Skip to main content
Version: v0.5

High Availability Installation

If you intend to run Walrus in production, you need to follow the high-avaialbility installation.

Prerequisites:

  • An highly-available Kubernetes cluster is required as the runtime cluster.
  • Kubernetes cluster supports Ingress.
  • Each Kubernetes node should have at least 4 CPU cores and 8GiB memory.
  • At least 50GB of free disk space on each Kubernetes node.
  • Ports 80 and 443 are opened on the nodes.

You can fill in the following YAML with relevant information and use the kubectl apply command to complete the high availability deployment.

  1. Create the Walrus deployment YAML:
vim walrus.yaml
  1. Fill in the following YAML:
---
apiVersion: v1
kind: Namespace
metadata:
name: walrus-system
labels:
"app.kubernetes.io/part-of": "walrus"
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "entrance"
spec:
defaultBackend:
service:
name: walrus
port:
number: 80
---
apiVersion: v1
kind: Secret
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "configuration"
stringData:
local_environment_mode: "disabled"
enable_tls: "false"
db_driver: "postgres"
db_user: "root"
db_password: "Root123"
db_name: "walrus"
---


# Database
#
---
apiVersion: v1
kind: ConfigMap
metadata:
namespace: walrus-system
name: database-script
data:
"init.sh": |
#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

if [[ ! -d ${PGDATA} ]]; then
mkdir -p ${PGDATA}
chown 999:999 ${PGDATA}
fi

"probe.sh": |
#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

psql --no-password --username=${POSTGRES_USER} --dbname=${POSTGRES_DB} --command="SELECT 1"

---
apiVersion: v1
kind: Service
metadata:
namespace: walrus-system
name: database
spec:
selector:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "database"
ports:
- name: conn
port: 5432
targetPort: conn
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
namespace: walrus-system
name: database
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "database"
spec:
# When a PVC does not specify a storageClassName,
# the default StorageClass is used.
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: walrus-system
name: database
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "database"
"app.kubernetes.io/name": "postgres"
spec:
strategy:
type: Recreate
replicas: 1
selector:
matchLabels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "database"
"app.kubernetes.io/name": "postgres"
template:
metadata:
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "database"
"app.kubernetes.io/name": "postgres"
spec:
automountServiceAccountToken: false
restartPolicy: Always
initContainers:
- name: init
image: postgres:14.8
imagePullPolicy: IfNotPresent
command:
- /script/init.sh
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: script
mountPath: /script
- name: data
mountPath: /var/lib/postgresql/data
containers:
- name: postgres
image: postgres:14.8
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: '4'
memory: '8Gi'
requests:
cpu: '500m'
memory: '512Mi'
securityContext:
runAsUser: 999
ports:
- name: conn
containerPort: 5432
env:
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: walrus
key: db_user
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: walrus
key: db_password
- name: POSTGRES_DB
valueFrom:
secretKeyRef:
name: walrus
key: db_name
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
startupProbe:
failureThreshold: 10
periodSeconds: 5
exec:
command:
- /script/probe.sh
readinessProbe:
failureThreshold: 3
timeoutSeconds: 5
periodSeconds: 5
exec:
command:
- /script/probe.sh
livenessProbe:
failureThreshold: 3
timeoutSeconds: 5
periodSeconds: 10
exec:
command:
- /script/probe.sh
volumeMounts:
- name: script
mountPath: /script
- name: data
mountPath: /var/lib/postgresql/data
volumes:
- name: script
configMap:
name: database-script
defaultMode: 0555
- name: data
persistentVolumeClaim:
claimName: database
---


# Identity Access Manager
#
---
apiVersion: v1
kind: ConfigMap
metadata:
namespace: walrus-system
name: identity-access-manager-script
data:
"init.sh": |
#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

# validate database
set +o errexit
while true; do
if psql --command="SELECT 1" "${DB_SOURCE}" >/dev/null 2>&1; then
break
fi
echo "waiting db to be ready ..."
sleep 2s
done
set -o errexit

# mutate app configuration
cp -f /conf/app.conf app.conf
sed -i '/^tableNamePrefix =.*/d' app.conf
echo "tableNamePrefix = casdoor_" >>app.conf
sed -i '/^driverName =.*/d' app.conf
echo "driverName = \"${DB_DRIVER}\"" >>app.conf
sed -i '/^dataSourceName =.*/d' app.conf
echo "dataSourceName = \"${DB_SOURCE}\"" >>app.conf
sed -i '/^sessionConfig =.*/d' app.conf
echo 'sessionConfig = {"enableSetCookie":true,"cookieName":"casdoor_session_id","cookieLifeTime":3600,"providerConfig":"/var/run/casdoor","gclifetime":3600,"domain":"","secure":false,"disableHTTPOnly":false}' >>app.conf
sed "s#${DB_PASSWORD}#***#g" app.conf

---
apiVersion: v1
kind: Service
metadata:
namespace: walrus-system
name: identity-access-manager
spec:
selector:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "identity-access-manager"
ports:
- name: http
port: 8000
targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: walrus-system
name: identity-access-manager
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "identity-access-manager"
"app.kubernetes.io/name": "casdoor"
spec:
replicas: 1
selector:
matchLabels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "identity-access-manager"
"app.kubernetes.io/name": "casdoor"
template:
metadata:
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "identity-access-manager"
"app.kubernetes.io/name": "casdoor"
spec:
automountServiceAccountToken: false
restartPolicy: Always
initContainers:
- name: init
image: sealio/casdoor:v1.344.0-seal.1
imagePullPolicy: IfNotPresent
workingDir: /tmp/conf
command:
- /script/init.sh
env:
- name: DB_DRIVER
valueFrom:
secretKeyRef:
name: walrus
key: db_driver
- name: DB_USER
valueFrom:
secretKeyRef:
name: walrus
key: db_user
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: walrus
key: db_password
- name: DB_NAME
valueFrom:
secretKeyRef:
name: walrus
key: db_name
- name: DB_SOURCE
value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD)@database:5432/$(DB_NAME)?sslmode=disable
volumeMounts:
- name: script
mountPath: /script
- name: config
mountPath: /tmp/conf
containers:
- name: casdoor
image: sealio/casdoor:v1.344.0-seal.1
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: '2'
memory: '4Gi'
requests:
cpu: '500m'
memory: '512Mi'
workingDir: /
command:
- /casdoor
- --createDatabase=true
ports:
- name: http
containerPort: 8000
startupProbe:
failureThreshold: 10
periodSeconds: 5

tcpSocket:
port: 8000
readinessProbe:
failureThreshold: 3
timeoutSeconds: 5
periodSeconds: 5
tcpSocket:
port: 8000
livenessProbe:
failureThreshold: 3
timeoutSeconds: 5
periodSeconds: 10
tcpSocket:
port: 8000
volumeMounts:
- name: config
mountPath: /conf
- name: data
mountPath: /var/run/casdoor
volumes:
- name: script
configMap:
name: identity-access-manager-script
defaultMode: 0500
- name: config
emptyDir: { }
- name: data
emptyDir: { }
---


# Walrus server
#
## RBAC for installing third-party applications.
##
## Since the installation of some third-party software has permission granting operations,
## it will contain some resource global operation permissions, but only for granting.
##
---
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
rules:
- apiGroups:
- "apiextensions.k8s.io"
resources:
- "customresourcedefinitions"
verbs:
- create
- update
- get
- list
- patch
- apiGroups:
- "rbac.authorization.k8s.io"
resources:
- "clusterroles"
- "clusterrolebindings"
- "roles"
- "rolebindings"
- "serviceaccounts"
verbs:
- create
- update
- get
- list
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus
namespace: walrus-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: walrus
## RBAC for launching Walrus.
##
## As limiting in the walrus-system, it can be safe to make all verbs as "*".
##
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
rules:
- apiGroups:
- "authorization.k8s.io"
resources:
- "subjectaccessreviews"
- "selfsubjectaccessreviews"
verbs:
- "*"
- apiGroups:
- "coordination.k8s.io"
resources:
- "leases"
verbs:
- "*"
- apiGroups:
- "apps"
resources:
- "statefulsets"
- "deployments"
- "replicasets"
verbs:
- "*"
- apiGroups:
- "batch"
resources:
- "jobs"
verbs:
- "*"
- apiGroups:
- ""
resources:
- "persistentvolumeclaims"
- "persistentvolumeclaims/finalizers"
- "secrets"
- "pods"
- "pods/log"
- "events"
- "services"
- "configmaps"
- "serviceaccounts"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: walrus
## RBAC for enabling workflow
##
## As limiting in the walrus-system, it can be safe to make all verbs as "*".
##
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: walrus-system
name: walrus-enable-workflow
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
rules:
- apiGroups:
- argoproj.io
resources:
- "*"
verbs:
- "*"
- apiGroups:
- ""
resources:
- "persistentvolumeclaims"
- "persistentvolumeclaims/finalizers"
verbs:
- "*"
- apiGroups:
- ""
resources:
- "pods/exec"
verbs:
- "*"
- apiGroups:
- "policy"
resources:
- "poddisruptionbudgets"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: walrus-system
name: walrus-enable-workflow
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: walrus-enable-workflow
## RBAC for deploying
##
## As limiting in the walrus-system, it can be safe to make all verbs as "*".
##
---
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: walrus-system
name: walrus-deployer
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: walrus-system
name: walrus-deployer
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
rules:
- apiGroups:
- "batch"
resources:
- "jobs"
verbs:
- "*"
- apiGroups:
- ""
resources:
- "secrets"
- "pods"
- "pods/log"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: walrus-system
name: walrus-deployer
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus-deployer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: walrus-deployer
## RBAC for running workflow
##
## As limiting in the walrus-system, it can be safe to make all verbs as "*".
##
---
apiVersion: v1
kind: ServiceAccount
metadata:
namespace: walrus-system
name: walrus-workflow
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: walrus-system
name: walrus-workflow
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
rules:
- apiGroups:
- ""
resources:
- "pods"
- "pods/logs"
- "secrets"
verbs:
- "*"
- apiGroups:
- "argoproj.io"
resources:
- "*"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: walrus-system
name: walrus-workflow
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus-workflow
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: walrus-workflow
## Storage
##
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
spec:
# When a PVC does not specify a storageClassName,
# the default StorageClass is used.
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 500Mi
## Service
##
---
apiVersion: v1
kind: Service
metadata:
namespace: walrus-system
name: walrus
spec:
selector:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
sessionAffinity: ClientIP
ports:
- name: http
port: 80
targetPort: http
## Deployment
##
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
"app.kubernetes.io/name": "walrus-server"
spec:
replicas: 1
selector:
matchLabels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
"app.kubernetes.io/name": "walrus-server"
template:
metadata:
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
"app.kubernetes.io/name": "walrus-server"
spec:
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
topologyKey: "kubernetes.io/hostname"
labelSelector:
matchExpressions:
- key: "app.kubernetes.io/component"
operator: In
values:
- "walrus"
- key: "app.kubernetes.io/part-of"
operator: In
values:
- "walrus"
- key: "app.kubernetes.io/name"
operator: In
values:
- "walrus-server"
restartPolicy: Always
serviceAccountName: walrus
containers:
- name: walrus-server
image: sealio/walrus:v0.5.1
imagePullPolicy: Always
resources:
limits:
cpu: '4'
memory: '8Gi'
requests:
cpu: '500m'
memory: '512Mi'
env:
- name: DB_DRIVER
valueFrom:
secretKeyRef:
name: walrus
key: db_driver
- name: DB_USER
valueFrom:
secretKeyRef:
name: walrus
key: db_user
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: walrus
key: db_password
- name: DB_NAME
valueFrom:
secretKeyRef:
name: walrus
key: db_name
- name: SERVER_SETTING_LOCAL_ENVIRONMENT_MODE
valueFrom:
secretKeyRef:
name: walrus
key: local_environment_mode
- name: SERVER_ENABLE_TLS
valueFrom:
secretKeyRef:
name: walrus
key: enable_tls
- name: SERVER_DATA_SOURCE_ADDRESS
value: $(DB_DRIVER)://$(DB_USER):$(DB_PASSWORD)@database:5432/$(DB_NAME)?sslmode=disable
- name: SERVER_CASDOOR_SERVER
value: http://identity-access-manager:8000
ports:
- name: http
containerPort: 80
- name: https
containerPort: 443
startupProbe:
failureThreshold: 10
periodSeconds: 5
httpGet:
port: 80
path: /readyz
readinessProbe:
failureThreshold: 3
timeoutSeconds: 5
periodSeconds: 5
httpGet:
port: 80
path: /readyz
livenessProbe:
failureThreshold: 10
timeoutSeconds: 5
periodSeconds: 10
httpGet:
httpHeaders:
- name: "User-Agent"
value: ""
port: 80
path: /livez
volumeMounts:
- name: custom-tls
mountPath: /etc/walrus/ssl
- name: data
mountPath: /var/run/walrus
volumes:
- name: custom-tls
secret:
secretName: walrus-custom-tls
optional: true
- name: data
persistentVolumeClaim:
claimName: walrus

After using the above YAML for high-availability deployment, Walrus will not create a local Environment under the default Project, nor will the Kubernetes cluster where Walrus is deployed be used as a local Kubernetes Connector.

If you want to deploy Walrus' Kubernetes cluster as a local Kubernetes Connector after high-availability deployment, that is, allow Walrus to manage the cluster, you need to make the following modifications.

 apiVersion: v1
kind: Secret
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "configuration"
stringData:
- local_environment_mode: "disabled"
+ local_environment_mode: "kubernetes"
enable_tls: "false"
db_driver: "postgres"
db_user: "root"
db_password: "Root123"
db_name: "walrus"
 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
subjects:
- kind: ServiceAccount
name: walrus
namespace: walrus-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
- name: walrus
+ name: cluster-admin
  1. Apply the YAML:
kubectl apply -f walrus.yaml

Configuring TLS

Default method, using TLS termination

TLS termination is usually performed by a reverse proxy service, that is, the Ingress Service of the cluster provides the TLS service.

Note:

  • The reverse proxy service can use HTTP requests to Walrus, and you should set Walrus's session cookie walrus_session to Secure: true to prevent man-in-the-middle attacks.

Using a Self-Signed Certificate

Walrus can issue a self-signed HTTPS certificate for test purposes.

  1. Use kubectl apply to add a NodePort type Service.
cat <<EOF | kubectl apply -f -

---
apiVersion: v1
kind: Service
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "entrance"
spec:
selector:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
sessionAffinity: ClientIP
type: NodePort
ports:
- name: http
port: 80
targetPort: http
- name: https
port: 443
targetPort: https

EOF
  1. Use kubectl patch to modify the TLS option in Secret.
kubectl -n walrus-system patch secret walrus --type='json' -p='[{"op":"replace","path":"/data/enable_tls","value":"dHJ1ZQ=="}]'
  1. Use kubectl delete to delete Ingress.
kubectl -n walrus-system delete ingress walrus
  1. Use kubectl rollout to restart Walrus.

Note:

  • After changing the access method, you need to adjust the "Server Address" in "System Settings".
kubectl -n walrus-system rollout restart deployment/walrus
  1. Due to lack of the access pointer provided by Ingress, it can be accessed by kubectl's port-forward.
sudo kubectl -n walrus-system port-forward service/walrus 443:443

Use ACME to Generate Trusted Certificate

Note:

  • If the cluster can perform ACME challenges at the Ingress Controller level via CertManager, please refer to "Using TLS Termination".

You can use Let's Encrypt to issue a 90-day HTTPS certificate. The renewal of this certificate is performed by Walrus automatically.

Prerequisites:

  • The cluster should support the LoadBalancer type of Service.
  • Provide a domain name, for example, walrus.mydomain.com.
  1. Use kubectl apply to add a LoadBalancer type of Service.
cat <<EOF | kubectl apply -f -

---
apiVersion: v1
kind: Service
metadata:
namespace: walrus-system
name: walrus
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "entrance"
spec:
selector:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "walrus"
sessionAffinity: ClientIP
type: LoadBalancer
ports:
- name: http
port: 80
targetPort: http
- name: https
port: 443
targetPort: https

EOF
  1. Use the kubectl get command to wait for the LoadBalancer type of service to get an Ingress IP.
until [[ -n $(kubectl -n walrus-system get service walrus --template="{{range .status.loadBalancer.ingress}}{{.ip}}{{end}}") ]]; do :; done && \
kubectl get service walrus -o=jsonpath='{.status.loadBalancer.ingress[0].ip}'

  1. On the DNS configuration panel, add the above A Record pointing to the output IP address.

  2. Use kubectl patch to modify the TLS option in Secret.

kubectl -n walrus-system patch secret walrus --type='json' -p='[{"op":"replace","path":"/data/enable_tls","value":"dHJ1ZQ=="}]'
  1. Use kubectl delete to delete Ingress.
kubectl -n walrus-system delete ingress walrus
  1. Use kubectl patch to modify the environment variables of Walrus to respond to the ACME challenge.

Note:

  • After changing the access method, you need to adjust the "Server Address" in "System Settings".
export DNS_NAME=""; kubectl -n walrus-system patch deployment walrus --type json -p "[{\"op\":\"add\",\"path\":\"/spec/template/spec/containers/0/env/-\",\"value\":{\"name\":\"SERVER_TLS_AUTO_CERT_DOMAINS\",\"value\":\"${DNS_NAME}\"}}]"

Using a Custom Certificate

A custom certificate is an HTTPS certificate issued by a certificate authority.

Prerequisites:

  • Get the content of the HTTPS service private key PEM file, note it as PRIVATE_KEY_FILE_CONTENT.
  • Get the content of the HTTPS service certificate (chain) PEM file, note it as CERT_FILE_CONTENT.
  • If there is a (non-publicly trusted) CA certificate, get the corresponding PEM file content and concatenate it to CERT_FILE_CONTENT.
  1. Use the kubectl apply command to add a Secret with custom certificate content.
export PRIVATE_KEY_FILE_CONTENT=""; export CERT_FILE_CONTENT=""; cat <<EOF | kubectl apply -f -

---
apiVersion: v1
kind: Secret
metadata:
namespace: walrus-system
name: walrus-custom-tls
labels:
"app.kubernetes.io/part-of": "walrus"
"app.kubernetes.io/component": "configuration"
type: kubernetes.io/tls
stringData:
"tls.crt": "\${CERT_FILE_CONTENT}"
"tls.key": "\${PRIVATE_KEY_FILE_CONTENT}"

EOF
  1. Use kubectl patch to modify the TLS option in Secret.
kubectl -n walrus-system patch secret walrus --type='json' -p='[{"op":"replace","path":"/data/enable_tls","value":"dHJ1ZQ=="}]'
  1. Use kubectl delete to delete Ingress.
kubectl -n walrus-system delete ingress walrus
  1. Use kubectl patch to modify the environment variables of Walrus to enable the custom certificate.

Note:

  • After changing the access method, you need to adjust the "Server Address" in "System Settings".
kubectl -n walrus-system patch deployment walrus --type json \
-p '[{"op":"add","path":"/spec/template/spec/containers/0/env/-","value":{"name":"SERVER_TLS_CERT_FILE","value":"/etc/walrus/ssl/tls.crt"}},{"op":"add","path":"/spec/template/spec/containers/0/env/-","value":{"name":"SERVER_TLS_PRIVATE_KEY_FILE","value":"/etc/walrus/ssl/tls.key"}}]'

Configuring the Database

Walrus relies on PostgreSQL relational database for data storage.

By default, Walrus will run an instance of PostgresSQL within the running container, which is can lead to potential data loss. In an HA install, users must provide an external PostgreSQL instance.

Note:

  • The following commands override previous variables by repeatedly adding duplicate environment variables, which may receive a warning from Kubernetes.
  1. Use kubectl patch to modify the environment variables of IdentifyAccessManager to connect to the external data source.
# use add operation to override existing env.
export DB_SOURCE=""; kubectl -n walrus-system patch deployment identity-access-manager --type json \
-p "[{\"op\":\"add\",\"path\":\"/spec/template/spec/initContainers/0/env/-\",\"value\":{\"name\":\"DB_SOURCE\",\"value\":\"${DB_SOURCE}\"}}]"
  1. Use kubectl patch to modify the environment variables of Walrus to connect to the external data source.
# use add operation to override existing env.
export DB_SOURCE=""; kubectl -n walrus-system patch deployment walrus --type json \
-p "[{\"op\":\"add\",\"path\":\"/spec/template/spec/containers/0/env/-\",\"value\":{\"name\":\"SERVER_DATA_SOURCE_ADDRESS\",\"value\":\"${DB_SOURCE}\"}}]"