Skip to content

docs: GitOps and own-Secrets examples for 2.0.0's defaults #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
levivannoort merged 2 commits into from
Oct 14, 2026
Merged

docs: GitOps and own-Secrets examples for 2.0.0's defaults #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b812990
docs: GitOps and own-Secrets examples for 2.0.0's defaults
levivannoort Oct 14, 2026
e1ee19b
docs: Sysbox needs privileged: false with 2.0.0's defaults
levivannoort Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions charts/appwrite/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -908,10 +908,10 @@ The build orchestrator and the executor.
| compute.executor.podAnnotations | object | `{}` | Pod annotations, merged over `defaults.podAnnotations`. |
| compute.executor.podLabels | object | `{}` | Pod labels, merged over `defaults.podLabels`. |
| compute.executor.priorityClassName | string | `""` | Priority class. Empty inherits `defaults.priorityClassName`. |
| compute.executor.privileged | bool | `true` | Run the Docker daemon as a privileged container, which makes it root on its node. Required unless `runtimeClassName` names a runtime that runs Docker without it, such as Sysbox. For production, give the executor nodes of its own (`nodeSelector`, `tolerations`). |
| compute.executor.privileged | bool | `true` | Run the Docker daemon as a privileged container, which makes it root on its node. Set to false, together with `runtimeClassName`, for a runtime that runs Docker without it, such as Sysbox. For production, give the executor nodes of its own (`nodeSelector`, `tolerations`). |
| compute.executor.replicaCount | int | `1` | Executor replicas. Each has its own Docker daemon: a runtime starts on the replica an execution reaches and stays there until it's idle. |
| compute.executor.resources | object | `{"limits":{"memory":"4Gi"},"requests":{"cpu":"500m","memory":"1Gi"}}` | Resources of the Docker daemon container, which runs the executor and every runtime: size it for the executions you expect. |
| compute.executor.runtimeClassName | string | `""` | RuntimeClass of executor pods, e.g. `sysbox-runc`. |
| compute.executor.runtimeClassName | string | `""` | RuntimeClass of executor pods, e.g. `sysbox-runc` (with `privileged: false`). |
| compute.executor.terminationGracePeriodSeconds | int | `60` | Seconds to wait on shutdown. |
| compute.executor.tolerations | list | `[]` | Tolerations. Empty inherits `defaults.tolerations`. |
| compute.executor.topologySpreadConstraints | list | `[]` | Topology spread constraints. Empty inherits `defaults.topologySpreadConstraints`, or spreads replicas across nodes. |
Expand Down
4 changes: 2 additions & 2 deletions charts/appwrite/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1379,7 +1379,7 @@
"type": "string"
},
"privileged": {
"description": "Run the Docker daemon as a privileged container, which makes it root on its node. Required unless `runtimeClassName` names a runtime that runs Docker without it, such as Sysbox. For production, give the executor nodes of its own (`nodeSelector`, `tolerations`).",
"description": "Run the Docker daemon as a privileged container, which makes it root on its node. Set to false, together with `runtimeClassName`, for a runtime that runs Docker without it, such as Sysbox. For production, give the executor nodes of its own (`nodeSelector`, `tolerations`).",
"type": "boolean"
},
"replicaCount": {
Expand Down Expand Up @@ -1419,7 +1419,7 @@
"description": "Resources of the Docker daemon container, which runs the executor and every runtime: size it for the executions you expect."
},
"runtimeClassName": {
"description": "RuntimeClass of executor pods, e.g. `sysbox-runc`.",
"description": "RuntimeClass of executor pods, e.g. `sysbox-runc` (with `privileged: false`).",
"type": "string"
},
"terminationGracePeriodSeconds": {
Expand Down
9 changes: 5 additions & 4 deletions charts/appwrite/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -828,11 +828,12 @@ compute:
# on Docker-in-Docker, in a namespace of its own.
executor:
# -- Run the Docker daemon as a privileged container, which makes it root
# on its node. Required unless `runtimeClassName` names a runtime that runs
# Docker without it, such as Sysbox. For production, give the executor
# nodes of its own (`nodeSelector`, `tolerations`).
# on its node. Set to false, together with `runtimeClassName`, for a
# runtime that runs Docker without it, such as Sysbox. For production,
# give the executor nodes of its own (`nodeSelector`, `tolerations`).
privileged: true
# -- RuntimeClass of executor pods, e.g. `sysbox-runc`.
# -- RuntimeClass of executor pods, e.g. `sysbox-runc` (with
# `privileged: false`).
runtimeClassName: ""
# -- Namespace of the executor. Defaults to `<release namespace>-executor`.
# Use a different one per release when several releases share a namespace.
Expand Down
38 changes: 31 additions & 7 deletions docs/gitops.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,26 @@ credentials, and how upgrades run Appwrite's data migration.
> clickhouse:
> password:
> secretName: appwrite-credentials
> storage:
> s3: # the built-in object storage's keys too
> accessKeyId:
> secretName: appwrite-credentials
> secretAccessKey:
> secretName: appwrite-credentials
> compute:
> secrets:
> existingSecret: appwrite-credentials
> executor:
> existingSecret: appwrite-executor # a copy in the executor namespace
Comment on lines +40 to +49

@hansi-codes hansi-codes Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documented Secret creation command omits these required keys

The kubectl create secret example below creates appwrite-credentials without s3-access-key, s3-secret-key, executor-secret or orchestrator-secret, but this values example now points S3 and compute credentials at that Secret. Following the documented setup therefore leaves required keys absent; please add them to the creation instructions or mark that command as partial.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: docs/gitops.md
Line: 40-49

Comment:
**The documented Secret creation command omits these required keys**

The `kubectl create secret` example below creates `appwrite-credentials` without `s3-access-key`, `s3-secret-key`, `executor-secret` or `orchestrator-secret`, but this values example now points S3 and compute credentials at that Secret. Following the documented setup therefore leaves required keys absent; please add them to the creation instructions or mark that command as partial.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

🟡 Minor · documentation · Reply if this doesn't apply.

> migrations:
> mode: job
> ```
>
> With Functions and Sites, add the [compute Secrets](#what-goes-in-the-secrets)
> too. [Credentials](#credentials) has the details.
> Functions and Sites are on by default, so the executor needs
> [its own copy](#what-goes-in-the-secrets) of its secret and the S3 keys, in
> its namespace. Without Functions and Sites, set `compute.enabled: false`
> and leave out the `compute` block. [Credentials](#credentials) has the
Comment on lines +56 to +57

@hansi-codes hansi-codes Bot Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The no-compute instructions contradict each other

This says to set compute.enabled: false and leave out the entire compute block, but the setting itself must be in that block (and compute is enabled by default). A user omitting the block will still render Functions and Sites; clarify that they need a minimal compute: { enabled: false } setting.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: docs/gitops.md
Line: 56-57

Comment:
**The no-compute instructions contradict each other**

This says to set `compute.enabled: false` and leave out the entire `compute` block, but the setting itself must be in that block (and compute is enabled by default). A user omitting the block will still render Functions and Sites; clarify that they need a minimal `compute: { enabled: false }` setting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

🟡 Minor · documentation · Reply if this doesn't apply.

> details.

## Credentials

Expand Down Expand Up @@ -83,9 +97,9 @@ change it.
| `database.password.secretName` | `db-password` (`database.password.secretKey`) | always: generated for the built-in PostgreSQL, required for an external database |
| `redis.password.secretName` | `redis-password` (`redis.password.secretKey`) | built-in Redis with `redis.builtin.requirePassword` (the default), or an external Redis with a password |
| `clickhouse.password.secretName` | `clickhouse-password` (`clickhouse.password.secretKey`) | built-in ClickHouse, or an external one with a password |
| `compute.secrets.existingSecret` | `executor-secret`, `orchestrator-secret` (`compute.secrets.executorSecretKey`, `orchestratorSecretKey`) | `compute.enabled` |
| `compute.executor.existingSecret`, **in the executor namespace** | `executor-secret`, `s3-access-key`, `s3-secret-key` ([executor.md](executor.md#existing-secrets)) | `compute.enabled`, with `compute.secrets.existingSecret` or an S3 `secretName` |
| `storage.s3.accessKeyId.secretName`, `storage.s3.secretAccessKey.secretName` | `s3-access-key`, `s3-secret-key` (their `secretKey`) | S3 storage |
| `compute.secrets.existingSecret` | `executor-secret`, `orchestrator-secret` (`compute.secrets.executorSecretKey`, `orchestratorSecretKey`) | `compute.enabled`, the default |
| `compute.executor.existingSecret`, **in the executor namespace** | `executor-secret`, `s3-access-key`, `s3-secret-key` ([executor.md](executor.md#existing-secrets)) | `compute.enabled`, the default, with `compute.secrets.existingSecret` or an S3 `secretName` |
| `storage.s3.accessKeyId.secretName`, `storage.s3.secretAccessKey.secretName` | `s3-access-key`, `s3-secret-key` (their `secretKey`) | `storage.device: s3`, the default: for the built-in object storage too, whose keys the chart would otherwise generate |
| `documentsDb.password.secretName`, `vectorsDb.password.secretName` | `documentsdb-password`, `vectorsdb-password` (their `secretKey`) | DocumentsDB or VectorsDB with a password other than the main database's |
| `smtp.password.secretName` | `smtp-password` (`smtp.password.secretKey`) | SMTP with a password |

Expand Down Expand Up @@ -298,12 +312,22 @@ spec:
clickhouse:
password:
secretName: appwrite-credentials
migrations:
mode: job
storage:
s3:
accessKeyId:
secretName: appwrite-credentials
secretAccessKey:
secretName: appwrite-credentials
volume:
annotations:
argocd.argoproj.io/sync-options: Prune=false,Delete=false
compute:
secrets:
existingSecret: appwrite-credentials
executor:
existingSecret: appwrite-executor
migrations:
mode: job
# ... the rest of your values
destination:
server: https://kubernetes.default.svc
Expand Down
16 changes: 14 additions & 2 deletions docs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,9 @@ Executions need a Docker daemon: the
container per runtime. In the cluster the chart gives each executor pod its
own daemon (Docker-in-Docker), which runs as a **privileged container: root
on its node**, and it runs your users' code. That is the one exception to the
standards above, and the chart only renders it when you accept it
(`compute.executor.privileged: true`, or `runtimeClassName` for Sysbox):
standards above. It's on by default (`compute.executor.privileged: true`);
turn it off with `compute.enabled: false`, or run the daemon through Sysbox
instead (`privileged: false` with `runtimeClassName`):

- The executor gets a namespace of its own, the only one labelled for the
`privileged` standard. The Appwrite namespace stays `restricted` and the
Expand Down Expand Up @@ -166,6 +167,17 @@ redis:
clickhouse:
password:
secretName: appwrite-clickhouse # key: clickhouse-password
storage:
s3: # the built-in object storage's keys too
accessKeyId:
secretName: appwrite-s3 # key: s3-access-key
secretAccessKey:
secretName: appwrite-s3 # key: s3-secret-key
compute: # Functions and Sites, on by default
secrets:
existingSecret: appwrite-compute # keys: executor-secret, orchestrator-secret
executor:
existingSecret: appwrite-executor # a copy in the executor namespace (executor.md#existing-secrets)
```

Key names are configurable (`appwrite.secrets.keys.*`, and `secretKey` next
Expand Down
4 changes: 2 additions & 2 deletions docs/storage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,12 +186,12 @@ If you restricted egress with
`networkPolicy.egress.enabled`, allow the endpoint in
`networkPolicy.egress.extraRules` ([security.md](security.md#egress)).

With `endpoint` empty, Appwrite talks to AWS S3 with virtual-hosted URLs
With `storage.s3.external.endpoint` empty, Appwrite talks to AWS S3 with virtual-hosted URLs
(`<bucket>.s3.<region>.amazonaws.com`). With an endpoint, it uses path-style
URLs (`<endpoint>/<bucket>/...`), which every S3-compatible store accepts. An
endpoint without a scheme gets `https://`.

| Provider | `endpoint` | `region` |
| Provider | `external.endpoint` | `external.region` |
| --- | --- | --- |
| AWS S3 | *(empty)* | the bucket's region, e.g. `eu-central-1` |
| Cloudflare R2 | `https://<account id>.r2.cloudflarestorage.com` | `auto` |
Expand Down
13 changes: 8 additions & 5 deletions docs/troubleshooting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,10 +219,12 @@ the built-in ClickHouse with your own Secret too.

### S3: uploads fail with `SignatureDoesNotMatch`, `AccessDenied` or `NoSuchBucket`

Check `region` (R2 and GCS use `auto`), that the bucket exists, and that the
key may read, write, list and delete in it. With an `endpoint`, Appwrite uses
path-style URLs, which the store must accept
([storage.md](storage.md#s3)).
With your own store, check `storage.s3.external.region` (R2 and GCS use
`auto`), that the bucket exists, and that the key may read, write, list and
delete in it. With an `external.endpoint`, Appwrite uses path-style URLs,
which the store must accept ([storage.md](storage.md#your-own-s3-store)). With
the built-in object storage, check that the `seaweedfs` pod is ready: it
creates the bucket when it starts.

### Emails don't arrive

Expand Down Expand Up @@ -392,7 +394,8 @@ ordinary Jobs.

The alternative is [Sysbox](https://github.com/nestybox/sysbox), which runs
the daemon without `privileged`: install it on the executor's nodes and set
`compute.executor.runtimeClassName: sysbox-runc` instead
`compute.executor.privileged: false` with
`compute.executor.runtimeClassName: sysbox-runc`
([executor.md](executor.md#without-a-privileged-container)). CI doesn't test
it.

Expand Down
Loading