6단계 - 필수 구성 요소 설치 및 구성

역할 ARN 수집

Prerequisites 단계에서 생성된 역할의 ARN이 있으면 이 부분은 건너뛸 수 있습니다.

대신 역할 이름이 있는 경우, 아래 명령을 사용하여 역할 ARN을 가져오세요. 실행하기 전에 아래 명령에서 prefix 및 profile을 설정해야 합니다.

prefix=""
profile=""
external_secrets_iam_role_arn=$(aws iam get-role --role-name role-cdrp-ext-secrets-${prefix} --profile ${profile} --query 'Role.Arn')
echo "external_secrets_iam_role_arn=${external_secrets_iam_role_arn}"
efs_iam_role_arn=$(aws iam get-role --role-name role-cdrp-efs-csi-${prefix} --profile ${profile} --query 'Role.Arn')
echo "external_secrets_iam_role_arn=${efs_iam_role_arn}"

이제 Helm 차트에 액세스할 수 있으므로 배포할 수 있습니다.

먼저 필수 구성 요소를 설치합니다:

# Install RabbitMQ cluster operator
helm upgrade --install rabbitmq-cluster-operator oci://glasswallhub.azurecr.io/docker/bitnamicharts/rabbitmq-cluster-operator \
  --atomic \
  --version 4.4.34 \
  --set global.imageRegistry=glasswallhub.azurecr.io \
  --set global.imagePullSecrets[0]=acr-secret \
  --set global.security.allowInsecureImages=true \
  --set msgTopologyOperator.fullnameOverride=rabbitmq-messaging-topology-operator \
  --set clusterOperator.image.repository="cgr.dev/rabbitmq-cluster-operator" \
  --set clusterOperator.image.tag=2.17.0 \
  --set msgTopologyOperator.image.repository="cgr.dev/rabbitmq-messaging-topology-operator" \
  --set msgTopologyOperator.image.tag=1.18.3 \
  --set credentialUpdaterImage.repository="cgr.dev/rabbitmq-default-user-credential-updater" \
  --set credentialUpdaterImage.tag=1.0.12 \
  --set rabbitmqImage.repository="cgr.dev/rabbitmq" \
  --set rabbitmqImage.tag=4.2.6 \
  --set clusterOperator.watchAllNamespaces=false \
  --set clusterOperator.watchNamespaces={cdrplatform} \
  --set msgTopologyOperator.watchAllNamespaces=false \
  --set msgTopologyOperator.watchNamespaces={cdrplatform} \
  --set clusterOperator.resources.requests.cpu=100m \
  --set clusterOperator.resources.requests.memory=256Mi \
  --set clusterOperator.resources.limits.cpu=100m \
  --set clusterOperator.resources.limits.memory=256Mi \
  --set msgTopologyOperator.resources.requests.cpu=100m \
  --set msgTopologyOperator.resources.requests.memory=256Mi \
  --set msgTopologyOperator.resources.limits.cpu=100m \
  --set msgTopologyOperator.resources.limits.memory=256Mi

# Install KEDA
helm upgrade --install keda "oci://glasswallhub.azurecr.io/ghcr/home-operations/charts-mirror/keda" --atomic \
  --namespace cdrplatform \
  --set imagePullSecrets[0].name=acr-secret \
  --set global.image.registry="glasswallhub.azurecr.io" \
  --set image.keda.repository="cgr.dev/keda" \
  --set image.keda.tag=2.19.0 \
  --set image.metricsApiServer.repository="cgr.dev/keda-metrics-apiserver" \
  --set image.metricsApiServer.tag=2.19.0 \
  --set image.webhooks.repository="cgr.dev/keda-admission-webhooks" \
  --set image.webhooks.tag=2.19.0 \
  --version 2.19.0

# Install nginx ingress controller
helm upgrade --install nginx-ingress oci://glasswallhub.azurecr.io/k8s/ingress-nginx/charts/ingress-nginx --atomic \
  --set imagePullSecrets[0].name=acr-secret \
  --set global.image.registry="glasswallhub.azurecr.io" \
  --set controller.image.image="cgr.dev/ingress-nginx-controller" \
  --set controller.image.tag=1.14.4-nginx.1.27 \
  --set controller.admissionWebhooks.patch.image.image="cgr.dev/kube-webhook-certgen" \
  --set controller.admissionWebhooks.patch.image.tag=1.14.4 \
  --set controller.image.digest="" \
  --set controller.admissionWebhooks.patch.image.digest="" \
  --version v4.15.0

# Install External Secrets
helm upgrade --install external-secrets oci://glasswallhub.azurecr.io/ghcr/external-secrets/charts/external-secrets \
  --atomic \
  --set imagePullSecrets[0].name=acr-secret \
  --set webhook.imagePullSecrets[0].name=acr-secret \
  --set certController.imagePullSecrets[0].name=acr-secret \
  --set image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set image.tag=2.1.0 \
  --set webhook.image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set webhook.image.tag=2.1.0 \
  --set certController.image.repository="glasswallhub.azurecr.io/cgr.dev/external-secrets" \
  --set certController.image.tag=2.1.0 \
  --version 2.1.0 \
  --set installCRDs=true

# Replace ${external_secrets_iam_role_arn} with the ARN value of the role that has access to Secrets Manager,
# and ${region} with your AWS region.
helm upgrade --install cdrplatform-external-secrets -n cdrplatform cdrplatform-external-secrets --atomic --create-namespace \
  --set cloud_providers.aws.enabled=true \
  --set cloud_providers.aws.secretsManager.iam_role="${external_secrets_iam_role_arn}" \
  --set cloud_providers.aws.secretsManager.region="${region}"

# Replace ${efs_iam_role_arn} with the ARN value of the role for EFS CSI driver.
helm upgrade -i aws-efs-csi-driver aws-efs-csi-driver/aws-efs-csi-driver \
  --namespace cdrplatform \
  --set image.repository=602401143452.dkr.ecr.${region}.amazonaws.com/eks/aws-efs-csi-driver \
  --set controller.serviceAccount.create=true \
  --set controller.serviceAccount.name=sa-efs-csi-controller \
  --set controller.serviceAccount.annotations."eks\.amazonaws\.com/role-arn"="${efs_iam_role_arn}"

참고로 rabbitmq-cluster-operator Helm chart를 업그레이드할 때는 CRD가 설치되지 않습니다. 새 릴리스에 새로운 CRD가 도입된 경우, 실행 중인 RabbitMQ cluster operator pod 관련 문제를 방지하려면 CRD를 수동으로 설치해야 합니다.

helm pull oci://glasswallhub.azurecr.io/docker/bitnamicharts/rabbitmq-cluster-operator --untar
kubectl apply -f rabbitmq-cluster-operator/crds/

그런 다음 지원 구성 요소를 설치합니다:

# Replace ${file_system_id} and ${storageAmount} with values for your environment.
helm upgrade --install cdrplatform-storage -n cdrplatform cdrplatform-storage \
  --set cloud_provider=aws \
  --set aws.efs.file_system_id=${file_system_id} \
  --set storageAmount=${storageAmount}

helm upgrade --install cdrplatform-rabbitmq -n cdrplatform cdrplatform-rabbitmq \
  --set image.registry=glasswallhub.azurecr.io \
  --set image.tag=2.18.1-183506 \
  --set cloud_provider=aws \
  --atomic

계속

도움이 필요하신가요?

역할 ARN 수집​

역할 ARN 수집