|
33 | 33 | - [Port Forward](#port-forward) |
34 | 34 | - [Forward to Pod](#forward-to-pod) |
35 | 35 | - [Forward to Service](#forward-to-service) |
| 36 | + - [HAPorxy Load Balancer](#haporxy-load-balancer) |
| 37 | + - [Enable HAProxy](#enable-haproxy) |
| 38 | + - [Configuration](#configuration) |
| 39 | + - [ConfigMap](#configmap) |
| 40 | + - [Modify Port Configuration](#modify-port-configuration) |
| 41 | + - [Automatic Reload Configuration](#automatic-reload-configuration) |
| 42 | + - [External Access](#external-access) |
| 43 | + - [Access HAProxy](#access-haproxy) |
| 44 | +- [Security](#security) |
36 | 45 | - [Security Context](#security-context) |
37 | 46 | - [Network Policy](#network-policy) |
38 | 47 | - [Pod Priorty](#pod-priorty) |
@@ -249,7 +258,7 @@ Identify the name of the secret. |
249 | 258 |
|
250 | 259 | 2. Save the secret name from step 1 and get the admin password using the following script: |
251 | 260 | ``` |
252 | | -kubectl get secret SECRET_NAME -o jsonpath='{.data.marklogic-password}' | base64 --decode |
| 261 | +kubectl get secret SECRET_NAME -o jsonpath='{.data.password}' | base64 --decode |
253 | 262 | ``` |
254 | 263 | ### Log Collection |
255 | 264 |
|
@@ -412,6 +421,75 @@ kubectl port-forward svc/marklogic 8000:8000 |
412 | 421 |
|
413 | 422 | This pod can now be accessed via http://localhost:8001. |
414 | 423 |
|
| 424 | +## HAPorxy Load Balancer |
| 425 | + |
| 426 | +HAProxy is provided as a load balancer that is configured to supported cookie-based session affinity and multi-statement transaction that is needed by some of the MarkLogic client application like MLCP. |
| 427 | + |
| 428 | +### Enable HAProxy |
| 429 | + |
| 430 | +The HAProxy Load Balancer is disabled by default. To enable the HAProxy, provide the following config in your values file for your Chart installation: |
| 431 | +``` |
| 432 | +haproxy: |
| 433 | + enabled: true |
| 434 | +``` |
| 435 | + |
| 436 | +### Configuration |
| 437 | + |
| 438 | +#### ConfigMap |
| 439 | + |
| 440 | +The HAProxy configuation is dynamically generated in ConfigMap with the name of "marklogic-haproxy". You can provide your own configuation by creating a new ConfigMap and set the "existingConfigmap" in values file to the name of the new ConfigMap. |
| 441 | + |
| 442 | +#### Modify Port Configuration |
| 443 | + |
| 444 | +By default, port 8000, 8001, 8002 are configuered to handle HTTP traffic. |
| 445 | + |
| 446 | +You can modify the default ports selection for the HAProxy by providing your own configuration in values file. Below is the default configuration: |
| 447 | +``` |
| 448 | +haproxy: |
| 449 | + ports: |
| 450 | + - name: app-service |
| 451 | + type: HTTP |
| 452 | + port: 8000 |
| 453 | + - name: admin |
| 454 | + type: HTTP |
| 455 | + port: 8001 |
| 456 | + - name: manage |
| 457 | + type: HTTP |
| 458 | + port: 8002 |
| 459 | + - name: odbc |
| 460 | + type: TCP |
| 461 | + port: 5432 |
| 462 | +``` |
| 463 | +You can remove/add/modify the entry in ports by providing your own entry. For each entry, you need to specify the name, type and port. There are three type backend supported when configuring the loadbalancer: |
| 464 | +1. HTTP: configure the backend as HTTP proxy that handles HTTPC traffic. It also configured to handle Cookie based session affinity and multi-statement trasaction from MarkLogic Client. |
| 465 | +2. TCP: configure the backend as TCP proxy that handles TCP traffic. |
| 466 | + |
| 467 | +#### Automatic Reload Configuration |
| 468 | + |
| 469 | +When any change to the current deployment happens(change the backend ports, number of running MarkLogic nodes), the HAProxy will be restarted to load the new configuration by default. You can change this behavior by change the setting below: |
| 470 | +``` |
| 471 | +haproxy: |
| 472 | + restartWhenUpgrade: |
| 473 | + enabled: false |
| 474 | +``` |
| 475 | +Note: if restartWhenUpgrade.enabled set to false, you have to manually delete the HAProxy deployment to have the lastest configuration if you update the number of MarkLogic node. |
| 476 | + |
| 477 | +#### External Access |
| 478 | + |
| 479 | +By default, the HAProxy is configured to provide access within the Kubernetes cluster. You can configure the HAProxy to provide external access by setting the service type in values file below: |
| 480 | +``` |
| 481 | +haproxy: |
| 482 | + service: |
| 483 | + type: LoadBalancer |
| 484 | +``` |
| 485 | +Warning: By setting the haproxy service type to loadbalancer MarkLogic endpoint is exposed to public Internet. Please set the networkPolicy to limit the sources that can visit MarkLogic. |
| 486 | + |
| 487 | +### Access HAProxy |
| 488 | + |
| 489 | +The HAProxy can be accessed from service with the name of <RELEASE_NAME>-haproxy. For example, if the release name is marklogic, then the name of the service will be marklogic-haproxy. |
| 490 | + |
| 491 | +# Security |
| 492 | + |
415 | 493 | ## Security Context |
416 | 494 |
|
417 | 495 | Security context defines privilege and access control settings for a Pod or Container. By default security context for containers is enabled with runAsUser, runAsNonRoot, allowPrivilegeEscalation settings. To configure these values for containers, set the containerSecurityContext in the values.yaml file or using the `--set` flag. Additional security context settings can be added to containerSecurityContext configuration. Please refer [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). |
|
0 commit comments