koji-hub will create.

If mnt_pvc_name exists, this value is ignored.

mbox

A Mbox resource name to retrieve shared data from (pvc volume and shared certs).

Koji-builder will use the following vars if this property is missing to create/use those shared resources:

  • mnt_pvc_name (shared koji mnt volume)
  • ca_cert_secret (root ca secret)
  • postgres_secret (PSQL secret)

web_client_cert_secret

The koji-web secret name to use or create for koji-hub authentication.

It will skip its creation (self signed) if one is already present.

It needs to be created and signed using the root CA certificate and private key.

It should have one key “client.pem” to store both private key and public certificate.

The certificate’s CN field will be used as username during authentication.

Secret format:

apiVersion: v1
kind: Secret
metadata:
  name: koji-hub-web-client-cert-secret
  namespace: default
  labels:
    app: koji-hub
data:
  client.pem: -|
    fillme

web_client_username

Koji web client username to be used when authenticating to koji-hub.

This property will be ignored if not using a self-signed certificate generated by the operator.

admin_client_cert

The admin koji-hub secret name to use or create for koji-hub authentication as the admin user.

It will skip its creation (self signed) if one is already present.

It needs to be created and signed using the root CA certificate and private key.

It should have one key “client.pem” to store both private key and public certificate.

The certificate’s CN field will be used as username during authentication.

Secret format:

apiVersion: v1
kind: Secret
metadata:
  name: koji-hub-admin-client-cert-secret
  namespace: default
  labels:
    app: koji-hub
data:
  client.pem: -|
    fillme

admin_username

The koji-hub admin username.

The username should match the CN field from the “admin_client_cert” certificate.

Usage

Upstream file can be found here

Create a file containing the following content (modify as needed):

apiVersion: apps.fedoraproject.org/v1alpha1
kind: MBKojiHub
metadata:
  name: example
  labels:
    app: mbox
spec:
  image: quay.io/fedora/koji-hub:latest
  replicas: 1
  persistent: true
  host: koji-hub
  configmap: koji-hub
  ca_cert_secret: koji-hub-ca-cert
  service_cert_secret: koji-hub-service-cert
  postgres_secret: postgres
  http_enabled: true
  https_enabled: true
  topic_prefix: mbox_dev
  fedora_messaging_url: amqps://koji@messaging.url
  messaging_cert_cm: koji-hub-msg
  ingress_backend: nginx

Run the following command to create a koji-hub resource:

kubectl apply -f koji-hub-cr.yaml

You can check its status by running:

kubectl get mbkojihub/example -o yaml