Skip to content

Commit 5733334

Browse files
JeffMboyaJeffMboya
authored
MG-141 - Fix Bootstrap and Certs services startup in k8s setup with HELM (#152)
* Fix default pull secret Signed-off-by: JeffMboya <[email protected]> emove extra bootstrap url Signed-off-by: JeffMboya <[email protected]> change BS pull policy to always Signed-off-by: JeffMboya <[email protected]> change encKey Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> fix image: {} Signed-off-by: JeffMboya <[email protected]> * fix bootstrap not starting Signed-off-by: JeffMboya <[email protected]> * remove MG_BOOTSTRAP_ES_URL and MG_SDK_BASE_URL Signed-off-by: JeffMboya <[email protected]> * enable certs and vault Signed-off-by: JeffMboya <[email protected]> * add vault parameters Signed-off-by: JeffMboya <[email protected]> * update jaegerTraceRatio to 1.0 Signed-off-by: JeffMboya <[email protected]> * update maintainers Signed-off-by: JeffMboya <[email protected]> * update helm docs Signed-off-by: JeffMboya <[email protected]> * fix journal container restarting Signed-off-by: JeffMboya <[email protected]> * Fix certs Signed-off-by: JeffMboya <[email protected]> * Update readme; disable vault by default Signed-off-by: JeffMboya <[email protected]> * Update README Signed-off-by: JeffMboya <[email protected]> --------- Signed-off-by: JeffMboya <[email protected]>
1 parent 8182259 commit 5733334

8 files changed

+173
-83
lines changed

‎charts/magistrala/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ sources:
1313
- https://hub.docker.com/u/magistrala
1414
maintainers:
1515
- name: drasko
16-
email: draasko[email protected]
16+
email: drasko[email protected]
1717
- name: dusan
1818
email: [email protected]
1919

‎charts/magistrala/README.md

+17-11
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Magistrala IoT Platform
1010

1111
| Name | Email | Url |
1212
| ---- | ------ | --- |
13-
| drasko | <draasko[email protected]> | |
13+
| drasko | <drasko[email protected]> | |
1414
| dusan | <[email protected]> | |
1515

1616
## Source Code
@@ -60,26 +60,32 @@ Magistrala IoT Platform
6060
| bootstrap.encKey | string | `"randomstring"` | |
6161
| bootstrap.eventConsumerName | string | `"EventConsumerByBootstrap"` | |
6262
| bootstrap.httpPort | int | `9013` | |
63-
| bootstrap.image | object | `{}` | |
63+
| bootstrap.image.pullPolicy | string | `"IfNotPresent"` | |
64+
| bootstrap.image.pullSecrets | object | `{}` | |
65+
| bootstrap.image.repository | string | `"magistrala/bootstrap"` | |
66+
| bootstrap.image.tag | string | `"latest"` | |
67+
| bootstrap.jaegerTraceRatio | float | `1` | |
68+
| bootstrap.logLevel | string | `"info"` | |
6469
| bootstrap.redisESPort | int | `6379` | |
65-
| certs.enabled | bool | `false` | |
70+
| bootstrap.sendTelemetry | bool | `true` | |
71+
| certs.enabled | bool | `true` | |
6672
| certs.httpPort | int | `9019` | |
6773
| certs.image | object | `{}` | |
6874
| certs.logLevel | string | `"info"` | |
6975
| certs.signCAKeyPath | string | `"/etc/ssl/certs/ca.key"` | |
7076
| certs.signCAPath | string | `"/etc/ssl/certs/ca.crt"` | |
71-
| certs.vault.approleRoleid | string | `""` | |
72-
| certs.vault.approleSecret | string | `""` | |
73-
| certs.vault.namespace | string | `""` | |
74-
| certs.vault.thingsCertsPkiPath | string | `""` | |
75-
| certs.vault.thingsCertsPkiRoleName | string | `""` | |
76-
| certs.vault.url | string | `""` | |
77+
| certs.vault.approleRoleid | string | `"magistrala"` | |
78+
| certs.vault.approleSecret | string | `"magistrala"` | |
79+
| certs.vault.namespace | string | `"magistrala"` | |
80+
| certs.vault.thingsCertsPkiPath | string | `"pki_int"` | |
81+
| certs.vault.thingsCertsPkiRoleName | string | `"magistrala_things_certs"` | |
82+
| certs.vault.url | string | `"http://magistrala-vault:8200"` | |
7783
| defaults.eventStreamURL | string | `"magistrala-nats:4222"` | |
7884
| defaults.image.pullPolicy | string | `"IfNotPresent"` | |
7985
| defaults.image.rootRepository | string | `"magistrala"` | |
8086
| defaults.image.tag | string | `"latest"` | |
8187
| defaults.jaegerCollectorPort | int | `4318` | |
82-
| defaults.jaegerTraceRatio | int | `10` | |
88+
| defaults.jaegerTraceRatio | float | `1` | |
8389
| defaults.logLevel | string | `"info"` | |
8490
| defaults.natsPort | int | `4222` | |
8591
| defaults.replicaCount | int | `3` | |
@@ -308,4 +314,4 @@ Magistrala IoT Platform
308314
| users.passwordRegex | string | `"^.{8,}$"` | |
309315
| users.secretKey | string | `"secretKey"` | |
310316
| users.tokenResetEndpoint | string | `"/reset-request"` | |
311-
| vault.enabled | bool | `false` | |
317+
| vault.enabled | bool | `true` | |

‎charts/magistrala/templates/bootstrap-deployment.yaml

+5-3
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,14 @@ spec:
4242
value: {{ .Values.defaults.eventStreamURL | quote }}
4343
- name: MG_BOOTSTRAP_LOG_LEVEL
4444
value: {{ default .Values.defaults.logLevel .Values.bootstrap.logLevel | quote }}
45-
- name: MG_BOOTSTRAP_HOST
45+
- name: MG_BOOTSTRAP_HTTP_HOST
4646
value: "0.0.0.0"
47-
- name: MG_BOOTSTRAP_PORT
47+
- name: MG_BOOTSTRAP_HTTP_PORT
4848
value: {{ .Values.bootstrap.httpPort | quote }}
4949
- name: MG_THINGS_URL
5050
value: http://{{ .Release.Name }}-things:{{ .Values.things.httpPort }}
51+
- name: MG_THINGS_ES_URL
52+
value: {{ .Release.Name }}-redis-streams-master:{{ .Values.things.redisESPort }}
5153
- name: MG_AUTH_GRPC_URL
5254
value: {{ .Release.Name }}-envoy:{{ .Values.auth.grpcPort }}
5355
- name: MG_BOOTSTRAP_ENCRYPT_KEY
@@ -66,7 +68,7 @@ spec:
6668
value: {{ .Values.postgresqlbootstrap.username | quote }}
6769
- name: MG_BOOTSTRAP_DB_PASS
6870
value: {{ .Values.postgresqlbootstrap.password | quote }}
69-
- name: MG_BOOTSTRAP_NAME
71+
- name: MG_BOOTSTRAP_DB_NAME
7072
value: {{ .Values.postgresqlbootstrap.database | quote }}
7173

7274
ports:

‎charts/magistrala/templates/journal-deployment.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -47,19 +47,19 @@ spec:
4747
value: {{ .Values.journal.httpPort | quote }}
4848
- name : MG_AUTH_GRPC_URL
4949
value: {{ .Release.Name }}-envoy:{{ .Values.auth.grpcPort }}
50-
- name: MG_JOURNAL_HOST
50+
- name: MG_JOURNAL_DB_HOST
5151
{{- if .Values.postgresqljournal.enabled }}
5252
value: "{{ .Release.Name }}-postgresqljournal"
5353
{{- else }}
5454
value: {{ .Values.postgresqljournal.host | quote }}
5555
{{- end }}
56-
- name: MG_JOURNAL_PORT
56+
- name: MG_JOURNAL_DB_PORT
5757
value: {{ .Values.postgresqljournal.port | quote }}
58-
- name: MG_JOURNAL_NAME
58+
- name: MG_JOURNAL_DB_NAME
5959
value: {{ .Values.postgresqljournal.database | quote }}
60-
- name: MG_JOURNAL_USER
60+
- name: MG_JOURNAL_DB_USER
6161
value: {{ .Values.postgresqljournal.username | quote }}
62-
- name: MG_JOURNAL_PASS
62+
- name: MG_JOURNAL_DB_PASS
6363
value: {{ .Values.postgresqljournal.password | quote }}
6464
ports:
6565
- containerPort: {{ .Values.journal.httpPort }}

‎charts/magistrala/templates/things-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ spec:
5656
value: {{ .Values.postgresqlthings.username | quote }}
5757
- name: MG_THINGS_DB_PASS
5858
value: {{ .Values.postgresqlthings.password | quote }}
59-
- name: MG_THINGS_DB
59+
- name: MG_THINGS_DB_NAME
6060
value: {{ .Values.postgresqlthings.database | quote }}
6161
- name: MG_ES_URL
6262
value: {{ .Values.defaults.eventStreamURL | quote }}

‎charts/magistrala/values.yaml

+25-27
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,12 @@ defaults:
1010
pullPolicy: "IfNotPresent"
1111
rootRepository: "magistrala"
1212
tag: "latest"
13-
# pullSecrets:
14-
# - {}
13+
# pullSecrets: {}
1514
# Replicas of MQTT adapter, NATS, Things, Envoy and Auth
1615
replicaCount: 3
1716
natsPort: 4222
1817
jaegerCollectorPort: 4318
19-
jaegerTraceRatio: 10
18+
jaegerTraceRatio: 1.0
2019
sendTelemetry: true
2120
eventStreamURL: "magistrala-nats:4222"
2221

@@ -235,7 +234,7 @@ auth:
235234
# tag: "latest"
236235
# pullPolicy: "IfNotPresent"
237236
# Log level for the auth service. Common options are "debug", "info", "warn", "error".
238-
# jaegerTraceRatio: 10
237+
# jaegerTraceRatio: 1.0
239238
# sendTelemetry: true
240239
httpPort: 8189
241240
grpcPort: 8181
@@ -275,7 +274,7 @@ users:
275274
# repository: "magistrala/users"
276275
# tag: "latest"
277276
# pullPolicy: "IfNotPresent"
278-
# jaegerTraceRatio: 10
277+
# jaegerTraceRatio: 1.0
279278
# sendTelemetry: true
280279
# logLevel: "info"
281280
httpPort: 9002
@@ -356,15 +355,15 @@ redis-things:
356355
usePassword: false
357356

358357
bootstrap:
359-
image: {}
360-
# pullSecrets: {}
361-
# repository: "magistrala/bootstrap"
362-
# tag: "latest"
363-
# pullPolicy: "IfNotPresent"
364-
# jaegerTraceRatio: 10
365-
# sendTelemetry: true
366-
# logLevel: "info"
367358
enabled: true
359+
image:
360+
pullSecrets: {}
361+
repository: "magistrala/bootstrap"
362+
tag: "latest"
363+
pullPolicy: "IfNotPresent"
364+
jaegerTraceRatio: 1.0
365+
sendTelemetry: true
366+
logLevel: "info"
368367
httpPort: 9013
369368
redisESPort: 6379
370369
encKey: "randomstring"
@@ -394,25 +393,25 @@ postgresqlbootstrap:
394393
postgresql: *postgresqlBootstrapPort
395394

396395
certs:
397-
enabled: false
396+
enabled: true
398397
image: {}
399398
# pullSecrets: {}
400399
# repository: "magistrala/certs"
401400
# tag: "latest"
402401
# pullPolicy: "IfNotPresent"
403-
# jaegerTraceRatio: 10
402+
# jaegerTraceRatio: 1.0
404403
# sendTelemetry: true
405404
httpPort: 9019
406405
logLevel: "info"
407406
signCAPath: "/etc/ssl/certs/ca.crt"
408407
signCAKeyPath: "/etc/ssl/certs/ca.key"
409408
vault:
410-
url: ""
411-
approleRoleid: ""
412-
approleSecret: ""
413-
namespace: ""
414-
thingsCertsPkiPath: ""
415-
thingsCertsPkiRoleName: ""
409+
url: "http://magistrala-vault:8200"
410+
approleRoleid: magistrala
411+
approleSecret: magistrala
412+
namespace: magistrala
413+
thingsCertsPkiPath: pki_int
414+
thingsCertsPkiRoleName: magistrala_things_certs
416415

417416
vault:
418417
enabled: false
@@ -444,7 +443,7 @@ invitations:
444443
# repository: "magistrala/invitations"
445444
# tag: "latest"
446445
# pullPolicy: "IfNotPresent"
447-
# jaegerTraceRatio: 10
446+
# jaegerTraceRatio: 1.0
448447
# sendTelemetry: true
449448
# logLevel: "info"
450449
httpPort: 9020
@@ -479,7 +478,7 @@ journal:
479478
# repository: "magistrala/journal"
480479
# tag: "latest"
481480
# pullPolicy: "IfNotPresent"
482-
# jaegerTraceRatio: 10
481+
# jaegerTraceRatio: 1.0
483482
# sendTelemetry: true
484483
# logLevel: "info"
485484
httpPort: 9021
@@ -522,7 +521,7 @@ timescaledb:
522521
# repository: "magistrala/timescale-reader"
523522
# tag: "latest"
524523
# pullPolicy: "IfNotPresent"
525-
# jaegerTraceRatio: 10
524+
# jaegerTraceRatio: 1.0
526525
# sendTelemetry: true
527526
# logLevel: "info"
528527
enabled: true
@@ -536,7 +535,7 @@ timescaledb:
536535
# repository: "magistrala/timescale-writer"
537536
# tag: "latest"
538537
# pullPolicy: "IfNotPresent"
539-
# jaegerTraceRatio: 10
538+
# jaegerTraceRatio: 1.0
540539
# sendTelemetry: true
541540
# logLevel: "info"
542541
# nodeSelector: {}
@@ -567,7 +566,7 @@ ui:
567566
# repository: "magistrala/ui"
568567
# tag: "latest"
569568
# pullPolicy: "IfNotPresent"
570-
# logLevel: "info"
569+
# logLevel: "info"
571570
# hostname: ""
572571
# contentTypes: "application/senml+json"
573572
port: 9095
@@ -582,7 +581,6 @@ ui:
582581
# invitationsUrl: "http:///magistrala-auth:9020"
583582
# journalUrl: "http:///magistrala-auth:9021"
584583
# domainsUrl: "http://magistrala-auth:8189"
585-
# bootstrapUrl: "http://magistrala-boostrap:9013"
586584
googleClientID: ""
587585
googleClientSecret: ""
588586
googleRedirectHostname: "https://stage-domain-name"

‎scripts/vault/vault.md

+70-27
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,70 @@
1-
# Install and configure `vault` with `certs`
2-
Make sure you configured your `KUBECONFIG` to point to destination cluster.
3-
4-
Install vault
5-
6-
```bash
7-
cd charts/magistrala
8-
helm upgrade magistrala . -n mg --set vault.enabled=true
9-
```
10-
11-
Initialize vault
12-
```bash
13-
cd ../../scripts/vault
14-
./vault_init.sh
15-
```
16-
17-
18-
Now upgrade installation of magistrala enabling certs service and setting proper values
19-
```bash
20-
source .env
21-
cd ../../charts/magistrala
22-
helm upgrade magistrala --create-namespace -n mg . \
23-
--set certs.vault.url=$MG_VAULT_ADDR \
24-
--set certs.vault.approleRoleid=$MG_VAULT_THINGS_CERTS_ISSUER_ROLEID \
25-
--set certs.vault.approleSecret=$MG_VAULT_THINGS_CERTS_ISSUER_SECRET \
26-
--set certs.vault.namespace=$MG_VAULT_NAMESPACE
27-
```
1+
## How to Install and Configure `vault` with `certs`
2+
3+
### Prerequisites:
4+
5+
1. **Kubernetes Configuration**: Ensure your `KUBECONFIG` is set up to point to the Kubernetes cluster where you want to deploy `vault`. This can typically be done by running:
6+
```bash
7+
export KUBECONFIG=/path/to/your/kubeconfig
8+
```
9+
This command tells your local machine which Kubernetes cluster to interact with.
10+
11+
### Step 1: Install `vault` using Helm
12+
13+
1. **Navigate to the `magistrala` Helm chart directory**:
14+
15+
```bash
16+
cd charts/magistrala
17+
```
18+
19+
2. **Install `vault`**:
20+
```bash
21+
helm upgrade magistrala . -n mg --set vault.enabled=true
22+
```
23+
This command uses Helm to upgrade (or install) the `magistrala` release in the `mg` namespace with `vault` enabled.
24+
25+
### Step 2: Initialize `vault`
26+
27+
1. **Navigate to the `vault` Scripts Directory**:
28+
29+
If you are currently in the `charts/magistrala` directory, go up two levels to the root and then to the `vault` scripts directory by running:
30+
31+
```bash
32+
cd ../../scripts/vault
33+
```
34+
35+
If you are at the root of the repository, navigate to the `vault` scripts directory directly by running:
36+
37+
```bash
38+
cd scripts/vault
39+
```
40+
41+
2. **Run the `vault_init.sh` script**:
42+
```bash
43+
./vault_init.sh
44+
```
45+
This script initializes `vault` by setting up necessary configurations, such as unsealing the vault and applying initial policies. This is a crucial step to get `vault` ready for use.
46+
47+
### Step 3: Enable the `certs` Service and Apply Configuration
48+
49+
1. **Load Environment Variables**:
50+
51+
```bash
52+
source .env
53+
```
54+
55+
This command loads environment variables from the `.env` file into your current shell session. These variables are required for the next step to configure the `certs` service.
56+
57+
2. **Navigate back to the `magistrala` Helm chart directory**:
58+
59+
```bash
60+
cd ../../charts/magistrala
61+
```
62+
63+
3. **Upgrade the `magistrala` installation with `certs` enabled**:
64+
```bash
65+
helm upgrade magistrala --create-namespace -n mg . \
66+
--set certs.vault.url=$MG_VAULT_ADDR \
67+
--set certs.vault.approleRoleid=$MG_VAULT_THINGS_CERTS_ISSUER_ROLEID \
68+
--set certs.vault.approleSecret=$MG_VAULT_THINGS_CERTS_ISSUER_SECRET \
69+
--set certs.vault.namespace=$MG_VAULT_NAMESPACE
70+
```

0 commit comments

Comments
 (0)