mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
106 lines
4.6 KiB
Markdown
106 lines
4.6 KiB
Markdown
<!--
|
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
SPDX-License-Identifier: Apache-2.0
|
|
-->
|
|
<h1>Requirements</h1>
|
|
|
|
This section covers the internal system requirements as well as external service requirements for productive use.
|
|
|
|
<!-- TOC -->
|
|
* [TL;DR;](#tldr)
|
|
* [Hardware](#hardware)
|
|
* [Kubernetes](#kubernetes)
|
|
* [Ingress controller](#ingress-controller)
|
|
* [Volume provisioner](#volume-provisioner)
|
|
* [Certificate management](#certificate-management)
|
|
* [External services](#external-services)
|
|
* [Deployment](#deployment)
|
|
<!-- TOC -->
|
|
|
|
## TL;DR;
|
|
openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
|
|
|
|
- K8s cluster >= 1.24, [CNCF Certified Kubernetes Distro](https://www.cncf.io/certification/software-conformance/)
|
|
- Domain and DNS Service
|
|
- Ingress controller (supported are nginx-ingress, HAProxy)
|
|
- [Helm](https://helm.sh/) >= v3.9.0
|
|
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
|
|
- [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
|
|
- Volume provisioner supporting RWO (read-write-once)
|
|
- Certificate handling with [cert-manager](https://cert-manager.io/)
|
|
- [Istio](https://istio.io/) is currently required to deploy and operate OX AppSuite8
|
|
|
|
## Hardware
|
|
|
|
The following minimal requirements are thought for initial evaluation deployment:
|
|
|
|
| Spec | Value |
|
|
|------|------------------------------------------------------|
|
|
| CPU | 8 Cores of x64 or x86 CPU (ARM is not supported yet) |
|
|
| RAM | 16 GB, recommended 32 GB |
|
|
| Disk | HDD or SSD, >10 GB |
|
|
|
|
## Kubernetes
|
|
|
|
Any self-hosted or managed K8s cluster >= 1.24 listed in
|
|
[CNCF Certified Kubernetes Distros](https://www.cncf.io/certification/software-conformance/) should be supported.
|
|
|
|
The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
|
|
|
|
> **Note:** The deployment is not tested against OpenShift.
|
|
|
|
## Ingress controller
|
|
|
|
The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
|
|
configured ingress controller deployed.
|
|
|
|
**Maintained controllers:**
|
|
- [NGINX Ingress Controller](https://github.com/nginxinc/kubernetes-ingress)
|
|
- [HAProxy Kubernetes Ingress Controller](https://github.com/haproxytech/kubernetes-ingress)
|
|
|
|
**Community Supported:**
|
|
- [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
|
|
|
|
When you want to use Open-Xchange Appsuite 8, you need to deploy and configure additionally [Istio](https://istio.io/)
|
|
|
|
## Volume provisioner
|
|
|
|
Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
|
|
provisioner is sufficient.
|
|
|
|
> **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
|
|
|
|
## Certificate management
|
|
|
|
This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
|
|
but a secret containing a valid TLS certificate is required.
|
|
|
|
Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
|
|
openDesk certificate management disabled.
|
|
|
|
## External services
|
|
|
|
Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
|
|
|
|
|
|
| Group | Type | Version | Tested against |
|
|
|----------|---------------------|---------|-----------------------|
|
|
| Cache | Memached | `1.6.x` | Memached |
|
|
| | Redis | `7.x.x` | Redis |
|
|
| Database | MariaDB | `10.x` | MariaDB |
|
|
| | PostgreSQL | `15.x` | PostgreSQL |
|
|
| Mail | Mail Transfer Agent | | Postfix |
|
|
| | PKI/CI (SMIME) | | |
|
|
| Security | AntiVirus/ICAP | | ClamAV |
|
|
| Storage | K8s ReadWriteOnce | | Ceph / Cloud specific |
|
|
| | K8s ReadWriteMany | | Ceph / NFS |
|
|
| | Object Storage | | MinIO |
|
|
| Voice | TURN | | Coturn |
|
|
|
|
## Deployment
|
|
|
|
The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
|
|
templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.
|
|
|
|
Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare desired against deployed state.
|