HA Nextcloud with Kubernetes

Deploy Nextcloud on Kubernetes Cluster

We are an infrastructure and cloud-agnostic integrator of the components (compute, storage, networking, access management) that enterprises require to robustly deploy a highly available instance of Nextcloud on a Kubernetes cluster.

The latest versions of Nextcloud Hub support “cloud native” modes of deployment using Helm charts and Kubernetes objects such as CSI Volumes, Ingress, and Secrets. The entire deployment is defined by YAML so it can be easily maintained or even migrated to another environment if needed.

The Kubernetes CSI driver support greatly simplifies integrating the primary storage of Nextcloud with provider managed services like Amazon EFS or Azure Files, or enterprise storage solutions such as NetApp Cloud Volumes ONTAP over the NFS/CIFS protocols. It is also possible to mount a volume from an OpenZFS-based NAS, such as TrueNAS or a CephFS persistent volume on a Ceph cluster as the storage for Nextcloud – a common use case in on-prem or traditional hosting environments. For lower IOPS (bulk storage) use cases, Nextcloud can also use S3 compatible primary storage, including self-hosted MinIO or OpenStack Swift.

When you scale out to multiple replicas of Nextcloud, it is critical that your load balancer and session store can correctly manage user sessions. Our implementation leveraging NGINX or HAProxy ingress controllers, and Redis key-value store ensures that users can reliably reach Nextcloud and its companion applications, such as Collabora Office, no matter which Kubernetes node serves their request. This is without using workarounds such as sticky sessions, which can result in uneven utilization of nodes.

Security is not an afterthought either. The Nextcloud Helm chart can optionally consume external secrets synced from password vaults including 1Password, HashiCorp Vault, or Passbolt, making it easy to periodically rotate secrets as a best practice. It also eliminates the possibility that sensitive passwords, such as database credentials or API tokens, are accidentally pushed to a public repo or storage bucket.

Certificate management is automated by Kubernetes cert-manager, integrating with a list of DNS providers (Azure DNS, Cloudflare, Route53) and certificate authorities like Let’s Encrypt to prevent downtime from expired certificates. The NGINX and HAProxy ingress annotations that we use are updated for the latest TLS versions and secure cipher suites, scoring top ratings on SSL tests such as HTBridge and Qualys SSL Test.

Start with any CNCF-certified Kubernetes distribution in the cloud, co-located, or on-prem environment of your choice. If desired, we can recommend a cloud or datacenter provider that meets your data residency requirements. Contact our team of Nextcloud architects for more details about our highly available Nextcloud solution on Kubernetes and how it can integrate with your IT environment.