You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can find [guides for other platforms here](README.md).
9
11
10
12
## Before you begin
11
13
12
14
### Install IBM Cloud Private
13
15
14
-
Knative requires a v3.1.1 standard [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster. Before you can install Knative, you must first complete all the steps that are provided in the [IBM Cloud Private standard cluster installation instructions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html). For Example:
16
+
Knative requires a v3.1.1 standard
17
+
[IBM Cloud Private](https://www.ibm.com/cloud/private) cluster. Before you can
18
+
install Knative, you must first complete all the steps that are provided in the
19
+
[IBM Cloud Private standard cluster installation instructions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html).
20
+
For Example:
15
21
16
22
1. Install Docker for your boot node only
17
23
@@ -27,114 +33,141 @@ Knative requires a v3.1.1 standard [IBM Cloud Private](https://www.ibm.com/cloud
27
33
28
34
### Configure IBM Cloud Private security policies
29
35
30
-
You need to create and set both the image security and pod security policies before you install Knative in your cluster.
36
+
You need to create and set both the image security and pod security policies
37
+
before you install Knative in your cluster.
31
38
32
39
#### Update the image security policy
33
-
Update the [image security policy (`image-security-enforcement`)](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) in IBM Cloud Private to allow the access to the Knative image:
2. Update `spec.repositories` by adding `"gcr.io/knative-releases/*"`, for
52
+
example:
53
+
```yaml
54
+
spec:
55
+
repositories:
56
+
- name: "gcr.io/knative-releases/*"
57
+
```
46
58
47
59
#### Update pod security policy
48
-
Configure the namespaces `knative-serving` into pod security policy `ibm-privileged-psp`. The step as follows:
49
-
50
-
1. Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use `ibm-privileged-psp`. Run the following command:
51
-
```shell
52
-
cat <<EOF | kubectl apply -f -
53
-
apiVersion: rbac.authorization.k8s.io/v1
54
-
kind: ClusterRole
55
-
metadata:
56
-
name: knative-role
57
-
rules:
58
-
-
59
-
apiGroups:
60
-
- extensions
61
-
resourceNames:
62
-
- ibm-privileged-psp
63
-
resources:
64
-
- podsecuritypolicies
65
-
verbs:
66
-
- use
67
-
EOF
68
-
```
69
-
70
-
2. In the Knative installation steps below, you have the option of installing a Knative installation bundle or individual components. For each component that you install, you must create a cluster role binding between the service account of the Knative namespace and the `ibm-privileged-psp` pod security policy that you created.
71
-
72
-
For example to create a role binding for the `knative-serving` namespace, run the following command:
73
-
```shell
74
-
cat <<EOF | kubectl apply -f -
75
-
apiVersion: rbac.authorization.k8s.io/v1
76
-
kind: ClusterRoleBinding
77
-
metadata:
78
-
name: knative-serving-psp-users
79
-
roleRef:
80
-
apiGroup: rbac.authorization.k8s.io
81
-
kind: ClusterRole
82
-
name: knative-role
83
-
subjects:
84
-
-
85
-
apiGroup: rbac.authorization.k8s.io
86
-
kind: Group
87
-
name: "system:serviceaccounts:knative-serving"
88
-
EOF
89
-
```
90
-
91
-
**Important**: If you choose to install the Knative Build or observability plugin, you must also create cluster role bindings for the service accounts in the`knative-build` and `knative-monitoring` namespaces.
60
+
61
+
Configure the namespaces `knative-serving` into pod security policy
62
+
`ibm-privileged-psp`. The step as follows:
63
+
64
+
1. Create a cluster role for the pod security policy resource. The resourceNames
65
+
for this role must be the name of the pod security policy that was created
66
+
previous. Here we use `ibm-privileged-psp`. Run the following command:
67
+
68
+
```shell
69
+
cat <<EOF | kubectl apply -f -
70
+
apiVersion: rbac.authorization.k8s.io/v1
71
+
kind: ClusterRole
72
+
metadata:
73
+
name: knative-role
74
+
rules:
75
+
-
76
+
apiGroups:
77
+
- extensions
78
+
resourceNames:
79
+
- ibm-privileged-psp
80
+
resources:
81
+
- podsecuritypolicies
82
+
verbs:
83
+
- use
84
+
EOF
85
+
```
86
+
87
+
2. In the Knative installation steps below, you have the option of installing a
88
+
Knative installation bundle or individual components. For each component that
89
+
you install, you must create a cluster role binding between the service
90
+
account of the Knative namespace and the `ibm-privileged-psp` pod security
91
+
policy that you created.
92
+
93
+
For example to create a role binding for the `knative-serving` namespace, run
94
+
the following command:
95
+
96
+
```shell
97
+
cat <<EOF | kubectl apply -f -
98
+
apiVersion: rbac.authorization.k8s.io/v1
99
+
kind: ClusterRoleBinding
100
+
metadata:
101
+
name: knative-serving-psp-users
102
+
roleRef:
103
+
apiGroup: rbac.authorization.k8s.io
104
+
kind: ClusterRole
105
+
name: knative-role
106
+
subjects:
107
+
-
108
+
apiGroup: rbac.authorization.k8s.io
109
+
kind: Group
110
+
name: "system:serviceaccounts:knative-serving"
111
+
EOF
112
+
```
113
+
114
+
**Important**: If you choose to install the Knative Build or observability
115
+
plugin, you must also create cluster role bindings for the service accounts in
116
+
the`knative-build` and `knative-monitoring` namespaces.
92
117
93
118
## Installing Istio
94
119
95
120
[Follow the instructions to install and run Istio in IBM Cloud Private](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private).
96
121
97
122
## Installing Knative components
98
123
99
-
You can install the Knative Serving, Knative Build and Knative Monitoring components together, or individually.
124
+
You can install the Knative Serving, Knative Build and Knative Monitoring
125
+
components together, or individually.
126
+
127
+
1. Run one of the following commands to install Knative:
100
128
101
-
1. Run one of the following commands to install Knative:
129
+
- Specify `release-lite.yaml` to install the
130
+
[Knative Serving](https://github.com/knative/serving) and
131
+
[Knative Build](https://github.com/knative/build) components with metrics
132
+
monitoring:
102
133
103
-
* Specify `release-lite.yaml` to install the [Knative Serving](https://github.com/knative/serving) and
104
-
[Knative Build](https://github.com/knative/build) components with metrics monitoring:
1. Depending on the Knative that you chose to install, ensure that the installation is successful by running the following commands until the namespace shows a `STATUS` of `Running`:
158
+
1. Depending on the Knative that you chose to install, ensure that the
159
+
installation is successful by running the following commands until the
160
+
namespace shows a `STATUS` of `Running`:
129
161
130
-
```
131
-
kubectl get pods --namespace knative-serving
132
-
kubectl get pods --namespace knative-build
133
-
kubectl get pods --namespace knative-monitoring
134
-
```
162
+
```
163
+
kubectl get pods --namespace knative-serving
164
+
kubectl get pods --namespace knative-build
165
+
kubectl get pods --namespace knative-monitoring
166
+
```
135
167
136
-
> Note: Instead of rerunning the command, you can add `--watch` to the above
137
-
command to view the component's status updates in real time. Use CTRL+C to exit watch mode.
168
+
> Note: Instead of rerunning the command, you can add `--watch` to the above
169
+
> command to view the component's status updates in real time. Use CTRL+C to
170
+
> exit watch mode.
138
171
139
172
Now you can deploy an app to your newly created Knative cluster.
140
173
@@ -150,39 +183,43 @@ guide.
150
183
If you'd like to view the available sample apps and deploy one of your choosing,
151
184
head to the [sample apps](../serving/samples/README.md) repo.
152
185
153
-
*Note*: When looking up the IP address to use for accessing your app, you need to look up
154
-
the NodePort for the `knative-ingressgateway` as well as the IP address used for ICP.
155
-
You can use the following command to look up the value to use for the {IP_ADDRESS} placeholder
156
-
used in the samples:
186
+
_Note_: When looking up the IP address to use for accessing your app, you need
187
+
to look up the NodePort for the `knative-ingressgateway` as well as the IP
188
+
address used for ICP. You can use the following command to look up the value to
189
+
use for the {IP_ADDRESS} placeholder used in the samples:
190
+
191
+
```shell
192
+
echo $(ICP cluster ip):$(kubectl get svc knative-ingressgateway --namespace istio-system \
0 commit comments