Kubernetes

The Docker walkthrough under the chart: local storage on a volume, the accounts in a Secret, the roles in config.toml.

kubectl create secret generic sftp-host-keys --from-file=host_ed25519
kubectl create secret generic sftp-users --from-file=users.toml
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: sftp-data }
spec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 10Gi } } }
EOF
helm install sftp deploy/helm/craft-file-gate -f sftp-values.yaml \
  --set-file config.inline=config.toml

# sftp-values.yaml
hostKeys:
  existingSecret: sftp-host-keys                         # /keys/host_ed25519
extraVolumes:
  - name: data
    persistentVolumeClaim: { claimName: sftp-data }
  - name: users
    secret: { secretName: sftp-users, defaultMode: 0440 }
extraVolumeMounts:
  - { name: data, mountPath: /data }                     # the backend's root = "/data"
  - { name: users, mountPath: /secrets/users, readOnly: true }

config.toml is the Docker one followed by the content of its roles.toml (the chart mounts only config.toml), with host_keys = ["/keys/host_ed25519"] under [sftp] and users_file = "/secrets/users/users.toml" under [auth]. Listeners stay on 0.0.0.0 (the probes reach the pod by its IP) and [[admin.roles]] opens the console, since the chart sets the static token aside. The volume belongs to the pod’s group (fsGroup 65532): create_home creates alice/ there. Beyond one pod, the volume is ReadWriteMany.

The chart

• One Service per exposure: publishing SFTP through a LoadBalancer (service.sftp.type) publishes neither the console, nor /metrics, nor the probes.
• The kubelet probes come from the pod’s node, which most CNIs let through despite the NetworkPolicy; otherwise, add the node CIDR as an ipBlock to networkPolicy.controlFrom. To restrict Prometheus and the ingress, list their namespaces in networkPolicy.controlFrom.

Probes

/livez and /readyz (Probes and health) are probed on the probe port when one is given, otherwise on the control port, otherwise on the admin port.

A port for the probes

service.probes.port: 9090 sets [server] probes_listen: the probes and /metrics get a port of their own, in plain HTTP, even under [admin.tls] (One door or two). The kubelet and Prometheus (per pod: PodMonitor or annotations) no longer need the certificate or the console port; the port is on the Service <release>-control only with service.probes.expose: true. An SFTP pod without [admin] thus has its probes, with /readyz ready as soon as the SFTP door listens.

Pod hardening

The chart applies the restricted profile of the Pod Security Standards. Each field can be overridden in podSecurityContext and securityContext; null removes a field or a block.

The root of a local backend is a volume from extraVolumes. Host keys and the TLS pair come from a Secret (cert-manager for TLS), never from an emptyDir: auto_generate of [admin.tls] does not apply under this chart.

Several pods

Each Role covers a single name, without create: get, update on the Secret; get, update, patch on each ConfigMap, watch on their collection for bans (helm template ... --show-only templates/rbac.yaml).

Sharing through a ConfigMap

Feature k8s (in the published images). The pod reads the ConfigMap before serving; each publication is conditioned on the resourceVersion it read, and a data.bans erased by kubectl edit is published again on the next one. Without watch, propagation falls back to a re-read every 30 s; a deployment that does not create the ConfigMap adds create on the collection.

[sftp.ban]           # same under [api.ban] and [admin.ban]; the chart provides the name
backend = "configmap"

inotify on a shared node

fs.inotify.max_user_instances (128 by default) is counted per UID, across the whole node. The server takes only one. When other pods have used them up and you cannot tune the node:

[reload]
watch = "poll"   # no inotify instance; a Secret update is seen within 5 s

See Hot reload.