Kubernetes

#Amazon Web Services (AWS) - EKS

#Setup Cluster

• Follow this guide to install a cluster with worker nodes. Please make sure that you have all the IAM policies for the AWS user that will be creating the cluster and volumes.

• To be able to attach volumes to your pod, you need to install the Amazon EBS CSI driver

#Requirements

• The above guide should also walk you through installing kubectl, aws-iam-authenticator and aws cli on the VM you will be managing your cluster and nodes from. Check to make sure.

  aws-iam-authenticator help
  aws-cli
  kubectl version
  

  Copy

• Optional[alpha]: If using Istio please install it prior to installing Gluu. You may choose to use any installation method Istio supports. If you have installed istio ingress, a loadbalancer will have been created. Please save the address of the loadbalancer for use later during installation.

#GCE (Google Cloud Engine) - GKE

#Setup Cluster

1. Install gcloud

2. Install kubectl using gcloud components install kubectl command

3. Create a cluster using a command such as the following example:

   gcloud container clusters create exploringgluu --num-nodes 2 --machine-type e2-highcpu-8 --zone us-west1-a

   Copy

   where CLUSTER_NAME is the name you choose for the cluster and ZONE_NAME is the name of zone where the cluster resources live in.

4. Configure kubectl to use the cluster:

   gcloud container clusters get-credentials CLUSTER_NAME --zone ZONE_NAME

   Copy

   where CLUSTER_NAME is the name you choose for the cluster and ZONE_NAME is the name of zone where the cluster resources live in.

5. Afterwards, run kubectl cluster-info to check whether kubectl is ready to interact with the cluster. Make sure you are authenticated by using one of the several ways

• Optional[alpha]: If using Istio please install it prior to installing Gluu. You may choose to use any installation method Istio supports. If you have installed istio ingress, a loadbalancer will have been created. Please save the ip of loadbalancer for use later during installation.

#DigitalOcean Kubernetes (DOKS)

#Setup Cluster

• Follow this guide to create a digital ocean kubernetes service cluster and connect to it.

• Optional[alpha]: If using Istio please install it prior to installing Gluu. You may choose to use any installation method Istio supports. If you have installed istio ingress, a loadbalancer will have been created. Please save the ip of loadbalancer for use later during installation.

#Azure - AKS

#Requirements

• Follow this guide to install Azure CLI on the VM that will be managing the cluster and nodes. Check to make sure.

• Follow this section to create the resource group for the AKS setup.

• Follow this section to create the AKS cluster

• Follow this section to connect to the AKS cluster

• Optional[alpha]: If using Istio please install it prior to installing Gluu. You may choose to use any installation method Istio supports. If you have installed istio ingress, a loadbalancer will have been created. Please save the ip of loadbalancer for use later during installation.

#Minikube

#Requirements

1. Install minikube.

2. Install kubectl.

3. Create cluster:

   minikube start

   Copy

4. Configure kubectl to use the cluster:

    kubectl config use-context minikube
   

   Copy

5. Enable ingress on minikube

   minikube addons enable ingress

   Copy

6. Optional[alpha]: If using Istio please install it prior to installing Gluu. You may choose to use any installation method Istio supports. Please note that at the moment Istio ingress is not supported with Minikube.

#MicroK8s

#Requirements

1. Install MicroK8s

2. Make sure all ports are open for microk8s

3. Enable helm3, hostpath-storage, and dns:

   sudo microk8s.enable dns
   sudo microk8s.enable hostpath-storage
   sudo microk8s.enable helm3 

   Copy

   Make aliases for kubectl and helm3:

   sudo snap alias microk8s.kubectl kubectl
   sudo snap alias microk8s.helm3 helm

   Copy

4. Optional: If using nginx ingress, please enable it.

   sudo microk8s.enable ingress

   Copy

5. Optional[alpha]: If using Istio please enable it.

   sudo microk8s.enable community
   sudo microk8s.enable istio

   Copy

#Install Gluu using Helm

#Prerequisites

• Kubernetes >=1.19x
• Persistent volume provisioner support in the underlying infrastructure
• Install Helm

#Quickstart

1. Download pygluu-kubernetes.pyz. This package can be built manually.

2. Optional: If using couchbase as the persistence backend. Download the couchbase kubernetes operator package for Linux and place it in the same directory as pygluu-kubernetes.pyz

3. Run :

./pygluu-kubernetes.pyz helm-install

#Installing Gluu using Helm manually

1. Optional if not using Istio ingress: Install NGINX-Ingress Helm Chart.

   helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
   helm repo add stable https://charts.helm.sh/stable
   helm repo update
   helm install <nginx-release-name> ingress-nginx/ingress-nginx --namespace=<nginx-namespace>

   Copy

2. • If the FQDN for gluu i.e. demoexample.gluu.org is registered and globally resolvable, forward it to the loadbalancer address created in the previous step by NGINX-Ingress. A record can be added on most cloud providers to forward the domain to the loadbalancer. For example, on AWS assign a CNAME record for the LoadBalancer DNS name, or use Amazon Route 53 to create a hosted zone. More details in this AWS guide. Another example on GCE.

   • If the FQDN is not registered acquire the loadbalancer ip if on GCE, or Azure using kubectl get svc <release-name>-nginx-ingress-controller --output jsonpath='{.status.loadBalancer.ingress[0].ip}' and if on AWS get the loadbalancer addresss using kubectl -n ingress-nginx get svc ingress-nginx \--output jsonpath='{.status.loadBalancer.ingress[0].hostname}'.

3. • If deploying on the cloud make sure to take a look at the Helm cloud-specific notes before continuing.

     • EKS
     • GKE

   • If deploying locally make sure to take a look at the helm-specific notes below before continuing.

     • Minikube
     • MicroK8s

4. Optional: If using PostgreSQL as the persistence backend. In a production environment, a production-grade PostgreSQL server should be used such as Cloud SQL in GCP or Amazon RDS in AWS.

   For testing purposes, you can deploy it on your Kubernetes cluster using the following commands:

   wget https://raw.githubusercontent.com/GluuFederation/flex/nightly/automation/pgsql.yaml
   kubectl apply -f pgsql.yaml

   Copy

   Add the following yaml snippet to your override.yaml file:

   global:
     gluuPersistenceType: sql
   config:
     configmap:
       cnSqlDbName: gluu
       cnSqlDbPort: 5432
       cnSqlDbDialect: pgsql
       cnSqlDbHost: postgresql.gluu.svc
       cnSqlDbUser: postgres
       cnSqlDbTimezone: UTC
       cnSqldbUserPassword: Test1234#

   Copy

5. Optional: If using MySQL as the persistence backend. In a production environment, a production grade MySQL server should be used such as Cloud SQL in GCP or Amazon RDS in AWS.

   For testing purposes, you can deploy it on your Kubernetes cluster using the following commands:

   wget https://raw.githubusercontent.com/GluuFederation/flex/nightly/automation/mysql.yaml
   kubectl apply -f mysql.yaml

   Copy

   Add the following yaml snippet to your override.yaml file:

   global:
     gluuPersistenceType: sql
   config:
     configmap:
       cnSqlDbName: gluu
       cnSqlDbPort: 3306
       cnSqlDbDialect: mysql
       cnSqlDbHost: mysql.gluu.svc
       cnSqlDbUser: root
       cnSqlDbTimezone: UTC
       cnSqldbUserPassword: Test1234#

   Copy

6. Optional: If using couchbase as the persistence backend.

   1. Download pygluu-kubernetes.pyz. This package can be built manually.

   2. Download the couchbase kubernetes operator package for Linux and place it in the same directory as pygluu-kubernetes.pyz

   3. Run:

   ./pygluu-kubernetes.pyz couchbase-install

   Copy
   1. Open the settings.json file generated from the previous step and copy over the values of COUCHBASE_URL and COUCHBASE_USER to global.gluuCouchbaseUrl and global.gluuCouchbaseUser in values.yaml respectively.

7. Create your override-values.yaml and execute:

 helm repo add gluu https://gluufederation.github.io/gluu4/pygluu/kubernetes/templates/helm
 helm repo update
 helm install gluu gluu/gluu -n <namespace> --version=1.8.x -f override-values.yaml

#EKS Helm notes

#Required changes to the values.yaml

Inside the global values.yaml change the marked keys with CHANGE-THIS to the appropriate values :

#global values to be used across charts
global:
  storageClass:
    provisioner: kubernetes.io/aws-ebs
  domain: demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
  isDomainRegistered: "false" # CHANGE-THIS  "true" or "false" to specify if the domain above is registered or not.    
nginx-ingress:
  ingress:
    enabled: true
    path: /
    hosts:
      - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
    tls:
      - secretName: tls-certificate
        hosts:
          - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
config:
  configmap:
    lbAddr: "" #CHANGE-THIS to the address received in the previous step axx-109xx52.us-west-2.elb.amazonaws.com 

Tweak the optional parameters in values.yaml to fit the setup needed.

#GKE Helm notes

#Required changes to the values.yaml

Inside the global values.yaml change the marked keys with CHANGE-THIS to the appropriate values :

#global values to be used across charts
global:
  storageClass:
    provisioner: kubernetes.io/gce-pd
  domain: demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
  # Networking configs
  lbIp: "" #CHANGE-THIS  to the IP received from the previous step
  isDomainRegistered: "false" # CHANGE-THIS  "true" or "false" to specify if the domain above is registered or not.
nginx-ingress:
  ingress:
    enabled: true
    path: /
    hosts:
      - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
    tls:
      - secretName: tls-certificate
        hosts:
          - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu

Tweak the optional parameters in values.yaml to fit the setup needed.

#Minikube Helm notes

#Required changes to the values.yaml

Inside the global values.yaml change the marked keys with CHANGE-THIS to the appropriate values :

#global values to be used across charts
global:
  storageClass:
    provisioner: k8s.io/minikube-hostpath
  domain: demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
  lbIp: "" #CHANGE-THIS  to the IP of minikube <minikube ip>

nginx-ingress:
  ingress:
    enabled: true
    path: /
    hosts:
      - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
    tls:
      - secretName: tls-certificate
        hosts:
          - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu

Tweak the optional parameters in values.yaml to fit the setup needed.

• Map gluu's FQDN at /etc/hosts file to the minikube IP as shown below.

  ##
  # Host Database
  #
  # localhost is used to configure the loopback interface
  # when the system is booting.  Do not change this entry.
  ##
  192.168.99.100    demoexample.gluu.org #minikube IP and example domain
  127.0.0.1    localhost
  255.255.255.255    broadcasthost
  ::1             localhost

  Copy

#Microk8s helm notes

#Required changes to the values.yaml

Inside the global values.yaml change the marked keys with CHANGE-THIS to the appropriate values :

#global values to be used across charts
global:
  storageClass:
    provisioner: microk8s.io/hostpath
  domain: demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
  lbIp: "" #CHANGE-THIS  to the IP of the microk8s VM

nginx-ingress:
  ingress:
    enabled: true
    path: /
    hosts:
      - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu
    tls:
      - secretName: tls-certificate
        hosts:
          - demoexample.gluu.org #CHANGE-THIS to the FQDN used for Gluu

Tweak the optional parameters in values.yaml to fit the setup needed.

• Map gluu's FQDN at /etc/hosts file to the microk8s VM IP as shown below.

  ##
  # Host Database
  #
  # localhost is used to configure the loopback interface
  # when the system is booting.  Do not change this entry.
  ##
  192.168.99.100    demoexample.gluu.org #microk8s IP and example domain
  127.0.0.1    localhost
  255.255.255.255    broadcasthost
  ::1             localhost

  Copy

#Uninstalling the Chart

To uninstall/delete my-release deployment:

helm delete <my-release>

If during installation the release was not defined, the release name is checked by running $ helm ls then deleted using the previous command and the default release name.

#Configuration

#Instructions on how to install different services

Enabling the following services automatically install the corresponding associated chart. To enable/disable them set true or false in the persistence configs as shown below.

config:
  configmap:
    # Auto install other services. If enabled the respective service chart will be installed
    gluuPassportEnabled: false
    gluuCasaEnabled: false
    gluuRadiusEnabled: false
    gluuSamlEnabled: false

#CASA

• CASA is dependant on oxd-server. To install it oxd-server must be enabled.

#Other optional services

Other optional services like key-rotation, and cr-rotation, are enabled by setting their corresponding values to true under the global block.

For example, to enable cr-rotate set

global:
  cr-rotate:
    enabled: true

#Install Gluu using the gui installer

1. Create the GUI installer job

   cat <<EOF | kubectl apply -f -
   apiVersion: batch/v1
   kind: Job
   metadata:
     name: cloud-native-installer
     labels:
       APP_NAME: cloud-native-installer
   spec:
     template:
       metadata:
         labels:
           APP_NAME: cloud-native-installer
       spec:
         restartPolicy: Never
         containers:
           - name: cloud-native-installer
             image: gluufederation/cloud-native:4.4.0_dev
   ---
   kind: Service
   apiVersion: v1
   metadata:
     name: cloud-native-installer
   spec:
     type: LoadBalancer
     selector:
       app: cloud-native-installer
     ports:
       - name: http
         port: 80
         targetPort: 5000           
   EOF

   Copy

2. Grab the Loadbalancer address , ip or Nodeport and follow installation setup.

   AWS

   kubectl -n default get svc cloud-native-installer --output jsonpath='{.status.loadBalancer.ingress[0].hostname}'

   Copy

   GKE

   kubectl -n default get svc cloud-native-installer --output jsonpath='{.status.loadBalancer.ingress[0].ip}'

   Copy

   Azure

   kubectl -n default get svc cloud-native-installer --output jsonpath='{.status.loadBalancer.ingress[0].ip}'

   Copy

   DigitalOcean

   kubectl -n default get svc cloud-native-installer --output jsonpath='{.status.loadBalancer.ingress[0].ip}'

   Copy

   Microk8s

   1. Get ip of microk8s vm

   2. Get NodePort of the GUI installer service

      kubectl -n default get svc cloud-native-installer

      Copy

   Minikube

   1. Get ip of minikube vm

      minikube ip

      Copy

   2. Get NodePort of the GUI installer service

      kubectl -n default get svc cloud-native-installer

      Copy

3. Head to the address from previous step to start the installation.

1. Port forward Jackrabbit at localhost on port 8080

       kubectl port-forward jackrabbit-0 --namespace gluu 8080:8080

   Copy

2. Optional: If your managing VM is in the cloud you must forward the connection to the Mac, Linux or Windows computer you are working from.

       ssh -i <key.pem> -L 8080:localhost:8080 user-of-managing-vm@ip-of-managing-vm

   Copy

3. Use any filemanager to connect to Jackrabbit. Here are some examples:

   Linux

   Open file manager which maybe Nautilus and find Connect to Server place the address which should be dav://localhost:8080/repository/default. By default, the username and password are admin if not changed in /etc/gluu/conf/jackrabbit_admin_password inside the pod.

   Windows

   Install a WebDav client such as WinSCP. Connect using the jackrabbit address which should be http://localhost:8080/repository/default. By default, the username and password are admin if not changed in /etc/gluu/conf/jackrabbit_admmin_password inside the pod.

   Mac

   Open Finder , Go then Connect to Server and place the address which should be http://localhost:8080/repository/default. By default, the username and password are admin if not changed in /etc/gluu/conf/jackrabbit_admin_password inside the pod.

1. Login to the Jackrabbit container, for example: kubectl -n gluu exec -ti jackrabbit-0 -- sh.

2. Go to /opt/webdav directory; create any files or directory under this directory.

3. Run python3 /app/scripts/jca_sync.py.