From 38e6100c8cc3ef5b7ddd7ded0a142886e408a6f1 Mon Sep 17 00:00:00 2001 From: Jack Henschel Date: Tue, 8 Oct 2024 09:27:32 +0200 Subject: [PATCH 1/2] Expose pod and container SecurityContext fields for Jellyfin pod --- charts/jellyfin/README.md.gotmpl | 27 +++++++++++++++++++++++ charts/jellyfin/templates/deployment.yaml | 3 +++ charts/jellyfin/values.yaml | 15 +++++++++++++ 3 files changed, 45 insertions(+) diff --git a/charts/jellyfin/README.md.gotmpl b/charts/jellyfin/README.md.gotmpl index 330a79a..51152fc 100644 --- a/charts/jellyfin/README.md.gotmpl +++ b/charts/jellyfin/README.md.gotmpl @@ -58,3 +58,30 @@ helm install -f values.yaml {{ template "chart.valuesSection" . }} {{ template "helm-docs.versionFooter" . }} + +## Hardware acceleration + +Out of the box the pod does not have the necessary permissions to enable hardware acceleration (HWA) in Jellyfin. +Adding the following Helm values should make it enable you to use hardware acceleration features. +Some settings may need to be tweaked depending on the type of device (Intel/AMD/NVIDIA/...) and your container runtime. + +Please refer to the Jellyfin upstream documentation for more information about hardware acceleration: + +```yaml +securityContext: + capabilities: + add: + - "SYS_ADMIN" + drop: + - "ALL" + privileged: false + +extraVolumes: + - name: hwa + hostPath: + path: /dev/dri + +extraVolumeMounts: + - name: hwa + mountPath: /dev/dri +``` diff --git a/charts/jellyfin/templates/deployment.yaml b/charts/jellyfin/templates/deployment.yaml index 84dd24c..3d4d8df 100644 --- a/charts/jellyfin/templates/deployment.yaml +++ b/charts/jellyfin/templates/deployment.yaml @@ -125,6 +125,8 @@ spec: {{- end }} resources: {{ toYaml .Values.resources | indent 12 }} + terminationMessagePolicy: FallbackToLogsOnError + securityContext: {{- toYaml .Values.securityContext | nindent 12 }} {{- if .Values.extraInitContainers }} initContainers: {{- toYaml .Values.extraInitContainers | nindent 10 }} @@ -164,3 +166,4 @@ spec: tolerations: {{ toYaml . | indent 8 }} {{- end }} + securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} diff --git a/charts/jellyfin/values.yaml b/charts/jellyfin/values.yaml index a6bacbd..c383798 100644 --- a/charts/jellyfin/values.yaml +++ b/charts/jellyfin/values.yaml @@ -127,6 +127,21 @@ extraInitContainers: {} # -- additional sidecar containers to run inside the pod. extraContainers: {} +# -- SecurityContext configuration for the Jellyfin pod +podSecurityContext: {} +# Jellyfin can be run as an unprivileged user with the following settings: + # runAsUser: 65534 + # runAsGroup: 65534 + +# -- SecurityContext configuration for the Jellyfin container +securityContext: {} +# For example, you might need to grant the following capabilities to enable hardware acceleration when mounting a /dev/dri device: + # capabilities: + # add: + # - "SYS_ADMIN" + # drop: + # - "ALL" + # -- Larger libraries may need to increase the readinessProbe and livenessProbe timeouts. Start by increasing the initialDelaySeconds. livenessProbe: enabled: true From 581735dc61af7262757927ebb7a7cbacc236d831 Mon Sep 17 00:00:00 2001 From: Jack Henschel Date: Tue, 8 Oct 2024 10:02:28 +0200 Subject: [PATCH 2/2] Allow setting custom labels and annotations on PVCs --- charts/jellyfin/templates/config-pvc.yaml | 7 +++++++ charts/jellyfin/templates/media-pvc.yaml | 7 +++++++ charts/jellyfin/values.yaml | 9 +++++++++ 3 files changed, 23 insertions(+) diff --git a/charts/jellyfin/templates/config-pvc.yaml b/charts/jellyfin/templates/config-pvc.yaml index 25b7ec9..fe80ae5 100644 --- a/charts/jellyfin/templates/config-pvc.yaml +++ b/charts/jellyfin/templates/config-pvc.yaml @@ -9,6 +9,13 @@ metadata: helm.sh/chart: {{ include "jellyfin.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- with .Values.persistence.config.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.persistence.config.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} spec: accessModes: - {{ .Values.persistence.config.accessMode | quote }} diff --git a/charts/jellyfin/templates/media-pvc.yaml b/charts/jellyfin/templates/media-pvc.yaml index c14b822..8c55d47 100644 --- a/charts/jellyfin/templates/media-pvc.yaml +++ b/charts/jellyfin/templates/media-pvc.yaml @@ -9,6 +9,13 @@ metadata: helm.sh/chart: {{ include "jellyfin.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- with .Values.persistence.media.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.persistence.media.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} spec: accessModes: - {{ .Values.persistence.media.accessMode | quote }} diff --git a/charts/jellyfin/values.yaml b/charts/jellyfin/values.yaml index c383798..9f25245 100644 --- a/charts/jellyfin/values.yaml +++ b/charts/jellyfin/values.yaml @@ -62,6 +62,10 @@ persistence: # subPath: some-subpath accessMode: ReadWriteOnce size: 1Gi + # -- Custom labels to be added to the PVC + labels: {} + # -- Custom annotations to be added to the PVC + annotations: {} media: enabled: false # -- If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner. @@ -72,6 +76,11 @@ persistence: # subPath: some-subpath accessMode: ReadWriteOnce size: 10Gi + # -- Custom labels to be added to the PVC + labels: {} + # -- Custom annotations to be added to the PVC + annotations: {} + # -- Add aditional PVs/PVCs to our container. Check values.yaml to see an example. extraExistingClaimMounts: [] # - name: external-mount