# S3 proxying in Kubernetes via S3-Gateway

> [HTML Version](proxy-s3-kubernetes.html)

Proxying traffic to S3 storage is one of the steps for preparing the BRIX infrastructure. The S3‑Gateway tool can be used for this purpose. 

It provides access to the S3 storage deployed inside or outside the Kubernetes cluster via a single entry point — domain (FQDN) or IP address for BRIX.

S3-Gateway installation consists of four steps:

1. [Download the Helm chart and configuration file](#download-helm-chart-and-config-file).

2. [Fill in the configuration file](#fill-config-file).

3. [Install the S3 Gateway chart using Helm in the Kubernetes cluster](#set-chart-s3-gateway).

4. [Connect to S3](#s3-connect).

## Step 1: Download the Helm chart and configuration file

To install via the internet, obtain the \[OBJECT\] configuration file by executing the following command:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm show values brix365/s3gateway > values-s3gateway.yaml

````
Obtaining the configuration file for installation in a closed-loop environment without internet access

1. On a computer with internet access, download the archive of the latest version of the S3 Gateway chart from the brix365 repository:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm pull brix365/s3gateway

2. ````
Copy the obtained **s3gateway-X.Y.Z.tgz** chart archive to the server where the installation will take place.

3. Unpack the **s3gateway-X.Y.Z.tgz** chart on the installation server, and copy the \[OBJECT\] default configuration file to \[OBJECT\]: 

````
tar -xf s3gateway-X.Y.Z.tgz  
cp s3gateway/values.yaml values-s3gateway.yaml
````

## ````
Step 2: Fill in the configuration file

Fill in the configuration file \[OBJECT\]** **for the S3 Gateway installation:

1. In the \[OBJECT\] parameter, specify the domain (FQDN) or IP address through which the BRIX application is accessible. 

2. In the \[OBJECT\] parameter, specify the name of the S3 bucket in which the BRIX application stores files.  
The name of the bucket in S3 must correspond to the **s3brix365 **format.

````
Начало примера

````
Example

1. s3brix365.

2. s3brix365-dev.

3. s3brix365-prod.

````
конец примера

3. ````
The following changes should be made to the configuration file if the BRIX application web‑interface is accessible via HTTPS:

- Specify the domain (FQDN) in the \[OBJECT\] parameter.

- Enable TLS support by setting the value to \[OBJECT\] in the \[OBJECT\] parameter.

- Uncomment the parameters in the \[OBJECT\] section.

- For the \[OBJECT\] parameter, specify the domain (FQDN) through which the BRIX application is accessible.

- For the \[OBJECT\] parameter, specify the name of the TLS type secret for the domain specified in \[OBJECT\].

4. If high availability is required, specify the desired number of replicas in the \[OBJECT\] parameter.

5. The \[OBJECT\] parameter specifies the HAProxy configuration with which it will run in the Kubernetes cluster. In the \[OBJECT\] section of the HAProxy configuration, specify the list of S3 servers to which user traffic should be redirected.

How to proxy the user traffic in the S3 MinIO storage using the brix365 dbs chart without SSL support in the Kubernetes cluster

  
In this example, the S3 storage is installed according to the instruction in the [MinIO S3](configure-minio.md) article.

````
  
\# HAProxy settings for proxying connections to the S3 Storage  
haproxy:  
  ingress:  
    enabled: true  
  # enabling HAProxy Ingress support for working with OpenShift  
  openshift: false  
  # system's domain (FQDN) through which it is accessible  
  hostname: brix365-server.your\_domain  
  # name of the bucket (in the S3 storage) for the BRIX application  
  path: /s3brix365  
  # enabling https  
  tls: false  
  #  extraTls:  
  #  - hosts:  
  #      - brix365-server.your\_domain  
  #  secretName: brix365-server.your\_domain-tls  
  # number of replicas to ensure high availability  
  replicaCount: 1  
  containerPorts:  
    - name: http  
      containerPort: 8080  
  # HAProxy configuration  
  configuration: |  
    global  
      log stdout format raw local0  
      maxconn 1024  
    defaults  
      log global  
      timeout client 60s  
      timeout connect 60s  
      timeout server 60s  
    frontend s3\_main  
      bind :8080  
      default\_backend s3\_main  
    backend s3\_main  
      server s3\_1 minio.brix365-dbs.svc.cluster.local:80 check inter 2s  
  # safety context policy  
  podSecurityContext:  
    enabled: true  
    fsGroup: 1001  
  containerSecurityContext:  
    enabled: true  
    runAsUser: 1001  
    runAsNonRoot: true  
  # specifying resources  
  resources:  
    requests:  
      memory: "64Mi"  
      cpu: "50m"  
    limits:  
      memory: "512Mi"  
      cpu: "500m"  
...
````

````


How to proxy the user traffic in the S3 MinIO storage with SSL support

  
In this example, four S3 (MinIO) servers are located outside the Kubernetes cluster and deployed according to the instructions in [MinIO cluster](minio-cluster.md) article.

````
  
\# HAProxy settings for proxying connections to the S3 Storage  
haproxy:  
  ingress:  
    enabled: true  
  # enabling HAProxy Ingress support for working with OpenShift  
  openshift: false  
  # system's domain (FQDN) through which it is accessible  
  hostname: brix365-server.your\_domain  
  # name of the bucket (in the S3 storage) for the BRIX application  
  path: /s3brix365  
  # enabling https  
  tls: true  
    extraTls:  
    - hosts:  
        - brix365-server.your\_domain  
    secretName: brix365-server.your\_domain-tls  
  # number of replicas to ensure high availability  
  replicaCount: 1  
  containerPorts:  
    - name: http  
      containerPort: 8080  
  # HAProxy configuration  
  configuration: |  
    global  
      log stdout format raw local0  
      maxconn 100000  
    defaults  
      log global  
      timeout client 60s  
      timeout connect 60s  
      timeout server 60s  
    frontend s3\_main  
      bind :8080  
      default\_backend s3\_main  
    backend s3\_main  
      balance leastconn  
      server s3\_1 minio-server1.your\_domain:9000 check-ssl ssl verify none check inter 2s  
      server s3\_2 minio-server1.your\_domain:9000 check-ssl ssl verify none check inter 2s  
      server s3\_3 minio-server1.your\_domain:9000 check-ssl ssl verify none check inter 2s  
      server s3\_4 minio-server1.your\_domain:9000 check-ssl ssl verify none check inter 2s  
  # safety context policy  
  podSecurityContext:  
    enabled: true  
    fsGroup: 1001  
  containerSecurityContext:  
    enabled: true  
    runAsUser: 1001  
    runAsNonRoot: true  
  # resources  
  resources:  
    requests:  
      memory: "64Mi"  
      cpu: "50m"  
    limits:  
      memory: "512Mi"  
      cpu: "500m"  
...
````

6. ````
If you install S3‑Gateway in an isolated environment without internet access, fill out the parameters for connecting to the private **registry**.

How to fill out the connection parameters for the private registry



1. Set address in \[OBJECT\].

2. Set path in \[OBJECT\].

3. Set name of the secret with access rights to the private registry in** **\[OBJECT\]. The private registry must be created manually and encrypted in Base64.

````
\# HAProxy settings for proxying connections to the S3 Storage.  
haproxy:  
...  
  # connection parameters to the private registry  
  image:  
    # address and path for the private registry  
    registry: registry.example.com  
    repository: /bitnami/haproxy  
\#   tag: 2.7.3-debian-11-r5  
    #  secret with access rights to the private registry must be created manually and encrypted in Base64  
    pullSecrets:  
      - myRegistryKeySecretName
````

## ````
Step 3: Install the S3 Gateway chart using Helm in the Kubernetes cluster

Perform the installation of the S3 Gateway chart in the **s3gateway** \[OBJECT\].

Run the following command for online installation:

````
helm upgrade --install s3gateway brix365/s3gateway -f values-s3gateway.yaml -n s3gateway --create-namespace 

````
Run the following command for offline installation without internet access:

````
helm upgrade --install s3gateway ./s3gateway -f values-s3gateway.yaml -n s3gateway --create-namespace 

## ````
Step 4: Connect to S3

Parameters for connecting to S3:

- \[OBJECT\]: specify \[OBJECT\].

- \[OBJECT\], \[OBJECT\], \[OBJECT\], \[OBJECT\] and \[OBJECT\]: specify values according to the parameters of the S3 storage for which proxying is configured.

````
начало внимание

````
Infrastructure preparation occurs before the installation of the BRIX application. If the S3-Gateway chart has been installed, change the connection address to S3 (**brix365.s3.backend.address**) in the [BRIX application settings](change-settings-enterprise.md#changes-config-file).

````
конец внимание
````