Helm chart
The Helm chart deploys Cockpit.
It does not deploy PostgreSQL, the OIDC provider or Trino.
The chart is published to oci.stackable.tech/sdp-charts/cockpit and quay.io/stackable/sdp-charts/cockpit.
Each chart pulls the image from the registry it comes from.
The chart README lists all values.
$ helm install cockpit oci://oci.stackable.tech/sdp-charts/cockpit --version 0.0.0-dev --values cockpit-values.yamlTo install from quay.io instead:
$ helm install cockpit oci://quay.io/stackable/sdp-charts/cockpit --version 0.0.0-dev --values cockpit-values.yamlIngress and reverse proxy
Cockpit must be served over HTTPS, because session cookies and credentials such as S3 keys pass through the browser connection.
Cockpit itself serves plain HTTP, so terminate TLS at the Ingress or reverse proxy and use https:// URLs for origin and auth.baseUrl.
|
The chart creates a ClusterIP Service on port 3000 and can create an Ingress with the ingress values.
Cockpit must be served at the root path / of its host, for example https://cockpit.example.com/.
Other base paths such as https://example.com/cockpit/ are not supported, so do not route a path prefix to Cockpit or rewrite paths in the Ingress or reverse proxy.
Set origin to the URL users open in the browser.
Behind a reverse proxy, also set the forwarded headers Cockpit trusts:
origin: https://cockpit.example.com
proxy:
protocolHeader: x-forwarded-proto
hostHeader: x-forwarded-hostResponse header size
Pages send a Link header that preloads their JavaScript and CSS.
It grows with the number of files a page loads and exceeds 4 KB on some pages.
Proxies with a smaller header buffer answer these pages with 502 Bad Gateway, for example ingress-nginx and nginx with their default 4k buffer.
Raise the buffer to 16 KB:
ingress:
enabled: true
className: nginx
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"For plain nginx, set proxy_buffer_size 16k; and proxy_busy_buffers_size 16k;.
CA certificates
For an OIDC provider or backends with a private CA, add its CA certificate from a SecretClass or a mounted file:
tls:
secretClasses:
- tls (1)
caCerts:
- /stackable/database-ca/ca.crt (2)
extraVolumes:
- name: database-ca
secret:
secretName: database-ca
extraVolumeMounts:
- name: database-ca
mountPath: /stackable/database-ca
readOnly: true| 1 | The Secret Operator mounts the CA certificate of the SecretClass. |
| 2 | A CA file mounted from a Secret. |
Cockpit trusts these CAs for all outgoing TLS connections, in addition to the public CAs bundled with Node.js. They are not tied to a service: a CA added for Trino is also trusted for the OIDC provider, PostgreSQL and S3. Only add CAs you trust for all of them.
Cockpit does not start if a CA file is missing or invalid.
Additional environment variables
To set environment variables directly, use extraEnv or extraEnvFrom:
extraEnv:
- name: LOG_LEVEL
value: debug