tree: 876c137b8c692506d19948c18d31175bc6c095cb [path history] [tgz]
  1. charts/
  2. templates/
  3. .helmignore
  4. Chart.lock
  5. Chart.yaml
  6. README.md
  7. values.yaml
charts/penpot/README.md

Penpot

Penpot is the first Open Source design and prototyping platform meant for cross-domain teams. Non dependent on operating systems, Penpot is web based and works with open standards (SVG). Penpot invites designers all over the world to fall in love with open source while getting developers excited about the design process in return.

TL;DR

helm repo add codechem https://charts.codechem.com
helm install penpot codechem/penpot

Introduction

Penpot makes design and prototyping accessible to every team in the world. It has a clear focus on design and code teams and its capabilities reflect exactly that. The less hand-off mindset, the more fun for everyone. Being web based, Penpot is not dependent on operating systems or local installations, you will only need to run a modern browser. Using SVG as no other design and prototyping tool does, Penpot files sport compatibility with most of the vectorial tools, are tech friendly and extremely easy to use on the web. It makes sure you will always own your work.

Prerequisites

  • Kubernetes 1.18+
  • Helm 3.2.0+

Installing the Chart

To install the chart with the release name penpot:

helm install penpot codechem/penpot

The command deploys penpot on the Kubernetes cluster in the default configuration. The Parameters section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Uninstalling the Chart

To uninstall/delete the penpot deployment:

helm delete penpot

The command removes all the Kubernetes components associated with the chart and deletes the release.

Parameters

Global parameters

NameDescriptionValue
global.postgresqlEnabledWhether to deploy the Bitnami PostgreSQL chart as subchart. Check the official chart for configuration.false
global.redisEnabledWhether to deploy the Bitnami Redis chart as subchart. Check the official chart for configuration.false
global.imagePullSecretsGlobal Docker registry secret names as an array.[]

Common parameters

NameDescriptionValue
nameOverrideString to partially override common.names.fullname""
fullnameOverrideString to fully override common.names.fullname""
serviceAccount.enabledSpecifies whether a ServiceAccount should be created.true
serviceAccount.annotationsAnnotations for service account. Evaluated as a template. Only used if create is true.{}
serviceAccount.nameThe name of the ServiceAccount to use. If not set and enabled is true, a name is generated using the fullname template.""

Backend parameters

NameDescriptionValue
backend.image.repositoryThe Docker repository to pull the image from.penpotapp/backend
backend.image.tagThe image tag to use.1.16.0-beta
backend.image.imagePullPolicyThe image pull policy to use.IfNotPresent
backend.replicaCountThe number of replicas to deploy.1
backend.service.typeThe service type to create.ClusterIP
backend.service.portThe service port to use.6060
backend.podSecurityContext.enabledEnabled Penpot pods' security contexttrue
backend.podSecurityContext.fsGroupSet Penpot pod's security context fsGroup1001
backend.containerSecurityContext.enabledEnabled Penpot containers' security contexttrue
backend.containerSecurityContext.runAsUserSet Penpot containers' security context runAsUser1001
backend.containerSecurityContext.allowPrivilegeEscalationSet Penpot containers' security context allowPrivilegeEscalationfalse
backend.containerSecurityContext.capabilities.dropSet Penpot containers' security context capabilities to be dropped["all"]
backend.containerSecurityContext.readOnlyRootFilesystemSet Penpot containers' security context readOnlyRootFilesystemfalse
backend.containerSecurityContext.runAsNonRootSet Penpot container's security context runAsNonRoottrue
backend.affinityAffinity for Penpot pods assignment{}
backend.nodeSelectorNode labels for Penpot pods assignment{}
backend.tolerationsTolerations for Penpot pods assignment[]
backend.resources.limitsThe resources limits for the Penpot backend containers{}
backend.resources.requestsThe requested resources for the Penpot backend containers{}

Frontend parameters

NameDescriptionValue
frontend.image.repositoryThe Docker repository to pull the image from.penpotapp/frontend
frontend.image.tagThe image tag to use.1.16.0-beta
frontend.image.imagePullPolicyThe image pull policy to use.IfNotPresent
frontend.replicaCountThe number of replicas to deploy.1
frontend.service.typeThe service type to create.ClusterIP
frontend.service.portThe service port to use.80
frontend.ingress.enabledEnable ingress record generation for Penpot frontend.false
frontend.ingress.annotationsMapped annotations for the frontend ingress.{}
frontend.ingress.hostsArray style hosts for the frontend ingress.[]
frontend.ingress.tlsArray style TLS secrets for the frontend ingress.[]
frontend.affinityAffinity for Penpot pods assignment{}
frontend.nodeSelectorNode labels for Penpot pods assignment{}
frontend.tolerationsTolerations for Penpot pods assignment[]
frontend.resources.limitsThe resources limits for the Penpot frontend containers{}
frontend.resources.requestsThe requested resources for the Penpot frontend containers{}

Exporter parameters

NameDescriptionValue
exporter.image.repositoryThe Docker repository to pull the image from.penpotapp/exporter
exporter.image.tagThe image tag to use.1.16.0-beta
exporter.image.imagePullPolicyThe image pull policy to use.IfNotPresent
exporter.replicaCountThe number of replicas to deploy.1
exporter.service.typeThe service type to create.ClusterIP
exporter.service.portThe service port to use.6061
exporter.podSecurityContext.enabledEnabled Penpot pods' security contexttrue
exporter.podSecurityContext.fsGroupSet Penpot pod's security context fsGroup1001
exporter.containerSecurityContext.enabledEnabled Penpot containers' security contexttrue
exporter.containerSecurityContext.runAsUserSet Penpot containers' security context runAsUser1001
exporter.containerSecurityContext.allowPrivilegeEscalationSet Penpot containers' security context allowPrivilegeEscalationfalse
exporter.containerSecurityContext.capabilities.dropSet Penpot containers' security context capabilities to be dropped["all"]
exporter.containerSecurityContext.readOnlyRootFilesystemSet Penpot containers' security context readOnlyRootFilesystemfalse
exporter.containerSecurityContext.runAsNonRootSet Penpot container's security context runAsNonRoottrue
exporter.affinityAffinity for Penpot pods assignment{}
exporter.nodeSelectorNode labels for Penpot pods assignment{}
exporter.tolerationsTolerations for Penpot pods assignment[]
exporter.resources.limitsThe resources limits for the Penpot exporter containers{}
exporter.resources.requestsThe requested resources for the Penpot exporter containers{}

Persistence parameters

NameDescriptionValue
persistence.enabledEnable persistence using Persistent Volume Claims.false
persistence.storageClassPersistent Volume storage class.""
persistence.sizePersistent Volume size.8Gi
persistence.existingClaimThe name of an existing PVC to use for persistence.""
persistence.accessModesPersistent Volume access modes.["ReadWriteOnce"]
persistence.annotationsPersistent Volume Claim annotations.{}

Configuration parameters

NameDescriptionValue
config.publicURIThe public domain to serve Penpot on. Set disable-secure-session-cookies in the flags if you plan on serving it on a non HTTPS domain.http://localhost:8080
config.flagsThe feature flags to enable. Check the official docs for more info.enable-registration enable-login disable-demo-users disable-demo-warning
config.apiSecretKeyA random secret key needed for persistent user sessions. Generate with openssl rand -hex 16 for example.b46a12cb4bedc6b9df8cb3f18c708b65
config.postgresql.hostThe PostgreSQL host to connect to.postgresql.penpot.svc.cluster.local
config.postgresql.portThe PostgreSQL host port to use.5432
config.postgresql.databaseThe PostgreSQL database to use.""
config.postgresql.usernameThe database username to use.""
config.postgresql.passwordThe database username to use.""
config.postgresql.existingSecretThe name of an existing secret.""
config.postgresql.secretKeys.usernameKeyThe username key to use from an existing secret.""
config.postgresql.secretKeys.passwordKeyThe password key to use from an existing secret.""
config.redis.hostThe Redis host to connect to.redis-headless.penpot.svc.cluster.local
config.redis.portThe Redis host port to use.6379
config.redis.databaseThe Redis database to connect to.0
config.assets.storageBackendThe storage backend for assets to use. Use assets-fs for filesystem, and assets-s3 for S3.assets-fs
config.assets.filesystem.directoryThe storage directory to use if you chose the filesystem storage backend./opt/data/assets
config.assets.s3.accessKeyIDThe S3 access key ID to use if you chose the S3 storage backend.""
config.assets.s3.secretAccessKeyThe S3 secret access key to use if you chose the S3 storage backend.""
config.assets.s3.regionThe S3 region to use if you chose the S3 storage backend.""
config.assets.s3.bucketThe name of the S3 bucket to use if you chose the S3 storage backend.""
config.assets.s3.endpointURIThe S3 endpoint URI to use if you chose the S3 storage backend.""
config.assets.s3.existingSecretThe name of an existing secret.""
config.assets.s3.secretKeys.accessKeyIDKeyThe S3 access key ID to use from an existing secret.""
config.assets.s3.secretKeys.secretAccessKeyThe S3 secret access key to use from an existing secret.""
config.assets.s3.secretKeys.endpointURIKeyThe S3 endpoint URI to use from an existing secret.""
config.telemetryEnabledWhether to enable sending of anonymous telemetry data.true
config.smtp.enabledWhether to enable SMTP configuration. You also need to add the 'enable-smtp' flag to the PENPOT_FLAGS variable.false
config.smtp.defaultFromThe SMTP default email to send from.""
config.smtp.defaultReplyToThe SMTP default email to reply to.""
config.smtp.hostThe SMTP host to use.""
config.smtp.portThe SMTP host port to use.""
config.smtp.usernameThe SMTP username to use.""
config.smtp.passwordThe SMTP password to use.""
config.smtp.tlsWhether to use TLS for the SMTP connection.true
config.smtp.sslWhether to use SSL for the SMTP connection.false
config.smtp.existingSecretThe name of an existing secret.""
config.smtp.secretKeys.usernameKeyThe SMTP username to use from an existing secret.""
config.smtp.secretKeys.passwordKeyThe SMTP password to use from an existing secret.""
config.registrationDomainWhitelistComma separated list of allowed domains to register. Empty to allow all domains.""
config.providers.google.enabledWhether to enable Google configuration. To enable Google auth, add enable-login-with-google to the flags.false
config.providers.google.clientIDThe Google client ID to use. To enable Google auth, add enable-login-with-google to the flags.""
config.providers.google.clientSecretThe Google client secret to use. To enable Google auth, add enable-login-with-google to the flags.""
config.providers.github.enabledWhether to enable GitHub configuration. To enable GitHub auth, also add enable-login-with-github to the flags.false
config.providers.github.clientIDThe GitHub client ID to use.""
config.providers.github.clientSecretThe GitHub client secret to use.""
config.providers.gitlab.enabledWhether to enable GitLab configuration. To enable GitLab auth, also add enable-login-with-gitlab to the flags.false
config.providers.gitlab.baseURIThe GitLab base URI to use.https://gitlab.com
config.providers.gitlab.clientIDThe GitLab client ID to use.""
config.providers.gitlab.clientSecretThe GitLab client secret to use.""
config.providers.oidc.enabledWhether to enable OIDC configuration. To enable OpenID Connect auth, also add enable-login-with-oidc to the flags.false
config.providers.oidc.baseURIThe OpenID Connect base URI to use.""
config.providers.oidc.clientIDThe OpenID Connect client ID to use.""
config.providers.oidc.clientSecretThe OpenID Connect client secret to use.""
config.providers.oidc.authURIOptional OpenID Connect auth URI to use. Auto discovered if not provided.""
config.providers.oidc.tokenURIOptional OpenID Connect token URI to use. Auto discovered if not provided.""
config.providers.oidc.userURIOptional OpenID Connect user URI to use. Auto discovered if not provided.""
config.providers.oidc.rolesOptional OpenID Connect roles to use. If no role is provided, roles checking disabled.role1 role2
config.providers.oidc.rolesAttributeOptional OpenID Connect roles attribute to use. If not provided, the roles checking will be disabled.""
config.providers.oidc.scopesOptional OpenID Connect scopes to use. This settings allow overwrite the required scopes, use with caution because penpot requres at least name and email attrs found on the user info. Optional, defaults to openid profile.scope1 scope2
config.providers.oidc.nameAttributeOptional OpenID Connect name attribute to use. If not provided, the name prop will be used.""
config.providers.oidc.emailAttributeOptional OpenID Connect email attribute to use. If not provided, the email prop will be used.""
config.providers.ldap.enabledWhether to enable LDAP configuration. To enable LDAP, also add enable-login-with-ldap to the flags.false
config.providers.ldap.hostThe LDAP host to use.ldap
config.providers.ldap.portThe LDAP port to use.10389
config.providers.ldap.sslWhether to use SSL for the LDAP connection.false
config.providers.ldap.startTLSWhether to utilize StartTLS for the LDAP connection.false
config.providers.ldap.baseDNThe LDAP base DN to use.ou=people,dc=planetexpress,dc=com
config.providers.ldap.bindDNThe LDAP bind DN to use.cn=admin,dc=planetexpress,dc=com
config.providers.ldap.bindPasswordThe LDAP bind password to use.GoodNewsEveryone
config.providers.ldap.attributesUsernameThe LDAP attributes username to use.uid
config.providers.ldap.attributesEmailThe LDAP attributes email to use.mail
config.providers.ldap.attributesFullnameThe LDAP attributes fullname to use.cn
config.providers.ldap.attributesPhotoThe LDAP attributes photo format to use.jpegPhoto
config.providers.existingSecretThe name of an existing secret to use.""
config.providers.secretKeys.googleClientIDKeyThe Google client ID key to use from an existing secret.""
config.providers.secretKeys.googleClientSecretKeyThe Google client secret key to use from an existing secret.""
config.providers.secretKeys.githubClientIDKeyThe GitHub client ID key to use from an existing secret.""
config.providers.secretKeys.githubClientSecretKeyThe GitHub client secret key to use from an existing secret.""
config.providers.secretKeys.gitlabClientIDKeyThe GitLab client ID key to use from an existing secret.""
config.providers.secretKeys.gitlabClientSecretKeyThe GitLab client secret key to use from an existing secret.""
config.providers.secretKeys.oidcClientIDKeyThe OpenID Connect client ID key to use from an existing secret.""
config.providers.secretKeys.oidcClientSecretKeyThe OpenID Connect client secret key to use from an existing secret.""

PostgreSQL configuration (Check for more parameters here)

NameDescriptionValue
postgresql.auth.usernameName for a custom user to create.example
postgresql.auth.passwordPassword for the custom user to create.secretpassword
postgresql.auth.databaseName for a custom database to create.penpot

Redis configuration (Check for more parameters here)

NameDescriptionValue
redis.auth.enabledWhether to enable password authentication.false

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

helm install example \
  --set user=example \
  --set password=example \
    codechem/example

Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,

helm install example -f values.yaml codechem/example

Tip: You can use the default values.yaml

Configuration and installation details

Common configuration

There are two types of configuration: options (properties that requieres some value) and flags (that just enables or disables something). The PENPOT_FLAGS environment variable will have an ordered list of strings using this format: <enable|disable>-<flag-name>.

Regarding the flags, they are all listed in the official docs, and here are the additional flags which are not mentioned in the chart configuration above, but you can still use them!

Authentication providers

For configuration of the authentication with third-party auth providers you will need to configure penpot and set the correct callback of your penpot instance in the auth-provider configuration. The callback has the following format:

<https://<your_domain>/api/auth/oauth/<oauth_provider>/callback>

You will need to change <your_domain> and <oauth_provider> according to your setup. This is how it looks with the gitlab.com provider:

<https://<your_domain>/api/auth/oauth/gitlab/callback>

Redis configuration

The redis configuration is very simple, just provide a valid Redis URI. Redis is used mainly for websocket notifications coordination. Currently just a non authentication connection is supported!

License

Copyright © 2022 CodeChem

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.