You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/deploy_dx/install/kubernetes_deployment/image_list.md
+39-1Lines changed: 39 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,6 +13,45 @@ In future continuous delivery updates, entitled customers can obtain the HCL DX
13
13
14
14
Video: [How to upload HCL DX 9.5 container images to a private repository](https://youtu.be/XJONRdpgCuo)
15
15
16
+
## HCL DX 9.5 Compose CF232
17
+
18
+
If you are deploying the HCL DX 9.5 Compose CF232 release, the following software packages are available in your MHS portal HCL DX Compose v9.5 entitlements:
If you are deploying the HCL DX 9.5 Compose CF231 release, the following software packages are available in your MHS portal HCL DX Compose v9.5 entitlements:
If you are deploying the HCL DX 9.5 Compose CF230 release, the following software packages are available in your MHS portal HCL DX Compose v9.5 entitlements:
To prevent a possible Kubernetes deployment failure in Kubernetes versions 1.28 and 1.29, it may be required to run the command `modprobe br_netfilter` before running `kubeadm init`. This is a potential solution to avoid a networking bridge/iptables issue.
Copy file name to clipboardExpand all lines: docs/deploy_dx/install/kubernetes_deployment/preparation/get_the_code/configure_harbor_helm_repo.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# Configure Harbor Helm Repository
2
2
3
-
The HCL Digital Experience (DX) Compose 9.5 container images and Helm charts can be accessed from the [HCL Harbor container repository](https://hclcr.io/){target="_blank"}. Customers with credentials to access entitled software on the HCL Software Licensing Portal can apply those credentials to access these HCL DX Compose 9.5 components.
3
+
The HCL Digital Experience (DX) Compose 9.5 container images and Helm charts can be accessed from the [HCL Harbor container repository](https://hclcr.io/){target="_blank"}. Customers with credentials to access entitled software on the [My HCLSoftware (MHS) portal](https://my.hcltechsw.com/){target="blank"} can apply those credentials to access these HCL DX Compose 9.5 components.
4
4
5
5
The Harbor repository is updated with a registry based on Open Container Initiative (OCI) standards. The Helm chart command is updated to be OCI-compliant.
Copy file name to clipboardExpand all lines: docs/deploy_dx/install/kubernetes_deployment/preparation/mandatory_tasks/prepare_configure_networking.md
+44-6Lines changed: 44 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# Configure Networking
2
2
3
-
This section explains what must be configured from a networking perspective to get HCL Digital Experience Compose 9.5 running in your Kubernetes or OpenShift cluster, and to provide accessibility to your deployment from outside the Cluster.
3
+
This section explains what must be configured from a networking perspective to get HCL Digital Experience (DX) Compose 9.5 running in your Kubernetes or OpenShift cluster, and to provide accessibility to your deployment from outside the Cluster.
4
4
5
5
## Full Kubernetes or OpenShift deployment
6
6
@@ -27,7 +27,7 @@ If you do not know the hostname beforehand, you can leave it blank and run an ad
27
27
28
28
## Configure Cross Origin Resource Sharing (CORS)
29
29
30
-
The HCL Digital Experience Compose 9.5 Helm Chart allows you to configure CORS configuration for all the `addon` to WebEngine applications such as Digital Asset Management or Ring API. This allows you to access the APIs provided by those applications in other applications with ease.
30
+
The HCL DX Compose 9.5 Helm chart allows you to configure CORS configuration for all the `addon` to WebEngine applications such as Digital Asset Management or Ring API. This allows you to access the APIs provided by those applications in other applications with ease.
31
31
32
32
You can define a list of allowed hosts for a specific application using the following syntax in your `custom-values.yaml`:
33
33
@@ -51,7 +51,7 @@ For HAProxy to allow forward requests to your applications, you must provide it
51
51
52
52
## Configure HAProxy networking
53
53
54
-
HAProxy is deployed with a `LoadBalancer` type service to handle the incoming traffic as well as the SSL offloading for HCL Digital Experience. In addition, the Helm deployment offers adjustability for HAProxy and its services to allow for more flexible deployment and use of custom `Ingress Controllers`.
54
+
HAProxy is deployed with a `LoadBalancer` type service to handle the incoming traffic as well as the SSL offloading for HCL DX. In addition, the Helm deployment offers adjustability for HAProxy and its services to allow for more flexible deployment and use of custom `Ingress Controllers`.
55
55
56
56
|Parameter|Description| Type | Default value|
57
57
|---------|-----------|-------------|------|
@@ -127,7 +127,7 @@ To have your deployment and HAProxy to use the certificate, you must store it in
127
127
The secret can be created using the following commands:
128
128
129
129
!!!note
130
-
The secret name can be chosen by you and must be referenced in the next configuration step (the following example uses `dx-tls-cert`). The namespace is the Kubernetes namespace where you want to deploy HCL Digital Experience Compose 9.5 to (the example uses `digital-experience-compose`).
130
+
The secret name can be chosen by you and must be referenced in the next configuration step (the following example uses `dx-tls-cert`). The namespace is the Kubernetes namespace where you want to deploy HCL DX Compose 9.5 to (the example uses `digital-experience-compose`).
The HCL Digital Experience Compose 9.5 Helm Chart allows you to configure **[Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors){target="blank"}: frame-ancestors** for DX WebEngine and all other components, such as Digital Asset Management, Ring API, etc.
192
+
The HCL DX Compose 9.5 Helm chart allows you to configure **[Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors){target="blank"}: frame-ancestors** for DX WebEngine and all other components, such as Digital Asset Management, Ring API, etc.
193
193
194
194
Setting `cspFrameAncestorsEnabled` to true adds `content-security-policy: frame-ancestor 'self'` headers to the responses, enabling you to frame DX and other add-on applications.
195
195
@@ -220,7 +220,7 @@ Refer to the HCL DX Compose 9.5 `values.yaml` detail for all possible applicatio
220
220
221
221
## Configuring SameSite Cookie Attribute
222
222
223
-
The HCL Digital Experience Compose 9.5 Helm Chart allows you to configure **[SameSite Cookie Attribute](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite){target="blank"}** for DX WebEngine. This configuration sets the `WASReqURL` Cookie Attributes `Secure` and `SameSite`.
223
+
The HCL DX Compose 9.5 Helm chart allows you to configure **[SameSite Cookie Attribute](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite){target="blank"}** for DX WebEngine. This configuration sets the `WASReqURL` Cookie Attributes `Secure` and `SameSite`.
224
224
225
225
!!!note
226
226
This should only be set in an HTTPS environment to prevent unwanted behaviors.
@@ -238,3 +238,41 @@ networking:
238
238
```
239
239
240
240
Refer to the HCL DX Compose 9.5 `values.yaml` detail for all possible applications that can be configured.
241
+
242
+
## HAProxy custom headers
243
+
244
+
The HCL DX 9.5 Helm chart allows you to configure custom HTTP headers in the HAProxy configuration. You can both add new headers and remove existing headers from responses generated by HAProxy.
245
+
246
+
### Adding custom headers
247
+
248
+
You can add custom HTTP headers to all responses from HAProxy using the `customHeader` property. This is useful for implementing security best practices or adding specific information to responses.
249
+
250
+
Each header entry supports the following properties:
251
+
252
+
- `name`: The name of the HTTP header to be added
253
+
- `value`: The value that should be set for the header
254
+
255
+
Example configuration in your `custom-values.yaml` file:
256
+
257
+
```yaml
258
+
networking:
259
+
haproxy:
260
+
customHeader:
261
+
- name: X-Content-Type-Options
262
+
value: nosniff
263
+
- name: Referrer-Policy
264
+
value: no-referrer
265
+
```
266
+
267
+
### Removing headers
268
+
269
+
You can specify header names that should be removed from HAProxy responses using the `deleteHeader` property. This is useful for removing headers that might reveal internal information or that you do not wish to forward.
270
+
271
+
Example configuration in your `custom-values.yaml` file:
Copy file name to clipboardExpand all lines: docs/deploy_dx/manage/cfg_dx_compose/configure_sso/integrating_leap_sso/index.md
+13-16Lines changed: 13 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,13 +4,13 @@ This page provides information on how to configure the Single Sign-On (SSO) laye
4
4
5
5
## Enabling SSO between HCL Leap and HCL DX Compose in Kubernetes
6
6
7
-
This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the modern and natively supported OpenID Connect (OIDC) protocol since both applications run on Open Liberty. The protocol connects directly to the preferred Identity Provider (IdP), such as Azure AD, Keycloakor Okta. By configuring DX and Leap to trust your central IdP, users get a seamless, single log-in experience.
7
+
This guide shows how you can enable SSO between HCL DX Compose and HCL Leap. You can use the modern and natively supported OpenID Connect (OIDC) protocol since both applications run on Open Liberty. The protocol connects directly to your preferred Identity Provider (IdP), such as Azure AD, Keycloak, Okta, or any OIDC-compliant provider. By configuring HCL DX Compose and Leap to trust your central IdP, users get a seamless, single log-in experience.
8
8
9
9
### Implementing OIDC SSO
10
10
11
-
1.Install and configure your IdP.
11
+
1.Choose and configure your IdP.
12
12
13
-
Create a client for each product. IdPs will serve as the single point of truth for credential inputs.
13
+
Create a client registration for each product (HCL DX Compose and HCL Leap). Your IdP serves as the single source of truth for credential input.
14
14
15
15
2. Enable OIDC in HCL DX.
16
16
@@ -22,7 +22,7 @@ This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the
22
22
23
23
1. Configure the OIDC IdP, which will serve as the OIDC provider.
24
24
25
-
As part of the configuration process for your identify provider, you will have created or obtained a digital certificate for configuring HTTPS. This certificate will also need to be deployed to Leap so that the two servers can communicate with each other.
25
+
As part of the configuration process for your identity provider, create or obtain a digital certificate for HTTPS. Deploy this certificate to Leap so the two servers can communicate securely.
26
26
27
27
!!!note
28
28
The SSL certificate (`.crt`) and public key (`.key`) should be in PKCS12 format.
@@ -39,7 +39,7 @@ This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the
39
39
configuration:
40
40
leap:
41
41
customCertificateSecrets:
42
-
keycloakCert: <tls-secret>
42
+
idpCert: <tls-secret>
43
43
```
44
44
45
45
3. Add the OIDC definition as a server customization in the `values.yaml` file.
@@ -51,14 +51,13 @@ This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the
51
51
Example of an OIDC definition:
52
52
53
53
```yaml
54
-
# Enter appropriate values for <your-oidc-id>, <your-client-id>, <your-client-secret>, <your-oidc-server>, <your-realm-name>.
55
-
# You may have to refer to your identity provider's configuration.
54
+
# Replace placeholder values with your actual OIDC configuration
56
55
configuration:
57
56
leap:
58
57
configOverrideFiles:
59
58
openIdConnect: |
60
59
<server description="leapServer">
61
-
<openidConnectClient id="<your-oidc-id>"
60
+
<openidConnectClient id="<unique-oidc-id>"
62
61
clientId="<your-client-id>"
63
62
clientSecret="<your-client-secret>"
64
63
signatureAlgorithm="RS256"
@@ -67,7 +66,7 @@ This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the
@@ -92,23 +91,21 @@ This guide shows how to enable SSO between HCL DX and HCL Leap. You can use the
92
91
93
92
- `userLookups`: Set this to `false` to disable user lookups, which is not available when configured with OIDC.
94
93
- `userGroups`: Set this to `false` to disable group lookups, which is not available when configured with OIDC.
95
-
- `postLogoutRedirectURL`: Set this to the URL to which Leap will redirect the browser after a user logs out. This is necessary to completethe loop with the OIDC IdP.
94
+
- `postLogoutRedirectURL`: Set this to the URL where Leap redirects the browser after a user logs out. This setting completes the sign-out flow with the OIDC IdP. The URL format varies by IdP. For more information, refer to your IdP documentation.
0 commit comments