Contents
odoo安装
参考: https://artifacthub.io/packages/helm/bitnami/odoo
配置
新建一个命名空间,作为默认命名空间
kubectl create ns odoo
kubectl config set-context --current --namespace odoo
参考: https://artifacthub.io/packages/helm/bitnami/odoo
使用helm安装,使用bitnami的chart. 这里先下载下来解压看看。
helm pull oci://registry-1.docker.io/bitnamicharts/odoo --untar
复制一份默认的values.yaml配置文件, 打开副本,编辑,保留并编辑需要修改的配置项
root@jingmin-kube-archlinux odoo]# cp ./values.yaml my-override-values.yaml
[root@jingmin-kube-archlinux odoo]# vim my-override-values.yaml
[root@jingmin-kube-archlinux odoo]# cat my-override-values.yaml
[global:
storageClass: ""
## @section Common parameters
##
## @param clusterDomain Default Kubernetes cluster domain
##
clusterDomain: cluster.local
## @param extraDeploy Array of extra objects to deploy with the release
##
## @section Odoo Configuration parameters
## Odoo settings based on environment variables
## ref: https://github.com/bitnami/containers/tree/main/bitnami/odoo#environment-variables
##
## @param odooEmail Odoo user email
## ref: https://github.com/bitnami/containers/tree/main/bitnami/odoo#configuration
##
odooEmail: 784319947@qq.com
## @param odooPassword Odoo user password
## Defaults to a random 10-character alphanumeric string if not set
## ref: https://github.com/bitnami/containers/tree/main/bitnami/odoo#configuration
##
odooPassword: "Odoo12345"
## @param odooSkipInstall Skip Odoo installation wizard
##
odooSkipInstall: false
## @param loadDemoData Whether to load demo data for all modules during initialization
## ref: https://github.com/bitnami/containers/tree/main/bitnami/odoo#configuration
##
loadDemoData: true
## SMTP mail delivery configuration
## ref: https://github.com/bitnami/containers/tree/main/bitnami/odoo/#smtp-configuration
## @param smtpHost SMTP server host
## @param smtpPort SMTP server port
## @param smtpUser SMTP username
## @param smtpPassword SMTP user password
## @param smtpProtocol SMTP protocol
##
smtpHost: "smtp.qq.com"
smtpPort: "465"
smtpUser: "784319947@qq.com"
smtpPassword: "jgjfnjcfomgcbdaf"
smtpProtocol: ""
## @param allowEmptyPassword Allow the container to be started with blank passwords
##
allowEmptyPassword: false
## @section Odoo deployment parameters
##
## @param replicaCount Number of Odoo replicas to deploy
## NOTE: ReadWriteMany PVC(s) are required if replicaCount > 1
##
replicaCount: 1
## Odoo container ports
## @param containerPorts.http Odoo HTTP container port
##
containerPorts:
http: 8069
## @param affinity Affinity for pod assignment
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
##
affinity: {}
## @param nodeSelector Node labels for pod assignment
## ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
## @param tolerations Tolerations for pod assignment
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## @section Traffic Exposure Parameters
##
## Odoo service parameters
##
service:
## @param service.type Odoo service type
##
type: LoadBalancer
## @param service.ports.http Odoo service HTTP port
##
ports:
http: 80
## @param service.nodePorts.http NodePort for the Odoo HTTP endpoint
## NOTE: choose port between <30000-32767>
##
nodePorts:
http: ""
## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin
## Values: ClientIP or None
## ref: https://kubernetes.io/docs/user-guide/services/
##
sessionAffinity: None
## Configure the ingress resource that allows you to access the Odoo installation
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
##
ingress:
## @param ingress.enabled Enable ingress record generation for Odoo
##
enabled: true
## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
##
ingressClassName: "nginx"
## @param ingress.pathType Ingress path type
##
pathType: ImplementationSpecific
## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)
##
apiVersion: ""
## @param ingress.hostname Default host for the ingress record
##
hostname: odoo.ole12138.cn
## @param ingress.path Default path for the ingress record
## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers
##
path: /
## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
## Use this parameter to set the required annotations for cert-manager, see
## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
## e.g:
## annotations:
## kubernetes.io/ingress.class: nginx
## cert-manager.io/cluster-issuer: cluster-issuer-name
##
annotations: {}
## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter
## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname | trunc 63 | trimSuffix "-" }}`
## You can:
## - Use the `ingress.secrets` parameter to create this TLS secret
## - Rely on cert-manager to create it by setting the corresponding annotations
## - Rely on Helm to create self-signed certificates by setting `ingress.tls=true` and `ingress.certManager=false`
##
tls: true
## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
##
selfSigned: true
## @section Persistence Parameters
##
## Persistence Parameters
## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
## @param persistence.enabled Enable persistence using Persistent Volume Claims
##
enabled: true
## @section Database Parameters
## PostgreSQL chart configuration
## ref: https://github.com/bitnami/charts/blob/main/bitnami/postgresql/values.yaml
## @param postgresql.enabled Switch to enable or disable the PostgreSQL helm chart
## @param postgresql.auth.username Name for a custom user to create
## @param postgresql.auth.password Password for the custom user to create
## @param postgresql.auth.database Name for a custom database to create
## @param postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials
## @param postgresql.architecture PostgreSQL architecture (`standalone` or `replication`)
##
postgresql:
enabled: true
auth:
username: bn_odoo
password: ""
database: bitnami_odoo
existingSecret: ""
architecture: standalone
这里使用默认的storageclass.
设置默认的odoo密码
设置默认的odoo邮箱
设置邮箱服务器配置
开启ingress,开启tls
使用默认的postgresql数据库.
部署安装
部署安装
[root@jingmin-kube-archlinux odoo]# cd ..
[root@jingmin-kube-archlinux k8s]# helm install odoo -f ./odoo/my-override-values.yaml ./odoo/
coalesce.go:223: warning: destination for postgresql.networkPolicy.egressRules.customRules is a table. Ignoring non-table value ([])
NAME: odoo
LAST DEPLOYED: Sat Sep 9 13:54:51 2023
NAMESPACE: odoo
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
CHART NAME: odoo
CHART VERSION: 23.3.2
APP VERSION: 16.0.20230815
** Please be patient while the chart is being deployed **
1. Get the Odoo URL indicated on the Ingress Rule and associate it to your cluster external IP:
export CLUSTER_IP=$(minikube ip) # On Minikube. Use: `kubectl cluster-info` on others K8s clusters
export HOSTNAME=$(kubectl get ingress --namespace odoo odoo -o jsonpath='{.spec.rules[0].host}')
echo "Odoo URL: http://$HOSTNAME/"
echo "$CLUSTER_IP $HOSTNAME" | sudo tee -a /etc/hosts
2. Obtain the login credentials
export ODOO_EMAIL=784319947@qq.com
export ODOO_PASSWORD=$(kubectl get secret --namespace "odoo" odoo -o jsonpath="{.data.odoo-password}" | base64 -d)
echo Email : $ODOO_EMAIL
echo Password: $ODOO_PASSWORD
这里提示了一些查看帐号密码的信息.
去域名服务商那里,更新下 odoo.ole1213.cn
的dns指向.我这里有一层代理,与本文无关(略)
配tls证书
先配下cert-manager的issuer,用于提供证书, 使用由Let’s Encrypt颁发的证书。
之前章节配好了cert-manager,在当前命名空间下还是建一下staging和production环境的issuer (由Let’s Encrypt提供服务)
修改其中的邮箱部分,用于创建账号,以及将来有证书将要过期相关的内容会发到对应的邮箱
[root@jingmin-kube-archlinux odoo]# vim staging-issuer.yaml
[root@jingmin-kube-archlinux odoo]# cat staging-issuer.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-staging
spec:
acme:
# The ACME server URL
server: https://acme-staging-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: 784319947@qq.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-staging
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
ingressClassName: nginx
部署staging-issuer
kubectl create -f ./staging-issuer.yaml
类似的方式,创建production-issuer
wget https://raw.githubusercontent.com/cert-manager/website/master/content/docs/tutorials/acme/example/production-issuer.yaml
同样,修改其中的邮箱为自己的邮箱
[root@jingmin-kube-archlinux odoo]# vim production-issuer.yaml
[root@jingmin-kube-archlinux odoo]# cat production-issuer.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: letsencrypt-prod
spec:
acme:
# The ACME server URL
server: https://acme-v02.api.letsencrypt.org/directory
# Email address used for ACME registration
email: 784319947@qq.com
# Name of a secret used to store the ACME account private key
privateKeySecretRef:
name: letsencrypt-prod
# Enable the HTTP-01 challenge provider
solvers:
- http01:
ingress:
ingressClassName: nginx
部署到当前命名空间中
kubectl create -f ./production-issuer.yaml
这两个issuer都通过http01的方式向Let’s Encrypt 发出challenge.
kubectl describe issuer
可以看到description中都有一条Message: The ACME account was registered with the ACME server
向ingress中,
添加cert-manager的issuer注解cert-manager.io/issuer: letsencrypt-staging
,
以及添加tls的hosts和secretsName部分(secretsName名称随便起,cert-manager会自动生成)
[root@jingmin-kube-archlinux k8s]# kubectl edit ingress odoo
[root@jingmin-kube-archlinux k8s]# kubectl get ingress odoo -o yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/issuer: letsencrypt-staging
meta.helm.sh/release-name: odoo
meta.helm.sh/release-namespace: odoo
creationTimestamp: "2023-09-09T05:54:53Z"
generation: 2
labels:
app.kubernetes.io/instance: odoo
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: odoo
helm.sh/chart: odoo-23.3.2
name: odoo
namespace: odoo
resourceVersion: "3643309"
uid: 1b7c4db0-8ac6-4198-b925-04c56140ba87
spec:
ingressClassName: nginx
rules:
- host: odoo.ole12138.cn
http:
paths:
- backend:
service:
name: odoo
port:
name: http
path: /
pathType: ImplementationSpecific
tls:
- hosts:
- odoo.ole12138.cn
secretName: odoo.ole12138.cn-tls
status:
loadBalancer:
ingress:
- ip: 192.168.1.100
在浏览器中,使用https访问ingress地址https://nexus.ole12138.cn/
, 会有提示警告,看下证书,以及颁发者(虽然是提示无效,但不是k8s或odoo提供默认的fake证书,那就是Let’s Encrypt提供的staging证书)。
现在再修改一下ingress中annotations中的issuer,切换为production环境的issuer。注意其中一行: cert-manager.io/issuer: letsencrypt-prod
[root@jingmin-kube-archlinux k8s]# kubectl edit ingress odoo
ingress.networking.k8s.io/odoo edited
[root@jingmin-kube-archlinux k8s]# kubectl get ingress odoo -o yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/issuer: letsencrypt-prod
meta.helm.sh/release-name: odoo
meta.helm.sh/release-namespace: odoo
creationTimestamp: "2023-09-09T05:54:53Z"
generation: 2
labels:
app.kubernetes.io/instance: odoo
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: odoo
helm.sh/chart: odoo-23.3.2
name: odoo
namespace: odoo
resourceVersion: "3643705"
uid: 1b7c4db0-8ac6-4198-b925-04c56140ba87
spec:
ingressClassName: nginx
rules:
- host: odoo.ole12138.cn
http:
paths:
- backend:
service:
name: odoo
port:
name: http
path: /
pathType: ImplementationSpecific
tls:
- hosts:
- odoo.ole12138.cn
secretName: odoo.ole12138.cn-tls
status:
loadBalancer:
ingress:
- ip: 192.168.1.100
再次在浏览器中,以https方式,访问nacos的ingress地址https://nexus.ole12138.cn/
. 正常的话,可以直接访通,没有任何警告。 看下地址栏前面的锁头标志,点看看下证书,确认是Let’s Encrypt颁发的。
发表回复