Files

Georg K 99e1245ed3 feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-12 05:45:10 +03:00

3.4 KiB

Raw Blame History

FreeRADIUS Helm chart

Deploys the custom FreeRADIUS 3.2.x build — with the rlm_raw module, PostgreSQL backend and REST-based dynamic clients — to Kubernetes.

The chart is published to the Gitea Helm registry by CI: https://git.ahax86.ru/api/packages/pub/helm

Prerequisites

The container image must be published (CI job build-image): git.ahax86.ru/pub/freeradius:<version>.
A reachable PostgreSQL with the RADIUS schema (radacct, radcheck, nas, ...).
The REST hotspotter service (fallback NAS authorization).
If the image registry is private: a pre-created docker-registry Secret, referenced via imagePullSecrets.

Install

helm repo add --username <user> --password <token> \
  ahax86 https://git.ahax86.ru/api/packages/pub/helm
helm repo update

helm upgrade --install freeradius ahax86/freeradius \
  --namespace radius --create-namespace \
  --set db.host=postgresql-pgbouncer \
  --set db.password=<db-password>

Use an existing Secret for the DB password instead of --set db.password:

helm upgrade --install freeradius ahax86/freeradius -n radius \
  --set db.existingSecret=freeradius-db --set db.passwordKey=password

db.password (or db.existingSecret) is required — install fails otherwise.

How config is delivered

default (virtual server) and rest (hotspotter) render into a ConfigMap.
sql renders into the same ConfigMap but the password is not stored there: it is read at runtime via $ENV{DB_PASSWORD}, injected from the DB Secret.
The entrypoint copies /configs/{default,sql,rest} into /etc/freeradius.
Certificates live on a PVC and survive restarts.

Values

Key	Default	Description
`replicaCount`	`1`	Pod replicas.
`image.repository`	`git.ahax86.ru/pub/freeradius`	Image repo.
`image.tag`	`""`	Empty → chart `appVersion`.
`image.pullPolicy`	`IfNotPresent`
`imagePullSecrets`	`[]`	Names of pull secrets.
`args`	`[freeradius, -f]`	Use `[freeradius, -X]` for debug.
`service.type`	`NodePort`	`ClusterIP` / `NodePort` / `LoadBalancer`.
`service.authPort` / `service.acctPort`	`31812` / `31813`	UDP ports.
`service.authNodePort` / `service.acctNodePort`	`31812` / `31813`	NodePort only.
`service.externalTrafficPolicy`	`Local`	NodePort only.
`db.host` / `db.port`	`postgresql-pgbouncer` / `6432`	PostgreSQL.
`db.user` / `db.name`	`admin` / `radius_db`
`db.password`	`""`	Required unless `db.existingSecret`.
`db.existingSecret` / `db.passwordKey`	`""` / `db-password`	Use an existing Secret.
`api.host` / `api.port`	`hotspotter` / `8080`	REST hotspotter.
`persistence.enabled`	`true`	Cert PVC (else `emptyDir`).
`persistence.existingClaim`	`""`	Use a pre-created PVC.
`persistence.storageClass`	`""`
`persistence.size`	`32Mi`
`resources` / `nodeSelector` / `tolerations` / `affinity`	`{}` / `{}` / `[]` / `{}`	Scheduling.
`env`	`{TZ: UTC}`	Extra container env.

Note: the previous deployment pinned nodeSelector freeradius=enabled and a matching toleration. These are no longer hardcoded — set them via nodeSelector / tolerations if your nodes are tainted.

Render locally

helm template freeradius charts/freeradius --set db.password=test | less
helm lint charts/freeradius --set db.password=test

3.4 KiB Raw Blame History