...
Excerpt |
---|
|
The preparations described below are required to install Usage Engine using Helm charts and Docker images. Read through the steps below and follow each step before installing. Fetching and Configuring Helm ChartsYou will download the Helm chart with the instructions below: When you are required to enter the <chart version>, refer to Release Information for the Helm Chart version required The Helm chart configuration installs a large portion of the product, apart from the ECD instance. Add the helm repository Code Block |
---|
$ helm repo add usage-engine-private-edition 'https://digitalroute-public.github.io/usage-engine-private-edition'
$ helm repo update |
Check if the charts are available: Code Block |
---|
$ helm search repo -l usage-engine-private-edition/usage-engine-private-edition --version <chart version>
Example:
$ helm search repo -l usage-engine-private-edition/usage-engine-private-edition --version 2.0.0
#The output:
NAME CHART VERSION APP VERSION DESCRIPTION
usage-engine-private-edition/usage-engine-private-edition 2.0.0 The Usage Engine Private Edition helm chart |
Create a directory dedicated for the installation and download the platform Helm chart. Code Block |
---|
$ mkdir <your directory>
$ cd <your directory>
$ helm fetch usage-engine-private-edition/usage-engine-private-edition --version <chart version> --untar |
Make sure the Helm chart is defined for on-premise (Private cloud) by viewing the file: usage-engine-private-edition / values.yaml Code Block |
---|
$ cat usage-engine-private-edition/values.yaml | grep environment:
# Only on-premise and aws supported for now
environment: on-premise |
If required, modify the Helm chart for the needed level of Access Control for Kubernetes Resources Usage Engine relies on Role Based Access Control (RBAC) when specifying the level of access needed for the kubernetes resources involved in any given Usage Engine installation. Essentially, to make sure that the service account used has the right level of access in order for Usage Engine to function properly. Some features do require cluster wide access to certain resources (typically resources that are not namespaced). This is realized by the use of ClusterRoles. If ClusterRoles are not permitted in the given kubernetes cluster for one reason or another, those features will have to be switched off. The following helm values can be used to switch off features relying on ClusterRoles, see the Helm chart for further details: - mzonline.ecd.nodeHostSelectionEnabled - mzOperator.rbacAuthProxy.enabled
|
...
For information about Persistent Storage, see Persistent Storage (23.20).
Excerpt |
---|
|
Create kubernetes docker pull secretAll the usage-engine-private-edition container images are kept in a private repository (AWS ECR). In order to pull the container images in the Kubernetes cluster you will need to create a secret for use with Digitalroute AWS ECR. You will need to have the access keys provided by Digitalroute in order to create the secret. Export AWS keys Code Block |
---|
$ export AWS_ACCESS_KEY_ID=<access key provided by Digitalroute>
$ export AWS_SECRET_ACCESS_KEY=<secret access key provided by Digitalroute>
$ export AWS_REGION=eu-west-1 |
Create Secret Code Block |
---|
$ kubectl create secret docker-registry <name of the secret> \
--docker-server=https://462803626708.dkr.ecr.eu-west-1.amazonaws.com \
--docker-username=AWS \
--docker-password=$(aws ecr get-login-password --region eu-west-1) \
-n <namespace> |
Info |
---|
Example Create secret named ecr-cred in default namespace. Code Block |
---|
$ kubectl create secret docker-registry ecr-cred \
--docker-server=https://462803626708.dkr.ecr.eu-west-1.amazonaws.com \
--docker-username=AWS \
--docker-password=$(aws ecr get-login-password --region eu-west-1) \
-n default
//Verify that the secret is created.
$ kubectl get secret ecr-cred -n default
NAME TYPE DATA AGE
ecr-cred kubernetes.io/dockerconfigjson 1 25s
|
|
When installing usage-engine-private-edition you will need to use the ecr-cred secret in set values. Info |
---|
Example Code Block |
---|
$ helm install uepe usage-engine-private-edition --set "global.imagePullSecrets[0].name=ecr-cred" |
The created pull secret will only be valid for 12 hours! You can at any time re-create the pull secret by deleting and creating again. Code Block |
---|
//Example
$ kubectl delete secret ecr-cred -n default
$ kubectl create secret docker-registry ecr-cred \
--docker-server=https://462803626708.dkr.ecr.eu-west-1.amazonaws.com \
--docker-username=AWS \
--docker-password=$(aws ecr get-login-password --region eu-west-1) \
-n default |
|
Using CronJob to sync ECR credentials as a Kubernetes secretThis is the recommended procedure to make sure the secret is always valid. Copy the below content in a yaml file and make sure to update the namespaces and access keys. The yaml code below updates the secret ecr-cred every 8 hours in the given namespace. Code Block |
---|
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ecr-credentials-sync
namespace: <your namespace>
rules:
- apiGroups: [""]
resources:
- secrets
verbs:
- get
- create
- patch
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: ecr-credentials-sync
namespace: <your namespace>
subjects:
- kind: ServiceAccount
name: ecr-credentials-sync
roleRef:
kind: Role
name: ecr-credentials-sync
apiGroup: ""
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: ecr-credentials-sync
namespace: <your namespace>
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: ecr-credentials-sync
namespace: <your namespace>
spec:
suspend: false
schedule: 0 */8 * * *
failedJobsHistoryLimit: 1
successfulJobsHistoryLimit: 1
jobTemplate:
spec:
template:
spec:
serviceAccountName: ecr-credentials-sync
restartPolicy: Never
volumes:
- name: token
emptyDir:
medium: Memory
initContainers:
- image: amazon/aws-cli
name: get-token
imagePullPolicy: IfNotPresent
env:
- name: AWS_ACCESS_KEY_ID
value: <access key provided by Digitalroute>
- name: AWS_SECRET_ACCESS_KEY
value: <secret access key provided by Digitalroute>
- name: REGION
value: eu-west-1
volumeMounts:
- mountPath: /token
name: token
command:
- /bin/sh
- -ce
- aws ecr get-login-password --region ${REGION} > /token/ecr-token
containers:
- image: bitnami/kubectl
name: create-secret
imagePullPolicy: IfNotPresent
env:
- name: SECRET_NAME
value: ecr-cred
volumeMounts:
- mountPath: /token
name: token
command:
- /bin/sh
- -ce
- |-
kubectl create secret docker-registry $SECRET_NAME \
--dry-run=client \
--docker-server=https://462803626708.dkr.ecr.eu-west-1.amazonaws.com \
--docker-username=AWS \
--docker-password="$(cat /token/ecr-token)" \
-o yaml | kubectl apply -f -
|
Code Block |
---|
$ touch cronjob-k8s-ecr-secret.yaml
// paste the above code in the file.
$ kubectl apply -f cronjob-k8s-ecr-secret.yaml -n <namespace>
//Example
$ kubectl apply -f cronjob-k8s-ecr-secret.yaml -n default
role.rbac.authorization.k8s.io/ecr-credentials-sync created
rolebinding.rbac.authorization.k8s.io/ecr-credentials-sync created
serviceaccount/ecr-credentials-sync created
cronjob.batch/ecr-credentials-sync created |
|