sheppy/opendesk
1
0
Fork 0
mirror of https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git synced 2025-12-07 16:01:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(univention-management-stack): Switch to Univention Keycloak

Browse Source
This commit is contained in:
Thorsten Roßner
2023-12-15 08:38:46 +01:00
parent 1b9f394489
commit 902076c629
53 changed files with 865 additions and 2386 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/ci.md
View File

@@ -7,11 +7,11 @@ SPDX-License-Identifier: Apache-2.0
This page will cover openDesk automation via Gitlab CI.
<!-- TOC -->
* [Deployment](#deployment)
* [Tests](#tests)
* [Deployment](#deployment)
* [Tests](#tests)
<!-- TOC -->
## Deployment
# Deployment
The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a Gitlab instance of your choice.
@@ -30,8 +30,7 @@ Based on your input, the following variables will be set:
You might want to set credential variables in the Gitlab project at `Settings` > `CI/CD` > `Variables`.
## Tests
# Tests
The gitlab-ci pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another gitlab project.
The `DEPLOY_`-variables are used to determine which components should be tested.

55
docs/components.md
View File

@@ -7,20 +7,20 @@ SPDX-License-Identifier: Apache-2.0
This section covers the internal system requirements as well as external service requirements for productive use.
<!-- TOC -->
* [Overview](#overview)
* [Component integration](#component-integration)
* [Intercom Service (ICS)](#intercom-service-ics)
* [Filepicker](#filepicker)
* [Central Navigation](#central-navigation)
* [(Read & write) Central contacts](#read--write-central-contacts)
* [OpenProject Filestore](#openproject-filestore)
* [Identity data flows](#identity-data-flows)
* [Provisioning](#provisioning)
* [Component specific documentation](#component-specific-documentation)
* [Links to component docs](#links-to-component-docs)
* [Overview](#overview)
* [Component integration](#component-integration)
* [Intercom Service (ICS)](#intercom-service-ics)
* [Filepicker](#filepicker)
* [Central Navigation](#central-navigation)
* [(Read \& write) Central contacts](#read--write-central-contacts)
* [OpenProject Filestore](#openproject-filestore)
* [Identity data flows](#identity-data-flows)
* [Provisioning](#provisioning)
* [Component specific documentation](#component-specific-documentation)
* [Links to component docs](#links-to-component-docs)
<!-- TOC -->
## Overview
# Overview
openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
@@ -38,7 +38,6 @@ they need to be replaced in production deployments.
| Element | Secure communications platform | Functional |
| Intercom Service | Cross service data exchange | Functional |
| Jitsi | Videoconferencing | Functional |
| Keycloak | Identity Provider | Functional |
| MariaDB | Database | Eval |
| Memcached | Cache Database | Eval |
| MinIO | Object Storage | Eval |
@@ -49,18 +48,17 @@ they need to be replaced in production deployments.
| Postfix | MTA | Eval |
| PostgreSQL | Database | Eval |
| Redis | Cache Database | Eval |
| Univention Corporate Server | Identity Management & Portal | Functional |
| Univention Management Stack | Identity Management & Portal | Eval |
| Univention Management Stack | Identity Management & Portal | Functional |
| XWiki | Knowledgebase | Functional |
## Component integration
# Component integration
Some use cases require inter component integration.
```mermaid
flowchart TD
OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
IntercomService-->|SilentLogin, TokenExchange|Keycloak
IntercomService-->|SilentLogin, TokenExchange|IdP
IntercomService-->|Filepicker|Nextcloud
IntercomService-->|CentralNavigation|Portal
OXAppSuiteBackend-->|Filepicker|Nextcloud
@@ -71,7 +69,7 @@ flowchart TD
OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
```
### Intercom Service (ICS)
## Intercom Service (ICS)
The UCS Intercom Service's role is to enable cross-application integration based on browser interaction.
Handling authentication when the frontend of an application is using the API from another application is often a
@@ -84,7 +82,7 @@ login.
Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
the ICS API.
### Filepicker
## Filepicker
The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
and saving attachments to Nextcloud.
@@ -94,34 +92,33 @@ Frontend-based integration means that OX AppSuite in the browser is communicatin
While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
when adding a file to an email or storing a file into Nextcloud.
### Central Navigation
## Central Navigation
Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
allow components to render the menu showing all available SWP applications for the user.
### (Read & write) Central contacts
## (Read & write) Central contacts
Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
available personal contact.
### OpenProject Filestore
## OpenProject Filestore
By default, Nextcloud is a configured option for storing attachments in OpenProject.
The Filestore can be enabled on a per-project level in OpenProject's project admin section.
## Identity data flows
# Identity data flows
An overview of
- components that consume the LDAP service. Mostly by using a dedicated LDAP search account.
- components using Keycloak as identity provider. If not otherwise denoted based on the OAuth2 / OIDC flows.
- components using Univention Keycloak as identity provider (IdP). If not otherwise denoted based on the OAuth2 / OIDC flows.
Some components trust others to handle authentication for them.
```mermaid
flowchart TD
K[Keycloak]-->L[LDAP]
K[IdP]-->L[LDAP]
N[Nextcloud]-->L
O[OpenProject] --> L
A[OX AppSuite]-->L
@@ -142,7 +139,7 @@ flowchart TD
F[Postfix]-->D
```
## Provisioning
# Provisioning
Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
@@ -153,7 +150,7 @@ deleting activities for the following objects to the OX AppSuite using the AppSu
- Functional Mailboxes
- Resources
## Component specific documentation
# Component specific documentation
We want to provide more information per component in separate, component-specific markdown file.
To establish a common view on the components, we are going to cover various aspects:
@@ -173,6 +170,6 @@ To establish a common view on the components, we are going to cover various aspe
- **Uninstall**: Documented and working complete uninstallation of the component.
- **Debugging**: Some helpful information when it comes to debugging a component, e.g. setting log level.
## Links to component docs
# Links to component docs
- [Intercom-Service](./components/intercom-service.md)

12
docs/external-services.md
View File

@@ -8,12 +8,12 @@ SPDX-License-Identifier: Apache-2.0
This document will cover the additional configuration to use external services like databases, caches or buckets.
<!-- TOC -->
* [Database](#database)
* [Objectstore](#objectstore)
* [Cache](#cache)
* [Database](#database)
* [Objectstore](#objectstore)
* [Cache](#cache)
<!-- TOC -->
## Database
# Database
When deploying this suite to production, you need to configure the applications to use your production grade database
service.
@@ -72,7 +72,7 @@ service.
| | | | Username | `databases.xwiki.username` | `xwiki_user` |
| | | | Password | `databases.xwiki.password` | |
## Objectstore
# Objectstore
When deploying this suite to production, you need to configure the applications to use your production grade objectstore
service.
@@ -89,7 +89,7 @@ service.
| | | Username | `objectstores.openproject.username` | `openproject_user` |
| | | Use IAM profile | `objectstores.openproject.useIAMProfile` | |
## Cache
# Cache
When deploying this suite to production, you need to configure the applications to use your production grade cache
service.

82
docs/getting-started.md
View File

@@ -8,38 +8,38 @@ SPDX-License-Identifier: Apache-2.0
This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
<!-- TOC -->
* [Requirements](#requirements)
* [Customize environment](#customize-environment)
* [Domain](#domain)
* [Requirements](#requirements)
* [Customize environment](#customize-environment)
* [Domain](#domain)
* [Apps](#apps)
* [Private Image registry](#private-image-registry)
* [Private Helm registry](#private-helm-registry)
* [Cluster capabilities](#cluster-capabilities)
* [Service](#service)
* [Networking](#networking)
* [Ingress](#ingress)
* [Container runtime](#container-runtime)
* [Volumes](#volumes)
* [Connectivity](#connectivity)
* [Mail/SMTP configuration](#mailsmtp-configuration)
* [TURN configuration](#turn-configuration)
* [Certificate issuer](#certificate-issuer)
* [Password seed](#password-seed)
* [Private Image registry](#private-image-registry)
* [Private Helm registry](#private-helm-registry)
* [Cluster capabilities](#cluster-capabilities)
* [Service](#service)
* [Networking](#networking)
* [Ingress](#ingress)
* [Container runtime](#container-runtime)
* [Volumes](#volumes)
* [Connectivity](#connectivity)
* [Mail/SMTP configuration](#mailsmtp-configuration)
* [TURN configuration](#turn-configuration)
* [Certificate issuer](#certificate-issuer)
* [Password seed](#password-seed)
* [Install](#install)
* [Install single app](#install-single-app)
* [Install single release/chart](#install-single-releasechart)
* [Access deployment](#access-deployment)
* [Uninstall](#uninstall)
* [Install single app](#install-single-app)
* [Install single release/chart](#install-single-releasechart)
* [Access deployment](#access-deployment)
* [Uninstall](#uninstall)
<!-- TOC -->
Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
deploy openDesk onto your kubernetes infrastructure.
## Requirements
# Requirements
Detailed system requirements are covered on [requirements](requirements.md) page.
## Customize environment
# Customize environment
Before deploying openDesk, you have to configure the deployment to suit your environment.
To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
@@ -50,7 +50,7 @@ files.
For the following guide, we will use `dev` as environment, where variables can be set in
`helmfile/environments/dev/values.yaml`.
### Domain
## Domain
The deployment is designed to deploy each app under a subdomains. For your convenience, we recommend to create a
`*.domain.tld` A-Record to your cluster ingress controller, otherwise you need to create an A-Record for each subdomain.
@@ -107,7 +107,6 @@ All available apps and their default value can be found in `helmfile/environment
| Element | `element.enabled` | `true` | Secure communications platform |
| Intercom Service | `intercom.enabled` | `true` | Cross service data exchange |
| Jitsi | `jitsi.enabled` | `true` | Videoconferencing |
| Keycloak | `keycloak.enabled` | `true` | Identity Provider |
| MariaDB | `mariadb.enabled` | `true` | Database |
| Memcached | `memcached.enabled` | `true` | Cache Database |
| MinIO | `minio.enabled` | `true` | Object Storage |
@@ -128,7 +127,7 @@ jitsi:
enabled: false
```
### Private Image registry
## Private Image registry
By default, all OCI artifacts are proxied via the project's image registry, which should get replaced soon by the
OCI registries provided by Open CoDE.
@@ -153,7 +152,7 @@ global:
- "external-registry"
```
### Private Helm registry
## Private Helm registry
Some apps use OCI style registry and some use Helm chart museum style registries.
In `helmfile/environments/default/charts.yaml` you can find all helm charts used and modify their registry, repository
@@ -180,10 +179,9 @@ The following environment variables have to be exposed when using the example:
| `OD_PRIVATE_HELM_REGISTRY_USERNAME` | Username |
| `OD_PRIVATE_HELM_REGISTRY_PASSWORD` | Password |
## Cluster capabilities
### Cluster capabilities
#### Service
### Service
Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
These apps create a Kubernetes service object.
@@ -196,7 +194,7 @@ cluster:
type: "NodePort"
```
#### Networking
### Networking
If your cluster has not the default `cluster.local` domain configured, you need to provide the domain via:
@@ -214,7 +212,7 @@ cluster:
cidr: "127.0.0.0/8"
```
#### Ingress
### Ingress
By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
setting:
@@ -224,7 +222,7 @@ ingress:
ingressClassName: "cilium"
```
#### Container runtime
### Container runtime
Some apps require specific configuration for container runtimes. You can set your container runtime like `cri-o`,
`containerd` or `docker` by:
@@ -235,7 +233,7 @@ cluster:
engine: "containerd"
```
#### Volumes
### Volumes
When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
@@ -255,9 +253,9 @@ persistence:
RWO: "my-read-write-once-class"
```
### Connectivity
## Connectivity
#### Mail/SMTP configuration
### Mail/SMTP configuration
To use the full potential of the openDesk, you need to set up an SMTP Smarthost/Relay which allows to send emails from
the whole subdomain.
@@ -269,7 +267,7 @@ smtp:
password: "secret"
```
#### TURN configuration
### TURN configuration
Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
these options:
@@ -286,7 +284,7 @@ turn:
port: "5349"
```
#### Certificate issuer
### Certificate issuer
As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
@@ -313,7 +311,7 @@ certificate:
wildcard: true
```
### Password seed
## Password seed
All secrets are generated from a single master password via Master Password (algorithm).
To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
@@ -337,7 +335,7 @@ helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
- `-l <label>`: Label selector
- `--suppress-diff`: Disable diff printing
### Install single app
## Install single app
You can also install or upgrade only a single app like Collabora, either by label selector:
@@ -352,7 +350,7 @@ cd helmfile/apps/collabora
helmfile apply -e dev -n <NAMESPACE>
```
### Install single release/chart
## Install single release/chart
Instead of iteration through all services, you can also deploy a single release like mariadb by:
@@ -360,7 +358,7 @@ Instead of iteration through all services, you can also deploy a single release
helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
```
## Access deployment
# Access deployment
When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
@@ -394,7 +392,7 @@ Now you can log in with obtained credentials:
| `default.user` | `40615..............................e9e2f` | Application user |
| `default.admin` | `bdbbb..............................04db6` | Administrator |
## Uninstall
# Uninstall
You can uninstall the deployment by:

25
docs/monitoring.md
View File

@@ -9,15 +9,15 @@ This document will cover how you can enable observability with Prometheus based
well as the overall status of monitoring integration.
<!-- TOC -->
* [Technology](#technology)
* [Defaults](#defaults)
* [Metrics](#metrics)
* [Alerts](#alerts)
* [Dashboards for Grafana](#dashboards-for-grafana)
* [Components](#components)
* [Technology](#technology)
* [Defaults](#defaults)
* [Metrics](#metrics)
* [Alerts](#alerts)
* [Dashboards for Grafana](#dashboards-for-grafana)
* [Components](#components)
<!-- TOC -->
## Technology
# Technology
We provide integration into the Prometheus based monitoring.
Together with
@@ -27,12 +27,12 @@ easily leverage the full potential of open-source cloud-native observability sta
Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
repository or prometheus operator.
## Defaults
# Defaults
All configurable options and their defaults can be found in
[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
## Metrics
# Metrics
To deploy podMonitor and serviceMonitor custom resources, enable it by:
@@ -44,7 +44,7 @@ prometheus:
enabled: true
```
## Alerts
# Alerts
Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
@@ -54,7 +54,7 @@ prometheus:
enabled: true
```
## Dashboards for Grafana
# Dashboards for Grafana
To deploy optional ConfigMaps with Grafana dashboards, enable it by:
@@ -64,7 +64,8 @@ grafana:
enabled: true
```
## Components
# Components
| Component | Metrics (pod- or serviceMonitor) | Alerts (prometheusRule) | Dashboard (Grafana) |
|:----------|-----------------------------------|-------------------------|---------------------|
| Collabora | :white_check_mark: | :white_check_mark: | :white_check_mark: |

42
docs/requirements.md
View File

@@ -7,17 +7,17 @@ SPDX-License-Identifier: Apache-2.0
This section covers the internal system requirements as well as external service requirements for productive use.
<!-- TOC -->
* [TL;DR;](#tldr)
* [Hardware](#hardware)
* [Kubernetes](#kubernetes)
* [Ingress controller](#ingress-controller)
* [Volume provisioner](#volume-provisioner)
* [Certificate management](#certificate-management)
* [External services](#external-services)
* [Deployment](#deployment)
* [TL;DR;](#tldr)
* [Hardware](#hardware)
* [Kubernetes](#kubernetes)
* [Ingress controller](#ingress-controller)
* [Volume provisioner](#volume-provisioner)
* [Certificate management](#certificate-management)
* [External services](#external-services)
* [Deployment](#deployment)
<!-- TOC -->
## TL;DR;
# TL;DR;
openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
- K8s cluster >= 1.24, [CNCF Certified Kubernetes Distro](https://www.cncf.io/certification/software-conformance/)
@@ -30,7 +30,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
- Certificate handling with [cert-manager](https://cert-manager.io/)
- [Istio](https://istio.io/) is currently required to deploy and operate OX AppSuite8
## Hardware
# Hardware
The following minimal requirements are thought for initial evaluation deployment:
@@ -40,7 +40,7 @@ The following minimal requirements are thought for initial evaluation deployment
| RAM | 16 GB, recommended 32 GB |
| Disk | HDD or SSD, >10 GB |
## Kubernetes
# Kubernetes
Any self-hosted or managed K8s cluster >= 1.24 listed in
[CNCF Certified Kubernetes Distros](https://www.cncf.io/certification/software-conformance/) should be supported.
@@ -49,7 +49,7 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
> **Note:** The deployment is not tested against OpenShift.
## Ingress controller
# Ingress controller
The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
configured ingress controller deployed.
@@ -63,14 +63,14 @@ configured ingress controller deployed.
When you want to use Open-Xchange Appsuite 8, you need to deploy and configure additionally [Istio](https://istio.io/)
## Volume provisioner
# Volume provisioner
Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
provisioner is sufficient.
> **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
## Certificate management
# Certificate management
This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
but a secret containing a valid TLS certificate is required.
@@ -78,16 +78,16 @@ but a secret containing a valid TLS certificate is required.
Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
openDesk certificate management disabled.
## External services
# External services
Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
| Group | Type | Version | Tested against |
|----------|---------------------|---------|-----------------------|
| Cache | Memached | `1.6.x` | Memached |
| | Redis | `7.x.x` | Redis |
| Database | MariaDB | `10.x` | MariaDB |
| Group | Type | Version | Tested against |
|----------|---------------------|---------|-----------------------|
| Cache | Memached | `1.6.x` | Memached |
| | Redis | `7.x.x` | Redis |
| Database | MariaDB | `10.x` | MariaDB |
| | PostgreSQL | `15.x` | PostgreSQL |
| Mail | Mail Transfer Agent | | Postfix |
| | PKI/CI (SMIME) | | |
@@ -97,7 +97,7 @@ Evaluation the openDesk deployment does not require any external service to star
| | Object Storage | | MinIO |
| Voice | TURN | | Coturn |
## Deployment
# Deployment
The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.

4
docs/scaling.md
View File

@@ -8,10 +8,10 @@ SPDX-License-Identifier: Apache-2.0
This document should cover the abilities to scale apps.
<!-- TOC -->
* [Replicas](#replicas)
* [Replicas](#replicas)
<!-- TOC -->
## Replicas
# Replicas
The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
apps with a check-mark in `Scaling (effective)` column.

17
docs/security.md
View File

@@ -8,12 +8,12 @@ SPDX-License-Identifier: Apache-2.0
This document should cover the current status of security measurements.
<!-- TOC -->
* [Helm Chart Trust Chain](#helm-chart-trust-chain)
* [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
* [NetworkPolicies](#networkpolicies)
* [Helm Chart Trust Chain](#helm-chart-trust-chain)
* [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
* [NetworkPolicies](#networkpolicies)
<!-- TOC -->
## Helm Chart Trust Chain
# Helm Chart Trust Chain
Helm Charts which are released via openDesk CI/CD process are always signed. The public GPG keys are present in
`pubkey.gpg` file and are validated during helmfile installation.
@@ -28,7 +28,6 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
| istio-resources-repo | yes | :white_check_mark: |
| jitsi-repo | yes | :white_check_mark: |
| keycloak-extensions-repo | no | :x: |
| keycloak-theme-repo | yes | :white_check_mark: |
| mariadb-repo | yes | :white_check_mark: |
| nextcloud-repo | no | :x: |
| opendesk-certificates-repo | yes | :white_check_mark: |
@@ -43,9 +42,11 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
| postfix-repo | yes | :white_check_mark: |
| postgresql-repo | yes | :white_check_mark: |
| ums-repo | no | :x: |
| univention-keycloak-repo | yes | :white_check_mark: |
| univention-keycloak-bootstrap-repo | yes | :white_check_mark: |
| xwiki-repo | no | :x: |
## Kubernetes Security Enforcements
# Kubernetes Security Enforcements
This list gives you an overview of default security settings and if they comply with security standards:
@@ -109,9 +110,9 @@ This list gives you an overview of default security settings and if they comply
| | umc-gateway | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
| | umc-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
| XWiki | xwiki | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 101 |
| | xwiki initContainers | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
| | xwiki initContainers | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
## NetworkPolicies
# NetworkPolicies
Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
When applied, they restrict the traffic to your services.

14
docs/theming.md
View File

@@ -8,13 +8,13 @@ SPDX-License-Identifier: Apache-2.0
This document will cover the theming and customization of your openDesk deployment.
<!-- TOC -->
* [Strings and texts](#strings-and-texts)
* [Colors](#colors)
* [Strings and texts](#strings-and-texts)
* [Colors](#colors)
* [Images and Logos](#images-and-logos)
* [Known limits](#known-limits)
* [Known limits](#known-limits)
<!-- TOC -->
## Strings and texts
# Strings and texts
The deployment name can be changed by:
@@ -24,7 +24,7 @@ theme:
productName: "openDesk Cloud"
```
## Colors
# Colors
The primary color and their derivates with lesser opacity be customized by:
@@ -50,10 +50,10 @@ theme:
faviconIco: "..."
```
## Known limits
# Known limits
Not all applications support theming. Known exceptions are:
- Univention Corporate Container (should be superseded by the Univention Management Stack which has planned support
- Univention Corporate Container (should be superseded by the Univention Management Stack which has planned support
for theming through the deployment).
- OpenProject
- Jitsi