Skip to content

Commit 738262b

Browse files
paigecalvertpaigecalvert
committed
Move EC to top level
1 parent c853bcd commit 738262b

File tree

5 files changed

+106
-90
lines changed

5 files changed

+106
-90
lines changed

‎docs/enterprise/installing-embedded-requirements.mdx‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import EmbeddedClusterRequirements from "../partials/embedded-cluster/_requirements.mdx"
2+
import EmbeddedClusterPortRequirements from "../partials/embedded-cluster/_port-reqs.mdx"
3+
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
4+
5+
# Embedded Cluster Installation Requirements
6+
7+
This topic lists the installation requirements for Replicated Embedded Cluster. Ensure that the installation environment meets these requirements before attempting to install.
8+
9+
## System Requirements
10+
11+
<EmbeddedClusterRequirements/>
12+
13+
## Port Requirements
14+
15+
<EmbeddedClusterPortRequirements/>
16+
17+
## Firewall Openings for Online Installations
18+
19+
<FirewallOpenings/>

‎docs/enterprise/installing-general-requirements.mdx‎

Lines changed: 27 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
import DockerCompatibility from "../partials/image-registry/_docker-compatibility.mdx"
22
import KubernetesCompatibility from "../partials/install/_kubernetes-compatibility.mdx"
3-
import EmbeddedClusterRequirements from "../partials/embedded-cluster/_requirements.mdx"
4-
import EmbeddedClusterPortRequirements from "../partials/embedded-cluster/_port-reqs.mdx"
3+
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
54

6-
# Installation Requirements
5+
# KOTS Installation Requirements
76

8-
This topic describes the requirements for installing applications with Replicated KOTS. It includes requirements for installing KOTS in existing clusters and in clusters created with Replicated Embedded Cluster or Replicated kURL.
7+
This topic describes the requirements for installing in a Kubernetes cluster with Replicated KOTS.
98

109
:::note
1110
This topic does not include any requirements specific to the application. Ensure that you meet any additional requirements for the application before installing.
@@ -34,15 +33,11 @@ Replicated recommends using a version of KOTS that is compatible with Kubernetes
3433

3534
<KubernetesCompatibility/>
3635

37-
## Existing Cluster Requirements
36+
## Minimum System Requirements
3837

39-
To install KOTS in an existing cluster, your environment must meet the following minimum requirements.
38+
To install KOTS in an existing cluster, your environment must meet the following minimum requirements:
4039

41-
### Minimum System Requirements
42-
43-
To install the Admin Console on an existing cluster, the cluster must meet the following requirements:
44-
45-
* **Admin console minimum requirements**: Existing clusters that have LimitRanges specified must support the following minimum requirements for the Admin Console:
40+
* **KOTS Admin Console minimum requirements**: Clusters that have LimitRanges specified must support the following minimum requirements for the Admin Console:
4641

4742
* **CPU resources and memory**: The Admin Console pod requests 100m CPU resources and 100Mi memory.
4843

@@ -65,8 +60,11 @@ To install the Admin Console on an existing cluster, the cluster must meet the f
6560
* **Kubernetes version compatibility**: The version of Kubernetes running on the cluster must be compatible with the version of KOTS that you use to install the application. This compatibility requirement does not include any specific and additional requirements defined by the software vendor for the application.
6661

6762
For more information about the versions of Kubernetes that are compatible with each version of KOTS, see [Kubernetes Version Compatibility](#kubernetes-version-compatibility) above.
63+
6864
* **OpenShift version compatibility**: For Red Hat OpenShift clusters, the version of OpenShift must use a supported Kubernetes version. For more information about supported Kubernetes versions, see [Kubernetes Version Compatibility](#kubernetes-version-compatibility) above.
65+
6966
* **Storage class**: The cluster must have an existing storage class available. For more information, see [Storage Classes](https://kubernetes.io/docs/concepts/storage/storage-classes/) in the Kubernetes documentation.
67+
7068
* **Port forwarding**: To support port forwarding, Kubernetes clusters require that the SOcket CAT (socat) package is installed on each node.
7169

7270
If the package is not installed on each node in the cluster, you see the following error message when the installation script attempts to connect to the Admin Console: `unable to do port forwarding: socat not found`.
@@ -75,23 +73,23 @@ To install the Admin Console on an existing cluster, the cluster must meet the f
7573

7674
If the output of the `which socat` command is `socat not found`, then you must install the package that provides the socat command. The name of this package can vary depending on the node's operating system.
7775

78-
### RBAC Requirements
76+
## RBAC Requirements
7977

8078
The user that runs the installation command must have at least the minimum role-based access control (RBAC) permissions that are required by KOTS. If the user does not have the required RBAC permissions, then an error message displays: `Current user has insufficient privileges to install Admin Console`.
8179

8280
The required RBAC permissions vary depending on if the user attempts to install KOTS with cluster-scoped access or namespace-scoped access:
8381
* [Cluster-scoped RBAC Requirements (Default)](#cluster-scoped)
8482
* [Namespace-scoped RBAC Requirements](#namespace-scoped)
8583

86-
#### Cluster-scoped RBAC Requirements (Default) {#cluster-scoped}
84+
### Cluster-scoped RBAC Requirements (Default) {#cluster-scoped}
8785

8886
By default, KOTS requires cluster-scoped access. With cluster-scoped access, a Kubernetes ClusterRole and ClusterRoleBinding are created that grant KOTS access to all resources across all namespaces in the cluster.
8987

9088
To install KOTS with cluster-scoped access, the user must meet the following RBAC requirements:
9189
* The user must be able to create workloads, ClusterRoles, and ClusterRoleBindings.
9290
* The user must have cluster-admin permissions to create namespaces and assign RBAC roles across the cluster.
9391

94-
#### Namespace-scoped RBAC Requirements {#namespace-scoped}
92+
### Namespace-scoped RBAC Requirements {#namespace-scoped}
9593

9694
KOTS can be installed with namespace-scoped access rather than the default cluster-scoped access. With namespace-scoped access, a Kubernetes Role and RoleBinding are automatically created that grant KOTS permissions only in the namespace where it is installed.
9795

@@ -100,8 +98,14 @@ Depending on the application, namespace-scoped access for KOTS is required, opti
10098
:::
10199

102100
To install or upgrade KOTS with namespace-scoped access, the user must have _one_ of the following permission levels in the target namespace:
101+
* Wildcard Permissions (Default)
102+
* Minimum KOTS RBAC Permissions
103103

104-
* **Wildcard permissions (Default)**: By default, when namespace-scoped access is enabled, KOTS attempts to automatically create the following Role to acquire wildcard (`* * *`) permissions in the target namespace:
104+
See the sections below for more information.
105+
106+
#### Wildcard Permissions (Default)
107+
108+
By default, when namespace-scoped access is enabled, KOTS attempts to automatically create the following Role to acquire wildcard (`* * *`) permissions in the target namespace:
105109

106110
```yaml
107111
apiVersion: "rbac.authorization.k8s.io/v1"
@@ -116,7 +120,9 @@ To install or upgrade KOTS with namespace-scoped access, the user must have _one
116120
117121
To support this default behavior, the user must also have `* * *` permissions in the target namespace.
118122

119-
* **Minimum KOTS RBAC permissions**: In some cases, it is not possible to grant the user `* * *` permissions in the target namespace. For example, an organization might have security policies that prevent this level of permissions.
123+
#### Minimum KOTS RBAC Permissions
124+
125+
In some cases, it is not possible to grant the user `* * *` permissions in the target namespace. For example, an organization might have security policies that prevent this level of permissions.
120126

121127
If the user installing or upgrading KOTS cannot be granted `* * *` permissions in the namespace, then they can instead request the minimum RBAC permissions required by KOTS. Using the minimum KOTS RBAC permissions also requires manually creating a ServiceAccount, Role, and RoleBinding for KOTS, rather than allowing KOTS to automatically create a Role with `* * *` permissions.
122128

@@ -250,89 +256,20 @@ To install or upgrade KOTS with namespace-scoped access, the user must have _one
250256
After manually creating these RBAC resources, the user must include both the `--ensure-rbac=false` and `--skip-rbac-check` flags when installing or upgrading. These flags prevent KOTS from checking for or attempting to create a Role with `* * *` permissions in the namespace. For more information, see [Prerequisites](installing-existing-cluster#prerequisites) in _Online Installation in Existing Clusters_.
251257
:::
252258

253-
## Embedded Cluster Requirements
254-
255-
To install with the Embedded Cluster installer, your environment must meet the following requirements.
256-
257-
### System Requirements
258-
259-
<EmbeddedClusterRequirements/>
260-
261-
### Port Requirements
262-
263-
<EmbeddedClusterPortRequirements/>
264-
265-
## kURL Requirements {#kurl-requirements}
266-
267-
To install with kURL, your environment must meet the following requirements.
268-
269-
### Minimum System Requirements
270-
271-
* 4 CPUs or equivalent per machine
272-
* 8GB of RAM per machine
273-
* 40GB of disk space per machine
274-
* TCP ports 2379, 2380, 6443, 6783, and 10250 open between cluster nodes
275-
* UDP port 8472 open between cluster nodes
276-
277-
:::note
278-
If the Kubernetes installer specification uses the deprecated kURL [Weave add-on](https://kurl.sh/docs/add-ons/weave), UDP ports 6783 and 6784 must be open between cluster nodes. Reach out to your software vendor for more information.
279-
:::
259+
## Compatible Image Registries
280260

281-
* Root access is required
282-
* (Rook Only) The Rook add-on version 1.4.3 and later requires block storage on each node in the cluster. For more information about how to enable block storage for Rook, see [Block Storage](https://kurl.sh/docs/add-ons/rook/#block-storage) in _Rook Add-On_ in the kURL documentation.
261+
This section describes the requirements for using a local private image regsitry when performing air gap installations with KOTS.
283262

284-
### Additional System Requirements
285-
286-
You must meet the additional kURL system requirements when applicable:
287-
288-
- **Supported Operating Systems**: For supported operating systems, see [Supported Operating Systems](https://kurl.sh/docs/install-with-kurl/system-requirements#supported-operating-systems) in the kURL documentation.
289-
290-
- **kURL Dependencies Directory**: kURL installs additional dependencies in the directory /var/lib/kurl and the directory requirements must be met. See [kURL Dependencies Directory](https://kurl.sh/docs/install-with-kurl/system-requirements#kurl-dependencies-directory) in the kURL documentation.
291-
292-
- **Networking Requirements**: Networking requirements include firewall openings, host firewalls rules, and port availability. See [Networking Requirements](https://kurl.sh/docs/install-with-kurl/system-requirements#networking-requirements) in the kURL documentation.
293-
294-
- **High Availability Requirements**: If you are operating a cluster with high availability, see [High Availability Requirements](https://kurl.sh/docs/install-with-kurl/system-requirements#high-availability-requirements) in the kURL documentation.
295-
296-
- **Cloud Disk Performance**: For a list of cloud VM instance and disk combinations that are known to provide sufficient performance for etcd and pass the write latency preflight, see [Cloud Disk Performance](https://kurl.sh/docs/install-with-kurl/system-requirements#cloud-disk-performance) in the kURL documentation.
297-
298-
299-
## Private Registry Requirements
300-
301-
This section describes the requirements for using a private image regsitry for KOTS installations.
302-
303-
### About Using a Private Registry
304-
305-
A private image registry is required for air gap installations. For air gap installations in existing clusters, you must provide credentials for a compatible private registry during installation.
306-
307-
For air gap installations in kURL clusters, the kURL installer automatically uses the registry add-on to meet the private registry requirement. For more information, see [Registry Add-on](https://kurl.sh/docs/add-ons/registry) in the kURL documentation.
263+
A private image registry is required for air gap installations with KOTS in existing clusters. You provide the credentials for a compatible private registry during installation. You can also optionally configure a local private image registry for use with KOTS installations in online (internet-connected) environments.
308264

309265
Private registry settings can be changed at any time. For more information, see [Using Private Registries](image-registry-settings).
310266

311-
### Compatible Registries
267+
312268

313269
KOTS has been tested for compatibility with the following registries:
314270

315271
<DockerCompatibility/>
316272

317273
## Firewall Openings for Online Installations
318274

319-
The domains for the services listed in the table below need to be accessible from servers performing online installations. No outbound internet access is required for air gapped installations.
320-
321-
For services hosted at domains owned by Replicated, the table below includes a link to the list of IP addresses for the domain at [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json) in GitHub. Note that the IP addresses listed in the `replicatedhq/ips` repository also include IP addresses for some domains that are _not_ required for installation.
322-
323-
For third-party services hosted at domains not owned by Replicated, the table below lists the required domains. Consult the third-party's documentation for the IP address range for each domain, as needed.
324-
325-
| Host | Embedded Cluster | Existing Clusters | kURL Clusters | Description |
326-
|--------|------------------|-------------------|-------------------|-------------|
327-
| Docker Hub | Not Required | Required | Required | Some dependencies of KOTS are hosted as public images in Docker Hub. The required domains for this service are `index.docker.io`, `cdn.auth0.com`, `*.docker.io`, and `*.docker.com.` |
328-
| `replicated.app` | Required | Required | Required | <p>Upstream application YAML and metadata is pulled from `replicated.app`. The current running version of the application (if any), as well as a license ID and application ID to authenticate, are all sent to `replicated.app`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p> <p>For the range of IP addresses for `replicated.app`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L60-L65) in GitHub.</p> |
329-
| `proxy.replicated.com` | Required | Required&#42;| Required&#42;| <p>Private Docker images are proxied through `proxy.replicated.com`. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p> <p>For the range of IP addresses for `proxy.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L52-L57) in GitHub.</p> |
330-
| `registry.replicated.com` | Required&#42;&#42; | Required&#42;&#42; | Required&#42;&#42; | <p>Some applications host private images in the Replicated registry at this domain. The on-prem docker client uses a license ID to authenticate to `registry.replicated.com`. This domain is owned by Replicated, Inc which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `registry.replicated.com`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L20-L25) in GitHub.</p>
331-
| `kots.io` | Not Required | Required | Not Required | Requests are made to this domain when installing the Replicated KOTS CLI. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.|
332-
| `github.com ` | Not Required | Required | Not Required | Requests are made to this domain when installing the Replicated KOTS CLI. For information about retrieving GitHub IP addresses, see [About GitHub's IP addresses](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-githubs-ip-addresses) in the GitHub documentation. |
333-
| `k8s.kurl.sh`<br/>`s3.kurl.sh` | Not Required | Not Required | Required | <p>kURL installation scripts and artifacts are served from [kurl.sh](https://kurl.sh). An application identifier is sent in a URL path, and bash scripts and binary executables are served from kurl.sh. This domain is owned by Replicated, Inc., which is headquartered in Los Angeles, CA.</p><p> For the range of IP addresses for `k8s.kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L34-L39) in GitHub.</p><p> The range of IP addresses for `s3.kurl.sh` are the same as IP addresses for the `kurl.sh` domain. For the range of IP address for `kurl.sh`, see [replicatedhq/ips](https://github.com/replicatedhq/ips/blob/main/ip_addresses.json#L28-L31) in GitHub.</p> |
334-
| `amazonaws.com` | Not Required | Not Required | Required | `tar.gz` packages are downloaded from Amazon S3 during installations with kURL. For information about dynamically scraping the IP ranges to allowlist for accessing these packages, see [AWS IP address ranges](https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#aws-ip-download) in the AWS documentation.|
335-
336-
&#42; Required only if the application uses the Replicated proxy registry. Contact your software vendor for more information.
337-
338-
&#42;&#42; Required only if the application uses the Replicated registry. Contact your software vendor for more information.
275+
<FirewallOpenings/>

‎docs/enterprise/installing-kurl-requirements.mdx‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
import FirewallOpenings from "../partials/install/_firewall-openings.mdx"
2+
3+
# kURL Requirements
4+
5+
This topic lists the installation requirements for Replicated kURL. Ensure that the installation environment meets these requirements before attempting to install.
6+
7+
## Minimum System Requirements
8+
9+
* 4 CPUs or equivalent per machine
10+
* 8GB of RAM per machine
11+
* 40GB of disk space per machine
12+
* TCP ports 2379, 2380, 6443, 6783, and 10250 open between cluster nodes
13+
* UDP port 8472 open between cluster nodes
14+
15+
:::note
16+
If the Kubernetes installer specification uses the deprecated kURL [Weave add-on](https://kurl.sh/docs/add-ons/weave), UDP ports 6783 and 6784 must be open between cluster nodes. Reach out to your software vendor for more information.
17+
:::
18+
19+
* Root access is required
20+
* (Rook Only) The Rook add-on version 1.4.3 and later requires block storage on each node in the cluster. For more information about how to enable block storage for Rook, see [Block Storage](https://kurl.sh/docs/add-ons/rook/#block-storage) in _Rook Add-On_ in the kURL documentation.
21+
22+
## Additional System Requirements
23+
24+
You must meet the additional kURL system requirements when applicable:
25+
26+
- **Supported Operating Systems**: For supported operating systems, see [Supported Operating Systems](https://kurl.sh/docs/install-with-kurl/system-requirements#supported-operating-systems) in the kURL documentation.
27+
28+
- **kURL Dependencies Directory**: kURL installs additional dependencies in the directory /var/lib/kurl and the directory requirements must be met. See [kURL Dependencies Directory](https://kurl.sh/docs/install-with-kurl/system-requirements#kurl-dependencies-directory) in the kURL documentation.
29+
30+
- **Networking Requirements**: Networking requirements include firewall openings, host firewalls rules, and port availability. See [Networking Requirements](https://kurl.sh/docs/install-with-kurl/system-requirements#networking-requirements) in the kURL documentation.
31+
32+
- **High Availability Requirements**: If you are operating a cluster with high availability, see [High Availability Requirements](https://kurl.sh/docs/install-with-kurl/system-requirements#high-availability-requirements) in the kURL documentation.
33+
34+
- **Cloud Disk Performance**: For a list of cloud VM instance and disk combinations that are known to provide sufficient performance for etcd and pass the write latency preflight, see [Cloud Disk Performance](https://kurl.sh/docs/install-with-kurl/system-requirements#cloud-disk-performance) in the kURL documentation.
35+
36+
## Firewall Openings for Online Installations
37+
38+
<FirewallOpenings/>

0 commit comments

Comments
 (0)