From e9a2d5ff333059c3f6ada1d322dd5f3318bbadae Mon Sep 17 00:00:00 2001 From: linfraze Date: Fri, 25 Apr 2025 16:53:10 -0400 Subject: [PATCH 1/3] RHIDP-7038: Doc air-gapped installation on K8s platforms with Helm --- ...l-rhdh-airgapped-environment-k8s-helm.adoc | 19 ++ ...-install-rhdh-airgapped-full-k8s-helm.adoc | 234 ++++++++++++++++++ ...stall-rhdh-airgapped-partial-k8s-helm.adoc | 210 ++++++++++++++++ titles/install-rhdh-air-gapped/master.adoc | 10 +- 4 files changed, 470 insertions(+), 3 deletions(-) create mode 100644 assemblies/assembly-install-rhdh-airgapped-environment-k8s-helm.adoc create mode 100644 modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc create mode 100644 modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc diff --git a/assemblies/assembly-install-rhdh-airgapped-environment-k8s-helm.adoc b/assemblies/assembly-install-rhdh-airgapped-environment-k8s-helm.adoc new file mode 100644 index 0000000000..f6e0087a46 --- /dev/null +++ b/assemblies/assembly-install-rhdh-airgapped-environment-k8s-helm.adoc @@ -0,0 +1,19 @@ +[id="assembly-install-rhdh-airgapped-environment-k8s-helm_{context}"] += Installing {product} on a supported Kubernetes platform in an air-gapped environment with the Helm chart + +If you are using a supported Kubernetes platform in a fully disconnected or partially disconnected environment, you can install {product} by using the Helm chart. Supported Kubernetes platforms include the following: + +* {aks-brand-name} +* {eks-brand-name} +* {gke-brand-name} + +[role="_additional-resources"] +.Additional resources +* link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html/installing_red_hat_developer_hub_on_microsoft_azure_kubernetes_service/proc-rhdh-deploy-aks-helm_title-install-rhdh-aks[Deploying {product-short} on {aks-short} with the Helm chart]. +* link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html/installing_red_hat_developer_hub_on_amazon_elastic_kubernetes_service/proc-rhdh-deploy-eks-helm_title-install-rhdh-eksp[Installing {product-short} on {eks-short} with the Helm chart], +* link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html/installing_red_hat_developer_hub_on_google_kubernetes_engine/proc-rhdh-deploy-gke-helm_title-install-rhdh-gke[Installing {product-short} on {gke-short} with the Helm chart]. + +include::modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc[leveloffset=+1] + +include::modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc[leveloffset=+1] + diff --git a/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc new file mode 100644 index 0000000000..8017564302 --- /dev/null +++ b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc @@ -0,0 +1,234 @@ +[id="proc-install-rhdh-airgapped-full-k8s-helm_{context}"] += Installing {product} on a supported Kubernetes platform in a fully disconnected environment with the Helm chart + +In environments without internet access, a fully disconnected installation ensures that {product} can run reliably without external dependencies. This approach involves mirroring images and transferring them manually to the air-gapped environment. + +.Prerequisites + +* Skopeo 1.17 or later +* Yq 4.4 or later +* Access to registry.redhat.io for pulling images by using Skopeo login +* Access to the Kubernetes cluster with `kubectl` configured +* Helm 3.13 or later installed on the air-gapped host + +.Procedure + +. In a terminal, fetch the Helm charts values by running the following commands: ++ +[source,terminal,subs="+quotes"] +---- +helm repo add __ https://charts.openshift.io/ +helm repo update +helm show values __/redhat-developer-hub --version __ values.default.yaml +helm pull __/redhat-developer-hub --version __ +---- ++ +where + +__ :: Specifies the name of the Helm chart repository, for example, `openshift-helm-charts`. +__ :: Specifies the {product} version that you want to use, for example, `1.4.0`. ++ +[NOTE] +==== +The `helm pull __/redhat-developer-hub --version __` command automatically creates the Helm chart archive file and downloads the Helm chart to your current working directory. +==== ++ +. Extract the image digests by running the following commands: ++ +[source,terminal,subs="+quotes"] +---- +RHDH_IMAGE=$(yq '.upstream.backstage.image | .registry + "/" + .repository' values.default.yaml) +RHDH_DIGEST=$(yq '.upstream.backstage.image.tag' values.default.yaml) +PG_IMAGE=$(yq '.upstream.postgresql.image | .registry + "/" + .repository' values.default.yaml) +PG_DIGEST=$(yq '.upstream.postgresql.image.tag' values.default.yaml) +---- +. Mirror the images to your local archive by running the following commands: ++ +[source,terminal,subs="+quotes"] +---- +skopeo login registry.redhat.io +skopeo copy --all docker://${RHDH_IMAGE}:${RHDH_DIGEST} dir:./rhdh-hub +skopeo copy --all docker://${PG_IMAGE}:${PG_DIGEST} dir:./postgresql +---- + +. Transfer the following files and directories to your air-gapped environment: ++ +* rhdh-hub +* postgresql +* Helm chart archive file, for example, `redhat-developer-hub-1.4.0.tgz` ++ +. Load the images onto the air-gapped host by running the following command: ++ +[source,terminal,subs="+quotes"] +---- +skopeo copy --all dir:./rhdh-hub docker://__/__:${RHDH_DIGEST} + +skopeo copy --all dir:./postgresql docker://__/__:${PG_DIGEST} +---- ++ +where + +__ :: Specifies the name of the target mirror registry that you want to push the images to, for example, `registry.example.com`. + +__ :: Specifies the name of the repository where your {product} image is stored, for example, `rhdh/rhdh-hub-rhel9`. This value must match the name of the {product} image that you loaded onto the air-gapped host. + +__ :: Specifies the name of the repository where your PostgreSQL image is stored, for example, `rhdh/postgresql-15`. ++ +. Create a `values.yaml` file for the Kubernetes platform that you want to use and add the following image references to the file to reflect local use: ++ +[source,yaml,subs="+quotes"] +---- +upstream: + backstage: + image: + registry: "__" + repository: __ + tag: "${RHDH_DIGEST}" + + postgresql: + image: + registry: "__" + repository: __ + tag: "${PG_DIGEST}" + +---- ++ +where + +__ :: Specifies the name of the target mirror registry that you want to push the images to, for example, `registry.example.com`. + +__ :: Specifies the name of the repository where your {product} image is stored, for example, `rhdh/rhdh-hub-rhel9`. This value must match the name of the {product} image that you loaded onto the air-gapped host. + +__ :: Specifies the name of the repository where your PostgreSQL image is stored, for example, `rhdh/postgresql-15`. ++ +* For {aks-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + host: +route: + enabled: false +upstream: + ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + host: + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + fsGroup: 3000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +* For {eks-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + # TODO: Set your application domain name. + host: + +route: + enabled: false + +upstream: + service: + # NodePort is required for the ALB to route to the Service + type: NodePort + + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: alb + + alb.ingress.kubernetes.io/scheme: internet-facing + + # TODO: Using an ALB HTTPS Listener requires a certificate for your own domain. Fill in the ARN of your certificate, e.g.: + alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:xxx:xxxx:certificate/xxxxxx + + alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]' + + alb.ingress.kubernetes.io/ssl-redirect: '443' + + # TODO: Set your application domain name. + external-dns.alpha.kubernetes.io/hostname: + + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + # you can assign any random value as fsGroup + fsGroup: 2000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + # you can assign any random value as fsGroup + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +* For {gke-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + host: +route: + enabled: false +upstream: + service: + type: NodePort + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: gce + kubernetes.io/ingress.global-static-ip-name: + networking.gke.io/managed-certificates: + networking.gke.io/v1beta1.FrontendConfig: + className: gce + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + fsGroup: 2000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +. Install the Helm chart in the current namespace by running the following command: ++ +[source,terminal,subs="+quotes"] +---- +helm install rhdh ./__ -f values.yaml +---- ++ +where + +__ :: Specifies the name of the Helm chart archive file, for example, `redhat-developer-hub-1.4.0.tgz`. diff --git a/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc new file mode 100644 index 0000000000..6b04a78c75 --- /dev/null +++ b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc @@ -0,0 +1,210 @@ +[id="proc-install-rhdh-airgapped-partial-k8s-helm_{context}"] += Installing {product} on a supported Kubernetes platform in a partially disconnected environment with the Helm chart + +In a partially disconnected environment, the cluster cannot access external registries, for example, registry.redhat.io, but it can access an internal mirror registry. This method requires direct access to an internal mirror registry from the cluster. + +.Prerequisites + +* Skopeo 1.17 or later +* Yq 4.4 or later +* Active Skopeo session against registry.redhat.io +* Active Skopeo session against your target mirror registry, for example, `registry.internal.example.com` +* Access to the Kubernetes cluster with `kubectl` configured +* Helm 3.13 or later + +.Procedure + +. In a terminal, download and extract the Helm chart by running the following commands: ++ +[source,terminal,subs="attributes+"] +---- +helm repo add __ https://charts.openshift.io/ +helm repo update +helm pull __/redhat-developer-hub --version __ +helm show values __/redhat-developer-hub --version __ values.default.yaml +---- ++ +where + +__ :: Specifies the name of the Helm chart repository, for example, `openshift-helm-charts`. +__ :: Specifies the {product} version that you want to use, for example, `1.4.0`. ++ +. Use `yq` to extract the image digests by running the following commands: ++ +[source,terminal,subs="attributes+"] +---- +RHDH_IMAGE=$(yq '.upstream.backstage.image | .registry + "/" + .repository' values.default.yaml) +RHDH_DIGEST=$(yq '.upstream.backstage.image.tag' values.default.yaml) +PG_IMAGE=$(yq '.upstream.postgresql.image | .registry + "/" + .repository' values.default.yaml) +PG_DIGEST=$(yq '.upstream.postgresql.image.tag' values.default.yaml) +---- +. Mirror the images to the internal mirror registry by entering the following commands: ++ +[source,terminal,subs="attributes+"] +---- +skopeo login registry.redhat.io + +skopeo login __ + +skopeo copy --remove-signatures \ + docker://${PG_IMAGE}@${PG_DIGEST} \ + docker://__/__:${PG_DIGEST} + +skopeo copy --remove-signatures \ + docker://${RHDH_IMAGE}@${RHDH_DIGEST} \ + docker://__/__${RHDH_DIGEST} +---- ++ +where + +__ :: Specifies the name of the internal mirror registry, for example, `registry.internal.example.com`. + +__ :: Specifies the name of the PostgreSQL repository, for example, `rhdh/postgresql-15`. + +__ :: Specifies the name of the {product} repository, for example, `rhdh/rhdh-hub-rhel9`. ++ +. Create a `values.yaml` file for the Kubernetes platform that you want to use and add the following image references to the file to reflect local use: ++ +[source,yaml,subs="attributes+"] +---- +upstream: + backstage: + image: + registry: "__" + repository: __ + tag: "${RHDH_DIGEST}" + + postgresql: + image: + registry: "__" + repository: __ + tag: "${PG_DIGEST}" +---- ++ +* For {aks-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + host: +route: + enabled: false +upstream: + ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + host: + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + fsGroup: 3000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +* For {eks-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + # TODO: Set your application domain name. + host: + +route: + enabled: false + +upstream: + service: + # NodePort is required for the ALB to route to the Service + type: NodePort + + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: alb + + alb.ingress.kubernetes.io/scheme: internet-facing + + # TODO: Using an ALB HTTPS Listener requires a certificate for your own domain. Fill in the ARN of your certificate, e.g.: + alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:xxx:xxxx:certificate/xxxxxx + + alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]' + + alb.ingress.kubernetes.io/ssl-redirect: '443' + + # TODO: Set your application domain name. + external-dns.alpha.kubernetes.io/hostname: + + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + # you can assign any random value as fsGroup + fsGroup: 2000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + # you can assign any random value as fsGroup + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +* For {gke-short}, use the following `values.yaml` file template: ++ +[source,yaml,subs="+quotes"] +---- +global: + host: +route: + enabled: false +upstream: + service: + type: NodePort + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: gce + kubernetes.io/ingress.global-static-ip-name: + networking.gke.io/managed-certificates: + networking.gke.io/v1beta1.FrontendConfig: + className: gce + backstage: + image: + pullSecrets: + - rhdh-pull-secret + podSecurityContext: + fsGroup: 2000 + postgresql: + image: + pullSecrets: + - rhdh-pull-secret + primary: + podSecurityContext: + enabled: true + fsGroup: 3000 + volumePermissions: + enabled: true +---- ++ +. Install the Helm chart in the current namespace by running the following command: ++ +[source,terminal,subs="attributes+"] +---- +helm install rhdh ./redhat-developer-hub-1.4.0.tgz -f values.yaml +---- diff --git a/titles/install-rhdh-air-gapped/master.adoc b/titles/install-rhdh-air-gapped/master.adoc index 19b1cf2d92..cefdf890b4 100644 --- a/titles/install-rhdh-air-gapped/master.adoc +++ b/titles/install-rhdh-air-gapped/master.adoc @@ -1,14 +1,18 @@ [id="title-install-rhdh-air-grapped"] include::artifacts/attributes.adoc[] :title: Installing {product} in an air-gapped environment -:subtitle: Running {product} on {ocp-brand-name} in a networik restricted environment by using either the Operator or Helm chart. -:abstract: Platform administrators can configure roles, permissions, and other settings to enable other authorized users to deploy an air-gapped {product-short} instance on any supported platform using either the Operator or Helm chart. +:subtitle: Running {product} on {ocp-brand-name} in a networik restricted environment by using either the Operator or Helm chart +:abstract: Platform administrators can configure roles, permissions, and other settings to enable other authorized users to deploy an air-gapped {product-short} instance on any supported platform using either the Operator or Helm chart = {title} :context: title-install-rhdh-air-grapped :imagesdir: images include::modules/installation/con-airgapped-environment.adoc[leveloffset=+1] +// OCP include::assemblies/assembly-install-rhdh-airgapped-environment-ocp-operator.adoc[leveloffset=+1] -include::assemblies/assembly-install-rhdh-airgapped-environment-ocp-helm.adoc[leveloffset=+1] \ No newline at end of file +include::assemblies/assembly-install-rhdh-airgapped-environment-ocp-helm.adoc[leveloffset=+1] + +// Kubernetes +include::assemblies/assembly-install-rhdh-airgapped-environment-k8s-helm.adoc[leveloffset=+1] From b97eb0c34283f8de6999fe646486beb24e74fffb Mon Sep 17 00:00:00 2001 From: linfraze Date: Mon, 28 Apr 2025 11:43:38 -0400 Subject: [PATCH 2/3] RHIDP-7038: Apply Tech Review comments --- .../proc-install-rhdh-airgapped-full-k8s-helm.adoc | 6 +++--- .../proc-install-rhdh-airgapped-partial-k8s-helm.adoc | 10 +++++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc index 8017564302..c60dcc6785 100644 --- a/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc +++ b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc @@ -26,7 +26,7 @@ helm pull __/redhat-developer-hub --version __ :: Specifies the name of the Helm chart repository, for example, `openshift-helm-charts`. -__ :: Specifies the {product} version that you want to use, for example, `1.4.0`. +__ :: Specifies the {product} version that you want to use, for example, `{product-chart-version}`. + [NOTE] ==== @@ -55,9 +55,9 @@ skopeo copy --all docker://${PG_IMAGE}:${PG_DIGEST} dir:./postgresql + * rhdh-hub * postgresql -* Helm chart archive file, for example, `redhat-developer-hub-1.4.0.tgz` +* Helm chart archive file, for example, `redhat-developer-hub-{product-chart-version}.tgz` + -. Load the images onto the air-gapped host by running the following command: +. Load the images onto the air-gapped host by running the following commands: + [source,terminal,subs="+quotes"] ---- diff --git a/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc index 6b04a78c75..90871ca363 100644 --- a/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc +++ b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc @@ -21,13 +21,13 @@ In a partially disconnected environment, the cluster cannot access external regi helm repo add __ https://charts.openshift.io/ helm repo update helm pull __/redhat-developer-hub --version __ -helm show values __/redhat-developer-hub --version __ values.default.yaml +helm show values __/redhat-developer-hub --version __ > values.default.yaml ---- + where __ :: Specifies the name of the Helm chart repository, for example, `openshift-helm-charts`. -__ :: Specifies the {product} version that you want to use, for example, `1.4.0`. +__ :: Specifies the {product} version that you want to use, for example, `{product-chart-version}`. + . Use `yq` to extract the image digests by running the following commands: + @@ -206,5 +206,9 @@ upstream: + [source,terminal,subs="attributes+"] ---- -helm install rhdh ./redhat-developer-hub-1.4.0.tgz -f values.yaml +helm install rhdh ./__ -f values.yaml ---- ++ +where + +__ :: Specifies the name of the Helm chart archive file, for example, `redhat-developer-hub-{product-chart-version}.tgz`. From 0df95b9e9d0f0eb06a0f0ee28512cbc04099b8fe Mon Sep 17 00:00:00 2001 From: linfraze Date: Mon, 12 May 2025 12:07:52 -0400 Subject: [PATCH 3/3] RHIDP-7038: Apply peer review comments --- .../proc-install-rhdh-airgapped-full-k8s-helm.adoc | 12 ++++++------ ...roc-install-rhdh-airgapped-partial-k8s-helm.adoc | 13 +++++++------ 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc index c60dcc6785..6220f9882b 100644 --- a/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc +++ b/modules/installation/proc-install-rhdh-airgapped-full-k8s-helm.adoc @@ -5,15 +5,15 @@ In environments without internet access, a fully disconnected installation ensur .Prerequisites -* Skopeo 1.17 or later -* Yq 4.4 or later -* Access to registry.redhat.io for pulling images by using Skopeo login -* Access to the Kubernetes cluster with `kubectl` configured -* Helm 3.13 or later installed on the air-gapped host +* You have installed Skopeo 1.17 or later +* You have installed Yq 4.4 or later +* You authenticated to registry.redhat.io for pulling images by using the `skopeo login` command. +* You have access to the Kubernetes cluster with `kubectl` configured +* You have installed Helm 3.13 or later on the air-gapped host .Procedure -. In a terminal, fetch the Helm charts values by running the following commands: +. On the mirroring host, in a terminal, fetch the Helm charts values by running the following commands: + [source,terminal,subs="+quotes"] ---- diff --git a/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc index 90871ca363..9d2a67bf7c 100644 --- a/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc +++ b/modules/installation/proc-install-rhdh-airgapped-partial-k8s-helm.adoc @@ -5,12 +5,13 @@ In a partially disconnected environment, the cluster cannot access external regi .Prerequisites -* Skopeo 1.17 or later -* Yq 4.4 or later -* Active Skopeo session against registry.redhat.io -* Active Skopeo session against your target mirror registry, for example, `registry.internal.example.com` -* Access to the Kubernetes cluster with `kubectl` configured -* Helm 3.13 or later +* You have set up your workstation. +** You have installed Skopeo 1.17 or later +** You have installed Yq 4.4 or later +** You have installed Helm 3.13 or later +** You have an active Skopeo session against registry.redhat.io +** You have an active Skopeo session against your target mirror registry, for example, `registry.internal.example.com` +** You have access to the Kubernetes cluster with `kubectl` configured .Procedure