Update Tornjak deployment docs (#288)
* Update Tornjak deployment docs Signed-off-by: Mariusz Sabath <[email protected]> * Change the reference for installing standard Tornjak Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/tornjak/README.md Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Adjust deployment paths Signed-off-by: Mariusz Sabath <[email protected]> * Remove the production README changes Signed-off-by: Mariusz Sabath <[email protected]> * Minor text edits Signed-off-by: Mariusz Sabath <[email protected]> * Fix incorrect namespace value Signed-off-by: Mariusz Sabath <[email protected]> * Updat Tornjak README Signed-off-by: Mariusz Sabath <[email protected]> * Update Keycloak README Signed-off-by: Mariusz Sabath <[email protected]> * Text updates in Keycloak doc Signed-off-by: Mariusz Sabath <[email protected]> * Post-review updates Signed-off-by: Mariusz Sabath <[email protected]> * Update Tornjak message for User Management Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/tornjak/keycloak/README.md Co-authored-by: Mohammed Abdi <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update Tornjak deployment doc Signed-off-by: Mariusz Sabath <[email protected]> * Improve the Tornjak Auth message Signed-off-by: Mariusz Sabath <[email protected]> * Fix error with incorrect Ingress value Signed-off-by: Mariusz Sabath <[email protected]> * Fix documentation format Signed-off-by: Mariusz Sabath <[email protected]> * Update parameter format Signed-off-by: Mariusz Sabath <[email protected]> * Removed redundand doc sections Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: kfox1111 <[email protected]> Co-authored-by: Mohammed Abdi <[email protected]>
This commit is contained in:
Mariusz Sabath
co-authored by
kfox1111
Mohammed Abdi
kfox1111
Mohammed Abdi
parent
a9b04fd86c
commit
b6575c172d
+68
-31
@@ -1,29 +1,41 @@
|
||||
# Recommended setup to deploy Tornjak
|
||||
|
||||
To install Spire with the least privileges possible we deploy spire across 2 namespaces.
|
||||
> [!WARNING]
|
||||
> The default version of Tornjak in this chart is deployed without authentication. Therefore it is not suitable to run this version in production. In order to enable the user authentication,
|
||||
> follow [Keycloak instructions](keycloak/README.md)
|
||||
|
||||
## Deploy Standard SPIRE
|
||||
|
||||
Follow the production installation of SPIRE as described in the [install instructions] (https://artifacthub.io/packages/helm/spiffe/spire) document.
|
||||
|
||||
## Upgrade to enable Tornjak
|
||||
|
||||
Before we can deploy Tornjak with SPIRE we need to decide whether the services would be
|
||||
using direct access, Ingress, or some other method.
|
||||
|
||||
## Tornjak with Direct Access
|
||||
|
||||
This can be done using port-forward. For example, to start Tornjak APIs on port 10000
|
||||
|
||||
Deploy SPIRE with Tornjak enabled
|
||||
|
||||
```shell
|
||||
kubectl create namespace "spire-system"
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
|
||||
kubectl create namespace "spire-server"
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
|
||||
export TORNJAK_API=http://localhost:10000
|
||||
|
||||
# deploy SPIRE with Tornjak enabled
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values tests/integration/psat/values.yaml \
|
||||
helm upgrade --install -n spire-mgmt spire spire \
|
||||
--repo https://spiffe.github.io/helm-charts-hardened/ \
|
||||
--set tornjak-frontend.apiServerURL=$TORNJAK_API \
|
||||
--values examples/tornjak/values.yaml \
|
||||
--values your-values.yaml \
|
||||
--render-subchart-notes
|
||||
|
||||
|
||||
# test the Tornjak deployment
|
||||
helm test spire -n spire-server
|
||||
```
|
||||
|
||||
## Access Tornjak
|
||||
|
||||
To access Tornjak you will have to use port-forwarding for the time being *(until we add authentication and ingress)*.
|
||||
|
||||
Run following commands from your shell, if you ran with different values your namespace might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
|
||||
Run following commands from your shell, to start port forwarding for Tornjak backend (APIs)
|
||||
and Tornjak frontend (UI) services.
|
||||
If you deployed in different namespace, your values might differ. Consult the install notes printed when running above `helm upgrade` command in that case.
|
||||
|
||||
Since `port-forward` is a blocking command, execute them in two different consoles:
|
||||
|
||||
@@ -35,38 +47,63 @@ kubectl -n spire-server port-forward service/spire-tornjak-backend 10000:10000
|
||||
kubectl -n spire-server port-forward service/spire-tornjak-frontend 3000:3000
|
||||
```
|
||||
|
||||
You can now access Tornjak at [localhost:3000](http://localhost:3000).
|
||||
You can now access Tornjak with your browser at [localhost:3000](http://localhost:3000).
|
||||
|
||||
See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
|
||||
|
||||
## Tornjak and Ingress with ingress-nginx
|
||||
## Deploy Tornjak with ingress-nginx
|
||||
|
||||
Update examples/production/example-your-values.yaml with your information, most importantly, trustDomain.
|
||||
Update your-values.yaml with your ingress information, most importantly, trustDomain, and redeploy
|
||||
adding the following:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values tests/integration/psat/values.yaml \
|
||||
--values examples/tornjak/values.yaml \
|
||||
--values examples/tornjak/values-ingress.yaml \
|
||||
--set global.spire.ingressControllerType=ingress-nginx \
|
||||
--render-subchart-notes --debug
|
||||
--values examples/tornjak/values-ingress.yaml
|
||||
```
|
||||
|
||||
## Tornjak and Ingress on Openshift
|
||||
## Deploy Tornjak with Ingress on Openshift
|
||||
|
||||
When deploying on Openshift, follow the deployment setup as described in
|
||||
[Openshift README](../openshift/README.md)
|
||||
|
||||
Then just add Openshift specific configuration to the above command:
|
||||
Obtain the OpenShift Apps Subdomain for Ingress and assign it to the `trustDomain`
|
||||
environment variable:
|
||||
|
||||
```shell
|
||||
--values examples/openshift/openshift-values.yaml
|
||||
export appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
|
||||
echo $appdomain
|
||||
```
|
||||
|
||||
So it can be passed as follow:
|
||||
|
||||
```shell
|
||||
--set global.openshift=true \
|
||||
--set global.spire.trustDomain=$appdomain \
|
||||
--values examples/tornjak/values-ingress.yaml \
|
||||
```
|
||||
|
||||
When running on Openshift in some environments like IBM Cloud,
|
||||
you might need to add the following configurations:
|
||||
you might need to also add the following configurations:
|
||||
|
||||
```shell
|
||||
--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \
|
||||
--set spiffe-csi-driver.restrictedScc.enabled=true \
|
||||
--values examples/openshift/values-ibm-cloud.yaml
|
||||
```
|
||||
|
||||
## Validation
|
||||
|
||||
Confirm access to the Tornjak API (backend):
|
||||
|
||||
```shell
|
||||
curl https://tornjak-backend.$appdomain
|
||||
"Welcome to the Tornjak Backend!"
|
||||
```
|
||||
|
||||
If the APIs are accessible, we can verify the Tornjak UI (A React application running in the local browser) can be accessed.
|
||||
Test access to Tornjak by opening the URL provided in Tornjak-frontend route:
|
||||
|
||||
```shell
|
||||
oc get route -n spire-server -l=app.kubernetes.io/name=tornjak-frontend -o jsonpath='https://{ .items[0].spec.host }'
|
||||
```
|
||||
|
||||
The value should match the following URL:
|
||||
|
||||
```shell
|
||||
echo "https://tornjak-frontend.$appdomain"
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user