Lumaktaw sa pangunahing nilalaman

Hakbang 7 - I-install at i-configure ang mga kinakailangang component

Ngayong may access ka na sa Helm charts, maaari na silang i-deploy.

  • I-install muna ang mga prerequisite component.
helm upgrade --install rabbitmq-cluster-operator oci://glasswallhub.azurecr.io/docker/bitnamicharts/rabbitmq-cluster-operator \
  --atomic \
  --version 4.4.34 \
  --set global.imageRegistry=glasswallhub.azurecr.io \
  --set global.imagePullSecrets[0]=acr-secret \
  --set global.security.allowInsecureImages=true \
  --set msgTopologyOperator.fullnameOverride=rabbitmq-messaging-topology-operator \
  --set clusterOperator.image.repository="cgr.dev/rabbitmq-cluster-operator" \
  --set clusterOperator.image.tag=2.17.0 \
  --set msgTopologyOperator.image.repository="cgr.dev/rabbitmq-messaging-topology-operator" \
  --set msgTopologyOperator.image.tag=1.18.3 \
  --set credentialUpdaterImage.repository="cgr.dev/rabbitmq-default-user-credential-updater" \
  --set credentialUpdaterImage.tag=1.0.12 \
  --set rabbitmqImage.repository="cgr.dev/rabbitmq" \
  --set rabbitmqImage.tag=4.2.6 \
  --set clusterOperator.watchAllNamespaces=false \
  --set clusterOperator.watchNamespaces={cdrplatform} \
  --set msgTopologyOperator.watchAllNamespaces=false \
  --set msgTopologyOperator.watchNamespaces={cdrplatform} \
  --set clusterOperator.resources.requests.cpu=100m \
  --set clusterOperator.resources.requests.memory=256Mi \
  --set clusterOperator.resources.limits.cpu=100m \
  --set clusterOperator.resources.limits.memory=256Mi \
  --set msgTopologyOperator.resources.requests.cpu=100m \
  --set msgTopologyOperator.resources.requests.memory=256Mi \
  --set msgTopologyOperator.resources.limits.cpu=100m \
  --set msgTopologyOperator.resources.limits.memory=256Mi

helm upgrade --install keda "oci://glasswallhub.azurecr.io/ghcr/home-operations/charts-mirror/keda" --atomic \
  --set global.image.registry="glasswallhub.azurecr.io" \
  --set imagePullSecrets[0].name=acr-secret \
  --set image.keda.repository="cgr.dev/keda" \
  --set image.keda.tag=2.19.0 \
  --set image.metricsApiServer.repository="cgr.dev/keda-metrics-apiserver" \
  --set image.metricsApiServer.tag=2.19.0 \
  --set image.webhooks.repository="cgr.dev/keda-admission-webhooks" \
  --set image.webhooks.tag=2.19.0 \
  --version 2.19.0

helm upgrade --install nginx-ingress oci://glasswallhub.azurecr.io/k8s/ingress-nginx/charts/ingress-nginx --atomic \
  --set imagePullSecrets[0].name=acr-secret \
  --set global.image.registry="glasswallhub.azurecr.io" \
  --set controller.image.image="cgr.dev/ingress-nginx-controller" \
  --set controller.image.tag=1.14.4-nginx.1.27 \
  --set controller.admissionWebhooks.patch.image.image="cgr.dev/kube-webhook-certgen" \
  --set controller.admissionWebhooks.patch.image.tag=1.14.4 \
  --set controller.image.digest="" \
  --set controller.admissionWebhooks.patch.image.digest="" \
  --set controller.service.annotations."service\.beta\.kubernetes\.io/azure-load-balancer-health-probe-request-path"=/healthz \
  --version v4.15.0

helm upgrade --install external-secrets oci://glasswallhub.azurecr.io/ghcr/external-secrets/charts/external-secrets \
  --atomic \
  --set imagePullSecrets[0].name=acr-secret \
  --set webhook.imagePullSecrets[0].name=acr-secret \
  --set certController.imagePullSecrets[0].name=acr-secret \
  --set image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set image.tag=2.1.0 \
  --set webhook.image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set webhook.image.tag=2.1.0 \
  --set certController.image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set certController.image.tag=2.1.0 \
  --version 2.1.0 \
  --set installCRDs=true

Tandaan: kapag ina-upgrade ang rabbitmq-cluster-operator Helm chart, hindi mai-install ang mga CRD. Kung may mga bagong CRD na ipinakilala sa mga bagong release, kailangang manu-manong i-install ang mga CRD upang maiwasan ang mga isyu sa tumatakbong RabbitMQ cluster operator pods.

helm pull oci://glasswallhub.azurecr.io/docker/bitnamicharts/rabbitmq-cluster-operator --untar
kubectl apply -f rabbitmq-cluster-operator/crds/
  • Pagkatapos, i-install ang mga supporting component.
helm upgrade --install cdrplatform-storage cdrplatform-storage

helm upgrade --install cdrplatform-rabbitmq cdrplatform-rabbitmq \
  --set image.registry=glasswallhub.azurecr.io \
  --set image.tag="2.18.1-183506" \
  --set cloud_provider=azure

Para sa susunod na hakbang, piliin ang parehong paraan na ginamit mo upang i-configure ang access mo sa Key Vault sa Hakbang 4 (Managed identity o Service principal), at sundin ang mga kaukulang hakbang sa ibaba upang i-configure ang external secrets at i-install ang secret synchronization.

7A - Managed identity​

  • Kunin ang Kubelet Managed Identity Client ID gamit ang sumusunod na command.
az aks show -g "${rgp}" -n "${aksname}"

  • Hanapin ang kaparehong element tulad noong nakaraan na "identityProfile/kubeletidentity" ngunit sa pagkakataong ito kailangan mo ang value ng Client ID.

  • Susunod, i-install ang mga sumusuportang component (tiyaking ang ${kvname} ay ipinalit para sa pangalan ng Key Vault at ang ${MIclientID} ay pinalitan ng halagang kinuha sa itaas):

helm upgrade --install cdrplatform-external-secrets cdrplatform-external-secrets \
  --set cloud_providers.azurekv.enabled=true \
  --set cloud_providers.azurekv.vaultUrl="https://${kvname}.vault.azure.net" \
  --set cloud_providers.azurekv.clientId=${MIclientID}
Mga User ng Pamahalaan ng US

Gamitin ang sumusunod na command kapag nagde-deploy sa Azure US Government.

Tinitiyak ng mga setting na ito na ginagamit ang tamang mga endpoint at value ng environment:

helm upgrade --install cdrplatform-external-secrets cdrplatform-external-secrets \
  --set cloud_providers.azurekv.enabled=true \
  --set cloud_providers.azurekv.vaultUrl="https://${kvname}.vault.usgovcloudapi.net" \
  --set cloud_providers.azurekv.clientId=${MIclientID} \
  --set cloud_providers.azurekv.environmentType=USGovernmentCloud

OR

7B - Service principal​

Bukod sa 'ClientID' at 'ClientSecret' na itinakda mo sa nakaraang hakbang ng Service principal, kakailanganin mo ring ilagay ang 'tenantId' ng Service principal. Ang 'tenantID' ay makikita sa Azure Active Directory.

  • Kapag nakuha na, ilagay ang sumusunod na command upang i-install ang cdrplatform external secrets para gamitin ang nais na Service principal.
helm upgrade --install cdrplatform-external-secrets cdrplatform-external-secrets --create-namespace \
  --set cloud_providers.azurekv.enabled=true \
  --set cloud_providers.azurekv.authType=ServicePrincipal \
  --set cloud_providers.azurekv.tenantId=${tenantid} \
  --set cloud_providers.azurekv.authSecretRef.clientId.name=keyvault-service-principal \
  --set cloud_providers.azurekv.authSecretRef.clientId.key=ClientID \
  --set cloud_providers.azurekv.authSecretRef.clientSecret.name=keyvault-service-principal \
  --set cloud_providers.azurekv.authSecretRef.clientSecret.key=ClientSecret \
  --set cloud_providers.azurekv.vaultUrl="https://"${kvname}".vault.azure.net"
Mga User ng Azure US Government

Gamitin ang sumusunod na command kapag nagde-deploy sa Azure US Gov.

Tinitiyak ng mga setting na ito na ginagamit ang tamang mga endpoint at value ng environment

helm upgrade --install cdrplatform-external-secrets cdrplatform-external-secrets --create-namespace \
  --set cloud_providers.azurekv.enabled=true \
  --set cloud_providers.azurekv.authType=ServicePrincipal \
  --set cloud_providers.azurekv.tenantId=${tenantid} \
  --set cloud_providers.azurekv.authSecretRef.clientId.name=keyvault-service-principal \
  --set cloud_providers.azurekv.authSecretRef.clientId.key=ClientID \
  --set cloud_providers.azurekv.authSecretRef.clientSecret.name=keyvault-service-principal \
  --set cloud_providers.azurekv.authSecretRef.clientSecret.key=ClientSecret \
  --set cloud_providers.azurekv.vaultUrl="https://"${kvname}".vault.usgovcloudapi.net" \
  --set cloud_providers.azurekv.environmentType=USGovernmentCloud

Magpatuloy

Kailangan ng tulong?

Huling na-update noong