Setup Seafile with a single K8S pod with Seafile Helm Chart

This manual explains how to deploy and run Seafile server on a Linux server using Seafile Helm Chart (chart thereafter) in a single pod (i.e., single node mode). Comparing to Setup by K8S resource files, deployment with helm chart can simplify the deployment process and provide more flexible deployment control, which the way we recommend in deployment with K8S.

For specific environment and configuration requirements, please refer to the description of the Docker-based Seafile single-node deployment. Please also refer to the description of the K8S tool section in here.

Preparation

For persisting data using in the docker-base deployment, /opt/seafile-data, is still adopted in this manual. What's more, all K8S YAML files will be placed in /opt/seafile-k8s-yaml (replace it when following these instructions if you would like to use another path).

By the way, we don't provide the deployment methods of basic services (e.g., Redis, MySQL and Elasticsearch) and seafile-compatibility components (e.g., SeaDoc) for K8S in our document. If you need to install these services in K8S format, you can refer to the rewrite method in this document.

System requirements

Please refer here for the details of system requirements about Seafile service. By the way, this will apply to all nodes where Seafile pods may appear in your K8S cluster. In general, we recommend that each node should have at least 2G RAM and a 2-core CPU (> 2GHz).

Install Seafile helm chart

1. Create namespace

   kubectl create namespace seafile
   

2. Create a secret for sensitive data. The default Secret name is seafile-secret:

   Seafile ProSeafile CE

   kubectl create secret generic seafile-secret --namespace seafile \
   --from-literal=JWT_PRIVATE_KEY='<required>' \
   --from-literal=SEAFILE_MYSQL_DB_PASSWORD='<required>' \
   --from-literal=INIT_SEAFILE_ADMIN_PASSWORD='<required>' \
   --from-literal=INIT_SEAFILE_MYSQL_ROOT_PASSWORD='<required>' \
   --from-literal=REDIS_PASSWORD='' \
   --from-literal=S3_SECRET_KEY='' \
   --from-literal=S3_SSE_C_KEY=''
   

   kubectl create secret generic seafile-secret --namespace seafile \
   --from-literal=JWT_PRIVATE_KEY='<required>' \
   --from-literal=SEAFILE_MYSQL_DB_PASSWORD='<required>' \
   --from-literal=INIT_SEAFILE_ADMIN_PASSWORD='<required>' \
   --from-literal=INIT_SEAFILE_MYSQL_ROOT_PASSWORD='<required>' \
   --from-literal=REDIS_PASSWORD=''
   

   where the JWT_PRIVATE_KEY can be generate by pwgen -s 40 1.

   Use an existing Secret or a custom Secret name

   The chart does not create this Secret. To use an existing Secret with another name, create it in the seafile namespace with the required keys above, then set its name in my-values.yaml:

   seafile:
     existingSecret:
       name: my-seafile-secret
   

   This setting changes only the Secret resource name. The required key names remain unchanged.

3. Download and modify the my-values.yaml according to your configurations. By the way, you can follow here for the details:

   Seafile ProSeafile CE

   wget -O my-values.yaml https://haiwen.github.io/seafile-helm-chart/values/13.0/pro.yaml
   
   nano my-values.yaml
   

   wget -O my-values.yaml https://haiwen.github.io/seafile-helm-chart/values/13.0/ce.yaml
   
   nano my-values.yaml
   

   Tip

   • It is not necessary to use the my-values.yaml we provided (i.e., you can create an empty my-values.yaml and add required field, as others have defined default values in our chart), because it destroys the flexibility of deploying with Helm, but it contains some formats of how Seafile Helm Chart reads these configurations, as well as all the environment variables and secret variables that can be read directly.

   • In addition, you can also create a custom storageClassName for the persistence directory used by Seafile. You only need to specify storageClassName in the seafile.config.seafileDataVolume object in my-values.yaml:

     seafile:
       configs:
         seafileDataVolume:
           storageClassName: <your seafile storage class name>
       ...
     

   Expose Seafile service

   The chart creates a ClusterIP Service named seafile on port 80. It is not accessible from outside the cluster by itself. You can enable either an Ingress or a Gateway API HTTPRoute in my-values.yaml. Do not enable both unless you intentionally need two external routes.

   IngressGateway API HTTPRoute

   Use this option when your cluster has an Ingress controller. Replace the values below with those for your environment:

   ingress:
     enabled: true
     className: nginx
     annotations: {}
     hosts:
       - host: seafile.example.com
         paths:
           - path: /
             pathType: Prefix
     tls:
       - secretName: seafile-tls-cert
         hosts:
           - seafile.example.com
   

   The chart creates an Ingress named seafile and forwards each configured path to the seafile Service on port 80. TLS is optional; its Secret must be managed separately.

   Use this option when your cluster has Gateway API v1 CRDs and a Gateway controller. The referenced Gateway must already exist and allow routes from the release namespace:

   httpRoute:
     enabled: true
     annotations: {}
     parentRefs:
       - name: seafile-gateway
         # namespace: gateway-namespace  # Required when the Gateway is in another namespace.
     hostnames:
       - seafile.example.com
   

   The chart creates an HTTPRoute named seafile. It always matches the / path prefix and forwards requests to the seafile Service on port 80. Gateway listeners, TLS certificates, and advanced routing rules are managed separately.

4. Then install the chart use the following command:

   Seafile ProSeafile CE

   helm repo add seafile https://haiwen.github.io/seafile-helm-chart/repo
   helm upgrade --install seafile seafile/pro --version 13.0.4 --namespace seafile --create-namespace --values my-values.yaml
   

   helm repo add seafile https://haiwen.github.io/seafile-helm-chart/repo
   helm upgrade --install seafile seafile/ce --version 13.0.4 --namespace seafile --create-namespace --values my-values.yaml
   

   Seafile helm chart 13.0 support variable validity checking

   Starting from Seafile helm chart 13.0, the validity of variables in my-values.yaml will be checked at deployment time. When there is a variable validity check that fails, you may encounter the following error message:

   You have enabled <Some feature> but <Variable> is not specified and is not allowed to be empty
   

   If you encounter the following message, please check the relevant configuration in my-values.yaml.

After installing the chart, the Seafile pod should startup automaticlly.

About Seafile service

The chart creates a ClusterIP Service named seafile on port 80. Enable the chart's ingress or httpRoute configuration, or expose this Service with an operator-managed Ingress, Gateway, or load balancer.

Important for deployment

By default, Seafile will access the Elasticsearch (Pro only) with the specific service name: - Elasticsearch: elasticsearch with port 9200

If the above services are:

• Not in your K8S pods (including using an external service)
• With different service name
• With different server port

Please modfiy the files in /opt/seafile-data/seafile/conf to make correct the configurations for above services, otherwise the Seafile server cannot start normally. Then restart Seafile server:

kubectl delete pods -n seafile $(kubectl get pods -n seafile -o jsonpath='{.items[*].metadata.name}' | grep seafile)

Activating the Seafile License (Pro)

If you have a seafile-license.txt license file, simply put it in the volume of the Seafile container. The volumne's default path in the Compose file is /opt/seafile-data. If you have modified the path, save the license file under your custom path.

If the license file has a different name or cannot be read, Seafile server will start with in trailer mode with most THREE users

Then restart Seafile:

kubectl delete pods -n seafile $(kubectl get pods -n seafile -o jsonpath='{.items[*].metadata.name}' | grep seafile)

A safer way to use your Seafile license file

You can also create a secret resource to encrypt your license file in your K8S cluster, which is a safer way:

kubectl create secret generic seafile-license --from-file=seafile-license.txt=$PATH_TO_YOUR_LICENSE_FILE --namespace seafile

Then modify my-values.yaml to add the information extra volumes:

seafile:
...
extraVolumes:
  - name: seafileLicense
  volumeInfo:
    secret:
    secretName: seafile-license
      items:
        - key: seafile-license.txt
        path: seafile-license.txt
    subPath: seafile-license.txt
    mountPath: /shared/seafile/seafile-license.txt
    readOnly: true

Finally you can upgrade your chart by:

Seafile ProSeafile CE

helm upgrade --install seafile seafile/pro --version 13.0.4 --namespace seafile --create-namespace --values my-values.yaml

helm upgrade --install seafile seafile/ce --version 13.0.4 --namespace seafile --create-namespace --values my-values.yaml

Version control

Seafile Helm Chart is designed to provide fast deployment and version control. You can update and rollback versions using the following setps:

1. Update Helm repo

   helm repo update
   

   Tip

   When using the repo update command, this will not always take effect immediately, as the previous repo will be stored in the cache.

2. Download (optional) and modify the new my-values.yaml

   Seafile ProSeafile CE

   wget -O my-values.yaml https://haiwen.github.io/seafile-helm-chart/values/<seafile-version>/pro.yaml
   
   nano my-values.yaml
   

   wget -O my-values.yaml https://haiwen.github.io/seafile-helm-chart/values/<seafile-version>/ce.yaml
   
   nano my-values.yaml
   

   About version of Seafile Helm Chart and Seafile

   The version of Seafile Helm Chart is same as the major version of Seafile, i.e.:

   • Seafile version: 13.0
   • Helm Chart release: 13.0.4

   Use an explicit chart version, such as 13.0.4, for reproducible deployments. The unversioned 13.0 package may be updated with a newer chart revision.

3. Upgrade release to a new version

   Seafile ProSeafile CE

   helm upgrade --install seafile seafile/pro --namespace seafile --create-namespace --values my-values.yaml --version <release-version>
   

   helm upgrade --install seafile seafile/ce --namespace seafile --create-namespace --values my-values.yaml --version <release-version>
   

4. (Rollback) if you would like rollback to your old-running release, you can use following command to rollback your current instances

   helm rollback seafile -n seafile <revision>
   

Uninstall chart

You can uninstall chart by the following command:

helm delete seafile --namespace seafile

Advanced operations

For standard external access, use the chart's ingress or httpRoute configuration above. Refer to advanced K8S management when you need to manage Gateway resources or custom routing rules manually.