Skip to content

Commit f31d710

Browse files
zxDiscoveryknative-prow-robot
zxDiscovery
authored and
knative-prow-robot
committed
Update doc for knative deploy on IBMCloudPrivate (#660)
* Update doc for knative deploy on IBMCloudPrivate * Simplify IBMCloudPrivate Installation Steps * Change configuration order * Re-add lost edits + improvements and fixes Redo the overwritten commit, clarify security policy steps, fix indentation errors
1 parent 1ef00e4 commit f31d710

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎install/Knative-with-ICP.md‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
# Knative Install on IBM Cloud Private
2+
3+
This guide walks you through the installation of the latest version of
4+
[Knative Serving](https://github.com/knative/serving) and [Knative Build](https://github.com/knative/build) using pre-built images and
5+
demonstrates creating and deploying an image of a sample `hello world` app onto
6+
the newly created Knative cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private).
7+
8+
You can find [guides for other platforms here](README.md).
9+
10+
## Before you begin
11+
12+
### Install IBM Cloud Private
13+
14+
Knative requires a v3.1.1 standard [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster. Before you can install Knative, you must first complete all the steps that are provided in the [IBM Cloud Private standard cluster installation instructions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html). For Example:
15+
16+
1. Install Docker for your boot node only
17+
18+
2. Set up the installation environment
19+
20+
3. Customize your cluster
21+
22+
4. Set up Docker for your cluster nodes
23+
24+
5. Deploy the environment
25+
26+
6. Verify the status of your installation
27+
28+
### Configure IBM Cloud Private security policies
29+
30+
You need to create and set both the image security and pod security policies before you install Knative in your cluster.
31+
32+
#### Update the image security policy
33+
Update the [image security policy (`image-security-enforcement`)](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) in IBM Cloud Private to allow the access to the Knative image:
34+
35+
1. Edit the image security policy:
36+
```
37+
kubectl edit clusterimagepolicies ibmcloud-default-cluster-image-policy
38+
```
39+
40+
2. Update `spec.repositories` by adding `"gcr.io/knative-releases/*"`, for example:
41+
```yaml
42+
spec:
43+
repositories:
44+
- name: "gcr.io/knative-releases/*"
45+
```
46+
47+
#### Update pod security policy
48+
Configure the namespaces `knative-serving` into pod security policy `ibm-privileged-psp`. The step as follows:
49+
50+
1. Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use `ibm-privileged-psp`. Run the following command:
51+
```shell
52+
cat <<EOF | kubectl apply -f -
53+
apiVersion: rbac.authorization.k8s.io/v1
54+
kind: ClusterRole
55+
metadata:
56+
name: knative-role
57+
rules:
58+
-
59+
apiGroups:
60+
- extensions
61+
resourceNames:
62+
- ibm-privileged-psp
63+
resources:
64+
- podsecuritypolicies
65+
verbs:
66+
- use
67+
EOF
68+
```
69+
70+
2. In the Knative installation steps below, you have the option of installing a Knative installation bundle or individual components. For each component that you install, you must create a cluster role binding between the service account of the Knative namespace and the `ibm-privileged-psp` pod security policy that you created.
71+
72+
For example to create a role binding for the `knative-serving` namespace, run the following command:
73+
```shell
74+
cat <<EOF | kubectl apply -f -
75+
apiVersion: rbac.authorization.k8s.io/v1
76+
kind: ClusterRoleBinding
77+
metadata:
78+
name: knative-serving-psp-users
79+
roleRef:
80+
apiGroup: rbac.authorization.k8s.io
81+
kind: ClusterRole
82+
name: knative-role
83+
subjects:
84+
-
85+
apiGroup: rbac.authorization.k8s.io
86+
kind: Group
87+
name: "system:serviceaccounts:knative-serving"
88+
EOF
89+
```
90+
91+
**Important**: If you choose to install the Knative Build or observability plugin, you must also create cluster role bindings for the service accounts in the`knative-build` and `knative-monitoring` namespaces.
92+
93+
## Installing Istio
94+
95+
[Follow the instructions to install and run Istio in IBM Cloud Private](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private).
96+
97+
## Installing Knative components
98+
99+
You can install the Knative Serving, Knative Build and Knative Monitoring components together, or individually.
100+
101+
1. Run one of the following commands to install Knative:
102+
103+
* Specify `release-lite.yaml` to install the [Knative Serving](https://github.com/knative/serving) and
104+
[Knative Build](https://github.com/knative/build) components with metrics monitoring:
105+
106+
```shell
107+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/release-lite.yaml \
108+
| sed 's/LoadBalancer/NodePort/' \
109+
| kubectl apply --filename -
110+
```
111+
112+
* Specify `serving.yaml` to install only [Knative Serving](https://github.com/knative/serving):
113+
114+
```shell
115+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/serving.yaml \
116+
| sed 's/LoadBalancer/NodePort/' \
117+
| kubectl apply --filename -
118+
```
119+
120+
* Specify `build.yaml` to install only [Knative Serving](https://github.com/knative/build):
121+
122+
```shell
123+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/build.yaml \
124+
| sed 's/LoadBalancer/NodePort/' \
125+
| kubectl apply --filename -
126+
```
127+
128+
1. Depending on the Knative that you chose to install, ensure that the installation is successful by running the following commands until the namespace shows a `STATUS` of `Running`:
129+
130+
```
131+
kubectl get pods --namespace knative-serving
132+
kubectl get pods --namespace knative-build
133+
kubectl get pods --namespace knative-monitoring
134+
```
135+
136+
> Note: Instead of rerunning the command, you can add `--watch` to the above
137+
command to view the component's status updates in real time. Use CTRL+C to exit watch mode.
138+
139+
Now you can deploy an app to your newly created Knative cluster.
140+
141+
## Deploying an app
142+
143+
Now that your cluster has Knative installed, you're ready to deploy an app.
144+
145+
If you'd like to follow a step-by-step guide for deploying your first app on
146+
Knative, check out the
147+
[Getting Started with Knative App Deployment](getting-started-knative-app.md)
148+
guide.
149+
150+
If you'd like to view the available sample apps and deploy one of your choosing,
151+
head to the [sample apps](../serving/samples/README.md) repo.
152+
153+
*Note*: When looking up the IP address to use for accessing your app, you need to look up
154+
the NodePort for the `knative-ingressgateway` as well as the IP address used for ICP.
155+
You can use the following command to look up the value to use for the {IP_ADDRESS} placeholder
156+
used in the samples:
157+
```shell
158+
echo $(ICP cluster ip):$(kubectl get svc knative-ingressgateway --namespace istio-system \
159+
--output 'jsonpath={.spec.ports[?(@.port==80)].nodePort}')
160+
```
161+
162+
## Cleaning up
163+
164+
To remove Knative from your IBM Cloud Private cluster by running one of the following commands:
165+
166+
* If you installed `release-lite.yaml`, run:
167+
```shell
168+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/release-lite.yaml \
169+
| sed 's/LoadBalancer/NodePort/' \
170+
| kubectl delete --filename -
171+
```
172+
173+
* If you installed `serving.yaml`, run:
174+
```shell
175+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/serving.yaml \
176+
| sed 's/LoadBalancer/NodePort/' \
177+
| kubectl delete --filename -
178+
```
179+
180+
* If you installed `build.yaml`, run:
181+
```shell
182+
curl -L https://github.com/knative/serving/releases/download/v0.2.3/build.yaml \
183+
| sed 's/LoadBalancer/NodePort/' \
184+
| kubectl delete --filename -
185+
```
186+
187+
---
188+
189+
Except as otherwise noted, the content of this page is licensed under the
190+
[Creative Commons Attribution 4.0 License](https://creativecommons.org/licenses/by/4.0/),
191+
and code samples are licensed under the
192+
[Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0).

‎install/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ Knative components on the following platforms:
2626
- [Knative Install on Gardener](Knative-with-Gardener.md)
2727
- [Knative Install on Google Kubernetes Engine](Knative-with-GKE.md)
2828
- [Knative Install on IBM Cloud Kubernetes Service](Knative-with-IKS.md)
29+
- [Knative Install on IBM Cloud Private](Knative-with-ICP.md)
2930
- [Knative Install on Minikube](Knative-with-Minikube.md)
3031
- [Knative Install on OpenShift](Knative-with-OpenShift.md)
3132
- [Knative Install on Minishift](Knative-with-Minishift.md)

0 commit comments

Comments
 (0)