跳到主内容

使用Helm尝试

提示

Don't want to run it yourself? Casdoor Cloud gives you a dedicated Casdoor instance that we host and keep upgraded for you, from $25/month with no per-user fees.

本页面介绍如何使用Helm在Kubernetes上部署Casdoor。

先决条件​

  • 运行中的Kubernetes集群（1.19+）
  • Helm v3.8+

安装​

步骤1：安装Casdoor图表​

Install the Casdoor Helm chart (Artifact Hub, source):

helm install casdoor oci://ghcr.io/casdoor/helm-charts/casdoor --version <version>

使用自定义值文件进行安装：

helm install casdoor oci://ghcr.io/casdoor/helm-charts/casdoor \
  --version <version> \
  -f my-values.yaml

步骤2：访问Casdoor​

安装完成后，使用集群提供的服务URL访问Casdoor。

定制​

Override values.yaml to customize the deployment. 关键参数：

参数描述默认值
replicaCount运行 Casdoor 应用的副本数量。1
image.repositoryCasdoor Docker 图像的仓库。casbin
image.nameCasdoor Docker 图像的名称。casdoor
image.pullPolicyCasdoor Docker 图像的拉取策略。IfNotPresent
image.tagCasdoor Docker 图像的标签。""
configCasdoor 应用的配置设置。See values.yaml
database.driver要使用的数据库驱动程序（mysql、postgres、cockroachdb、sqlite）。sqlite
database.user数据库用户名。""
database.password数据库密码。""
database.host数据库主机。""
database.port数据库端口。""
database.databaseNameCasdoor 使用的数据库名称。casdoor
database.sslMode数据库连接的 SSL 模式。disable
service.typeKubernetes服务类型（ClusterIP、NodePort、LoadBalancer）。ClusterIP
service.portCasdoor 服务的端口号。8000
ingress.enabled是否启用 Casdoor 的 Ingress。false
ingress.annotationsIngress 资源的注解。{}
ingress.hostsIngress 资源的主机名。[]
resourcesCasdoor 容器的资源请求和限制。{}
autoscaling.enabled是否启用 Casdoor 的水平 Pod 自动扩展。false
autoscaling.minReplicasHPA 的最小副本数。1
autoscaling.maxReplicasHPA 的最大副本数。100
autoscaling.targetCPUUtilizationPercentageHPA 的目标 CPU 利用率百分比。80
nodeSelectorPod 分配的节点标签。{}
tolerationsPod 分配的容忍标签。[]
affinityPod 分配的亲和性设置。{}
extraContainersEnabled是否启用额外的边车容器。false
extraContainers额外的边车容器。""
extraVolumeMountsCasdoor 容器的额外卷挂载。[]
extraVolumesCasdoor 容器的额外卷。[]
envFromSecret来自单个Secret密钥的环境变量。[]
envFromConfigmap来自单个ConfigMap密钥的环境变量。[]
envFrom来自整个 Secret 或 ConfigMap 的环境变量。[]

暴露 Casdoor​

选项 1：Ingress（经典）​

启用并配置 Ingress：

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: casdoor.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: casdoor-tls
      hosts:
        - casdoor.example.com

选项2：网关API（现代）​

Kubernetes 网关 API 是 Ingress 的下一代替代方案，自 Kubernetes 1.31 起已正式进入 GA 阶段。它由Istio、Envoy网关、Cilium、Kong、NGINX网关Fabric等支持。

提示

先决条件

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml

您还需要在集群中运行一个兼容的网关控制器。

附加到现有网关​

如果您集群中已有一个网关资源，请将HTTPRoute指向它：

gatewayApi:
  enabled: true
  parentRefs:
    - name: my-gateway
      namespace: gateway-system
      sectionName: https
  hostnames:
    - casdoor.example.com

创建一个新的网关（例如使用Istio）​

让图表同时创建网关和HTTPRoute：

gatewayApi:
  enabled: true
  createGateway: true
  hostnames:
    - casdoor.example.com
  gateway:
    gatewayClassName: istio
    listeners:
      - name: http
        protocol: HTTP
        port: 80
        allowedRoutes:
          namespaces:
            from: Same

创建一个带有HTTP→HTTPS重定向的网关​

启用TLS终止和自动HTTP到HTTPS重定向：

gatewayApi:
  enabled: true
  createGateway: true
  hostnames:
    - casdoor.example.com
  gateway:
    gatewayClassName: istio
    listeners:
      - name: http
        protocol: HTTP
        port: 80
        allowedRoutes:
          namespaces:
            from: Same
      - name: https
        protocol: HTTPS
        port: 443
        tls:
          certificateRefs:
            - name: casdoor-tls
              kind: Secret
        allowedRoutes:
          namespaces:
            from: Same
  httpsRedirect:
    enabled: true

网关API参数​

参数描述默认值
gatewayApi.enabled启用HTTPRoute创建false
gatewayApi.createGateway同时创建一个 Gateway 资源false
gatewayApi.annotationsHTTPRoute 的注解{}
gatewayApi.labelsHTTPRoute 的额外标签{}
gatewayApi.parentRefs父网关引用[]
gatewayApi.hostnames要匹配的主机名（Host标头）[]
gatewayApi.rules路由规则（匹配、过滤器、后端引用）路径前缀 /
gatewayApi.gateway.name网关名称（默认为图表全名）""
gatewayApi.gateway.gatewayClassName网关类名称（当createGateway=true时必填）""
gatewayApi.gateway.listeners网关监听器HTTP:80
gatewayApi.httpsRedirect.enabled启用HTTP→HTTPS重定向HTTPRoutefalse
gatewayApi.httpsRedirect.statusCode重定向响应码301
gatewayApi.httpsRedirect.hostnames重定向路由的主机名[]
gatewayApi.httpsRedirect.parentRefs覆盖重定向路由的 parentRefs[]

Declarative configuration​

Organizations, applications, users, providers, roles and permissions can live in the values file next to the rest of the deployment. Casdoor applies them at startup and checks them for changes every 30 seconds, so a helm upgrade that changes them takes effect without restarting the pods:

initData:
  enabled: true
  data:
    organizations:
      - owner: admin
        name: acme
        displayName: Acme
        passwordType: bcrypt
    applications:
      - owner: admin
        name: app-acme
        organization: acme
        displayName: Acme Portal
        redirectUris:
          - https://portal.acme.example.com/callback

An existing object only gets the fields written here; its other fields keep the values edited in the web UI. The data is stored in a Secret; to keep it out of the values file, create the Secret yourself and set initData.existingSecret.

ParameterDescriptionDefault
initData.enabledApply initData.data (or initData.existingSecret)false
initData.mergeUpdate existing objects with the given fields only; when false, they are deleted and re-created on every applytrue
initData.watchIntervalSeconds between the checks for changes, 0 applies the data only at startup30
initData.existingSecretExisting Secret holding the data, instead of initData.data""
initData.existingSecretKeyKey of the file in existingSecret, .yaml/.yml keys are read as YAMLinit_data.yaml
initData.dataThe objects to apply, in the init data format{}

管理部署​

升级：

helm upgrade casdoor oci://ghcr.io/casdoor/helm-charts/casdoor --version <version>

Charts up to 4.15.0 were published as oci://registry-1.docker.io/casbin/casdoor-helm-charts, which still receives every release. To move an existing release to the new chart, run the helm upgrade command above; resource names stay the same.

卸载：

helm uninstall casdoor

更多选项，请参阅 Helm 和 Kubernetes 文档。