Helm Chart Template Image Configuration Enhancement for Air-Gapped Installations

[elysweyr]

Background:
In enterprise environments, especially those with stringent security measures and air-gapped installations, flexibility in configuring container image sources becomes crucial. Helm charts are widely used for packaging, deploying, and managing applications on Kubernetes clusters. However, the current lack of native support for changing the mirror URL and image organization name within Nextcloud's aio Helm chart templates poses challenges for organizations with specific deployment requirements. This scenario is especially prevalent in larger enterprises and industries obligated to adhere to strict compliance rules, where tailored deployment practices are essential for meeting regulatory standards.

Feature Proposal:
Introduce an enhancement to Helm chart templates, enabling users to easily customize the mirror URL and image organization name for container images. This feature aims to facilitate air-gapped installations and align with security best practices, catering specifically to the nuanced requirements of larger enterprises and industries with strict compliance rules.

Key Components:

Mirror URL Configuration:

Allow users to specify a mirror URL for container images within Helm chart templates.
Provide a configurable parameter in the values.yaml file to set the mirror URL.
Support both HTTP and HTTPS protocols to accommodate diverse deployment environments.

Image Organization Name Configuration:

Enable users to define the organization name for container images in Helm chart templates.
Introduce a parameter in the values.yaml file for specifying the image organization name.
Ensure compatibility with container registries that organize images under specific namespaces or organizations.

Benefits:

Improved flexibility for organizations with specific deployment requirements, especially those in air-gapped environments.
Enhanced security by allowing users to customize mirror URLs and image organization names according to best practices.
Simplified configuration management for container images within Helm charts.
By implementing this feature, Helm charts will better accommodate diverse deployment scenarios, empowering users in larger enterprises and compliance-driven industries to adhere to security best practices and ensuring seamless installations in air-gapped environments, all while meeting the strict compliance standards set forth by regulatory bodies.

[szaimen]

Hi, what is the final goal? To not have any outgoing external connectivity? I fear this is very hard to achieve with Nextcloud as some services need to be reached in order to make it work in a good way. So even if you adjust the images to use your repository, some external services still need to be reached.

Also see https://github.com/nextcloud/all-in-one?tab=readme-ov-file#can-i-run-aio-offline-or-in-an-airgapped-system

[elysweyr]

There are more nuances to this than you state: the primary goal is to allow setups where clusters are set up in such a way that OCI resources can be only fetched via a trusted proxy/mirror which acts as an artifact cache as well.

This allows companies to only allow images being fetched that are either manually approved or comply with automated security criteria (e.g. no vulnerability with a CVSS v3 rating > 9).

In addition to that this enables users to modify images in case there is the necessity to mitigate vulnerabilities or apply patches unsupported by the vendor.

Examples for such software:

• Harbor (CNCF project)
• JFrog Artifactory
• Sonatype Nexus
• AWS ECR
• Google Cloud Artifact Registry

[szaimen]

This was just implemented with #4387. Thanks a lot for your PR! :)