feat(nextcloud): Allow specifying service session affinity in helm chart

[qdii]

… chart

Description of the change

Services in kubernetes have the notion of session affinity which allow a given client to be sent to the same backend.

Benefits

When multiple instances of Nextcloud are deployed (for high availability), certain applications may break, for instance because a CSRF token is generated in one pod, and evaluated in another pod.

This feature mitigates this sort of application bugs.

Possible drawbacks

When enabled, the load between the pods may become uneven. However this is a choice of the administrator.

Checklist

• I have read the CONTRIBUTING.md doc.
• DCO has been signed off on the commit.
• Chart version bumped in Chart.yaml according to semver.
• (optional) Parameters are documented in the README.md

[wrenix]

Could you add also an toYaml for sessionAffinityConfig

Are your sure that this has your wish affect?
Maybe you want to take a look into your IngressController:
https://github.com/nextcloud/helm/tree/main/charts/nextcloud#ingress-sticky-sessions

[qdii]

As far as I understand, there are two different load-balancing system here:

• The Ingress configures the frontend pod so that it balances the load between the different backends behind it. In my setup, it adds configuration lines to the nginx instance which fronts nextcloud. There is just one upstream backend: the nextcloud service, so it doesn't do much.

• The Service configures the nextcloud service so that it balances the load to the nextcloud pods behind it. In practice I guess it configures kube-proxy, which likely set up iptables/nftables in turn.

So to answer your question, I'm fairly confident that this has the right effect, because I checked that the same user was correctly going to the same nginx instance, same service, but somehow ended up on different pods.

[wrenix]

Why you close your PR, it was already really good and close to merge?

Thanks for your description, the kube-proxy setup explant good your needs. For the most ingress-controller the most use direct the Endpoints behind the service (and for the service the Client is the ingress-controller pod).

[qdii]

Ah sorry, I'm not used to github, and I thought I was closing a comment, not the PR. Let me reopen it.

[wrenix]

LGFM, do you like to signoff your commits?

[qdii]

Should be good :)

[wrenix]

Sadly not, could you take a Look in the DCO check/action/job?
https://github.com/nextcloud/helm/pull/765/checks?check_run_id=49531399229

[qdii]

Ah it looks like the commit should be signed and a line with "Signed Off by" should appear in the commit message. It only had the first part.