Skip to content

Commit cec97de

Browse files
Gerry-FordeGerry-Forde
committed
RHIDP-1923 - GKE: Document how RHDH can be installed in GKE
1 parent f3f1614 commit cec97de

File tree

2 files changed

+179
-59
lines changed

2 files changed

+179
-59
lines changed

‎modules/installation/proc-deploy-rhdh-instance-gke.adoc‎

Lines changed: 92 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@
88
.Prerequisites
99

1010
* A cluster administrator has installed the {product} Operator.
11-
* You have an {eks-short} cluster with {aws-short} Application Load Balancer (ALB) add-on installed. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html[Application load balancing on {eks-brand-name}] and https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html[Installing the AWS Load Balancer Controller add-on].
12-
* You have configured a domain name for your {product-short} instance. The domain name can be a hosted zone entry on Route 53 or managed outside of AWS. For more information, see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring.html[Configuring Amazon Route 53 as your DNS service] documentation.
13-
* You have an entry in the {aws-short} Certificate Manager (ACM) for your preferred domain name. Make sure to keep a record of your Certificate ARN.
11+
//* You have an {eks-short} cluster with {aws-short} Application Load Balancer (ALB) add-on installed. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html[Application load balancing on {eks-brand-name}] and https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html[Installing the AWS Load Balancer Controller add-on].
12+
//* You have configured a domain name for your {product-short} instance. The domain name can be a hosted zone entry on Route 53 or managed outside of AWS. For more information, see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring.html[Configuring Amazon Route 53 as your DNS service] documentation.
13+
//* You have an entry in the {aws-short} Certificate Manager (ACM) for your preferred domain name. Make sure to keep a record of your Certificate ARN.
1414
* You have subscribed to `registry.redhat.io`. For more information, see https://access.redhat.com/RegistryAuthentication[{company-name} Container Registry Authentication].
15-
* You have set the context to the {eks-short} cluster in your current `kubeconfig`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html[Creating or updating a kubeconfig file for an Amazon {eks-short} cluster].
15+
//* You have set the context to the {eks-short} cluster in your current `kubeconfig`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html[Creating or updating a kubeconfig file for an Amazon {eks-short} cluster].
1616
* You have installed `kubectl`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html[Installing or updating kubectl].
1717

1818
.Procedure
@@ -29,18 +29,18 @@ metadata:
2929
data:
3030
"app-config-rhdh.yaml": |
3131
app:
32-
title: {product}
33-
baseUrl: https://<rhdh_dns_name>
32+
title: Red Hat Developer Hub
33+
baseUrl: https://<rhdh_domain_name>
3434
backend:
3535
auth:
3636
externalAccess:
3737
- type: legacy
3838
options:
3939
subject: legacy-default-config
4040
secret: "${BACKEND_SECRET}"
41-
baseUrl: https://<rhdh_dns_name>
41+
baseUrl: https://<rhdh_domain_name>
4242
cors:
43-
origin: https://<rhdh_dns_name>
43+
origin: https://<rhdh_domain_name>
4444
----
4545
--
4646

@@ -107,6 +107,89 @@ spec:
107107
----
108108
--
109109

110+
. Set up a Google-managed certificate by creating a `ManagedCertificate` object that you will later attach to the Ingress.
111+
+
112+
--
113+
[source,yaml,subs="attributes+"]
114+
----
115+
apiVersion: networking.gke.io/v1
116+
kind: ManagedCertificate
117+
metadata:
118+
name: <rhdh_certificate_name>
119+
spec:
120+
domains:
121+
- <rhdh_domain_name>
122+
----
123+
--
124+
For more information about setting up a Google-managed certificate, see https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs?hl=en#setting_up_a_google-managed_certificate
125+
126+
. Create a `FrontendConfig` object to set a policy for redirecting to HTTPS. You will later attach this policy to the Ingress.
127+
+
128+
--
129+
[source,yaml,subs="attributes+"]
130+
----
131+
apiVersion: networking.gke.io/v1beta1
132+
kind: FrontendConfig
133+
metadata:
134+
name: <ingress_security_config>
135+
spec:
136+
sslPolicy: gke-ingress-ssl-policy-https
137+
redirectToHttps:
138+
enabled: true
139+
----
140+
--
141+
For more information about setting a policy to redirect to HTTPS, see https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration?hl=en#https_redirect
142+
143+
. Create an Ingress resource using the following template, customizing the names as needed:
144+
+
145+
--
146+
[source,yaml,subs="attributes+"]
147+
----
148+
apiVersion: networking.k8s.io/v1
149+
kind: Ingress
150+
metadata:
151+
# TODO: this the name of your Developer Hub Ingress
152+
name: my-rhdh
153+
annotations:
154+
# If the class annotation is not specified it defaults to "gce".
155+
kubernetes.io/ingress.class: "gce"
156+
kubernetes.io/ingress.global-static-ip-name: <ADDRESS_NAME>
157+
networking.gke.io/managed-certificates: <rhdh_certificate_name>
158+
networking.gke.io/v1beta1.FrontendConfig: <ingress_security_config>
159+
spec:
160+
ingressClassName: gce
161+
rules:
162+
# TODO: Set your application domain name.
163+
- host: <rhdh_domain_name>
164+
http:
165+
paths:
166+
- path: /
167+
pathType: Prefix
168+
backend:
169+
service:
170+
# TODO: my-rhdh is the name of your Backstage Custom Resource.
171+
# Adjust if you changed it!
172+
name: backstage-my-rhdh
173+
port:
174+
name: http-backend
175+
----
176+
--
177+
178+
. Wait for the `ManagedCertificate` to be provisioned. This can take a couple of hours.
179+
180+
. Access RHDH with `https://<rhdh_domain_name>`
181+
+
182+
[IMPORTANT]
183+
Use the HTTPS protocol, not HTTP.
184+
185+
.Additional information
186+
For more information on setting up GKE using Ingress with TLS, see https://github.com/GoogleCloudPlatform/gke-networking-recipes/tree/main/ingress/single-cluster/ingress-https
187+
188+
For more information on setting up GKE with LoadBalancer instead of Ingress, see https://github.com/sumiranchugh/rhdh-gke-poc/tree/main
189+
190+
191+
192+
////
110193
. Create an Ingress resource using the following template, ensuring to customize the names as needed:
111194
+
112195
--
@@ -156,3 +239,4 @@ In the previous template, replace ` <rhdh_dns_name>` with your {product-short} d
156239
.Verification
157240
158241
Wait until the DNS name is responsive, indicating that your {product-short} instance is ready for use.
242+
////

‎modules/installation/proc-rhdh-deploy-gke-helm.adoc‎

Lines changed: 87 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,17 @@
44
[id='proc-rhdh-deploy-gke-helm_{context}']
55
= Installing {product-short} on {gke-short} with the Helm chart
66

7-
When you install the {product-short} Helm chart in {gke-name} ({gke-short}), it orchestrates the deployment of a {product-short} instance, which provides a robust developer platform within the {aws-short} ecosystem.
7+
When you install the {product-short} Helm chart in {gke-name} ({gke-short}), it orchestrates the deployment of a {product-short} instance, which provides a robust developer platform within the {gke-short} ecosystem.
88

99
.Prerequisites
1010

11-
* You have an {eks-short} cluster with AWS Application Load Balancer (ALB) add-on installed. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html[Application load balancing on Amazon {product-short}] and https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html[Installing the AWS Load Balancer Controller add-on].
12-
* You have configured a domain name for your {product-short} instance. The domain name can be a hosted zone entry on Route 53 or managed outside of AWS. For more information, see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring.html[Configuring Amazon Route 53 as your DNS service] documentation.
13-
* You have an entry in the AWS Certificate Manager (ACM) for your preferred domain name. Make sure to keep a record of your Certificate ARN.
11+
//* You have an {eks-short} cluster with AWS Application Load Balancer (ALB) add-on installed. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html[Application load balancing on Amazon {product-short}] and https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html[Installing the AWS Load Balancer Controller add-on].
12+
//* You have configured a domain name for your {product-short} instance. The domain name can be a hosted zone entry on Route 53 or managed outside of AWS. For more information, see https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring.html[Configuring Amazon Route 53 as your DNS service] documentation.
13+
//* You have an entry in the AWS Certificate Manager (ACM) for your preferred domain name. Make sure to keep a record of your Certificate ARN.
1414
* You have subscribed to `registry.redhat.io`. For more information, see https://access.redhat.com/RegistryAuthentication[{company-name} Container Registry Authentication].
15-
* You have set the context to the {eks-short} cluster in your current `kubeconfig`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html[Creating or updating a kubeconfig file for an Amazon {eks-short} cluster].
15+
//* You have set the context to the {eks-short} cluster in your current `kubeconfig`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html[Creating or updating a kubeconfig file for an Amazon {eks-short} cluster].
1616
* You have installed `kubectl`. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html[Installing or updating kubectl].
17-
* You have installed Helm 3 or the latest. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/helm.html[Using Helm with Amazon {eks-short}].
17+
//* You have installed Helm 3 or the latest. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/helm.html[Using Helm with Amazon {eks-short}].
1818

1919
.Procedure
2020

@@ -32,67 +32,77 @@ helm repo add openshift-helm-charts https://charts.openshift.io/
3232
--
3333
[source,terminal]
3434
----
35-
kubectl create secret docker-registry rhdh-pull-secret \
35+
kubectl -n <your-namespace> create secret docker-registry rhdh-pull-secret \ <1>
3636
--docker-server=registry.redhat.io \
37-
--docker-username=<user_name> \ <1>
38-
--docker-password=<password> \ <2>
39-
--docker-email=<email> <3>
37+
--docker-username=<user_name> \ <2>
38+
--docker-password=<password> \ <3>
39+
--docker-email=<email> <4>
4040
----
41-
<1> Enter your username in the command.
42-
<2> Enter your password in the command.
43-
<3> Enter your email address in the command.
41+
<1> Enter your GKE namespace in the command.
42+
<2> Enter your username in the command.
43+
<3> Enter your password in the command.
44+
<4> Enter your email address in the command.
4445

4546
The created pull secret is used to pull the {product-short} images from the {company-name} Ecosystem.
4647
--
4748

48-
. Create a file named `values.yaml` using the following template:
49+
. Set up a Google-managed certificate by creating a `ManagedCertificate` object that you will later attach to the Ingress.
4950
+
51+
--
5052
[source,yaml,subs="attributes+"]
5153
----
52-
global:
53-
# TODO: Set your application domain name.
54-
host: <your {product-short} domain name>
54+
apiVersion: networking.gke.io/v1
55+
kind: ManagedCertificate
56+
metadata:
57+
name: <rhdh_certificate_name>
58+
spec:
59+
domains:
60+
- <rhdh_domain_name>
61+
----
62+
--
63+
For more information about setting up a Google-managed certificate, see https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs?hl=en#setting_up_a_google-managed_certificate
5564

65+
. Create a `FrontendConfig` object to set a policy for redirecting to HTTPS. You will later attach this policy to the Ingress.
66+
+
67+
--
68+
[source,yaml,subs="attributes+"]
69+
----
70+
apiVersion: networking.gke.io/v1beta1
71+
kind: FrontendConfig
72+
metadata:
73+
name: <ingress_security_config>
74+
spec:
75+
sslPolicy: gke-ingress-ssl-policy-https
76+
redirectToHttps:
77+
enabled: true
78+
----
79+
--
80+
For more information about setting a policy to redirect to HTTPS, see https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration?hl=en#https_redirect
5681

82+
. Create a file named `values.yaml` using the following template:
83+
+
84+
[source,yaml,subs="attributes+"]
85+
----
86+
global:
87+
host: <rhdh_domain_name>
5788
route:
5889
enabled: false
59-
60-
6190
upstream:
6291
service:
63-
# NodePort is required for the ALB to route to the Service
6492
type: NodePort
65-
66-
6793
ingress:
6894
enabled: true
6995
annotations:
70-
kubernetes.io/ingress.class: alb
71-
72-
73-
alb.ingress.kubernetes.io/scheme: internet-facing
74-
75-
76-
# TODO: Using an ALB HTTPS Listener requires a certificate for your own domain. Fill in the ARN of your certificate, e.g.:
77-
alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:xxx:xxxx:certificate/xxxxxx
78-
79-
80-
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
81-
82-
83-
alb.ingress.kubernetes.io/ssl-redirect: '443'
84-
85-
86-
# TODO: Set your application domain name.
87-
external-dns.alpha.kubernetes.io/hostname: <your rhdh domain name>
88-
89-
96+
kubernetes.io/ingress.class: gce
97+
kubernetes.io/ingress.global-static-ip-name: <ADDRESS_NAME>
98+
networking.gke.io/managed-certificates: <rhdh_certificate_name>
99+
networking.gke.io/v1beta1.FrontendConfig: <ingress_security_config>
100+
className: gce
90101
backstage:
91102
image:
92103
pullSecrets:
93104
- rhdh-pull-secret
94105
podSecurityContext:
95-
# you can assign any random value as fsGroup
96106
fsGroup: 2000
97107
postgresql:
98108
image:
@@ -101,7 +111,6 @@ upstream:
101111
primary:
102112
podSecurityContext:
103113
enabled: true
104-
# you can assign any random value as fsGroup
105114
fsGroup: 3000
106115
volumePermissions:
107116
enabled: true
@@ -110,16 +119,43 @@ upstream:
110119
+
111120
[source,terminal,subs="attributes+"]
112121
----
113-
helm install rhdh \
122+
helm -n <your_namespace> install -f values.yaml <your_deploy_name> \
114123
openshift-helm-charts/redhat-developer-hub \
115-
[--version {product-chart-version}] \
116-
--values /path/to/values.yaml
124+
--version {product-chart-version}
125+
----
126+
+
127+
For the latest Helm Chart version, see https://github.com/openshift-helm-charts/charts/tree/main/charts/redhat/redhat/redhat-developer-hub
128+
+
129+
It takes some time to deploy it, check if the deployment completed use this command
130+
+
131+
[source,terminal,subs="attributes+"]
132+
----
133+
kubectl get deploy <you_deploy_name>-developer-hub -n <your_namespace>
117134
----
118135

119-
[NOTE]
120-
====
121-
For the latest chart version, see https://github.com/openshift-helm-charts/charts/tree/main/charts/redhat/redhat/redhat-developer-hub
122-
====
136+
. Verify that the service and ingress were created
137+
+
138+
[source,terminal,subs="attributes+"]
139+
----
140+
kubectl get service -n <your_namespace>
141+
kubectl get ingress -n <your_namespace>
142+
----
143+
144+
. Wait for the `ManagedCertificate` to be provisioned. This can take a couple of hours.
145+
146+
. Access RHDH with `https://<rhdh_domain_name>`
147+
+
148+
[IMPORTANT]
149+
Use the HTTPS protocol, not HTTP.
150+
151+
. To upgrade or delete your deployment use (mind the –version)
152+
+
153+
[source,terminal,subs="attributes+"]
154+
----
155+
helm -n <your_namespace> upgrade -f values.yaml <your_deploy_name> openshift-helm-charts/redhat-developer-hub --version 1.3.0
156+
157+
helm -n <your_namespace> delete <your_deploy_name>
158+
----
123159

124160
.Verification
125161

0 commit comments

Comments
 (0)