Zum Inhalt springen
openDesk Hilfe

Requirements

This section covers the internal system requirements and external service requirements for productive use.

tl;dr

openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s) cluster.

Hardware

The following minimum requirements are intended for initial evaluation deployment:

Spec Value
CPU 12 Cores of x64 or x86 CPU (ARM is not supported yet)
RAM 32 GB, more recommended
Disk HDD or SSD, >10 GB

Kubernetes

Any self-hosted or managed K8s cluster >= v1.24 listed in CNCF Certified Kubernetes distributions should be supported.

The deployment is tested against kubespray based clusters.

Note
The deployment is not tested against OpenShift.

Ingress controller

The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a properly configured ingress controller deployed in your cluster.

Supported controllers

Note
The platform development team is evaluating the use of Gateway API.

Compatibility with Ingress NGINX >= 1.12.0

With the release 1.12.0 Ingress NGINX introduced new security default settings, which are incompatible with current openDesk releases. If you want to use Ingress-NGINX >= 1.12.0 the following settings have to be set:

controller.config.annotations-risk-level=Critical
controller.config.strict-validate-path-type=false

See the annotations-risk-level documentation and strict-validate-path-type documentation for details.

Important Note
Ensure to install at least Ingress NGINX 1.11.5 or 1.12.1 due to security issues in earlier versions.

Minimal configuration

Several components in openDesk make use of snippet annotations, which are disabled by default. Please enable them using the following configuration:

controller.allowSnippetAnnotations=true
controller.admissionWebhooks.allowSnippetAnnotations=true

See the allowSnippetAnnotations documentation for context.

Volume provisioner

Initial evaluation deployment requires a ReadWriteOnce volume provisioner. For local deployment, a local- or hostPath- provisioner is sufficient.

Note
Some components require a ReadWriteMany volume provisioner for distributed mode or horizontal scaling.

Certificate management

This deployment leverages cert-manager to generate valid certificates. This is optional, but a secret containing a valid TLS certificate is required.

Only Certificate resources will be deployed; the cert-manager, including its CRD must be installed before this or openDesk certificate management is switched off.

External services

For the development and evaluation of openDesk, we bundle some services. Be aware that for production deployments, you need to make use of your own production-grade services; see the external-services.md for configuration details.

Group Type Version Tested against
Cache Memcached 1.6.x Memcached
Redis 7.x.x Redis
Database Cassandra1 5.0.x Cassandra
MariaDB 10.x MariaDB
PostgreSQL 15.x PostgreSQL
Mail Mail Transfer Agent Postfix
PKI/CI (S/MIME)
Security AntiVirus/ICAP ClamAV
Storage K8s ReadWriteOnce Ceph / Cloud specific
K8s ReadWriteMany Ceph / NFS
Object Storage MinIO
Voice TURN Coturn

Deployment

The deployment of each component is Helm based. The 35+ Helm charts are configured and templated via Helmfile to provide a streamlined deployment experience.

Helmfile requires HelmDiff to compare the desired state against the deployed state.

Footnotes

Footnotes

  1. Due to restrictions on Kubernetes emptyDir you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail. ↩ ↩2

  2. Required for Dovecot Pro as part of openDesk Enterprise Edition. ↩