Helm chart

[davidjpeters]

Add Helm Chart and OpenShift Compatibility

This PR contributes a Helm chart for deploying ResourceSpace on OpenShift, along with the image modifications required to run under OpenShift's restricted-v2 Security Context Constraint (SCC). The following work was done as part of a trial run of deploying applications to the OpenShift platform, and we felt it appropriate to contribute this work upstream to provide a resource for others who may desire something similar in the future. If these changes are accepted feel free to reorganize/restructure them in whichever way best fits the project. Any original files (Dockerfile, entrypoint.sh, etc) that were modified have been placed in the openshift directory

---

What's included

OpenShift image modifications

The upstream image runs Apache on port 80 as root, which is not permitted under OpenShift's default restricted-v2 SCC. The following changes make the image compatible:

• ports.conf — configures Apache to listen on port 8080 instead of 80
• 000-default.conf — updates the default vhost to port 8080
• entrypoint.sh — redirects Apache runtime files (PID, lock, log) to /tmp, which is writable by any UID; also handles config.php persistence across pod restarts via the filestore volume
• Dockerfile — copies the above configs, makes runtime directories world-writable, and exposes port 8080

Helm chart (helm/)

A complete Helm chart for deploying ResourceSpace on OpenShift 4.x with:

• ResourceSpace Deployment with liveness/readiness probes
• MariaDB StatefulSet with persistent storage
• PersistentVolumeClaims for filestore and MariaDB data (dynamic provisioning via StorageClass)
• OpenShift Route with edge TLS termination
• Secret for database credentials
• Input validation that fails fast if required values are not set at install time

---

Testing

Tested on OpenShift 4.12 with:

• Dynamic PVC provisioning via Ceph RBD
• MariaDB 11 StatefulSet
• ResourceSpace 10.7
• Full setup wizard flow, file uploads, and pod restart persistence verified

---

Licensing

Portions of this contribution were authored by the Government of Canada. See NOTICE for full attribution. Contributions are provided under the existing BSD-3-Clause licence of this repository in accordance with its contribution model. Crown copyright is retained for the portions authored by public servants in the form submitted, as noted in NOTICE. This does not modify or replace the applicable licence or affect any permissions granted to users.

---

Notes for maintainers

• The Helm chart requires the modified image (port 8080) — it will not work with the unmodified upstream image
• config.php persistence is handled by the entrypoint via a symlink to the filestore PVC on first run, and a copy-and-patch on subsequent restarts
• The setup wizard requires using the internal service URL (http://resourcespace) for the Base URL field due to OpenShift's ingress routing — the entrypoint corrects this automatically on restart