Merge ~kotodama/charm-k8s-discourse:s3_storage into charm-k8s-discourse:master

[Loïc Gomez]

Add S3 support for uploaded objects storage

[Loïc Gomez (kotodama)]

Careful: prerequisite branch ~kotodama/charm-k8s-discourse:fix_unit_tests

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Unable to determine commit message from repository - please click "Set commit message" and enter the commit message manually.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

FAILED: Continuous integration, rev:45c0d961fab14a396e475d944f64e9e9b4285c0c

No commit message was specified in the merge proposal. Click on the following link and set the commit message (if you want jenkins to rebuild you need to trigger it yourself):
https://code.launchpad.net/~kotodama/charm-k8s-discourse/+git/charm-k8s-discourse/+merge/414970/+edit-commit-message

https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/47/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/167/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/677791/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/47//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

PASSED: Continuous integration, rev:2cb1be3f9fb6d1bf885b2efb79b4d94c7fb6ff8c
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/49/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/169/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/679353/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/49//rebuild

review: Approve (continuous-integration)

[Tom Haddon (mthaddon)]

Some comments inline. Also, since we're spinning up a staging instance for this, let's test before merging.

[Loïc Gomez (kotodama)]

Thanks, fixed.
Also, changed naming of s3_config to s3_env, as it felt more natural (we're compiling S3 configuration into S3 environment variables actually).

Will set to Need Review again when it's been tested.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[Loïc Gomez (kotodama)]

Fixed default s3_endpoint, requires https:// prefix.
Charm tested on https://discourse-is.staging.canonical.com/ using AWS S3 buckets.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

PASSED: Continuous integration, rev:42f931199b4b4c4d5c992e3062125b4537bbc48e
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/50/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/171/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/693362/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/50//rebuild

review: Approve (continuous-integration)

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

A CI job is currently in progress. A follow up comment will be added when it completes.

[🤖 prod-jenkaas-is (prod-jenkaas-is)]

PASSED: Continuous integration, rev:70d5de3315b437da407d3610a9d0badb9f935639
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/51/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/is/job/lp-charm-test/172/
    None: https://jenkins.canonical.com/is/job/lp-update-mp/693503/

Click here to trigger a rebuild:
https://jenkins.canonical.com/is/job/lp-charm-k8s-discourse-ci/51//rebuild

review: Approve (continuous-integration)

[Tom Haddon (mthaddon)]

LGTM, thx

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 0df9bf214e523b084497453bba033bdc71214c4c

diff --git a/config.yaml b/config.yaml
index f8bd1bc..cd002bc 100644
--- a/config.yaml
+++ b/config.yaml
@@ -87,3 +87,65 @@ options:
     type: int
     description: "Max allowed body-size (for file uploads) in megabytes, set to 0 to disable limits"
     default: 20
+  s3_enabled:
+    type: boolean
+    description: |
+      Store uploaded objects in an S3-compatible object storage service instead of a local directory.
+
+      If true, sets DISCOURSE_USE_S3=true.
+      Check https://meta.discourse.org/t/using-object-storage-for-uploads-s3-clones/148916 for more details.
+    default: false
+  s3_endpoint:
+    type: string
+    description: |
+      The S3 endpoint to use.  This may be a non-Amazon S3-compatible endpoint.
+
+      Sets DISCOURSE_S3_ENDPOINT
+    default: "https://s3.amazonaws.com"
+  s3_bucket:
+    type: string
+    description: |
+      The S3 bucket to use.
+
+      Sets DISCOURSE_S3_BUCKET.
+      Required if s3_enabled is true.
+    default: ""
+  s3_access_key_id:
+    type: string
+    description: |
+      The S3 access key ID to use.
+
+      Sets DISCOURSE_S3_ACCESS_KEY_ID.
+      Required if s3_enabled is true.
+    default: ""
+  s3_secret_access_key:
+    type: string
+    description: |
+      The S3 secret key to use.
+
+      Sets DISCOURSE_S3_SECRET_ACCESS_KEY.
+      Required if s3_enabled is true.
+    default: ""
+  s3_region:
+    type: string
+    description: |
+      The S3 region to use.
+
+      Sets DISCOURSE_S3_REGION.
+      Required if s3_enabled is true.
+    default: ""
+  s3_backup_bucket:
+    type: string
+    description: |
+      The S3 bucket to use for backups.
+
+      Sets DISCOURSE_S3_BACKUP_BUCKET.
+      Also sets DISCOURSE_BACKUP_LOCATION=s3.
+    default: ""
+  s3_cdn_url:
+    type: string
+    description: |
+      The S3 Content Delivery Network URL.
+
+      Sets DISCOURSE_S3_CDN_URL.
+    default: ""
diff --git a/image/scripts/pod_setup b/image/scripts/pod_setup
index 69b7b55..4893723 100755
--- a/image/scripts/pod_setup
+++ b/image/scripts/pod_setup
@@ -45,3 +45,13 @@ su -s /bin/bash -c "bin/bundle exec rake assets:precompile RAILS_ENV=$RAILS_ENV"
 su -s /bin/bash -c "bin/bundle exec rake assets:precompile RAILS_ENV=$RAILS_ENV" ${CONTAINER_APP_USERNAME} 2>&1 |sed 's/^/asset-build-2: /'
 # LP#1952681: Third run consistently succeeds
 su -s /bin/bash -c "bin/bundle exec rake assets:precompile RAILS_ENV=$RAILS_ENV" ${CONTAINER_APP_USERNAME} 2>&1 |sed 's/^/asset-build-3: /'
+
+if [ ! -z "${DISCOURSE_USE_S3}" ] && [ "${DISCOURSE_USE_S3}" == "true" ]; then
+	echo "Discourse is configured to use S3:"
+	echo "S3_ENDPOINT=${DISCOURSE_S3_ENDPOINT}"
+	echo "S3_BUCKET=${DISCOURSE_S3_BUCKET}"
+	echo "Running migration to S3..."
+	su -s /bin/bash -c "bin/bundle exec rake s3:upload_assets RAILS_ENV=$RAILS_ENV" ${CONTAINER_APP_USERNAME} 2>&1
+else
+	echo "Not running migration to S3 (DISCOURSE_USE_S3=${DISCOURSE_USE_S3})."
+fi
diff --git a/src/charm.py b/src/charm.py
index 4085867..4710b2c 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -40,6 +40,7 @@ THROTTLE_LEVELS = {
         'DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE': 'false',
     },
 }
+REQUIRED_S3_SETTINGS = ['s3_access_key_id', 's3_bucket', 's3_region', 's3_secret_access_key']
 
 
 def create_discourse_pod_config(config):
@@ -71,6 +72,9 @@ def create_discourse_pod_config(config):
     for key in saml_config:
         pod_config[key] = saml_config[key]
 
+    if config.get('s3_enabled'):
+        pod_config.update(get_s3_env(config))
+
     # We only get valid throttle levels here, otherwise it would be caught
     # by `check_for_config_problems`, so we can be sure this won't raise a
     # KeyError.
@@ -105,6 +109,29 @@ def get_saml_config(config):
     return saml_config
 
 
+def get_s3_env(config):
+    """Get the list of S3-related environment variables from charm's configuration."""
+    if not config.get('s3_enabled'):
+        return {}
+
+    s3_env = {
+        'DISCOURSE_USE_S3': True,
+        'DISCOURSE_S3_REGION': config['s3_region'],
+        'DISCOURSE_S3_ENDPOINT': config.get('s3_endpoint', 's3.amazonaws.com'),
+        'DISCOURSE_S3_ACCESS_KEY_ID': config['s3_access_key_id'],
+        'DISCOURSE_S3_SECRET_ACCESS_KEY': config['s3_secret_access_key'],
+        'DISCOURSE_S3_BUCKET': config['s3_bucket'],
+    }
+
+    if config.get('s3_backup_bucket'):
+        s3_env['DISCOURSE_S3_BACKUP_BUCKET'] = config['s3_backup_bucket']
+        s3_env['DISCOURSE_BACKUP_LOCATION'] = 's3'
+    if config.get('s3_cdn_url'):
+        s3_env['DISCOURSE_S3_CDN_URL'] = config['s3_cdn_url']
+
+    return s3_env
+
+
 def create_ingress_config(app_name, config):
     """Create the ingress config form the juju config."""
     annotations = {}
@@ -201,6 +228,9 @@ def check_for_config_problems(config, stored):
     if config['saml_sync_groups'] and not config['saml_target_url']:
         errors.append("'saml_sync_groups' cannot be specified without a 'saml_target_url'")
 
+    if config.get('s3_enabled'):
+        errors.extend(["'s3_enabled' requires '{}'".format(x) for x in REQUIRED_S3_SETTINGS if x not in config])
+
     return errors
 
 
diff --git a/tests/unit/fixtures/config_invalid_missing_required_s3_options.yaml b/tests/unit/fixtures/config_invalid_missing_required_s3_options.yaml
new file mode 100644
index 0000000..f542315
--- /dev/null
+++ b/tests/unit/fixtures/config_invalid_missing_required_s3_options.yaml
@@ -0,0 +1,28 @@
+config:
+    cors_origin: '*'
+    db_name: discourse
+    developer_emails: [e-mail]
+    discourse_image: discourse-k8s:1.0.7f
+    enable_cors: true
+    external_hostname: discourse.local
+    image_pass: ''
+    image_user: ''
+    redis_host: 10.9.89.197
+    smtp_address: 167.89.123.58
+    smtp_authentication: login
+    smtp_domain: example.com
+    smtp_openssl_verify_mode: none
+    smtp_password: OBV10USLYF4K3
+    smtp_port: 587
+    smtp_username: apikey
+    saml_sync_groups: ''
+    saml_target_url: https://login.ubuntu.com/+saml
+    force_saml_login: true
+    throttle_level: none
+    s3_enabled: true
+config_problems:
+    - "'s3_enabled' requires 's3_access_key_id'"
+    - "'s3_enabled' requires 's3_bucket'"
+    - "'s3_enabled' requires 's3_region'"
+    - "'s3_enabled' requires 's3_secret_access_key'"
+missing_fields: []
diff --git a/tests/unit/fixtures/config_valid_complete.yaml b/tests/unit/fixtures/config_valid_complete.yaml
index 87127e5..1d14364 100644
--- a/tests/unit/fixtures/config_valid_complete.yaml
+++ b/tests/unit/fixtures/config_valid_complete.yaml
@@ -21,7 +21,16 @@ config:
     saml_target_url: https://login.ubuntu.com/+saml
     force_saml_login: true
     throttle_level: none
+    s3_enabled: true
+    s3_endpoint: 'not.aws.endpoi.nt'
+    s3_bucket: 'who-s-a-good-bucket?'
+    s3_access_key_id: '3|33+'
+    s3_secret_access_key: 's|kI0ure_k3Y'
+    s3_region: 'the-infinite-and-beyond'
+    s3_backup_bucket: 'backups-please'
+    s3_cdn_url: 'https://cdn.my.domain'
 pod_config:
+    DISCOURSE_BACKUP_LOCATION: 's3'
     DISCOURSE_CORS_ORIGIN: '*'
     DISCOURSE_DEVELOPER_EMAILS: [e-mail]
     DISCOURSE_ENABLE_CORS: true
@@ -40,6 +49,14 @@ pod_config:
     DISCOURSE_SMTP_PORT: 587
     DISCOURSE_SMTP_USER_NAME: apikey
     DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
+    DISCOURSE_USE_S3: true
+    DISCOURSE_S3_ACCESS_KEY_ID: '3|33+'
+    DISCOURSE_S3_BACKUP_BUCKET: 'backups-please'
+    DISCOURSE_S3_BUCKET: 'who-s-a-good-bucket?'
+    DISCOURSE_S3_CDN_URL: 'https://cdn.my.domain'
+    DISCOURSE_S3_ENDPOINT: 'not.aws.endpoi.nt'
+    DISCOURSE_S3_REGION: 'the-infinite-and-beyond'
+    DISCOURSE_S3_SECRET_ACCESS_KEY: 's|kI0ure_k3Y'
     DISCOURSE_SERVE_STATIC_ASSETS: 'true'
     DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
     DISCOURSE_SAML_SYNC_GROUPS: 'true'
@@ -54,6 +71,7 @@ pod_spec:
     containers:
     - name: discourse-k8s
       envConfig:
+        DISCOURSE_BACKUP_LOCATION: 's3'
         DISCOURSE_CORS_ORIGIN: '*'
         DISCOURSE_DEVELOPER_EMAILS: [e-mail]
         DISCOURSE_ENABLE_CORS: true
@@ -71,6 +89,14 @@ pod_spec:
         DISCOURSE_SMTP_PASSWORD: OBV10USLYF4K3
         DISCOURSE_SMTP_PORT: 587
         DISCOURSE_SMTP_USER_NAME: apikey
+        DISCOURSE_USE_S3: true
+        DISCOURSE_S3_ACCESS_KEY_ID: '3|33+'
+        DISCOURSE_S3_BACKUP_BUCKET: 'backups-please'
+        DISCOURSE_S3_BUCKET: 'who-s-a-good-bucket?'
+        DISCOURSE_S3_CDN_URL: 'https://cdn.my.domain'
+        DISCOURSE_S3_ENDPOINT: 'not.aws.endpoi.nt'
+        DISCOURSE_S3_REGION: 'the-infinite-and-beyond'
+        DISCOURSE_S3_SECRET_ACCESS_KEY: 's|kI0ure_k3Y'
         DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
         DISCOURSE_SERVE_STATIC_ASSETS: 'true'
         DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
diff --git a/tests/unit/fixtures/config_valid_no_s3.yaml b/tests/unit/fixtures/config_valid_no_s3.yaml
new file mode 100644
index 0000000..87127e5
--- /dev/null
+++ b/tests/unit/fixtures/config_valid_no_s3.yaml
@@ -0,0 +1,120 @@
+config: 
+    cors_origin: '*'
+    db_name: discourse
+    developer_emails: [e-mail]
+    discourse_image: discourse-k8s:1.0.7f
+    enable_cors: true
+    external_hostname: discourse.local
+    image_pass: 'somepass'
+    image_user: 'someuser'
+    max_body_size: 25
+    redis_host: 10.9.89.197
+    smtp_address: 167.89.123.58
+    smtp_authentication: login
+    smtp_domain: example.com
+    smtp_openssl_verify_mode: none
+    smtp_password: OBV10USLYF4K3
+    smtp_port: 587
+    smtp_username: apikey
+    tls_secret_name: discourse_local
+    saml_sync_groups: 'canonical, ubuntu-core'
+    saml_target_url: https://login.ubuntu.com/+saml
+    force_saml_login: true
+    throttle_level: none
+pod_config:
+    DISCOURSE_CORS_ORIGIN: '*'
+    DISCOURSE_DEVELOPER_EMAILS: [e-mail]
+    DISCOURSE_ENABLE_CORS: true
+    DISCOURSE_HOSTNAME: discourse.local
+    DISCOURSE_DB_HOST: 10.9.89.237
+    DISCOURSE_DB_NAME: discourse
+    DISCOURSE_DB_PASSWORD: a_real_password
+    DISCOURSE_DB_USERNAME: discourse_m
+    DISCOURSE_REDIS_HOST: 10.9.89.197
+    DISCOURSE_REDIS_PORT: 6379
+    DISCOURSE_SMTP_ADDRESS: 167.89.123.58
+    DISCOURSE_SMTP_AUTHENTICATION: login
+    DISCOURSE_SMTP_DOMAIN: example.com
+    DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
+    DISCOURSE_SMTP_PASSWORD: OBV10USLYF4K3
+    DISCOURSE_SMTP_PORT: 587
+    DISCOURSE_SMTP_USER_NAME: apikey
+    DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
+    DISCOURSE_SERVE_STATIC_ASSETS: 'true'
+    DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
+    DISCOURSE_SAML_SYNC_GROUPS: 'true'
+    DISCOURSE_SAML_SYNC_GROUPS_LIST: 'canonical|ubuntu-core'
+    DISCOURSE_SAML_TARGET_URL: https://login.ubuntu.com/+saml
+    DISCOURSE_SAML_FULL_SCREEN_LOGIN: "true"
+    DISCOURSE_SAML_CERT_FINGERPRINT: 32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5
+    DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
+    DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+pod_spec:
+    version: 3
+    containers:
+    - name: discourse-k8s
+      envConfig:
+        DISCOURSE_CORS_ORIGIN: '*'
+        DISCOURSE_DEVELOPER_EMAILS: [e-mail]
+        DISCOURSE_ENABLE_CORS: true
+        DISCOURSE_HOSTNAME: discourse.local
+        DISCOURSE_DB_HOST: 10.9.89.237
+        DISCOURSE_DB_NAME: discourse
+        DISCOURSE_DB_PASSWORD: a_real_password
+        DISCOURSE_DB_USERNAME: discourse_m
+        DISCOURSE_REDIS_HOST: 10.9.89.197
+        DISCOURSE_REDIS_PORT: 6379
+        DISCOURSE_SMTP_ADDRESS: 167.89.123.58
+        DISCOURSE_SMTP_AUTHENTICATION: login
+        DISCOURSE_SMTP_DOMAIN: example.com
+        DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
+        DISCOURSE_SMTP_PASSWORD: OBV10USLYF4K3
+        DISCOURSE_SMTP_PORT: 587
+        DISCOURSE_SMTP_USER_NAME: apikey
+        DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
+        DISCOURSE_SERVE_STATIC_ASSETS: 'true'
+        DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
+        DISCOURSE_SAML_SYNC_GROUPS: 'true'
+        DISCOURSE_SAML_SYNC_GROUPS_LIST: 'canonical|ubuntu-core'
+        DISCOURSE_SAML_TARGET_URL: https://login.ubuntu.com/+saml
+        DISCOURSE_SAML_FULL_SCREEN_LOGIN: "true"
+        DISCOURSE_SAML_CERT_FINGERPRINT: 32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5
+        DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
+        DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+      imageDetails:
+        imagePath: discourse-k8s:1.0.7f
+        password: somepass
+        username: someuser
+      imagePullPolicy: 'IfNotPresent'
+      kubernetes:
+        readinessProbe:
+          httpGet:
+            path: '/srv/status'
+            port: 3000
+      ports:
+        - containerPort: 3000
+          protocol: TCP
+    kubernetesResources:
+        ingressResources:
+            - annotations:
+                nginx.ingress.kubernetes.io/affinity: 'cookie'
+                nginx.ingress.kubernetes.io/affinity-mode: 'balanced'
+                nginx.ingress.kubernetes.io/proxy-body-size: '25m'
+                nginx.ingress.kubernetes.io/session-cookie-change-on-failure: 'true'
+                nginx.ingress.kubernetes.io/session-cookie-max-age: '3600'
+                nginx.ingress.kubernetes.io/session-cookie-name: 'DISCOURSE_AFFINITY'
+                nginx.ingress.kubernetes.io/session-cookie-samesite: 'Lax'
+              name: discourse-k8s-ingress
+              spec:
+                rules:
+                  - host: discourse.local
+                    http:
+                        paths:
+                         - backend:
+                             serviceName: discourse-k8s
+                             servicePort: 3000
+                           path: '/'
+                tls:
+                  - hosts:
+                      - 'discourse.local'
+                    secretName: 'discourse_local'
diff --git a/tests/unit/fixtures/config_valid_s3_only_required_options.yaml b/tests/unit/fixtures/config_valid_s3_only_required_options.yaml
new file mode 100644
index 0000000..dfd1993
--- /dev/null
+++ b/tests/unit/fixtures/config_valid_s3_only_required_options.yaml
@@ -0,0 +1,137 @@
+config: 
+    cors_origin: '*'
+    db_name: discourse
+    developer_emails: [e-mail]
+    discourse_image: discourse-k8s:1.0.7f
+    enable_cors: true
+    external_hostname: discourse.local
+    image_pass: 'somepass'
+    image_user: 'someuser'
+    max_body_size: 25
+    redis_host: 10.9.89.197
+    smtp_address: 167.89.123.58
+    smtp_authentication: login
+    smtp_domain: example.com
+    smtp_openssl_verify_mode: none
+    smtp_password: OBV10USLYF4K3
+    smtp_port: 587
+    smtp_username: apikey
+    tls_secret_name: discourse_local
+    saml_sync_groups: 'canonical, ubuntu-core'
+    saml_target_url: https://login.ubuntu.com/+saml
+    force_saml_login: true
+    throttle_level: none
+    s3_enabled: true
+    s3_bucket: 'who-s-a-good-bucket?'
+    s3_access_key_id: '3|33+'
+    s3_secret_access_key: 's|kI0ure_k3Y'
+    s3_region: 'the-infinite-and-beyond'
+pod_config:
+    DISCOURSE_CORS_ORIGIN: '*'
+    DISCOURSE_DEVELOPER_EMAILS: [e-mail]
+    DISCOURSE_ENABLE_CORS: true
+    DISCOURSE_HOSTNAME: discourse.local
+    DISCOURSE_DB_HOST: 10.9.89.237
+    DISCOURSE_DB_NAME: discourse
+    DISCOURSE_DB_PASSWORD: a_real_password
+    DISCOURSE_DB_USERNAME: discourse_m
+    DISCOURSE_REDIS_HOST: 10.9.89.197
+    DISCOURSE_REDIS_PORT: 6379
+    DISCOURSE_SMTP_ADDRESS: 167.89.123.58
+    DISCOURSE_SMTP_AUTHENTICATION: login
+    DISCOURSE_SMTP_DOMAIN: example.com
+    DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
+    DISCOURSE_SMTP_PASSWORD: OBV10USLYF4K3
+    DISCOURSE_SMTP_PORT: 587
+    DISCOURSE_SMTP_USER_NAME: apikey
+    DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
+    DISCOURSE_USE_S3: true
+    DISCOURSE_S3_ACCESS_KEY_ID: '3|33+'
+    DISCOURSE_S3_BUCKET: 'who-s-a-good-bucket?'
+    DISCOURSE_S3_ENDPOINT: 's3.amazonaws.com'
+    DISCOURSE_S3_REGION: 'the-infinite-and-beyond'
+    DISCOURSE_S3_SECRET_ACCESS_KEY: 's|kI0ure_k3Y'
+    DISCOURSE_SERVE_STATIC_ASSETS: 'true'
+    DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
+    DISCOURSE_SAML_SYNC_GROUPS: 'true'
+    DISCOURSE_SAML_SYNC_GROUPS_LIST: 'canonical|ubuntu-core'
+    DISCOURSE_SAML_TARGET_URL: https://login.ubuntu.com/+saml
+    DISCOURSE_SAML_FULL_SCREEN_LOGIN: "true"
+    DISCOURSE_SAML_CERT_FINGERPRINT: 32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5
+    DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
+    DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+pod_spec:
+    version: 3
+    containers:
+    - name: discourse-k8s
+      envConfig:
+        DISCOURSE_CORS_ORIGIN: '*'
+        DISCOURSE_DEVELOPER_EMAILS: [e-mail]
+        DISCOURSE_ENABLE_CORS: true
+        DISCOURSE_HOSTNAME: discourse.local
+        DISCOURSE_DB_HOST: 10.9.89.237
+        DISCOURSE_DB_NAME: discourse
+        DISCOURSE_DB_PASSWORD: a_real_password
+        DISCOURSE_DB_USERNAME: discourse_m
+        DISCOURSE_REDIS_HOST: 10.9.89.197
+        DISCOURSE_REDIS_PORT: 6379
+        DISCOURSE_SMTP_ADDRESS: 167.89.123.58
+        DISCOURSE_SMTP_AUTHENTICATION: login
+        DISCOURSE_SMTP_DOMAIN: example.com
+        DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
+        DISCOURSE_SMTP_PASSWORD: OBV10USLYF4K3
+        DISCOURSE_SMTP_PORT: 587
+        DISCOURSE_SMTP_USER_NAME: apikey
+        DISCOURSE_USE_S3: true
+        DISCOURSE_S3_ACCESS_KEY_ID: '3|33+'
+        DISCOURSE_S3_BUCKET: 'who-s-a-good-bucket?'
+        DISCOURSE_S3_ENDPOINT: 's3.amazonaws.com'
+        DISCOURSE_S3_REGION: 'the-infinite-and-beyond'
+        DISCOURSE_S3_SECRET_ACCESS_KEY: 's|kI0ure_k3Y'
+        DISCOURSE_REFRESH_MAXMIND_DB_DURING_PRECOMPILE_DAYS: '0'
+        DISCOURSE_SERVE_STATIC_ASSETS: 'true'
+        DISCOURSE_SAML_GROUPS_FULLSYNC: 'false'
+        DISCOURSE_SAML_SYNC_GROUPS: 'true'
+        DISCOURSE_SAML_SYNC_GROUPS_LIST: 'canonical|ubuntu-core'
+        DISCOURSE_SAML_TARGET_URL: https://login.ubuntu.com/+saml
+        DISCOURSE_SAML_FULL_SCREEN_LOGIN: "true"
+        DISCOURSE_SAML_CERT_FINGERPRINT: 32:15:20:9F:A4:3C:8E:3E:8E:47:72:62:9A:86:8D:0E:E6:CF:45:D5
+        DISCOURSE_MAX_REQS_PER_IP_MODE: "none"
+        DISCOURSE_MAX_REQS_RATE_LIMIT_ON_PRIVATE: "false"
+      imageDetails:
+        imagePath: discourse-k8s:1.0.7f
+        password: somepass
+        username: someuser
+      imagePullPolicy: 'IfNotPresent'
+      kubernetes:
+        readinessProbe:
+          httpGet:
+            path: '/srv/status'
+            port: 3000
+      ports:
+        - containerPort: 3000
+          protocol: TCP
+    kubernetesResources:
+        ingressResources:
+            - annotations:
+                nginx.ingress.kubernetes.io/affinity: 'cookie'
+                nginx.ingress.kubernetes.io/affinity-mode: 'balanced'
+                nginx.ingress.kubernetes.io/proxy-body-size: '25m'
+                nginx.ingress.kubernetes.io/session-cookie-change-on-failure: 'true'
+                nginx.ingress.kubernetes.io/session-cookie-max-age: '3600'
+                nginx.ingress.kubernetes.io/session-cookie-name: 'DISCOURSE_AFFINITY'
+                nginx.ingress.kubernetes.io/session-cookie-samesite: 'Lax'
+              name: discourse-k8s-ingress
+              spec:
+                rules:
+                  - host: discourse.local
+                    http:
+                        paths:
+                         - backend:
+                             serviceName: discourse-k8s
+                             servicePort: 3000
+                           path: '/'
+                tls:
+                  - hosts:
+                      - 'discourse.local'
+                    secretName: 'discourse_local'