⚠️ Repo Archive Notice

As of Nov 13, 2020, charts in this repo will no longer be updated. For more information, see the Helm Charts Deprecation and Archive Notice, and Update.

Hoard

Hoard is a stateless, deterministically encrypted, content-addressed object store. It currently supports local persistent storage, S3, GCS, Azure and IPFS backends. Files that are sent to Hoard are symmetrically encrypted, where the secret is the hash of the plaintext file, and then stored in the configured backend - this enables any party with knowledge of the hash or original file to retrieve it from the store.

DEPRECATION NOTICE

This chart is deprecated and no longer supported.

Introduction

This chart bootstraps a hoard daemon on a Kubernetes cluster using the Helm package manager.

Installation

To install the chart with the release name my-release, run:

bash

helm install --name my-release stable/hoard

This installation defaults to persistent volume storage. The configuration section below lists all possible parameters that can be configured.

Uninstall

To uninstall/delete the my-release deployment:

bash

helm delete my-release

Configuration

The following table lists the configurable parameters of the Hoard chart and its default values.

Parameter	Description	Default
`replicaCount`	number of daemons	`1`
`image.repository`	docker image	`"quay.io/monax/hoard"`
`image.tag`	version	`"6.0.0"`
`image.pullPolicy`	pull policy	`"IfNotPresent"`
`config.listenaddress`	address to listen on	`tcp://:53431`
`config.storage.storagetype`	backend object store (aws, azure, filesystem, gcp, ipfs)	`filesystem`
`config.storage.addressencoding`	object address encoding	`base64`
`config.storage.chunksize`	size to chunk at for streaming	`65536`
`config.storage.filesystemconfig.rootdirectory`	object address encoding	`"/data"`
`config.storage.cloudconfig.bucket`	object storage container (cloud only)	`""`
`config.storage.cloudconfig.prefix`	bucket folder (cloud only)	`""`
`config.storage.cloudconfig.region`	object store location (cloud only)	`""`
`config.storage.ipfsconfig.remoteapi`	remote api location (ipfs only)	`""`
`config.logging.loggingtype`	format for logging output	`"json"`
`config.logging.channels`	logging types	`[]`
`config.secrets.symmetric`	symmetric secrets (publicid, passphrase)	`[]`
`config.secrets.openpgp.privateid`	id of private key to sign with	`""`
`config.secrets.openpgp.file`	name of the file mounted from secret	`"/secrets/keyring"`
`controller.enabled`	enable the shared-secrets controller	`false`
`controller.keep`	keep the shared-secrets crd after chart deletion	`true`
`secrets.creds`	required secret for cloud providers	`"cloud-credentials"`
`secrets.keyring`	required secret for openpgp grants	`"private-keyring"`
`persistence.size`	size of local store	`"10Gi"`
`persistence.storageClass`	pvc type	`"standard"`
`persistence.accessMode`	pvc access	`"ReadWriteOnce"`
`persistence.persistentVolumeReclaimPolicy`	pvc policy	`"Retain"`
`persistence.annotations`	optional annotations	`{}`
`persistence.annotations."helm.sh/resource-policy"`	keep pvc	`keep`
`service.type`	type of service	`"ClusterIP"`
`service.port`	default listening port	`53431`
`ingress`	settings for ingress	`{}`
`resources`	pod resources	`{}`
`nodeSelector`	optional settings	`{}`
`tolerations`	optional settings	`[]`
`affinity`	session affinity	`{}`

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

bash

$ helm install --name my-release stable/hoard

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

bash

$ helm install --name my-release -f values.yaml stable/hoard

Cloud Examples

For each of the supported cloud back-ends, please ensure you have the appropriate credentials as identified by the corresponding environment variables.

AWS

bash

kubectl create secret generic cloud-credentials --from-literal access-key-id=${AWS_ACCESS_KEY_ID} --from-literal secret-access-key=${AWS_SECRET_ACCESS_KEY}
helm install --name my-release stable/hoard --set storage.type=aws,storage.region="eu-central-1",storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"

Azure

bash

kubectl create secret generic cloud-credentials --from-literal storage-account-name=${AZURE_STORAGE_ACCOUNT_NAME} --from-literal storage-account-key=${AZURE_STORAGE_ACCOUNT_KEY}
helm install --name my-release stable/hoard --set storage.type=azure,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"

GCP

bash

kubectl create secret generic cloud-credentials --from-literal service-key=${GCLOUD_SERVICE_KEY}
helm install --name my-release stable/hoard --set storage.type=gcp,storage.bucket="my-bucket",storage.prefix="folder",storage.secret="cloud-credentials"

OpenPGP Grants

Once configured, hoard can share access to a secret file by encrypting it with the public key of the recipient:

bash

kubectl create secret generic private-keyring --from-file ${GOPATH}/src/github.com/monax/hoard/grant/private.key.asc
helm install --name my-release stable/hoard --set openpgp.id="10449759736975846181",openpgp.secret=private-keyring

Shared Secrets

To enable Hoard to act as a 'secrets broker', deploy our CustomResourceDefinition and controller:

bash

helm install --name my-release stable/hoard --set controller.enabled=true