diff --git a/_partials/self-hosted/_install-next-steps.mdx b/_partials/self-hosted/_install-next-steps.mdx index c9d3848990f..0e7a170f972 100644 --- a/_partials/self-hosted/_install-next-steps.mdx +++ b/_partials/self-hosted/_install-next-steps.mdx @@ -13,6 +13,6 @@ Now that you have installed {props.version}, you can either edition={props.edition} text="activate your installation" url="/activate-installation" - /> . + />. Beginning with version 4.6.32, once you install {props.version}, you have 30 days to activate it; versions older than 4.6.32 do not need to be activated. During the 30-day trial period, you can use {props.version} without any restrictions. After 30 days, you can continue to use {props.version}, but you cannot deploy additional clusters or perform any day-2 operations on existing clusters until {props.version} is activated. Each installation of {props.version} must be activated separately. We recommend activating {props.version} as soon as possible to avoid any disruptions. \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-not-required.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-not-required.mdx new file mode 100644 index 00000000000..47e9c86e38d --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-not-required.mdx @@ -0,0 +1,28 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-config-not-required +--- + +Image pull secrets are managed by Spectro Cloud. While you do not need to configure the pull secret, you must ensure +that the secret propagates to your workload clusters. This happens automatically unless there are connectivity +constraints from your workload clusters to the {props.version} management plane. + +- **SaaS deployments** - Image pull secrets are managed automatically on the backend. For multi-tenant SaaS, no action + is needed; for dedicated SaaS customers with access to the system console, consult with your customer support + representative. + +- **Airgapped self-hosted {props.version} environments** - The Spectro Cloud-owned images are pulled directly + from your local registry and do not need the Spectro Cloud's OCI registry pull secret. + +- **Environments with configured mirror registries or image swaps** - If your non-airgapped self-hosted {props.version} environment pulls all Spectro Cloud-owned images from a custom or private registry through + or [image swaps](/clusters/cluster-management/image-swap/), you do not need to configure the image pull secret. + +- **Self-hosted OCI registries with pull-through cache** - If you are using a registry that uses pull-through cache (for + example, a [Harbor proxy cache project](https://goharbor.io/docs/latest/administration/configure-proxy-cache/) or a + [JFrog Artifactory remote repository](https://docs.jfrog.com/artifactory/docs/remote-repositories)), you must + configure the hardened image registry credentials at the cache level. + diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-required.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-required.mdx new file mode 100644 index 00000000000..5a595d968c7 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-config-required.mdx @@ -0,0 +1,13 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-config-required +--- + +Non-airgapped self-hosted {props.version} environments that pull images directly from Spectro Cloud-owned OCI +registries must configure an image pull secret. This _does not_ include environments that use + or [image swap](/clusters/cluster-management/image-swap/) configurations to redirect image pulls to a private +registry. \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-during-install.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-during-install.mdx new file mode 100644 index 00000000000..1d093945f19 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-during-install.mdx @@ -0,0 +1,15 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-during-install +--- + +Adding an image pull secret during installation is supported on the following deployment models: + +- Helm charts installations + +It is _not_ supported for the following deployment models: + +- Palette CLI +- Palette Management Appliance + +For these deployments, you must configure the secret [post-installation](#post-installation) using the system console. \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-enablement.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-enablement.mdx new file mode 100644 index 00000000000..91dd77ad0d1 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-enablement.mdx @@ -0,0 +1,23 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-enablement +--- + +1. Log in to the {props.version} + . + +2. From the left main menu, select **Administration**. + +3. Select the **Hardened Images** tab. + +4. In the **Pull secret** field, paste the image pull secret you received from Spectro Cloud support. + +5. Select **Validate and Save**. + +If the secret is valid, it is saved and distributed to the management plane, workload clusters, and PCGs. If you need to +rotate your image pull secret for any reason, repeat these steps, and paste your new secret into the **Pull secret** +field. diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-helm-install.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-helm-install.mdx new file mode 100644 index 00000000000..a26a5e9fed8 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-helm-install.mdx @@ -0,0 +1,20 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-helm-install +--- + +For self-hosted {props.version} environments installed on an existing Kubernetes cluster using Helm charts, +you can apply your image pull secret during the installation process. + +| **File** | **Parameter** | +| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | +| {props.helm}/values.yaml | | +| `extras/cert-manager/values.yaml` | `imagePullSecret.dockerConfigJson` | + +For the full installation process, refer to the + . \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-intro.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-intro.mdx new file mode 100644 index 00000000000..7f40cad96a3 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-intro.mdx @@ -0,0 +1,34 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-intro +--- + +Beginning in 4.9.b, Spectro Cloud is initiating the shift to security-hardened images. While images have a smaller +attack surface compared to physical and virtual machines, security-hardened images are built to reduce the attack +surface further by containing only the essential runtime components an application needs. They have strict Service Level +Agreements (SLAs) that require the images to be regularly scanned for vulnerabilities, rebuilt, and patched, keeping the +number of CVEs to a minimum. These images also contain artifacts such as Software Bill of Materials (SBOMs) and +cryptographic signatures to verify that the image has not been tampered with. + +As a result of this transition, all images hosted in Spectro Cloud's OCI registries must now be authenticated and +retrieved using +[image pull secrets](https://kubernetes.io/docs/concepts/configuration/secret/#using-imagepullsecrets-1). Like + , these secrets are obtained from your Spectro Cloud +customer support representative; they are intended for long-term use and only need to be configured once as part of your +initial setup process. If you need to rotate the secret as part of your organization's security policy, contact support +to request a new one. + +Once configured, the secret is distributed to the management plane, PCGs, and all managed workload clusters so they can +pull the required images. + +:::warning + +As of 4.9.b, configuring an image pull secret is optional; however, it will be mandatory in an upcoming release. +Therefore, we recommend configuring your image pull secret as soon as possible to avoid service disruptions. Refer to +the [Announcements](/release-notes/announcements/#upcoming-breaking-changes) page for the latest updates. + +::: \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-post-install.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-post-install.mdx new file mode 100644 index 00000000000..b1be7b30d4e --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-post-install.mdx @@ -0,0 +1,14 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-post-install +--- + +You can also configure the image pull secret once {props.version} is installed. + +:::warning + +Configuring an image pull secret is currently optional. Once it is mandatory, image pull secrets must be added during +the installation process. At that time, the following system console method will only be used to rotate the image +pull secret if required by your organization's security policy. + +::: \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-prereqs.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-prereqs.mdx new file mode 100644 index 00000000000..e3539959e34 --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-prereqs.mdx @@ -0,0 +1,15 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-prereqs +--- + +- A self-hosted instance of {props.version}. + +- Access to the {props.version} + . + +- An image pull secret provided by Spectro Cloud support. \ No newline at end of file diff --git a/_partials/self-hosted/image-pull-secret/_image-pull-secret-validate.mdx b/_partials/self-hosted/image-pull-secret/_image-pull-secret-validate.mdx new file mode 100644 index 00000000000..fc0fc4ca9ff --- /dev/null +++ b/_partials/self-hosted/image-pull-secret/_image-pull-secret-validate.mdx @@ -0,0 +1,66 @@ +--- +partial_category: self-hosted +partial_name: image-pull-secret-validate +--- + + + + + +1. Log in to the {props.version} + . + +2. From the left main menu, select **Administration**. + +3. Select the **Hardened Images** tab. + +4. Verify that the **Pull secret** field displays a masked secret. + + {props.edition === 'vertex' ? Configuring an image pull secret in the system console. : Configuring an image pull secret in the system console.} + + + + + +1. Open a terminal session in an environment that has network access to the cluster. Set the `KUBECONFIG` environment + variable to the file path of your cluster's kubeconfig that {props.version} is installed on. + + ```shell + export KUBECONFIG= + ``` + +2. Issue the following command to verify the secret propagated to your management cluster matches the one configured in + the system console. + + ```shell + kubectl get secret spectro-image-pull-secret --namespace hubble-system --output yaml + ``` + + ```yaml title="Example output" hideClipboard {3} + apiVersion: v1 + data: + .dockerconfigjson: abcdEFGhiJKlmnOPQrSTUVwX... # output omitted for brevity + kind: Secret + metadata: + annotations: + meta.helm.sh/release-name: hubble + meta.helm.sh/release-namespace: default + creationTimestamp: "2026-06-18T22:33:37Z" + labels: + app: spectro + app.kubernetes.io/managed-by: Helm + module: hubble + name: spectro-image-pull-secret + namespace: hubble-system + resourceVersion: "28192" + uid: c7991fac-2ec0-4419-b451-10c82208f8e5 + type: kubernetes.io/dockerconfigjson + ``` + + + + \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-begin.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-begin.mdx new file mode 100644 index 00000000000..601804c6fac --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-begin.mdx @@ -0,0 +1,18 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-begin +--- + +The following instructions are written agnostic to the Kubernetes distribution you are using. Depending on the +underlying infrastructure provider and your Kubernetes distribution, you may need to modify the instructions to match +your environment. Reach out to our support team if you need assistance. + +1. Open a terminal session and navigate to the directory where you downloaded the {props.version} install ZIP file + provided by our support team. Unzip the file to a directory named {props.helm}-install. + + {`unzip charts.zip -d ${props.helm}-install`} + + +2. Navigate to the {props.helm}-install directory. + + {`cd ${props.helm}-install`} \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-airgap.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-airgap.mdx new file mode 100644 index 00000000000..45e9e151064 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-airgap.mdx @@ -0,0 +1,68 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-cert-manager-airgap +--- + +Open the file `extras/cert-manager/values.yaml` using a text editor of your choice. This example uses Vim. + + ```shell + vim extras/cert-manager/values.yaml + ``` + + +
  • Append `` to each image, along with the `` where you want to store your images.
    • + + ```yaml + image: + cainjectorImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" + ``` + + In the example below, we used `harbor.docs.spectro.dev` for the registry and `spectro-images` for the repository. + + ```yaml hideClipboard title="Example output" + image: + cainjectorImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" + ``` + +
  • If the registry you are pulling images from requires authentication, use the base64-encoded + contents of your `config.json` containing the registry credentials. Refer to + for more information.
    • + + ```yaml title="Example configuration" hideClipboard {5} + imagePullSecret: + # When true, render Secret spectro-image-pull-secret in the cert-manager namespace. + # Pods automatically reference that pull secret when create is true or the secret already exists. + create: false + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # Used when create is true: base64-encoded dockerconfigjson + ``` + +
  • Install the Cert-Manager Helm chart.
    • + + ```shell + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml + ``` + + ```shell hideClipboard title="Example output" + Release "cert-manager" does not exist. Installing it now. + NAME: cert-manager + LAST DEPLOYED: Wed Jun 17 12:54:27 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-non-airgap.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-non-airgap.mdx new file mode 100644 index 00000000000..08828b7946b --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cert-manager-non-airgap.mdx @@ -0,0 +1,62 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-cert-manager-non-airgap +--- + +Open the file `extras/cert-manager/values.yaml` using a text editor of your choice. This example uses Vim. + + ```shell + vim extras/cert-manager/values.yaml + ``` + +
  • If you plan to pull images from Spectro Cloud OCI registries, paste the image pull secret received from your + customer support representative into the `imagePullSecret.dockerConfigJson` field. It is not required if you plan to + use mirror registries or image swap.
    • + + Alternately, if you plan to pull images from a private registry that requires authentication, use the base64-encoded + contents of your `config.json` containing the registry credentials. Refer to + for more information. + + :::info + + If you omit the image pull secret during installation, you must provide it through the system console. Refer to + for more information. + + ::: + + ```yaml title="Example configuration" hideClipboard {5} + imagePullSecret: + # When true, render Secret spectro-image-pull-secret in the cert-manager namespace. + # Pods automatically reference that pull secret when create is true or the secret already exists. + create: false + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # Used when create is true: base64-encoded dockerconfigjson + ``` + +
  • Install the Cert-Manager Helm chart.
    • + + ```shell + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml + ``` + + ```shell hideClipboard title="Example output" + Release "cert-manager" does not exist. Installing it now. + NAME: cert-manager + LAST DEPLOYED: Wed Jun 17 12:54:27 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-cluster-prereqs.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cluster-prereqs.mdx new file mode 100644 index 00000000000..da2d1b081ea --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-cluster-prereqs.mdx @@ -0,0 +1,62 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-cluster-prereqs +--- + +- We recommend the following resources for {props.version}. Refer to our + for additional sizing information. + + - A minimum of three AMD64 (x86_64) nodes. These can be worker nodes or three untainted control plane nodes. + - ARM-based nodes are not supported. + + - 8 CPUs per node + + - 16 GB of memory per node + + - 110 GB of disk space per node + +- The following network ports must be accessible: + + - **TCP/443** - Inbound and outbound to and from the {props.version} management cluster + + - **TCP/6443** - Outbound traffic from the {props.version} management cluster to the deployed workload cluster's Kubernetes API server. + +- The following TLS/SSL certificate files for the domain name you will assign to {props.version}. You must enable HTTPS + encryption for {props.version}. Reach out to your network administrator or security team to obtain these files: + + - x509 TLS/SSL certificate file in base64 format + + - x509 TLS/SSL certificate key file in base64 format + + - x509 TLS/SSL certificate authority file in base64 format + +- The Kubernetes cluster must use a Kubernetes version compatible with your {props.version} version. Refer to + to locate the required Kubernetes version. + +- Ensure the Kubernetes cluster _does_ not have Cert Manager installed. {props.version} requires a unique Cert Manager + configuration to be installed as part of the installation process. If Cert Manager is already installed, you must + uninstall it before installing {props.version}. + +- A Container Storage Interface (CSI) to create persistent volumes, which are used to store + persistent data. You may install any CSI that is compatible with your Kubernetes cluster. + +- A [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to manage persistent storage, with the + annotation `storageclass.kubernetes.io/is-default-class` set to `true`. You can set a default storage class in your Kubernetes cluster using the + following `kubectl` command. + + ```shell + kubectl patch storageclass --patch '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}' + ``` + + To use a non-default storage class for the {props.version} installation, you must set the preferred storage class name + in the {props.helm}/values.yaml file using the `mongo.storageClass` parameter. diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-end.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-end.mdx new file mode 100644 index 00000000000..9138f75d135 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-end.mdx @@ -0,0 +1,111 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-end +--- + +Install the {props.version} Helm Chart using the following command. + + {`helm upgrade --values ${props.helm}/values.yaml \\\n hubble ${props.helm}/spectro-mgmt-plane-*.tgz --install`} + + ```shell hideClipboard title="Example output" + Release "hubble" does not exist. Installing it now. + NAME: hubble + LAST DEPLOYED: Wed Jun 17 21:41:31 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` + +
  • Track the installation process using the command below. {props.version} is ready when the deployments in the namespaces + `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` reach the _Ready_ state.
    • + + + + ```shell + kubectl get pods --all-namespaces --watch + ``` + + :::tip + + For a more user-friendly experience, use the open source tool [k9s](https://k9scli.io/) to monitor the installation + process. + + ::: + +
  • Create a DNS CNAME record that is mapped to the {props.version} `traefik-ingress-controller` load balancer. You can use the + following command to retrieve the load balancer IP address. If you need assistance creating the DNS record, contact + your network administrator.
    • + + ```shell + kubectl get service traefik-ingress-controller --namespace ingress-traefik \ + --output jsonpath='{.status.loadBalancer.ingress[0].hostname}' + ``` + + :::warning + + If {props.version} has only one tenant and you use local accounts with Single Sign-On (SSO) disabled, you can access + {props.version} using the IP address or any domain name that resolves to that IP. However, once you enable SSO, users + must log in using the tenant-specific subdomain. For example, if you create a tenant named `tenant1` and the domain + name you assigned to {props.version} is {props.helm}.example.com, the tenant URL will be tenant1.{props.helm}.example.com. We recommend you create an additional wildcard DNS record to map all tenant URLs to the {props.version} load balancer. + For example, *.{props.helm}.example.com. + + ::: + +
  • Use the custom domain name or the IP address of the load balancer to visit the {props.version} system console. To access the + system console, open a web browser and paste the custom domain URL or the IP address of the load balancer in the address bar, and append the value + `/system`.
    • + + The first time you visit the {props.version} system console, a warning message about a not-trusted TLS/SSL certificate may + appear. This is expected, as you still need to upload your TLS/SSL certificate to {props.version}. You can ignore this warning + message and proceed. + + {props.edition === 'vertex' + ? Screenshot of the VerteX system console showing Username and Password fields. + : Screenshot of the Palette system console showing Username and Password fields. + } + + +
  • Log in to the system console using the following default credentials. Refer to + guide for more information.
    • + + | **Parameter** | **Value** | + | ------------- | --------- | + | Username | `admin` | + | Password | `admin` | + + After logging in, you must create a new password. Once you create your password, you are redirected to the {props.version} + system console. Use the username `admin` and your new password to log in to the system console. You can create + additional system administrator accounts and assign roles to users in the system console. Refer to + for more information. + +
  • After logging in, a summary page is displayed. {props.version} is installed with a self-signed TLS/SSL certificate. To assign a + different TLS/SSL certificate, you must upload the SSL certificate, TLS/SSL certificate key, and TLS/SSL certificate authority + files to {props.version}. You can upload the files using the {props.version} system console. Refer to + for more information.
    • + + :::warning + + If you plan to deploy host clusters into different networks, you may require a reverse proxy. Check out the + guide for more information. + + ::: + +You now have a self-hosted instance of {props.version} installed in a Kubernetes cluster. Make sure you retain the `values.yaml` +file, as you can refer to it for future upgrades. \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-image-swap.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-image-swap.mdx new file mode 100644 index 00000000000..acc1228f529 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-image-swap.mdx @@ -0,0 +1,38 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-image-swap +--- + +_(Self-hosted OCI registry only)_ If you plan to use image swap for self-hosted OCI registries, install the Image Swap + Helm chart. Image swap rewrites pod image references to pull from your mirror registry. {props.version} ignores the + `mirrorRegistries` configuration unless the Image Swap chart is installed. Choose the correct command based on + whether you added your image swap values to {props.helm}/values.yaml or `extras/image-swap/values.yaml`. + + + + + + {`helm upgrade --values ${props.helm}/values.yaml \\\n image-swap extras/image-swap/image-swap-*.tgz --install`} + + + + + + ```shell + helm upgrade --values extras/image-swap/values.yaml \ + image-swap extras/image-swap/image-swap-*.tgz --install + ``` + + + + + + ```shell hideClipboard title="Example output" + Release "image-swap" does not exist. Installing it now. + NAME: image-swap + LAST DEPLOYED: Wed Jun 17 14:44:13 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-local-prereqs.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-local-prereqs.mdx new file mode 100644 index 00000000000..c2c7d8d3ec7 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-local-prereqs.mdx @@ -0,0 +1,23 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-local-prereqs +--- + +- Access to the target Kubernetes cluster's kubeconfig file. You must be able to interact with the cluster using + `kubectl` commands and have sufficient permissions to install {props.version}. We recommend using a role with cluster-admin + permissions to install {props.version}. + +- The following software installed and available: + + - [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) + - [Helm](https://helm.sh/docs/intro/install/) + - `unzip` or a similar extraction utility + - `vim`, `nano`, or a similar text editor + +- Access to the {props.version} Helm charts (`charts.zip`). Refer to + for instructions on how to request access. \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-airgap.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-airgap.mdx new file mode 100644 index 00000000000..2b8db6a58cd --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-airgap.mdx @@ -0,0 +1,517 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-main-chart-airgap +--- + +Open the file {props.helm}/values.yaml using a text editor of your choice. This example uses Vim. + + {`vim ${props.helm}/values.yaml`} + + +
  • The file {props.helm}/values.yaml contains the default values for the {props.version} installation parameters. The following table lists the most important parameters to pay attention to. For a complete list of fields and additional + information, refer to + for more information.
    • + + | **Parameter** | **Description** | **Type** | + | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | + | `global.imagePullSecret.dockerConfigJson` | If you plan to pull images from private registries that require authentication, paste your image pull secret here. This must match the image pull secret configured for [Cert-Manager](#cert-manager-helm-chart). | string | + | `env.rootDomain` | The URL name or IP address you will use for the {props.version} installation. | string | + | `config.installationMode` | Determines whether your {props.version} installation should have a default connection to the internet. Set to `airgap`. | string | + | `ociPackRegistry` or `ociPackEcrRegistry` | The OCI registry credentials for {props.version} FIPS packs. These credentials are provided by our support team. If using images from a self-hosted OCI registry instead, leave these sections blank and refer to the [Self-Hosted OCI Registries](#self-hosted-oci-registries) table instead. | object | + | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | + | `reachSystem` | _(Proxy environments only)_ Set `reachSystem.enabled` to `true` and configure the `reachSystem.proxySettings` parameters to configure {props.version} to use a network proxy in your environment | object | + | `mongo.storageClass` | If you do not have a default storage class in your cluster (the annotation `"storageclass.kubernetes.io/is-default-class":"true"`), enter the name of the storage class to use for your {props.version} installation. | string | + + #### Self-Hosted OCI Registries + + The following parameters are required if you pull {props.version} images from a self-hosted OCI registry instead of a + Spectro Cloud OCI registry or AWS ECR. + + :::tip + + If you would prefer to keep your image swap values in a separate location, you can use the following table to + complete the `extras/image-swap/values.yaml` file instead. Otherwise, complete the following fields in {props.helm}/values.yaml. + + Use the following command to extract and edit the `extras/image-swap/values.yaml` file. + + ```shell + tar --extract --verbose --gzip --file extras/image-swap/image-swap-*.tgz --directory extras/ + vim extras/image-swap/values.yaml + ``` + + ::: + + | **Parameter** | **Description** | **Type** | + | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | + | `ociImageRegistry` | Configure the registry endpoint, credentials, and `mirrorRegistries` values. Refer to the page for parameter descriptions. | object | + | `ociImageRegistry.mirrorRegistries` | A comma-separated list of mirror registries in image swap format that maps public registry paths to your private registry. Refer to the page for examples. | string | + | `imageSwapImages` | The Image Swap init and webhook images. If you host these images in your OCI registry, replace the image paths with your registry URL and namespace or project. | object | + | `imageSwapConfig.isEKSCluster` | Set to `true` if you are installing {props.version} on an Amazon EKS cluster. Set to `false` for all other Kubernetes distributions. | boolean | + + :::info + + Include `/v2` in your mirror registry endpoints if you are using a + [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. + Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other + registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. + + Including `/v2` + for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: + `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. + + ::: + +
  • Save the completed {props.helm}/values.yaml file. You can review the following examples of the + {props.helm}/values.yaml file with the required parameters highlighted.
    • + + + + + + ```yaml {8,26,29,60,84-93,122-123,149-151} + ######################### + # Spectro Cloud Palette # + ######################### + + global: + imagePullSecret: + # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # omitted for brevity + + # MongoDB Configuration + mongo: + # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas + internal: true + + # Mongodb URL. Only change if using Mongo Atlas. + databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" + # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. + databasePassword: "" + + #No. of mongo replicas to run, default is 3 + replicas: 3 + # The following only apply if mongo.internal == true + cpuLimit: "2000m" + memoryLimit: "4Gi" + pvcSize: "20Gi" + storageClass: "" # leave empty to use the default storage class + + config: + installationMode: "airgap" #values can be connected or airgap. + isPaletteBaseCluster: false + + # SSO SAML Configuration (Optional for self-hosted type) + sso: + saml: + enabled: false + acsUrlRoot: "myfirstpalette.spectrocloud.com" + acsUrlScheme: "https" + audienceUrl: "https://www.spectrocloud.com" + entityId: "https://www.spectrocloud.com" + apiVersion: "v1" + + # Email Configurations. (Optional for self-hosted type) + email: + enabled: false + emailId: "noreply@spectrocloud.com" + smtpServer: "smtp.gmail.com" + smtpPort: 587 + insecureSkipVerifyTls: false + fromEmailId: "noreply@spectrocloud.com" + password: "" # base64 encoded SMTP password + + env: + # rootDomain is a DNS record which will be mapped to the ingress controller load balancer + # E.g., myfirstpalette.spectrocloud.com + # - Mandatory if ingress.traefik.hostPort == false (LoadBalancer mode) + # - Optional if ingress.traefik.hostPort == true (hostPort / appliance mode, leave empty) + # + # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes + # E.g., *.myfirstpalette.spectrocloud.com + rootDomain: "my-domain.docs-test.spectrocloud.com" + + # stableEndpointAccess is used when deploying EKS clusters in Private network type. + # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true + cluster: + stableEndpointAccess: false + + # registry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # insecureSkipVerify: false + # caCert: "" + + # ociPackRegistry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # baseContentPath: "" # + # insecureSkipVerify: false + # caCert: "" + + ociPackEcrRegistry: + endpoint: "https://123456789.dkr.ecr.us-east-1.amazonaws.com" # + name: "Palette Packs" # + accessKey: "**********" # + secretKey: "**********" # + baseContentPath: "production-fips" # + isPrivate: true + insecureSkipVerify: false + caCert: "" + credentialType: "" + + # ociImageRegistry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # baseContentPath: "" # + # insecureSkipVerify: false + # caCert: "" + # mirrorRegistries: "" # See instructions below. + + # Instruction for mirrorRegistries. + # ---------------------------------- + # Please provide the registry endpoint for the following registries, separated by double colons (::): + # docker.io + # gcr.io + # ghcr.io + # k8s.gcr.io + # registry.k8s.io + # quay.io + # For each registry, follow this example format: + # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ + # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. + + imageSwapImages: + imageSwapInitImage: "us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.9.0" + imageSwapImage: "us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap:v1.5.3-spectro-4.9.0" + + imageSwapConfig: + isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false + + grpc: + external: false + endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. + grpcStaticIP: "" + caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert + serverCrtBase64: "" + serverKeyBase64: "" + insecureSkipVerify: false + tunnel: + preferredServer: + endpoint: "" + servers: + - endpoint: "" + ingress: + # When enabled the Traefik ingress controller would be installed + enabled: true + + # Port allocation behaviour based on traefik.hostPort: + # + # traefik.hostPort=false → Traefik: 80/443 (LoadBalancer Service) -- default behaviour for self-hosted / cloud setups with an external LB. + # traefik.hostPort=true → Traefik: 80/443 (bound to node hostPort) -- appliance / on-prem setup with no external LB. + traefik: + # Whether to front the Traefik ingress controller with a cloud + # load balancer (hostPort == false) or bind directly to node host ports (hostPort == true) + hostPort: false + + ingress: + # Default SSL certificate and key for the ingress controller (Optional) + # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com + # If left blank, a self-signed cert will be generated (when terminating TLS upstream of the ingress controller) + certificate: "" + key: "" + + #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. + ingressStaticIP: "" + + # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. + terminateHTTPSAtLoadBalancer: false + + frps: + frps: + enabled: false + frpHostURL: proxy.sample.spectrocloud.com + server: + crt: LS0tLS1CRUdJTiBDRVJU... # omitted for brevity + key: LS0tLS1CRUdJTiBSU0Eg... # omitted for brevity + ca: + crt: LS0tLS1CRUdJTiBDRVJ... # omitted for brevity + service: + annotations: {} + + ui-system: + enabled: true + ui: + nocUI: + enable: true + mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette + mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID + + reachSystem: + enabled: false + proxySettings: + http_proxy: "" + https_proxy: "" + no_proxy: "" + ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. + scheduleOnControlPlane: true + ``` + + + + + + ```yaml {8,26,29,60,75-82,94-102,117-119,121-122,149-150} + ######################### + # Spectro Cloud Palette # + ######################### + + global: + imagePullSecret: + # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # omitted for brevity + + # MongoDB Configuration + mongo: + # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas + internal: true + + # Mongodb URL. Only change if using Mongo Atlas. + databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" + # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. + databasePassword: "" + + #No. of mongo replicas to run, default is 3 + replicas: 3 + # The following only apply if mongo.internal == true + cpuLimit: "2000m" + memoryLimit: "4Gi" + pvcSize: "20Gi" + storageClass: "" # leave empty to use the default storage class + + config: + installationMode: "airgap" #values can be connected or airgap. + isPaletteBaseCluster: false + + # SSO SAML Configuration (Optional for self-hosted type) + sso: + saml: + enabled: false + acsUrlRoot: "myfirstpalette.spectrocloud.com" + acsUrlScheme: "https" + audienceUrl: "https://www.spectrocloud.com" + entityId: "https://www.spectrocloud.com" + apiVersion: "v1" + + # Email Configurations. (Optional for self-hosted type) + email: + enabled: false + emailId: "noreply@spectrocloud.com" + smtpServer: "smtp.gmail.com" + smtpPort: 587 + insecureSkipVerifyTls: false + fromEmailId: "noreply@spectrocloud.com" + password: "" # base64 encoded SMTP password + + env: + # rootDomain is a DNS record which will be mapped to the ingress controller load balancer + # E.g., myfirstpalette.spectrocloud.com + # - Mandatory if ingress.traefik.hostPort == false (LoadBalancer mode) + # - Optional if ingress.traefik.hostPort == true (hostPort / appliance mode, leave empty) + # + # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes + # E.g., *.myfirstpalette.spectrocloud.com + rootDomain: "my-domain.docs-test.spectrocloud.com" + + # stableEndpointAccess is used when deploying EKS clusters in Private network type. + # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true + cluster: + stableEndpointAccess: false + + # registry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # insecureSkipVerify: false + # caCert: "" + + ociPackRegistry: + endpoint: "example.harbor.org" # + name: "Packs OCI" # + password: "**************" # + username: "**************" # + baseContentPath: "spectro-packs" # + insecureSkipVerify: false + caCert: "" + + # ociPackEcrRegistry: + # endpoint: "" # + # name: "" # + # accessKey: "" # + # secretKey: "" # + # baseContentPath: "" # + # isPrivate: true + # insecureSkipVerify: false + # caCert: "" + + ociImageRegistry: + endpoint: "example.harbor.org" # + name: "Images OCI" # + password: "**************" # + username: "**************" # + baseContentPath: "spectro-images" # + insecureSkipVerify: false + caCert: "" + mirrorRegistries: "docker.io::harbor.example.org/project/docker.io,gcr.io::harbor.example.org/project/gcr.io" # See instructions below. + + # Instruction for mirrorRegistries. + # ---------------------------------- + # Please provide the registry endpoint for the following registries, separated by double colons (::): + # docker.io + # gcr.io + # ghcr.io + # k8s.gcr.io + # registry.k8s.io + # quay.io + # For each registry, follow this example format: + # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ + # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. + + imageSwapImages: + imageSwapInitImage: "harbor.example.org/project/us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.9.0" + imageSwapImage: "harbor.example.org/project/us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap:v1.5.3-spectro-4.9.0" + + imageSwapConfig: + isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false + + grpc: + external: false + endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. + grpcStaticIP: "" + caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert + serverCrtBase64: "" + serverKeyBase64: "" + insecureSkipVerify: false + tunnel: + preferredServer: + endpoint: "" + servers: + - endpoint: "" + ingress: + # When enabled the Traefik ingress controller would be installed + enabled: true + + # Port allocation behaviour based on traefik.hostPort: + # + # traefik.hostPort=false → Traefik: 80/443 (LoadBalancer Service) -- default behaviour for self-hosted / cloud setups with an external LB. + # traefik.hostPort=true → Traefik: 80/443 (bound to node hostPort) -- appliance / on-prem setup with no external LB. + traefik: + # Whether to front the Traefik ingress controller with a cloud + # load balancer (hostPort == false) or bind directly to node host ports (hostPort == true) + hostPort: false + + ingress: + # Default SSL certificate and key for the ingress controller (Optional) + # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com + # If left blank, a self-signed cert will be generated (when terminating TLS upstream of the ingress controller) + certificate: "" + key: "" + + #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. + ingressStaticIP: "" + + # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. + terminateHTTPSAtLoadBalancer: false + + frps: + frps: + enabled: false + frpHostURL: proxy.sample.spectrocloud.com + server: + crt: LS0tLS1CRUdJTiBDRVJU... # omitted for brevity + key: LS0tLS1CRUdJTiBSU0Eg... # omitted for brevity + ca: + crt: LS0tLS1CRUdJTiBDRVJ... # omitted for brevity + service: + annotations: {} + + ui-system: + enabled: true + ui: + nocUI: + enable: true + mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette + mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID + + reachSystem: + enabled: false + proxySettings: + http_proxy: "" + https_proxy: "" + no_proxy: "" + ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. + scheduleOnControlPlane: true + ``` + + + + \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-non-airgap.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-non-airgap.mdx new file mode 100644 index 00000000000..f396726db75 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-main-chart-non-airgap.mdx @@ -0,0 +1,516 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-main-chart-non-airgap +--- + +Open the file {props.helm}/values.yaml using a text editor of your choice. This example uses Vim. + + {`vim ${props.helm}/values.yaml`} + + +
  • The file {props.helm}/values.yaml contains the default values for the {props.version} installation parameters. The following table lists the most important parameters to pay attention to. For a complete list of fields and additional + information, refer to + for more information.
    • + + | **Parameter** | **Description** | **Type** | + | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | + | `global.imagePullSecret.dockerConfigJson` | If you plan to pull images from Spectro Cloud OCI registries (without mirror registries or image swap configured) or images from private registries that require authentication, paste your image pull secret here. This must match the image pull secret configured for [Cert-Manager](#cert-manager-helm-chart). If you omit the image pull secret during installation, you must provide it through the system console. Refer to for more information. | string | + | `env.rootDomain` | The URL name or IP address you will use for the {props.version} installation. | string | + | `ociPackRegistry` or `ociPackEcrRegistry` | The OCI registry credentials for {props.version} FIPS packs. These credentials are provided by our support team. If using images from a self-hosted OCI registry instead, leave these sections blank and refer to the [Self-Hosted OCI Registries](#self-hosted-oci-registries) table instead. | object | + | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | + | `reachSystem` | _(Proxy environments only)_ Set `reachSystem.enabled` to `true` and configure the `reachSystem.proxySettings` parameters to configure {props.version} to use a network proxy in your environment | object | + | `mongo.storageClass` | If you do not have a default storage class in your cluster (the annotation `"storageclass.kubernetes.io/is-default-class":"true"`), enter the name of the storage class to use for your {props.version} installation. | string | + + #### Self-Hosted OCI Registries + + The following parameters are required if you pull {props.version} images from a self-hosted OCI registry instead of a + Spectro Cloud OCI registry or AWS ECR. + + :::tip + + If you would prefer to keep your image swap values in a separate location, you can use the following table to + complete the `extras/image-swap/values.yaml` file instead. Otherwise, complete the following fields in {props.helm}/values.yaml. + + Use the following command to extract and edit the `extras/image-swap/values.yaml` file. + + ```shell + tar --extract --verbose --gzip --file extras/image-swap/image-swap-*.tgz --directory extras/ + vim extras/image-swap/values.yaml + ``` + + ::: + + | **Parameter** | **Description** | **Type** | + | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | + | `ociImageRegistry` | Configure the registry endpoint, credentials, and `mirrorRegistries` values. Refer to the page for parameter descriptions. | object | + | `ociImageRegistry.mirrorRegistries` | A comma-separated list of mirror registries in image swap format that maps public registry paths to your private registry. Refer to the page for examples. | string | + | `imageSwapImages` | The Image Swap init and webhook images. If you host these images in your OCI registry, replace the image paths with your registry URL and namespace or project. | object | + | `imageSwapConfig.isEKSCluster` | Set to `true` if you are installing {props.version} on an Amazon EKS cluster. Set to `false` for all other Kubernetes distributions. | boolean | + + :::info + + Include `/v2` in your mirror registry endpoints if you are using a + [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. + Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other + registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. + + Including `/v2` + for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: + `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. + + ::: + +
  • Save the completed {props.helm}/values.yaml file. You can review the following examples of the + {props.helm}/values.yaml file with the required parameters highlighted.
    • + + + + + + ```yaml {8,26,60,84-93,122-123,149-151} + ######################### + # Spectro Cloud Palette # + ######################### + + global: + imagePullSecret: + # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # omitted for brevity + + # MongoDB Configuration + mongo: + # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas + internal: true + + # Mongodb URL. Only change if using Mongo Atlas. + databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" + # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. + databasePassword: "" + + #No. of mongo replicas to run, default is 3 + replicas: 3 + # The following only apply if mongo.internal == true + cpuLimit: "2000m" + memoryLimit: "4Gi" + pvcSize: "20Gi" + storageClass: "" # leave empty to use the default storage class + + config: + installationMode: "connected" #values can be connected or airgap. + isPaletteBaseCluster: false + + # SSO SAML Configuration (Optional for self-hosted type) + sso: + saml: + enabled: false + acsUrlRoot: "myfirstpalette.spectrocloud.com" + acsUrlScheme: "https" + audienceUrl: "https://www.spectrocloud.com" + entityId: "https://www.spectrocloud.com" + apiVersion: "v1" + + # Email Configurations. (Optional for self-hosted type) + email: + enabled: false + emailId: "noreply@spectrocloud.com" + smtpServer: "smtp.gmail.com" + smtpPort: 587 + insecureSkipVerifyTls: false + fromEmailId: "noreply@spectrocloud.com" + password: "" # base64 encoded SMTP password + + env: + # rootDomain is a DNS record which will be mapped to the ingress controller load balancer + # E.g., myfirstpalette.spectrocloud.com + # - Mandatory if ingress.traefik.hostPort == false (LoadBalancer mode) + # - Optional if ingress.traefik.hostPort == true (hostPort / appliance mode, leave empty) + # + # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes + # E.g., *.myfirstpalette.spectrocloud.com + rootDomain: "my-domain.docs-test.spectrocloud.com" + + # stableEndpointAccess is used when deploying EKS clusters in Private network type. + # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true + cluster: + stableEndpointAccess: false + + # registry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # insecureSkipVerify: false + # caCert: "" + + # ociPackRegistry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # baseContentPath: "" # + # insecureSkipVerify: false + # caCert: "" + + ociPackEcrRegistry: + endpoint: "https://123456789.dkr.ecr.us-east-1.amazonaws.com" # + name: "Palette Packs" # + accessKey: "**********" # + secretKey: "**********" # + baseContentPath: "production-fips" # + isPrivate: true + insecureSkipVerify: false + caCert: "" + credentialType: "" + + # ociImageRegistry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # baseContentPath: "" # + # insecureSkipVerify: false + # caCert: "" + # mirrorRegistries: "" # See instructions below. + + # Instruction for mirrorRegistries. + # ---------------------------------- + # Please provide the registry endpoint for the following registries, separated by double colons (::): + # docker.io + # gcr.io + # ghcr.io + # k8s.gcr.io + # registry.k8s.io + # quay.io + # For each registry, follow this example format: + # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ + # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. + + imageSwapImages: + imageSwapInitImage: "us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.9.0" + imageSwapImage: "us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap:v1.5.3-spectro-4.9.0" + + imageSwapConfig: + isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false + + grpc: + external: false + endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. + grpcStaticIP: "" + caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert + serverCrtBase64: "" + serverKeyBase64: "" + insecureSkipVerify: false + tunnel: + preferredServer: + endpoint: "" + servers: + - endpoint: "" + ingress: + # When enabled the Traefik ingress controller would be installed + enabled: true + + # Port allocation behaviour based on traefik.hostPort: + # + # traefik.hostPort=false → Traefik: 80/443 (LoadBalancer Service) -- default behaviour for self-hosted / cloud setups with an external LB. + # traefik.hostPort=true → Traefik: 80/443 (bound to node hostPort) -- appliance / on-prem setup with no external LB. + traefik: + # Whether to front the Traefik ingress controller with a cloud + # load balancer (hostPort == false) or bind directly to node host ports (hostPort == true) + hostPort: false + + ingress: + # Default SSL certificate and key for the ingress controller (Optional) + # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com + # If left blank, a self-signed cert will be generated (when terminating TLS upstream of the ingress controller) + certificate: "" + key: "" + + #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. + ingressStaticIP: "" + + # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. + terminateHTTPSAtLoadBalancer: false + + frps: + frps: + enabled: false + frpHostURL: proxy.sample.spectrocloud.com + server: + crt: LS0tLS1CRUdJTiBDRVJU... # omitted for brevity + key: LS0tLS1CRUdJTiBSU0Eg... # omitted for brevity + ca: + crt: LS0tLS1CRUdJTiBDRVJ... # omitted for brevity + service: + annotations: {} + + ui-system: + enabled: true + ui: + nocUI: + enable: true + mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette + mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID + + reachSystem: + enabled: false + proxySettings: + http_proxy: "" + https_proxy: "" + no_proxy: "" + ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. + scheduleOnControlPlane: true + ``` + + + + + + ```yaml {8,26,60,75-82,94-102,117-119,121-122,149-150} + ######################### + # Spectro Cloud Palette # + ######################### + + global: + imagePullSecret: + # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication + dockerConfigJson: "abcdEFGhiJKlmnOPQrSTUVwX..." # omitted for brevity + + # MongoDB Configuration + mongo: + # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas + internal: true + + # Mongodb URL. Only change if using Mongo Atlas. + databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" + # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. + databasePassword: "" + + #No. of mongo replicas to run, default is 3 + replicas: 3 + # The following only apply if mongo.internal == true + cpuLimit: "2000m" + memoryLimit: "4Gi" + pvcSize: "20Gi" + storageClass: "" # leave empty to use the default storage class + + config: + installationMode: "connected" #values can be connected or airgap. + isPaletteBaseCluster: false + + # SSO SAML Configuration (Optional for self-hosted type) + sso: + saml: + enabled: false + acsUrlRoot: "myfirstpalette.spectrocloud.com" + acsUrlScheme: "https" + audienceUrl: "https://www.spectrocloud.com" + entityId: "https://www.spectrocloud.com" + apiVersion: "v1" + + # Email Configurations. (Optional for self-hosted type) + email: + enabled: false + emailId: "noreply@spectrocloud.com" + smtpServer: "smtp.gmail.com" + smtpPort: 587 + insecureSkipVerifyTls: false + fromEmailId: "noreply@spectrocloud.com" + password: "" # base64 encoded SMTP password + + env: + # rootDomain is a DNS record which will be mapped to the ingress controller load balancer + # E.g., myfirstpalette.spectrocloud.com + # - Mandatory if ingress.traefik.hostPort == false (LoadBalancer mode) + # - Optional if ingress.traefik.hostPort == true (hostPort / appliance mode, leave empty) + # + # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes + # E.g., *.myfirstpalette.spectrocloud.com + rootDomain: "my-domain.docs-test.spectrocloud.com" + + # stableEndpointAccess is used when deploying EKS clusters in Private network type. + # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true + cluster: + stableEndpointAccess: false + + # registry: + # endpoint: "" # + # name: "" # + # password: "" # + # username: "" # + # insecureSkipVerify: false + # caCert: "" + + ociPackRegistry: + endpoint: "example.harbor.org" # + name: "Packs OCI" # + password: "**************" # + username: "**************" # + baseContentPath: "spectro-packs" # + insecureSkipVerify: false + caCert: "" + + # ociPackEcrRegistry: + # endpoint: "" # + # name: "" # + # accessKey: "" # + # secretKey: "" # + # baseContentPath: "" # + # isPrivate: true + # insecureSkipVerify: false + # caCert: "" + + ociImageRegistry: + endpoint: "example.harbor.org" # + name: "Images OCI" # + password: "**************" # + username: "**************" # + baseContentPath: "spectro-images" # + insecureSkipVerify: false + caCert: "" + mirrorRegistries: "docker.io::harbor.example.org/project/docker.io,gcr.io::harbor.example.org/project/gcr.io" # See instructions below. + + # Instruction for mirrorRegistries. + # ---------------------------------- + # Please provide the registry endpoint for the following registries, separated by double colons (::): + # docker.io + # gcr.io + # ghcr.io + # k8s.gcr.io + # registry.k8s.io + # quay.io + # For each registry, follow this example format: + # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ + # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. + + imageSwapImages: + imageSwapInitImage: "harbor.example.org/project/us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.9.0" + imageSwapImage: "harbor.example.org/project/us-docker.pkg.dev/palette-images-fips/third-party/thewebroot/imageswap:v1.5.3-spectro-4.9.0" + + imageSwapConfig: + isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false + + grpc: + external: false + endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. + grpcStaticIP: "" + caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert + serverCrtBase64: "" + serverKeyBase64: "" + insecureSkipVerify: false + tunnel: + preferredServer: + endpoint: "" + servers: + - endpoint: "" + ingress: + # When enabled the Traefik ingress controller would be installed + enabled: true + + # Port allocation behaviour based on traefik.hostPort: + # + # traefik.hostPort=false → Traefik: 80/443 (LoadBalancer Service) -- default behaviour for self-hosted / cloud setups with an external LB. + # traefik.hostPort=true → Traefik: 80/443 (bound to node hostPort) -- appliance / on-prem setup with no external LB. + traefik: + # Whether to front the Traefik ingress controller with a cloud + # load balancer (hostPort == false) or bind directly to node host ports (hostPort == true) + hostPort: false + + ingress: + # Default SSL certificate and key for the ingress controller (Optional) + # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com + # If left blank, a self-signed cert will be generated (when terminating TLS upstream of the ingress controller) + certificate: "" + key: "" + + #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. + annotations: {} + # AWS example + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp + # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: + # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" + # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' + + # Azure example + # service.beta.kubernetes.io/azure-load-balancer-internal: "true" + # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel + + # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. + ingressStaticIP: "" + + # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. + terminateHTTPSAtLoadBalancer: false + + frps: + frps: + enabled: false + frpHostURL: proxy.sample.spectrocloud.com + server: + crt: LS0tLS1CRUdJTiBDRVJU... # omitted for brevity + key: LS0tLS1CRUdJTiBSU0Eg... # omitted for brevity + ca: + crt: LS0tLS1CRUdJTiBDRVJ... # omitted for brevity + service: + annotations: {} + + ui-system: + enabled: true + ui: + nocUI: + enable: true + mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette + mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID + + reachSystem: + enabled: false + proxySettings: + http_proxy: "" + https_proxy: "" + no_proxy: "" + ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. + scheduleOnControlPlane: true + ``` + + + + \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-other-prereqs.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-other-prereqs.mdx new file mode 100644 index 00000000000..9d1a7b6bc33 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-other-prereqs.mdx @@ -0,0 +1,24 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-other-prereqs +--- + +- If you are using a _self-hosted MongoDB_ instance, such as MongoDB Atlas, ensure the MongoDB database has a user named + `hubble` with the permission `readWriteAnyDatabase`. Refer to the + [Add a Database User](https://www.mongodb.com/docs/guides/atlas/db-user/) guide for more information. + +- A custom domain and the ability to update DNS records. You will need this to enable HTTPS + encryption for {props.version}. + +- (Proxy environments only) If you are installing {props.version} behind a network proxy server, ensure {props.version} has access to the + required domains and ports. Refer to + for more information. + +- (Proxy environments only) If you are installing {props.version} behind a network proxy server, ensure you have the network proxy's Certificate + Authority (CA) certificate file in the base64 format. You will need this to enable {props.version} to communicate with the + network proxy server. \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-reach-system.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-reach-system.mdx new file mode 100644 index 00000000000..671f0c687be --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-reach-system.mdx @@ -0,0 +1,44 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-reach-system +--- + +_(Proxy environments only)_ If you are installing {props.version} in an environment where a network proxy must be + configured for {props.version} to access the internet, install the Reach System chart using the following command. + + :::warning + + Ensure you + set `reach-system.enabled` to `true` and configure `reach-system.proxySettings` in {props.helm}/values.yaml as well. + + ::: + + {`helm upgrade --values ${props.helm}/values.yaml \\\n reach-system extras/reach-system/reach-system-*.tgz --install`} + + ```shell hideClipboard title="Example output" + Release "reach-system" does not exist. Installing it now. + NAME: reach-system + LAST DEPLOYED: Fri Jan 30 18:40:57 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` + +
    + + Update containerd to use proxy configurations + + If your Kubernetes cluster is behind a network proxy, ensure the containerd service is configured to use proxy + settings. You can do this by updating the containerd configuration file on each node in the cluster. The + configuration file is typically located at `/etc/systemd/system/containerd.service.d/http-proxy.conf`. The following example shows configured proxy settings. Replace the values with your proxy settings. Ask your network administrator for + guidance. + + ``` + [Service] + Environment="HTTP_PROXY=http://example.com:9090" + Environment="HTTPS_PROXY=http://example.com:9090" + Environment="NO_PROXY=127.0.0.1,localhost,100.64.0.0/17,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,,.cluster.local" + ``` + +
    \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-spectro-mgmt-crds.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-spectro-mgmt-crds.mdx new file mode 100644 index 00000000000..db0e5ce3204 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-spectro-mgmt-crds.mdx @@ -0,0 +1,24 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-spectro-mgmt-crds +--- + +Install the Spectro Management CRDs chart. This chart contains Custom Resource Definitions (CRDs) required by + {props.version}, including Traefik CRDs, and must be installed before the main {props.version} Helm chart. When the + chart is installed, the custom resource types are registered with the Kubernetes API server; no pods are deployed. + + ```shell + helm upgrade --install spectro-mgmt-crds \ + extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ + --values extras/spectro-mgmt-crds/values.yaml + ``` + + ```shell hideClipboard title="Example output" + Release "spectro-mgmt-crds" does not exist. Installing it now. + NAME: spectro-mgmt-crds + LAST DEPLOYED: Wed Jun 17 21:17:39 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` \ No newline at end of file diff --git a/_partials/self-hosted/kubernetes-install/_kubernetes-install-validate.mdx b/_partials/self-hosted/kubernetes-install/_kubernetes-install-validate.mdx new file mode 100644 index 00000000000..54371a87fe4 --- /dev/null +++ b/_partials/self-hosted/kubernetes-install/_kubernetes-install-validate.mdx @@ -0,0 +1,114 @@ +--- +partial_category: self-hosted +partial_name: kubernetes-install-validate +--- + +Use the following steps to validate your {props.version} installation. + + + + + +1. Open up a web browser and navigate to the {props.version} system console. To access the system console, open a web + browser and paste the `env.rootDomain` value you provided in the address bar and append the value `/system`. You can + also use the IP address of the load balancer. + +2. Log in using the default credentials. After logging in, you are prompted to create a new password. Enter a new + password and save your changes. You are redirected to the {props.version} system console. + + + + + +1. Open a terminal session with access to the cluster you installed {props.version} on. + +2. Verify all pods in all namespaces are running. + + ```shell + kubectl get pods --all-namespaces + ``` + + ```shell hideClipboard title="Example output" + NAMESPACE NAME READY STATUS RESTARTS AGE + cert-manager cert-manager-5fb779d887-mz2vb 1/1 Running 0 8m46s + cert-manager cert-manager-cainjector-764f9646d4-7nhpq 1/1 Running 0 8m46s + cert-manager cert-manager-webhook-85b8dbdddd-fkn6z 1/1 Running 0 8m46s + cp-system spectro-cp-ui-5dffbcdc78-gk8st 1/1 Running 0 7m14s + hubble-system auth-7f4c7ff9c-2clwp 1/1 Running 0 6m8s + hubble-system auth-7f4c7ff9c-j84bt 1/1 Running 0 6m7s + hubble-system cloud-8f8467c95-9r8bp 1/1 Running 0 6m7s + hubble-system cloud-8f8467c95-pvcv4 1/1 Running 0 6m8s + hubble-system configserver-5bc8f9fdcb-mbt66 1/1 Running 0 6m8s + hubble-system event-5fbf6b7f44-bmzdk 1/1 Running 0 6m8s + hubble-system event-5fbf6b7f44-cxc58 1/1 Running 0 6m7s + hubble-system event-5fbf6b7f44-zhr9h 1/1 Running 0 6m7s + hubble-system foreq-8487bf9bbf-847vj 1/1 Running 0 6m7s + hubble-system hashboard-66f957cfdf-k48wn 1/1 Running 0 6m7s + hubble-system hashboard-66f957cfdf-pddx7 1/1 Running 0 6m6s + hubble-system hutil-7cc6975bb5-5mhjp 1/1 Running 0 6m6s + hubble-system hutil-7cc6975bb5-jwzr5 1/1 Running 0 6m7s + hubble-system memstore-7d59d65f67-j8lls 1/1 Running 0 6m6s + hubble-system mgmt-54fb5f487d-dj2tz 1/1 Running 0 7m14s + hubble-system mongo-0 2/2 Running 0 6m33s + hubble-system mongo-1 2/2 Running 0 5m47s + hubble-system mongo-2 2/2 Running 0 4m57s + hubble-system mongodb-key-manager-helm-k6294 0/1 Completed 0 7m15s + hubble-system msgbroker-0 1/1 Running 0 7m15s + hubble-system msgbroker-1 1/1 Running 0 6m43s + hubble-system oci-proxy-78cd749dc9-jfs86 1/1 Running 0 6m6s + hubble-system reloader-reloader-55d78d877b-7tnkq 1/1 Running 0 6m6s + hubble-system specman-0 1/1 Running 0 6m2s + hubble-system spectro-tunnel-74d559dd65-hlwch 1/1 Running 0 6m5s + hubble-system spectrocluster-6885954988-knrfq 1/1 Running 0 6m5s + hubble-system spectrocluster-6885954988-pb6pr 1/1 Running 0 6m5s + hubble-system spectrocluster-6885954988-xcvk9 1/1 Running 0 6m5s + hubble-system spectrocluster-jobs-7dc76bf6c7-pjc7l 1/1 Running 0 6m5s + hubble-system spectrocluster-reconciler-dcfd55ff5-gnfjg 1/1 Running 0 6m4s + hubble-system spectroclusterop-58966f7f54-grznt 1/1 Running 0 6m4s + hubble-system spectroclusterop-58966f7f54-jj9m6 1/1 Running 0 6m4s + hubble-system spectrossh-589d975d4d-82vm2 1/1 Running 0 6m4s + hubble-system system-d48fdbc9-ffzq9 1/1 Running 0 6m8s + hubble-system system-d48fdbc9-sztrr 1/1 Running 0 6m8s + hubble-system timeseries-f465b4c99-8h8c7 1/1 Running 0 6m4s + hubble-system timeseries-f465b4c99-jlzlj 1/1 Running 0 6m3s + hubble-system timeseries-f465b4c99-z27d8 1/1 Running 0 6m3s + hubble-system user-697c6f8bf-fgwtp 1/1 Running 0 6m3s + hubble-system user-697c6f8bf-wcqxk 1/1 Running 0 6m3s + ingress-traefik traefik-ingress-controller-5dctd 1/1 Running 0 7m15s + ingress-traefik traefik-ingress-controller-tx6st 1/1 Running 0 7m16s + ingress-traefik traefik-ingress-controller-zf25w 1/1 Running 0 7m16s + jet-system jet-796fc87c5d-vpvtz 1/1 Running 0 4m1s + kube-system aws-node-8xqnx 2/2 Running 0 121m + kube-system aws-node-gtr64 2/2 Running 0 121m + kube-system aws-node-h7pdv 2/2 Running 0 121m + kube-system coredns-566b9b9d-hck47 1/1 Running 0 129m + kube-system coredns-566b9b9d-jpnrs 1/1 Running 0 129m + kube-system ebs-csi-controller-7dfbb6bd58-nwcjl 6/6 Running 0 113m + kube-system ebs-csi-controller-7dfbb6bd58-w8kxz 6/6 Running 0 113m + kube-system ebs-csi-node-9r6fk 3/3 Running 0 113m + kube-system ebs-csi-node-vp744 3/3 Running 0 113m + kube-system ebs-csi-node-xb69v 3/3 Running 0 113m + kube-system kube-proxy-59qgr 1/1 Running 0 121m + kube-system kube-proxy-krrzd 1/1 Running 0 121m + kube-system kube-proxy-lbsgp 1/1 Running 0 121m + ui-system spectro-ui-56749c5f84-98m89 1/1 Running 0 7m15s + ``` + +3. Verify the `hubble` release is deployed. + + ```shell + helm status hubble + ``` + + ```shell title="Example output" hideClipboard + NAME: hubble + LAST DEPLOYED: Thu Jun 18 18:33:18 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 1 + TEST SUITE: None + ``` + + + + \ No newline at end of file diff --git a/docs/docs-content/clusters/edge/edgeforge-workflow/validate-user-data.md b/docs/docs-content/clusters/edge/edgeforge-workflow/validate-user-data.md index 1fb6f279404..4edcb7c6cba 100644 --- a/docs/docs-content/clusters/edge/edgeforge-workflow/validate-user-data.md +++ b/docs/docs-content/clusters/edge/edgeforge-workflow/validate-user-data.md @@ -46,8 +46,8 @@ However, this process is also executed automatically when you build the Edge ins :::deprecated -The Palette Edge CLI is deprecated and new image versions will no longer be published. We recommend using the -[Palette CLI](/automation/palette-cli/) CanvOS directory instead. +The Palette Edge CLI is deprecated and new image versions will no longer be published. We recommend using the CanvOS +directory instead. ::: diff --git a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/airgap-install/install.md b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/airgap-install/install.md index c48f16a2fba..1e93685896a 100644 --- a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/airgap-install/install.md +++ b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/airgap-install/install.md @@ -9,887 +9,121 @@ tags: ["self-hosted", "enterprise", "airgap"] keywords: ["self-hosted", "enterprise"] --- -You can use the Palette Helm Chart to install Palette in a multi-node Kubernetes cluster in your airgap production +You can use the Palette Helm chart to install Palette in a multi-node Kubernetes cluster in your airgap production environment. This installation method is common in secure environments with restricted network access that prohibits using Palette SaaS. Review our [architecture diagrams](../../../../architecture/networking-ports.md) to ensure your Kubernetes cluster has the necessary network connectivity for self-hosted Palette to operate successfully. -:::warning - -Complete the [Environment Setup](./kubernetes-airgap-instructions.md) steps before proceeding with the installation. - -::: - ## Prerequisites -- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) is installed and available. - -- [Helm](https://helm.sh/docs/intro/install/) is installed and available. - -- Access to the target Kubernetes cluster's kubeconfig file. You must be able to interact with the cluster using - `kubectl` commands and have sufficient permissions to install Palette. We recommend using a role with `cluster-admin` - permissions to install Palette. - -- Ensure `unzip` or a similar extraction utility is installed on your system. - -- The Kubernetes cluster must be set up on a supported version of Kubernetes. Refer to the - [Kubernetes Requirements](../../install-palette.md#kubernetes-requirements) section to find the version required for - your Palette installation. - -- Ensure the Kubernetes cluster does not have Cert Manager installed. Palette requires a unique Cert Manager - configuration to be installed as part of the installation process. If Cert Manager is already installed, you must - uninstall it before installing Palette. - -- Palette requires a Container Storage Interface (CSI) to create Persistent Volumes, which are used to store persistent - data. You may install any CSI that is compatible with your Kubernetes cluster. - -- If you are using a _self-hosted MongoDB_ instance, such as MongoDB Atlas, ensure the MongoDB database has a user named - `hubble` with the permission `readWriteAnyDatabase`. Refer to the - [Add a Database User](https://www.mongodb.com/docs/guides/atlas/db-user/) guide for guidance on how to create a - database user in Atlas. - -- We recommended the following resources for Palette. Refer to the - [Palette size guidelines](../../install-palette.md#size-guidelines) for additional sizing information. - - - 8 CPUs per node. - - - 16 GB Memory per node. - - - 110 GB Disk Space per node. - - - A minimum of three worker nodes or three untainted control plane nodes. - - - AMD64 (also known as x86_64) architecture. ARM-based nodes are not supported. - -- The following network ports must be accessible for Palette to operate successfully. - - - TCP/443: Inbound and outbound to and from the Palette management cluster. - - - TCP/6443: Outbound traffic from the Palette management cluster to the deployed clusters' Kubernetes API server. - -- Ensure you have an SSL certificate that matches the domain name you will assign to Palette. You will need this to - enable HTTPS encryption for Palette. Reach out to your network administrator or security team to obtain the SSL - certificate. You need the following files: - - - x509 SSL certificate file in the base64 format. - - - x509 SSL certificate key file in the base64 format. - - - x509 SSL certificate authority file in the base64 format. - -- A [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to manage persistent storage, with the - annotation `storageclass.kubernetes.io/is-default-class` set to `true`. To override the default StorageClass for a - workload, modify the `storageClass` parameter. Check out the - [Change the default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) - page to learn more about modifying StorageClasses. - -- Palette uses Traefik as the ingress controller. If you already have an ingress controller deployed in the cluster, set - the `ingress.enabled` parameter to `false` in the `values.yaml` file. - -- A custom domain and the ability to update Domain Name System (DNS) records. You will need this to enable HTTPS - encryption for Palette. - -- If you are installing Palette behind a network proxy server, ensure you have the Certificate Authority (CA) - certificate file in the base64 format. You will need this to enable Palette to communicate with the network proxy - server. - -- Access to the Palette Helm Charts. Refer to the [Access Palette](../../../enterprise-version.md#access-palette) for - instructions on how to request access to the Helm Chart. - :::warning -Do not use a Palette-managed Kubernetes cluster when installing Palette. Palette-managed clusters contain the Palette -agent and Palette-created Kubernetes resources that will interfere with the installation. - -::: - -## Install Palette - -The following instructions are agnostic to the Kubernetes distribution you are using. Depending on the underlying -infrastructure provider and your Kubernetes distribution, you may need to modify the instructions to match your -environment. Reach out to our support team if you need assistance. - -1. Open a terminal session and navigate to the directory where you downloaded the Palette installation zip file - provided by our support. Unzip the file to a directory named **palette-install**. - - ```shell - unzip release-*.zip -d palette-install - ``` - -2. Navigate to the release folder inside the **palette-install** directory. - - ```shell - cd palette-install/charts/release-* - ``` - -3. Open the file **extras/cert-manager/values.yaml** in a text editor and append the URL to your OCI registry, which - also includes the namespace or project that is hosting the Spectro Cloud images. The URL should be in the format - `/`. In the example configuration below, the value `my-oci-registry.com/spectro-images` is - prefixed to each URL. Save the file after you have appended the URL. - - ```yaml hideClipboard - image: - cainjectorImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" - ``` - -4. Install Cert Manager using the following command. Replace the actual file name of the Cert Manager Helm Chart with - the one you downloaded, as the version number may be different. - - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install - ``` - - ```shell hideClipboard - Release "cert-manager" does not exist. Installing it now. - NAME: cert-manager - LAST DEPLOYED: Mon Jan 29 16:32:33 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -5. Open the file **extras/image-swap/values.yaml** in a text editor and append the URL to your OCI registry that also - includes the namespace or project that is hosting the Spectro Cloud images. - - ```yaml hideClipboard - config: - imageSwapImages: - imageSwapInitImage: "my-oci-registry.com/spectro-images/gcr.io/spectro-images-public/release/thewebroot/imageswap-init:v1.5.3-spectro-4.5.1" - imageSwapImage: "my-oci-registry.com/spectro-images/gcr.io/spectro-images-public/release/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - ``` - -6. Update the `ociImageRegistry` section with the proper configuration values to your OCI registry. The - `ociImageRegistry` section should look similar to the following example. - - :::info - - Include `/v2` in your endpoints if you are using a - [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. - Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other - registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` - for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - - ::: - - ```yaml hideClipboard - ociImageRegistry: - endpoint: "my-oci-registry.com" - name: "Airgap Images OCI" - password: "" - username: "" - baseContentPath: "spectro-images" - insecureSkipVerify: true - caCert: "" - mirrorRegistries: "docker.io::my-oci-registry.com/spectro-images/docker.io,gcr.io::my-oci-registry.com/spectro-images/gcr.io,ghcr.io::my-oci-registry.com/spectro-images/ghcr.io,k8s.gcr.io::my-oci-registry.com/spectro-images/k8s.gcr.io,registry.k8s.io::my-oci-registry.com/spectro-images/registry.k8s.io,quay.io::my-oci-registry.com/spectro-images/quay.io,us-docker.pkg.dev::my-oci-registry.com/spectro-images/us-docker.pkg.dev" - ``` - -7. Go ahead and install the image-swap chart using the following command. Point to the **values.yaml** file you - configured in steps five through six. - - ```shell - helm upgrade --values extras/image-swap/values.yaml \ - image-swap extras/image-swap/image-swap-*.tgz --install - ``` - - ```shell hideClipboard - Release "image-swap" does not exist. Installing it now. - NAME: image-swap - LAST DEPLOYED: Mon Jan 29 17:04:23 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - :::tip - - If you need to override the image-swap registry configuration post-deployment, refer to the - [Override Registry Configuration](../../../system-management/registry-override.md) page for instructions. - - ::: - -8. Install the Spectro Management CRDs chart. This chart contains Custom Resource Definitions (CRDs) required by - Palette, including Traefik CRDs, and must be installed before the main Palette Helm chart. - - ```shell - helm upgrade --install spectro-mgmt-crds extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz - ``` - - ```shell hideClipboard title="Example output" - Release "spectro-mgmt-crds" does not exist. Installing it now. - NAME: spectro-mgmt-crds - LAST DEPLOYED: Mon Jan 29 16:35:00 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -9. Open the **values.yaml** file in the **spectro-mgmt-plane** folder with a text editor of your choice. The - **values.yaml** file contains the default values for the Palette installation parameters. However, you must populate - the following parameters before installing Palette. You can learn more about the parameters on the **values.yaml** - file on the [Helm Configuration Reference](../palette-helm-ref.md) page. - - Ensure you provide the proper `ociImageRegistry.mirrorRegistries` values if you are using a self-hosted OCI - registry. You can find the placeholder string in the `ociImageRegistry` section of the **values.yaml** file. - - | **Parameter** | **Description** | **Type** | - | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | - | `env.rootDomain` | The URL name or IP address you will use for the Palette installation. | string | - | `config.installationMode` | The installation mode for Palette. The values can be `connected` or `airgap`. Set this value to `airgap`. | string | - | `ociPackEcrRegistry` | The OCI registry credentials for the Palette FIPS packs repository. | object | - | `ociImageRegistry` | The OCI registry credentials for the Palette images repository. | object | - | `ociImageRegistry.mirrorRegistries` | A comma-separated list of mirror registries in [image swap format](https://github.com/phenixblue/imageswap-webhook/blob/master/docs/configuration.md) to use for pulling images. For example: `docker.io::harbor.example.org/airgap-images/docker.io,gcr.io::harbor.example.org/airgap-images/gcr.io`.

    **NOTE:** Include `/v2` in your endpoints if you are using a [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. | string | - | `imageSwapImages` | The image swap configuration for Palette. If you are using an OCI registry, such as Harbor, replace the prefix URLs with your OCI registry URL that includes the image namespace or project: `/`. | object | - | `imageSwapConfig.isEKSCluster` | If you are NOT installing Palette on an EKS cluster, set this value to `false`. | boolean | - | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | - | `reach-system` | Set `reach-system.enabled` to `true` and configure the `reach-system.proxySettings` parameters for Palette to use a network proxy in your environment. | object | - - :::info - - If you are installing Palette by pulling required images from a private mirror registry, you will need to provide - the credentials to your registry in the **values.yaml** file. For more information, refer to - [Helm Configuration Reference](../palette-helm-ref.md#image-pull-secret). - - ::: - - Save the **values.yaml** file after you have populated the required parameters mentioned in the table. Select one of - the following tabs to review an example of the **values.yaml** file with the required parameters highlighted. - - - - - - - ```yaml {30,60,75-82,94-102,118-120} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo,mongo-1.mongo,mongo-2.mongo" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "airgap" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: true - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "palette.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackRegistry: - endpoint: "my-oci-registry.com" # - name: "Airgap Packs OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-packs" # - insecureSkipVerify: false - caCert: "" - - # ociPackEcrRegistry: - # endpoint: "" # - # name: "" # - # accessKey: "" # - # secretKey: "" # - # baseContentPath: "" # - # isPrivate: true - # insecureSkipVerify: false - # caCert: "" - - ociImageRegistry: - endpoint: "my-oci-registry.com" # - name: "Airgap Images OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-images" # - insecureSkipVerify: true - caCert: "" - mirrorRegistries: "docker.io::my-oci-registry.com/spectro-images/docker.io,gcr.io::my-oci-registry.com/spectro-images/gcr.io,ghcr.io::my-oci-registry.com/spectro-images/ghcr.io,k8s.gcr.io::my-oci-registry.com/spectro-images/k8s.gcr.io,registry.k8s.io::my-oci-registry.com/spectro-images/registry.k8s.io,quay.io::my-oci-registry.com/spectro-images/quay.io,us-docker.pkg.dev::my-oci-registry.com/spectro-images/us-docker.pkg.dev" # See instructions below. +- Complete the [Environment Setup](./kubernetes-airgap-instructions.md) steps before proceeding with the installation. - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. +- Do not use a Palette-managed Kubernetes cluster when installing Palette. Palette-managed clusters contain the Palette + agent and Palette-created Kubernetes resources that will interfere with the installation of Palette. +::: - imageSwapImages: - imageSwapInitImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - imageSwapImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt : LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - ```yaml {30,60,84-92,94-102,117-119} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo,mongo-1.mongo,mongo-2.mongo" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "airgap" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: true - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "palette.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - # ociPackRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackEcrRegistry: - endpoint: "123456789.dkr.ecr.us-east-1.amazonaws.com" # - name: "Airgap Packs OCI" # - accessKey: "**************" # - secretKey: "**************" # - baseContentPath: "spectro-packs" # - isPrivate: true - insecureSkipVerify: true - caCert: "" - - ociImageRegistry: - endpoint: "public.ecr.aws/123456789" # - name: "Airgap Images OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-images" # - insecureSkipVerify: false - caCert: "" - mirrorRegistries: "docker.io::public.ecr.aws/123456789/spectro-images/docker.io,gcr.io::public.ecr.aws/123456789/spectro-images/gcr.io,ghcr.io::public.ecr.aws/123456789/spectro-images/ghcr.io,k8s.gcr.io::public.ecr.aws/123456789/spectro-images/k8s.gcr.io,registry.k8s.io::public.ecr.aws/123456789/spectro-images/registry.k8s.io,quay.io::public.ecr.aws/123456789/spectro-images/quay.io,us-docker.pkg.dev::public.ecr.aws/123456789/spectro-images/us-docker.pkg.dev" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "public.ecr.aws/123456789/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - imageSwapImage: "public.ecr.aws/123456789/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt : LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - :::warning - - Ensure you have configured the `values.yaml` file with the required parameters before proceeding to the next steps. - For the parameter `ociImageRegistry.mirrorRegistries`, include `/v2` in your endpoints if you are using a - [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. - Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other - registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` - for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - - ::: - -10. This step is only required if you are installing Palette in an environment where a network proxy must be configured - for Palette to access the internet. If you are not using a network proxy, skip to the next step. - - Install the reach-system chart using the following command. Point to the **values.yaml** file you configured in - step 9. - - ```shell - helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-*.tgz --install - ``` - - ```shell hideClipboard - Release "reach-system" does not exist. Installing it now. - NAME: reach-system - LAST DEPLOYED: Mon Jan 29 17:04:23 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - -
    - How to update containerd to use proxy configurations - - If your Kubernetes cluster is behind a network proxy, ensure the containerd service is configured to use proxy - settings. You can do this by updating the containerd configuration file on each node in the cluster. The - configuration file is typically located at ` /etc/systemd/system/containerd.service.d/http-proxy.conf`. Below is an - example of the configuration file. Replace the values with your proxy settings. Ask your network administrator for - guidance. - - ``` - [Service] - Environment="HTTP_PROXY=http://example.com:9090" - Environment="HTTPS_PROXY=http://example.com:9090" - Environment="NO_PROXY=127.0.0.1,localhost,100.64.0.0/17,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,,.cluster.local" - ``` - -
    - -11. Install the Palette Helm Chart using the following command. - - ```shell - helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-*.tgz --install - ``` - - ```shell hideClipboard - Release "hubble" does not exist. Installing it now. - NAME: hubble - LAST DEPLOYED: Mon Jan 29 17:07:51 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -12. Track the installation process using the command below. Palette is ready when the deployments in the namespaces - `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` reach the _Ready_ state. The - installation takes two to three minutes to complete. - - - - ```shell - kubectl get pods --all-namespaces --watch - ``` - - :::tip - - For a more user-friendly experience, use the open source tool [k9s](https://k9scli.io/) to monitor the installation - process. - - ::: - -13. Create a DNS CNAME record that is mapped to the Palette `traefik-ingress-controller` load balancer. You can use the - following command to retrieve the load balancer IP address. You may require the assistance of your network - administrator to create the DNS record. - - ```shell - kubectl get service traefik-ingress-controller --namespace ingress-traefik \ - --output jsonpath='{.status.loadBalancer.ingress[0].hostname}' - ``` - - :::warning - - If Palette has only one tenant and you use local accounts with Single Sign-On (SSO) disabled, you can access Palette - using the IP address or any domain name that resolves to that IP. However, once you enable SSO, users must log in - using the tenant-specific subdomain. For example, if you create a tenant named `tenant1` and the domain name you - assigned to Palette is `palette.example.com`, the tenant URL will be `tenant1.palette.example.com`. We recommend you - create an additional wildcard DNS record to map all tenant URLs to the Palette load balancer. For example, - `*.palette.example.com`. - - ::: - -14. Use the custom domain name or the IP address of the load balancer to visit the Palette system console. To access the - system console, open a web browser, paste the custom domain URL in the address bar, and append the value `/system`. - - The first time you visit the Palette system console, a warning message about a not-trusted SSL certificate may - appear. This is expected, as you have not yet uploaded your SSL certificate to Palette. You can ignore this warning - message and proceed. - - ![Screenshot of the Palette system console showing Username and Password fields.](/palette_installation_install-on-vmware_palette-system-console.webp) - -15. Log in to the system console using the following default credentials. Refer to the - [password requirements](../../../system-management/account-management/credentials.md#password-requirements-and-security) - documentation page to learn more about password requirements. +### Kubernetes Cluster - | **Parameter** | **Value** | - | ------------- | --------- | - | Username | `admin` | - | Password | `admin` | + - After login, you will be prompted to create a new password. Enter a new password and save your changes. You will be - redirected to the Palette system console. Use the username `admin` and your new password to log in to the system - console. You can create additional system administrator accounts and assign roles to users in the system console. - Refer to the [Account Management](../../../system-management/account-management/account-management.md) documentation - page for more information. +### Local Environment -16. After login, a summary page is displayed. Palette is installed with a self-signed SSL certificate. To assign a - different SSL certificate, you must upload the SSL certificate, SSL certificate key, and SSL certificate authority - files to Palette. You can upload the files using the Palette system console. Refer to the - [Configure HTTPS Encryption](../../../system-management/ssl-certificate-management.md) page for instructions on how - to upload the SSL certificate files to Palette. + - :::warning +### Other Prerequisites - If you plan to deploy host clusters into different networks, you may require a reverse proxy. Check out the - [Configure Reverse Proxy](../../../system-management/reverse-proxy.md) guide for instructions on how to configure a - reverse proxy for Palette. + - ::: +## Install Palette -You now have a self-hosted instance of Palette installed in a Kubernetes cluster. Make sure you retain the -**values.yaml** file, as you may need it for future upgrades. + + +### Cert-Manager Helm Chart + +3. + +### Spectro Management CRDs Helm Chart + +7. + +### Palette Helm Chart + +8. + +### Image Swap Helm Chart + +11. + +### Reach System Helm Chart + +12. + +### Installation + +13. ## Validate -Use the following steps to validate the Palette installation. - -1. Open up a web browser and navigate to the Palette system console. To access the system console, open a web browser, - paste the `env.rootDomain` value you provided in the address bar, and append the value `/system` in the following - format: `/system`. You can also use the IP address of the load balancer. - -2. Log in using the credentials you received from our support team. After login, you will be prompted to create a new - password. Enter a new password and save your changes. You will be redirected to the Palette system console. - -3. Open a terminal session and issue the following command to verify the Palette installation. The command should return - a list of deployments in the `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` - namespaces. - - ```shell - kubectl get pods --all-namespaces --output custom-columns="NAMESPACE:metadata.namespace,NAME:metadata.name,STATUS:status.phase" \ - | grep --extended-regexp '^(cp-system|hubble-system|ingress-traefik|jet-system|ui-system)\s' - ``` - - Your output should look similar to the following. - - ```shell hideClipboard - cp-system spectro-cp-ui-689984f88d-54wsw Running - hubble-system auth-85b748cbf4-6drkn Running - hubble-system auth-85b748cbf4-dwhw2 Running - hubble-system cloud-fb74b8558-lqjq5 Running - hubble-system cloud-fb74b8558-zkfp5 Running - hubble-system configserver-685fcc5b6d-t8f8h Running - hubble-system event-68568f54c7-jzx5t Running - hubble-system event-68568f54c7-w9rnh Running - hubble-system foreq-6b689f54fb-vxjts Running - hubble-system hashboard-897bc9884-pxpvn Running - hubble-system hashboard-897bc9884-rmn69 Running - hubble-system hutil-6d7c478c96-td8q4 Running - hubble-system hutil-6d7c478c96-zjhk4 Running - hubble-system mgmt-85dbf6bf9c-jbggc Running - hubble-system mongo-0 Running - hubble-system mongo-1 Running - hubble-system mongo-2 Running - hubble-system msgbroker-6c9b9fbf8b-mcsn5 Running - hubble-system oci-proxy-7789cf9bd8-qcjkl Running - hubble-system packsync-28205220-bmzcg Succeeded - hubble-system spectrocluster-6c57f5775d-dcm2q Running - hubble-system spectrocluster-6c57f5775d-gmdt2 Running - hubble-system spectrocluster-6c57f5775d-sxks5 Running - hubble-system system-686d77b947-8949z Running - hubble-system system-686d77b947-cgzx6 Running - hubble-system timeseries-7865bc9c56-5q87l Running - hubble-system timeseries-7865bc9c56-scncb Running - hubble-system timeseries-7865bc9c56-sxmgb Running - hubble-system user-5c9f6c6f4b-9dgqz Running - hubble-system user-5c9f6c6f4b-hxkj6 Running - ingress-traefik traefik-ingress-controller-9dmzq Running - ingress-traefik traefik-ingress-controller-tpwtf Running - ingress-traefik traefik-ingress-controller-xz4jf Running - jet-system jet-6599b9856d-t9mr4 Running - ui-system spectro-ui-76ffdf67fb-rkgx8 Running - ``` + ## Next Steps diff --git a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/install.md b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/install.md index e350c7344e0..5e4c4dd095e 100644 --- a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/install.md +++ b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/install.md @@ -9,87 +9,10 @@ tags: ["self-hosted", "enterprise"] keywords: ["self-hosted", "enterprise"] --- -You can use the Palette Helm Chart to install Palette in a multi-node Kubernetes cluster in your production environment. +You can use the Palette Helm chart to install Palette in a multi-node Kubernetes cluster in your production environment. ## Prerequisites -- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) is installed and available. - -- [Helm](https://helm.sh/docs/intro/install/) is installed and available. - -- Access to the target Kubernetes cluster's kubeconfig file. You must be able to interact with the cluster using - `kubectl` commands and have sufficient permissions to install Palette. We recommend using a role with cluster-admin - permissions to install Palette. - -- Ensure `unzip` or a similar extraction utility is installed on your system. - -- The Kubernetes cluster must be set up on a supported version of Kubernetes. Refer to the - [Kubernetes Requirements](../install-palette.md#kubernetes-requirements) section to find the version required for your - Palette installation. - -- Ensure the Kubernetes cluster does not have Cert Manager installed. Palette requires a unique Cert Manager - configuration to be installed as part of the installation process. If Cert Manager is already installed, you must - uninstall it before installing Palette. - -- Palette requires a Container Storage Interface (CSI) to create Persistent Volumes, which are used to store persistent - data. You may install any CSI that is compatible with your Kubernetes cluster. - -- If you are using a _self-hosted MongoDB_ instance, such as MongoDB Atlas, ensure the MongoDB database has a user named - `hubble` with the permission `readWriteAnyDatabase`. Refer to the - [Add a Database User](https://www.mongodb.com/docs/guides/atlas/db-user/) guide for guidance on how to create a - database user in Atlas. - -- We recommended the following resources for Palette. Refer to the - [Palette size guidelines](../install-palette.md#size-guidelines) for additional sizing information. - - - 8 CPUs per node. - - - 16 GB Memory per node. - - - 110 GB Disk Space per node. - - - A minimum of three worker nodes or three untainted control plane nodes. - - - AMD64 (also known as x86_64) architecture. ARM-based nodes are not supported. - -- The following network ports must be accessible for Palette to operate successfully. - - - TCP/443: Inbound and outbound to and from the Palette management cluster. - - - TCP/6443: Outbound traffic from the Palette management cluster to the deployed clusters' Kubernetes API server. - -- Ensure you have an SSL certificate that matches the domain name you will assign to Palette. You will need this to - enable HTTPS encryption for Palette. Reach out to your network administrator or security team to obtain the SSL - certificate. You need the following files: - - - x509 SSL certificate file in base64 format. - - - x509 SSL certificate key file in base64 format. - - - x509 SSL certificate authority file in base64 format. - -- A [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to manage persistent storage, with the - annotation `storageclass.kubernetes.io/is-default-class` set to `true`. To override the default StorageClass for a - workload, modify the `storageClass` parameter. Check out the - [Change the default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) - page to learn more about modifying StorageClasses. - -- Palette uses Traefik as the ingress controller. If you already have an ingress controller deployed in the cluster, set - the `ingress.enabled` parameter to `false` in the `values.yaml` file. - -- A custom domain and the ability to update Domain Name System (DNS) records. You will need this to enable HTTPS - encryption for Palette. - -- If you are installing Palette behind a network proxy server, ensure you have the Certificate Authority (CA) - certificate file in the base64 format. You will need this to enable Palette to communicate with the network proxy - server. - -- Ensure Palette has access to the required domains and ports. Refer to the - [Required Domains](../install-palette.md#proxy-requirements) section for more information. - -- Access to the Palette Helm Charts. Refer to the [Access Palette](../../enterprise-version.md#access-palette) for - instructions on how to request access to the Helm Chart - :::warning Do not use a Palette-managed Kubernetes cluster when installing Palette. Palette-managed clusters contain the Palette @@ -97,735 +20,109 @@ agent and Palette-created Kubernetes resources that will interfere with the inst ::: -## Install Palette - -The following instructions are written agnostic to the Kubernetes distribution you are using. Depending on the -underlying infrastructure provider and your Kubernetes distribution, you may need to modify the instructions to match -your environment. Reach out to our support team if you need assistance. - -1. Open a terminal session and navigate to the directory where you downloaded the Palette install zip file provided by - our support. Unzip the file to a directory named **palette-install**. - - ```shell - unzip charts.zip -d palette-install - ``` - -2. Navigate to the **palette-install** directory. - - ```shell - cd palette-install - ``` - -3. Install Cert Manager using the following command. Replace the actual file name of the Cert Manager Helm Chart with - the one you downloaded, as the version number may be different. - - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install - ``` - - ```shell hideClipboard - Release "cert-manager" does not exist. Installing it now. - NAME: cert-manager - LAST DEPLOYED: Fri Jan 30 18:40:57 2026 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - DESCRIPTION: Install complete - TEST SUITE: None - ``` - -4. Install the Spectro Management CRDs chart. This chart contains Custom Resource Definitions (CRDs) required by - Palette, including Traefik CRDs, and must be installed _before_ the main Palette Helm chart. When the chart is - installed, the custom resource types are registered with the Kubernetes API server; no pods are deployed. - - ```shell - helm upgrade --install spectro-mgmt-crds extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz - ``` - - ```shell hideClipboard title="Example output" - Release "spectro-mgmt-crds" does not exist. Installing it now. - NAME: spectro-mgmt-crds - LAST DEPLOYED: Fri Jan 30 18:42:30 2026 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - DESCRIPTION: Install complete - TEST SUITE: None - ``` - -5. Open the **values.yaml** in the **palette/spectro-mgmt-plane** folder with a text editor of your choice. The - **values.yaml** contains the default values for the Palette installation parameters, however, you must populate the - following parameters before installing Palette. You can learn more about the parameters in the **values.yaml** file - in the [Helm Configuration Reference](palette-helm-ref.md) page. - - | **Parameter** | **Description** | **Type** | - | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | - | `env.rootDomain` | The URL name or IP address you will use for the Palette installation. | string | - | `ociPackRegistry` or `ociPackEcrRegistry` | The OCI registry credentials for Palette FIPS packs. These credentials are provided by our support team. | object | - | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | - | `reachSystem` | Set `reach-system.enabled` to `true` and configure the `reach-system.proxySettings` parameters to configure Palette to use a network proxy in your environment | object | - - :::info - - If you are installing Palette by pulling required images from a private mirror registry, you will need to provide - the credentials to your registry in the **values.yaml** file. For more information, refer to - [Helm Configuration Reference](palette-helm-ref.md#image-pull-secret). - - ::: - - Save the **values.yaml** file after you have populated the required parameters mentioned in the table. Expand the - following sections to review an example of the **values.yaml** file with the required parameters highlighted. - - - - - - - ```yaml {60,84-92} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo,mongo-1.mongo,mongo-2.mongo" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "central" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: true - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "palette.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - # ociPackRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackEcrRegistry: - endpoint: "15789037893.dkr.ecr.us-east-1.amazonaws.com" # - name: "Palette Packs OCI" # - accessKey: "**************" # - secretKey: "**************" # - baseContentPath: "production" # - isPrivate: true - insecureSkipVerify: false - caCert: "" - - # ociImageRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - # mirrorRegistries: "" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "us-docker.pkg.dev/palette-images/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.8.a-v2" - imageSwapImage: "us-docker.pkg.dev/palette-images/third-party/thewebroot/imageswap:v1.5.3-spectro-4.8.a-v2" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - tunnel: - preferredServer: - endpoint: "" - servers: - - endpoint: "" - ingress: - msgbroker: - proxyBodySize: "15m" # Default proxy body size for msgbroker ingress - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" +### Kubernetes Cluster - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false + - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} +### Local Environment - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID + - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` +- An image pull secret from Spectro Cloud customer support, required to pull images from Spectro Cloud OCI registries. + This is not required if you plan to use [mirror registries](../../system-management/registry-override.md) or + [image swap](../../../clusters/cluster-management/image-swap.md) when pulling images. Refer to + [Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for + more information. - +### Other Prerequisites - + - ```yaml {61,76-83,95-103} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo,mongo-1.mongo,mongo-2.mongo" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "connected" #values can be connected or airgap. - isPaletteBaseCluster: false - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: true - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "palette.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackRegistry: - endpoint: "example.harbor.org" # - name: "Palette Packs OCI" # - password: "**************" # - username: "**************" # - baseContentPath: "spectro-packs" # - insecureSkipVerify: false - caCert: "" - - # ociPackEcrRegistry: - # endpoint: "" # - # name: "" # - # accessKey: "" # - # secretKey: "" # - # baseContentPath: "" # - # isPrivate: true - # insecureSkipVerify: false - # caCert: "" - - ociImageRegistry: - endpoint: "" # - name: "" # - password: "" # - username: "" # - baseContentPath: "" # - insecureSkipVerify: false - caCert: "" - mirrorRegistries: "" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "us-docker.pkg.dev/palette-images/third-party/thewebroot/imageswap-init:v1.5.3-spectro-4.8.a-v2" - imageSwapImage: "us-docker.pkg.dev/palette-images/third-party/thewebroot/imageswap:v1.5.3-spectro-4.8.a-v2" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - tunnel: - preferredServer: - endpoint: "" - servers: - - endpoint: "" - ingress: - msgbroker: - proxyBodySize: "15m" # Default proxy body size for msgbroker ingress - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - # service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - :::warning - - Ensure you have configured the **values.yaml** file with the required parameters before proceeding to the next - steps. - - ::: - -6. This step is only required if you are installing Palette in an environment where a network proxy must be configured - for Palette to access the internet. If you are not using a network proxy, skip to the next step. - - Install the reach-system chart using the following command. Point to the **values.yaml** file you configured in - step 5. Make sure you configure the `reach-system.enable` section in the **values.yaml** file. - - ```shell - helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-*.tgz --install - ``` - - ```shell hideClipboard - Release "reach-system" does not exist. Installing it now. - NAME: reach-system - LAST DEPLOYED: Fri Jan 30 18:40:57 2026 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - -
    - How to update containerd to use proxy configurations - - If your Kubernetes cluster is behind a network proxy, ensure the containerd service is configured to use proxy - settings. You can do this by updating the containerd configuration file on each node in the cluster. The - configuration file is typically located at ` /etc/systemd/system/containerd.service.d/http-proxy.conf`. Below is an - example of the configuration file. Replace the values with your proxy settings. Ask your network administrator for - guidance. - - ``` - [Service] - Environment="HTTP_PROXY=http://example.com:9090" - Environment="HTTPS_PROXY=http://example.com:9090" - Environment="NO_PROXY=127.0.0.1,localhost,100.64.0.0/17,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,,.cluster.local" - ``` - -
    - -7. Install the Palette Helm Chart using the following command. - - ```shell - helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-*.tgz --install - ``` - - ```shell hideClipboard - Release "hubble" does not exist. Installing it now. - NAME: hubble - LAST DEPLOYED: Fri Jan 30 18:46:53 2026 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - DESCRIPTION: Install complete - TEST SUITE: None - ``` - -8. Track the installation process using the command below. Palette is ready when the deployments in the namespaces - `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` reach the _Ready_ state. The - installation takes between two to three minutes to complete. - - - - ```shell - kubectl get pods --all-namespaces --watch - ``` - - :::tip - - For a more user-friendly experience, use the open source tool [k9s](https://k9scli.io/) to monitor the installation - process. - - ::: - -9. Create a DNS CNAME record that is mapped to the Palette `traefik-ingress-controller` load balancer. You can use the - following command to retrieve the load balancer IP address. You may require the assistance of your network - administrator to create the DNS record. - - ```shell - kubectl get service traefik-ingress-controller --namespace ingress-traefik \ - --output jsonpath='{.status.loadBalancer.ingress[0].hostname}' - ``` - - :::warning - - If Palette has only one tenant and you use local accounts with Single Sign-On (SSO) disabled, you can access Palette - using the IP address or any domain name that resolves to that IP. However, once you enable SSO, users must log in - using the tenant-specific subdomain. For example, if you create a tenant named `tenant1` and the domain name you - assigned to Palette is `palette.example.com`, the tenant URL will be `tenant1.palette.example.com`. We recommend you - create an additional wildcard DNS record to map all tenant URLs to the Palette load balancer. For example, - `*.palette.example.com`. - - ::: - -10. Use the custom domain name or the IP address of the load balancer to visit the Palette system console. system - console, open a web browser and paste the custom domain URL in the address bar and append the value `/system`. - Replace the domain name in the URL with your custom domain name or the IP address of the load balancer. - Alternatively, you can use the load balancer IP address with the appended value `/system` to access the system - console. - - The first time you visit the Palette system console, a warning message about a not trusted SSL certificate may - appear. This is expected, as you have not yet uploaded your SSL certificate to Palette. You can ignore this warning - message and proceed. - - ![Screenshot of the Palette system console showing Username and Password fields.](/palette_installation_install-on-vmware_palette-system-console.webp) - -11. Log in to the system console using the following default credentials. Refer to the - [password requirements](../../system-management/account-management/credentials.md#password-requirements-and-security) - documentation page to learn more about password requirements - - | **Parameter** | **Value** | - | ------------- | --------- | - | Username | `admin` | - | Password | `admin` | - - After login, you will be prompted to create a new password. Enter a new password and save your changes. You will be - redirected to the Palette system console. Use the username `admin` and your new password to log in to the system - console. You can create additional system administrator accounts and assign roles to users in the system console. - Refer to the [Account Management](../../system-management/account-management/account-management.md) documentation - page for more information. - -12. After login, a summary page is displayed. Palette is installed with a self-signed SSL certificate. To assign a - different SSL certificate you must upload the SSL certificate, SSL certificate key, and SSL certificate authority - files to Palette. You can upload the files using the Palette system console. Refer to the - [Configure HTTPS Encryption](../../system-management/ssl-certificate-management.md) page for instructions on how to - upload the SSL certificate files to Palette. - - :::warning - - If you plan to deploy host clusters into different networks, you may require a reverse proxy. Check out the - [Configure Reverse Proxy](../../system-management/reverse-proxy.md) guide for instructions on how to configure a - reverse proxy for Palette. - - ::: +## Install Palette -You now have a self-hosted instance of Palette installed in a Kubernetes cluster. Make sure you retain the -**values.yaml** file as you may need it for future upgrades. + + +### Cert-Manager Helm Chart + +3. + +### Spectro Management CRDs Helm Chart + +6. + +### Palette Helm Chart + +7. + +### Image Swap Helm Chart + +10. + +### Reach System Helm Chart + +11. + +### Installation + +12. ## Validate -Use the following steps to validate the Palette installation. - -1. Open up a web browser and navigate to the Palette system console. To access the system console, open a web browser - and paste the `env.rootDomain` value you provided in the address bar and append the value `/system`. You can also use - the IP address of the load balancer. - -2. Log in using the credentials you received from our support team. After login, you will be prompted to create a new - password. Enter a new password and save your changes. You will be redirected to the Palette system console. - -3. Open a terminal session and issue the following command to verify the Palette installation. The command should return - a list of deployments in the `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` - namespaces. - - ```shell - kubectl get pods --all-namespaces --output custom-columns="NAMESPACE:metadata.namespace,NAME:metadata.name,STATUS:status.phase" \ - | grep --extended-regexp '^(cp-system|hubble-system|ingress-traefik|jet-system|ui-system)\s' - ``` - - Your output should look similar to the following. - - ```shell hideClipboard - cp-system spectro-cp-ui-78c9b7dcc5-q8ln4 Running - hubble-system auth-58bc56bc79-68lbg Running - hubble-system auth-58bc56bc79-r2md8 Running - hubble-system cloud-8475845cff-dnq27 Running - hubble-system cloud-8475845cff-v2cww Running - hubble-system configserver-74dd648bf5-6tvmv Running - hubble-system event-68cfb57f6d-9dx5b Running - hubble-system event-68cfb57f6d-g5zrl Running - hubble-system event-68cfb57f6d-rz4sz Running - hubble-system foreq-6c75b84554-x4f7h Running - hubble-system hashboard-7b69cc685f-d8mmw Running - hubble-system hashboard-7b69cc685f-mbb57 Running - hubble-system hutil-5456dfbdd7-68p4m Running - hubble-system hutil-5456dfbdd7-dllfj Running - hubble-system memstore-8654b49cfd-npqbv Running - hubble-system mgmt-55985b7ccb-gpvnr Running - hubble-system mongo-0 Running - hubble-system mongo-1 Running - hubble-system mongo-2 Pending - hubble-system mongodb-key-manager-helm-4z2mw Running - hubble-system msgbroker-0 Running - hubble-system msgbroker-1 Running - hubble-system oci-proxy-787fd499d4-f772t Running - hubble-system specman-0 Running - hubble-system spectro-tunnel-69448888-qn7kk Running - hubble-system spectrocluster-54fb864b48-8fhkr Running - hubble-system spectrocluster-54fb864b48-9hkgg Running - hubble-system spectrocluster-54fb864b48-w5dwr Running - hubble-system spectrocluster-jobs-6ddfbddcd6-j9xb8 Running - hubble-system spectrocluster-reconciler-d448fc8cf-qr6bp Running - hubble-system spectroclusterop-89968785d-6n48l Running - hubble-system spectroclusterop-89968785d-gzd5w Running - hubble-system spectrossh-d5fd6b49-wfcgc Running - hubble-system system-6f7767845d-lm5zn Running - hubble-system system-6f7767845d-xf2hl Running - hubble-system timeseries-6f5bf98c5c-fcqnh Running - hubble-system timeseries-6f5bf98c5c-vmb5h Running - hubble-system timeseries-6f5bf98c5c-xm8s6 Running - hubble-system user-796c877b57-6rcdp Running - hubble-system user-796c877b57-ptbg4 Running - ingress-traefik traefik-ingress-controller-9dmzq Running - ingress-traefik traefik-ingress-controller-tpwtf Running - ingress-traefik traefik-ingress-controller-xz4jf Running - jet-system jet-555cdf78f5-4l2s2 Running - ui-system spectro-ui-8658f85c85-9lkhs Running - ``` + ## Next Steps diff --git a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/palette-helm-ref.md b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/palette-helm-ref.md index fd5d3b7c829..48c57a4d7ba 100644 --- a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/palette-helm-ref.md +++ b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/palette-helm-ref.md @@ -36,34 +36,51 @@ The global block allows you to provide configurations that apply globally to the ### Image Pull Secret -The `imagePullSecret` block allows you to provide image pull secrets that will be used to authenticate with private -registries to obtain the images required for Palette installation. This is relevant if you have your own mirror -registries you use for Palette installation. +:::warning -| **Parameters** | **Description** | **Type** | **Default value** | -| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------- | -| `create` | Specifies whether to create a secret containing credentials to your own private image registry. | Boolean | `false` | -| `dockerConfigJson` | The **config.json** file value containing the registry URL and credentials for your image registry in base64 encoded format on a single line. For more information about the **config.json** file, refer to [Kubernetes Documentation](https://kubernetes.io/docs/concepts/containers/images/#config-json). | String | None | +Spectro Cloud's image pull secret will be required in an upcoming release for any users pulling images from a Spectro +Cloud-owned registry. This is a breaking change. We recommend obtaining your secret as soon as possible to avoid service +disruptions. Refer to +[Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for +more information. -:::info +::: -To obtain the base-64 encoded version of the credential `config.json` file, you can issue the following command. Replace -`` with the path to your `config.json` file. The `tr -d '\n'` removes new line characters -and produce the output on a single line. +The `imagePullSecret` block configures the image pull secret used to authenticate with private registries. Palette +always creates a Kubernetes Secret named `spectro-image-pull-secret` from this value and distributes it to the +management plane, workload clusters, and PCGs. The secret serves the following purposes: -```shell -cat | base64 | tr -d '\n' -``` +- **Spectro Cloud registry authentication** - Authenticates with Spectro Cloud's registries to pull security-hardened + images. These images are used by the management plane, workload clusters, and PCGs. To obtain this secret, contact + your Spectro Cloud customer support representative. Refer to + [Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for + more information. -::: +- **Private registry authentication** - If you host Palette images in your own private registry, the secret provides the + credentials needed to pull those images. + +| **Parameters** | **Description** | **Type** | **Default value** | +| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------- | +| `dockerConfigJson` | The values of the `config.json` file encoded in base64 as a single string, containing the registry URL and credentials for your image registry. For more information about the `config.json` file, refer to the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/containers/images/#config-json). | String | `""` | ```yaml global: imagePullSecret: - create: true dockerConfigJson: ewoJImF1dGhzHsKCQkiaG9va3......MiOiAidHJ1ZSIKCX0KfQ # Base64 encoded config.json ``` +:::info + +To obtain the base64-encoded version of your `config.json` file, use the following command. Replace +`` with the path to your `config.json` file. The `tr --delete '\n'` removes new line +characters and produces the output on a single line. + +```shell +cat | base64 | tr --delete '\n' +``` + +::: + ## MongoDB Palette uses MongoDB Enterprise as its internal database and supports two modes of deployment: @@ -316,8 +333,8 @@ config: ### Image Swap Configuration You can configure Palette to use image swap to download the required images. This is an advanced configuration option, -and it is only required for air-gapped deployments. You must also install the Palette Image Swap Helm chart to use this -option, otherwise, Palette will ignore the configuration. +and it is only required for airgapped deployments or when you use a self-hosted OCI registry. You must also install the +Palette Image Swap Helm chart to use this option, otherwise, Palette will ignore the configuration. | **Parameters** | **Description** | **Type** | **Default value** | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------- | diff --git a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/uninstall.md b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/uninstall.md index 33b3a886f9b..96e015c4943 100644 --- a/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/uninstall.md +++ b/docs/docs-content/enterprise-version/install-palette/install-on-kubernetes/uninstall.md @@ -41,27 +41,34 @@ to install Palette, this process does not apply. ``` 2. Issue the following command to start uninstalling the Palette management plane. This will only remove the resources - managed by Helm and the remaining resources will require additional manual intervention. + managed by Helm. The remaining resources will require additional manual intervention. ```shell helm uninstall hubble ``` -3. Issue the following command to remove the namespace and custom resource definitions related to the Palette management - plane. +3. Remove the namespace and custom resource definitions related to the Palette management plane. ```shell - kubectl delete namespace hubble-system || kubectl delete crd spectroclusteractions.jet.cluster.spectrocloud.com + kubectl delete namespace hubble-system + kubectl delete crd spectroclusteractions.jet.cluster.spectrocloud.com ``` -4. Issue the following command to uninstall Cert Manager. Cert Manager does not reply on any Helm hooks and the Helm - uninstall command will uninstall all related resources. +4. Uninstall Cert Manager. ```shell helm uninstall cert-manager + kubectl delete namespace cert-manager ``` -5. (Optional) If you installed Reach, issue the following command to start uninstalling Reach. This will remove all +5. Uninstall the Spectro Management CRDs chart. + + ```shell + helm uninstall spectro-mgmt-crds + ``` + +6. _(Proxy environments only)_ If you installed Palette in an environment where a network proxy is configured for + Palette to access the internet, issue the following command to start uninstalling Reach. This will remove all resources related to Reach that are managed by Helm. However, some resources created by Helm hooks are not managed by Helm and will require additional manual intervention to remove. @@ -69,7 +76,7 @@ to install Palette, this process does not apply. helm uninstall reach-system ``` -6. (Optional) Issue the following commands to remove the remaining Reach system resources. +7. _(Proxy environments only)_ Issue the following commands to remove the remaining Reach system resources. ```shell kubectl delete ns reach-system @@ -83,13 +90,15 @@ to install Palette, this process does not apply. kubectl delete clusterrole reach-proxy-role ``` -7. (Optional) If you installed Image Swap, issue the following command to remove the `image-swap` chart. +8. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, issue the following command + to remove the `image-swap` chart. ```shell helm uninstall image-swap ``` -8. (Optional) Issue the following commands to remove the remaining resources related to `image-swap`. +9. _(Self-hosted OCI registry only)_ Issue the following commands to remove the remaining resources related to + `image-swap`. ```shell kubectl delete ns imageswap-system diff --git a/docs/docs-content/enterprise-version/system-management/configure-image-pull-secret.md b/docs/docs-content/enterprise-version/system-management/configure-image-pull-secret.md new file mode 100644 index 00000000000..d8d81a426db --- /dev/null +++ b/docs/docs-content/enterprise-version/system-management/configure-image-pull-secret.md @@ -0,0 +1,112 @@ +--- +sidebar_label: "Configure Image Pull Secret" +title: "Configure Image Pull Secret for Security-Hardened Images" +description: + "Learn how to request and configure an image pull secret from Spectro Cloud, used for retrieving security-hardened + images." +icon: "" +hide_table_of_contents: false +sidebar_position: 35 +tags: ["self-hosted", "account", "image pull secret", "hardened images", "security"] +keywords: ["self-hosted", "palette", "image pull secret", "hardened images", "security"] +--- + + + +## When to Configure Image Pull Secret + +Depending on how your environment retrieves images, you may or may not need to configure Spectro Cloud's image pull +secret. + +Review the following sections to learn if your environment requires configuration. + +### Configuration Required + + + +### Configuration Not Required + + + +## Configure Image Pull Secret + +Depending on your installation method, you can configure Spectro Cloud's image pull secret during or after installing +self-hosted Palette. + +### During Installation + + + +#### Helm Chart Installations + + + +### Post-Installation + + + +#### Prerequisites + + + +#### Enablement + + + +#### Validate + + diff --git a/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/airgap.md b/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/airgap.md index 2da2c9add5d..36cb5472bb4 100644 --- a/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/airgap.md +++ b/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/airgap.md @@ -253,54 +253,56 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet ::: -8. Navigate to the directory with the Palette installation zip file. Unzip the file to a **palette-install** directory. +8. Navigate to the directory where you downloaded the Palette install zip file provided by our support team. Unzip the + file to a directory named `palette-install`. ```shell - unzip release-*.zip -d palette-install + unzip charts.zip -d palette-install ``` -9. Navigate to the release directory inside **palette-install**. +9. Navigate to the `palette-install` directory. ```shell - cd palette-install/charts/release-* + cd palette-install ``` -10. In a code editor of your choice, open the **extras/cert-manager/values.yaml** file and replace the - `cainjectorImage`,`controllerImage`, `webhookImage`, and `amceResolverImage` image URLs and with your OCI image - registry URL and the `/spectro-images/` namespace. +10. Open the file `extras/cert-manager/values.yaml` with a text editor of your choice. This example uses Vim. - ```yaml {2-5} - image: - cainjectorImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" - - featureGates: "AdditionalCertificateOutputFormats=true" + ```shell + vim extras/cert-manager/values.yaml ``` - Consider the following example for reference. +11. Append `` to each image, along with the `` where you want to store your images. - ```yaml {2-5} + ```yaml image: - cainjectorImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" - - featureGates: "AdditionalCertificateOutputFormats=true" + cainjectorImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" ``` -11. Update the cert-manager chart using the following command. + In the example below, we used `harbor.docs.spectro.dev` for the registry and `spectro-images` for the repository. - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install + ```yaml {2-5} hideClipboard title="Example output" + image: + cainjectorImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" ``` - You should receive an output similar to the following. +12. Update the cert-manager chart using the following command. ```shell + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml + ``` + + ```shell hideClipboard title="Example output" Release "cert-manager" has been upgraded. Happy Helming! NAME: cert-manager LAST DEPLOYED: Thu Feb 22 19:42:33 2024 @@ -310,29 +312,28 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet TEST SUITE: None ``` -12. Prepare the Palette configuration file `values.yaml`. If you saved `values.yaml` used during the Palette - installation, you can reuse it for the upgrade. Alternatively, follow the - [Kubernetes Installation Instructions](../../install-palette/install-on-kubernetes/install.md) to populate your - `values.yaml`. +13. Open the file `palette/values.yaml` with a text editor of your choice. This example uses Vim. - :::warning - - Ensure that the `values.yaml` file is ready before proceeding. Specifically, make sure that the `ociPackEcrRegistry` - and `ociImageRegistry` configurations include the parameters necessary to interact with your `spectro-images` and - `spectro-packs` repositories. + ```shell + vim palette/values.yaml + ``` - ::: +14. Prepare the Palette configuration `palette/values.yaml` file. If you saved your `values.yaml` used during the + Palette installation, you can refer to it when upgrading. Ensure you carry over any necessary configurations, such + as root domains, certificates, image-swap paths, and registries. Refer to + [Kubernetes Installation Instructions](../../install-palette/install-on-kubernetes/airgap-install/install.md) for + basic `values.yaml` guidance. For a full list of parameters, refer to + [Helm Configuration Reference](../../install-palette/install-on-kubernetes/palette-helm-ref.md). -13. Upgrade the image-swap chart with the following command. Point to the `palette/values.yaml` file from step 12. +15. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, upgrade the image-swap chart + with the following command. Point to the `palette/values.yaml` file from step 14. ```shell helm upgrade --values palette/values.yaml \ image-swap extras/image-swap/image-swap-*.tgz --install ``` - You should receive an output similar to the following. - - ```shell + ```shell hideClipboard title="Example output" Release "image-swap" has been upgraded. Happy Helming! NAME: image-swap LAST DEPLOYED: Thu Feb 22 19:44:13 2024 @@ -342,16 +343,16 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet TEST SUITE: None ``` -14. Upgrade the reach-system chart with the following command. Point to the `palette/values.yaml` file from step 12. +16. _(Proxy environments only)_ If you are upgrading a Palette instance in an environment where a network proxy must be + configured for Palette to access the internet, upgrade the reach-system chart with the following command. Point to + the `palette/values.yaml` file from step 14. ```shell helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-\*.tgz --install + reach-system extras/reach-system/reach-system-*.tgz --install ``` - You should receive an output similar to the following. - - ```shell + ```shell hideClipboard title="Example output" Release "reach-system" has been upgraded. Happy Helming! NAME: reach-system LAST DEPLOYED: Thu Feb 22 19:47:10 2024 @@ -361,7 +362,7 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet TEST SUITE: None ``` -15. Upgrade the Spectro Management CRDs chart. +17. Upgrade the Spectro Management CRDs chart. ```shell helm upgrade --install spectro-mgmt-crds \ @@ -369,9 +370,7 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet --values extras/spectro-mgmt-crds/values.yaml ``` - You should receive an output similar to the following. - - ```shell + ```shell hideClipboard title="Example output" Release "spectro-mgmt-crds" has been upgraded. Happy Helming! NAME: spectro-mgmt-crds LAST DEPLOYED: Thu Feb 22 19:43:00 2024 @@ -381,16 +380,14 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet TEST SUITE: None ``` -16. Upgrade Palette with the following command. +18. Upgrade Palette with the following command. ```shell helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-\*.tgz --install + hubble palette/spectro-mgmt-plane-*.tgz --install ``` - You should receive an output similar to the following. - - ```shell + ```shell hideClipboard title="Example output" Release "hubble" has been upgraded. Happy Helming! NAME: hubble LAST DEPLOYED: Thu Feb 22 20:05:24 2024 @@ -400,7 +397,7 @@ This guide takes you through the process of upgrading a self-hosted airgap Palet TEST SUITE: None ``` -17. Use the following command to track the upgrade process. +19. Use the following command to track the upgrade process. ```shell kubectl get pods --all-namespaces --watch diff --git a/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/non-airgap.md b/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/non-airgap.md index 35ef8109607..594c932a4ac 100644 --- a/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/non-airgap.md +++ b/docs/docs-content/enterprise-version/upgrade/upgrade-k8s/non-airgap.md @@ -59,150 +59,133 @@ match your environment. ::: -1. Open a terminal session and navigate to the directory with the Palette installation zip file. Unzip the file to a - **palette-install** directory. - - ```shell - unzip release-*.zip -d palette-install - ``` - -2. Navigate to the release directory inside **palette-install**. - - ```shell - cd palette-install/charts/release-* - ``` - -3. Update the cert-manager chart using the following command. - - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install - ``` - - You should receive an output similar to the following. - - ```shell - Release "cert-manager" has been upgraded. Happy Helming! - NAME: cert-manager - LAST DEPLOYED: Thu Feb 22 19:42:33 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 2 - TEST SUITE: None - ``` - -4. Upgrade the Spectro Management CRDs chart. - - ```shell - helm upgrade --install spectro-mgmt-crds \ - extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ - --values extras/spectro-mgmt-crds/values.yaml - ``` - - You should receive an output similar to the following. - - ```shell - Release "spectro-mgmt-crds" has been upgraded. Happy Helming! - NAME: spectro-mgmt-crds - LAST DEPLOYED: Thu Feb 22 19:43:00 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 2 - TEST SUITE: None - ``` - -5. Prepare the Palette configuration file `values.yaml`. If you saved `values.yaml` used during the Palette - installation, you can reuse it for the upgrade. Alternatively, follow the - [Kubernetes Installation Instructions](../../install-palette/install-on-kubernetes/install.md) to populate your - `values.yaml`. - - :::warning - - Ensure that the `values.yaml` file is ready before proceeding. If you are using a self-hosted OCI registry, make sure - that the `ociImageRegistry.mirrorRegistries` parameter in your `values.yaml` includes the necessary mirror links. - - Include `/v2` in your endpoints if you are using a - [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. - Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other - registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` - for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - - ::: - -6. If you are using a self-hosted OCI registry, upgrade the image-swap chart with the following command. Point to the - `palette/values.yaml` file from step 5. - - ```shell - helm upgrade --values palette/values.yaml \ - image-swap extras/image-swap/image-swap-*.tgz --install - ``` - - You should receive an output similar to the following. - - ```shell - Release "image-swap" has been upgraded. Happy Helming! - NAME: image-swap - LAST DEPLOYED: Thu Feb 22 19:44:13 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 2 - TEST SUITE: None - ``` - -7. If you are upgrading a Palette instance in an environment that requires network proxy configuration, upgrade the - reach-system chart with the following command. Point to the `palette/values.yaml` file from step 5. - - ```shell - helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-\*.tgz --install - ``` - - You should receive an output similar to the following. - - ```shell - Release "reach-system" has been upgraded. Happy Helming! - NAME: reach-system - LAST DEPLOYED: Thu Feb 22 19:47:10 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 2 - TEST SUITE: None - ``` - -8. Upgrade Palette with the following command. - - ```shell - helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-\*.tgz --install - ``` - - You should receive an output similar to the following. - - ```shell - Release "hubble" has been upgraded. Happy Helming! - NAME: hubble - LAST DEPLOYED: Thu Feb 22 20:05:24 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 2 - TEST SUITE: None - ``` - -9. Use the following command to track the upgrade process. - - ```shell - kubectl get pods --all-namespaces --watch - ``` - - :::tip - - For a more user-friendly experience, consider using [K9s](https://k9scli.io/) or a similar tool to track the upgrade. - - ::: - - The upgrade usually takes up to five minutes. Palette is upgraded when the deployments in the namespaces `cp-system`, - `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` are in the **Ready** status. +1. Open a terminal session and navigate to the directory where you downloaded the Palette install ZIP file provided by + our support. Unzip the file to a directory named `palette-install`. + + ```shell + unzip charts.zip -d palette-install + ``` + +2. Navigate to the `palette-install` directory. + + ```shell + cd palette-install + ``` + +3. Update the cert-manager chart using the following command. + + ```shell + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml + ``` + + ```shell hideClipboard title="Example output" + Release "cert-manager" has been upgraded. Happy Helming! + NAME: cert-manager + LAST DEPLOYED: Wed Jun 17 14:54:45 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 2 + TEST SUITE: None + ``` + +4. Upgrade the Spectro Management CRDs chart. + + ```shell + helm upgrade --install spectro-mgmt-crds \ + extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ + --values extras/spectro-mgmt-crds/values.yaml + ``` + + ```shell hideClipboard title="Example output" + Release "spectro-mgmt-crds" has been upgraded. Happy Helming! + NAME: spectro-mgmt-crds + LAST DEPLOYED: Wed Jun 17 14:55:28 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 2 + TEST SUITE: None + ``` + +5. Prepare the Palette configuration file `values.yaml`. If you saved your `values.yaml` used during the Palette + installation, you can refer to it when upgrading. Ensure you carry over any necessary configurations, such as root + domains, certificates, image-swap paths, and registries. Refer to + [Kubernetes Installation Instructions](../../install-palette/install-on-kubernetes/install.md) for basic + `values.yaml` guidance. For a full list of parameters, refer to + [Helm Configuration Reference](../../install-palette/install-on-kubernetes/palette-helm-ref.md). + +6. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, upgrade the image-swap chart + with the following command. Point to the `palette/values.yaml` file from step 5. + + ```shell + helm upgrade --values palette/values.yaml \ + image-swap extras/image-swap/image-swap-*.tgz --install + ``` + + ```shell hideClipboard title="Example output" + Release "image-swap" has been upgraded. Happy Helming! + NAME: image-swap + LAST DEPLOYED: Thu Feb 22 19:44:13 2024 + NAMESPACE: default + STATUS: deployed + REVISION: 2 + TEST SUITE: None + ``` + +7. _(Proxy environments only)_ If you are upgrading a Palette instance in an environment where a network proxy must be + configured for Palette to access the internet, upgrade the reach-system chart with the following command. Point to + the `palette/values.yaml` file from step 5. + + ```shell + helm upgrade --values palette/values.yaml \ + reach-system extras/reach-system/reach-system-*.tgz --install + ``` + + ```shell hideClipboard title="Example output" + Release "reach-system" has been upgraded. Happy Helming! + NAME: reach-system + LAST DEPLOYED: Thu Feb 22 19:47:10 2024 + NAMESPACE: default + STATUS: deployed + REVISION: 2 + TEST SUITE: None + ``` + +8. Upgrade Palette with the following command. + + ```shell + helm upgrade --values palette/values.yaml \ + hubble palette/spectro-mgmt-plane-*.tgz --install + ``` + + ```shell hideClipboard title="Example output" + Release "hubble" has been upgraded. Happy Helming! + NAME: hubble + LAST DEPLOYED: Wed Jun 17 15:44:47 2026 + NAMESPACE: default + STATUS: deployed + REVISION: 2 + TEST SUITE: None + ``` + +9. Use the following command to track the upgrade process. + + ```shell + kubectl get pods --all-namespaces --watch + ``` + + :::tip + + For a more user-friendly experience, consider using [K9s](https://k9scli.io/) or a similar tool to track the + upgrade. + + ::: + + The upgrade usually takes up to five minutes. Palette is upgraded when the deployments in the namespaces + `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` are in the **Ready** status. ## Validate @@ -216,7 +199,7 @@ match your environment. `App Version` column of `cert-manager`, `image-swap`, `reach-system`, and `hubble` to verify that they have the expected versions. - ```shell + ```shell hideClipboard title="Example output" NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION cert-manager default 2 2024-02-22 19:42:33.776829 +0100 CET deployed cert-manager-1.11.0 1.11.0 image-swap default 2 2024-02-22 19:44:13.209592 +0100 CET deployed image-swap-v1.5.2-spectro-4.1.1 1.5.2 @@ -234,7 +217,7 @@ match your environment. The command should return a list of deployments in the `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` namespaces. All deployments should have the status `Running`. - ```shell + ```shell hideClipboard title="Example output" cp-system spectro-cp-ui-689984f88d-54wsw Running hubble-system auth-85b748cbf4-6drkn Running hubble-system auth-85b748cbf4-dwhw2 Running diff --git a/docs/docs-content/release-notes/announcements.md b/docs/docs-content/release-notes/announcements.md index a681094ecc2..224f34f8363 100644 --- a/docs/docs-content/release-notes/announcements.md +++ b/docs/docs-content/release-notes/announcements.md @@ -24,9 +24,10 @@ Use the [Find Breaking Changes](breaking-changes.md) page to list all the breaki Stay informed about the upcoming breaking changes in Palette and Palette VerteX. Use the information below to prepare for the changes in your environment. -| Change | Target Date | Published Date | -| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | -------------- | -| [AWS GovCloud](../clusters/public-cloud/aws/add-aws-accounts.md#aws-govcloud) and [Azure Government cloud](../clusters/public-cloud/azure/azure-cloud.md#azure-government-cloud), currently disabled in the Palette UI, will be removed from the [Palette API](/api/category/palette-api-v1/), [Spectro Cloud Terraform provider](https://registry.terraform.io/providers/spectrocloud/spectrocloud/latest/docs), and [Spectro Cloud Crossplane provider](https://marketplace.upbound.io/providers/crossplane-contrib/provider-palette) in an upcoming release. To continue deploying and managing clusters using AWS GovCloud or Azure Government cloud, use [Palette VerteX](../vertex/vertex.md) instead. | _To be announced_ | May 3, 2026 | +| Change | Target Date | Published Date | +| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -------------- | +| Spectro Cloud is transitioning to the use of security-hardened images. As a result, retrieving images from Spectro Cloud OCI registries will now require a Spectro Cloud image pull secret. This secret is intended for long-term use and is configured once. Image pulls from Spectro Cloud registries will not be allowed unless a valid image pull secret is configured.

    This change primarily affects non-airgap environments that do not configure mirror registries or image swap; it does not apply to airgapped environments, which pull images from their own registries. To obtain your image pull secret, contact your Spectro Cloud customer support representative. Refer to [Configure Image Pull Secret](../enterprise-version/system-management/configure-image-pull-secret.md) for more information. | _To be announced_ | June 28, 2026 | +| [AWS GovCloud](../clusters/public-cloud/aws/add-aws-accounts.md#aws-govcloud) and [Azure Government cloud](../clusters/public-cloud/azure/azure-cloud.md#azure-government-cloud), currently disabled in the Palette UI, will be removed from the [Palette API](/api/category/palette-api-v1/), [Spectro Cloud Terraform provider](https://registry.terraform.io/providers/spectrocloud/spectrocloud/latest/docs), and [Spectro Cloud Crossplane provider](https://marketplace.upbound.io/providers/crossplane-contrib/provider-palette) in an upcoming release. To continue deploying and managing clusters using AWS GovCloud or Azure Government cloud, use [Palette VerteX](../vertex/vertex.md) instead. | _To be announced_ | May 3, 2026 | diff --git a/docs/docs-content/release-notes/release-notes.md b/docs/docs-content/release-notes/release-notes.md index 9ee1f64211f..9836bc44eef 100644 --- a/docs/docs-content/release-notes/release-notes.md +++ b/docs/docs-content/release-notes/release-notes.md @@ -23,6 +23,23 @@ tags: ["release-notes"] #### Features + + +- Spectro Cloud is transitioning to the use of security-hardened images. As a result, retrieving images from Spectro + Cloud OCI registries will require a Spectro Cloud image pull secret. This secret is intended for long-term use and is + configured once. + + This change primarily affects non-airgap environments that do not configure mirror registries or image swap; it does + not apply to airgapped environments, which pull images from their own registries. While configuring an image pull + secret is not required for the current version of Palette, it is an + [upcoming breaking change](./announcements.md#upcoming-breaking-changes) and will be mandated in a future release. We + recommend that affected environments configure an image pull secret as soon as possible to prevent service disruptions + later. + + To obtain your image pull secret, contact your customer support representative. Refer to + [Configure Image Pull Secret](../enterprise-version/system-management/configure-image-pull-secret.md) for more + information. + - Overriding Cluster API (CAPI) properties is now supported on [AWS diff --git a/docs/docs-content/tutorials/getting-started/palette-edge/central-management/palette-edge.md b/docs/docs-content/tutorials/getting-started/palette-edge/central-management/palette-edge.md index 621cb722085..6161a03689b 100644 --- a/docs/docs-content/tutorials/getting-started/palette-edge/central-management/palette-edge.md +++ b/docs/docs-content/tutorials/getting-started/palette-edge/central-management/palette-edge.md @@ -86,25 +86,25 @@ designed to guide you step-by-step, building on the concepts introduced in the p title: "Build Edge Artifacts", description: "Build the artifacts required for your Edge deployment.", buttonText: "Learn more", - url: "/tutorials/getting-started/palette-edge/entral-management/build-edge-artifacts", + url: "/tutorials/getting-started/palette-edge/central-management/build-edge-artifacts", }, { title: "Create Edge Cluster Profile", description: "Create an Edge native cluster profile to deploy Edge workloads.", buttonText: "Learn more", - url: "/tutorials/getting-started/palette-edge/entral-management/edge-cluster-profile", + url: "/tutorials/getting-started/palette-edge/central-management/edge-cluster-profile", }, { title: "Prepare Edge Host", description: "Install the Palette agent on your Edge host and register the host with Palette.", buttonText: "Learn more", - url: "/tutorials/getting-started/palette-edge/entral-management/prepare-edge-host", + url: "/tutorials/getting-started/palette-edge/central-management/prepare-edge-host", }, { title: "Deploy Edge Cluster", description: "Deploy an Edge cluster with Palette.", buttonText: "Learn more", - url: "/tutorials/getting-started/palette-edge/entral-management/deploy-edge-cluster", + url: "/tutorials/getting-started/palette-edge/central-management/deploy-edge-cluster", }, ]} /> diff --git a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/airgap-install/install.md b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/airgap-install/install.md index 9aa6242a868..a33f320f568 100644 --- a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/airgap-install/install.md +++ b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/airgap-install/install.md @@ -1,6 +1,6 @@ --- sidebar_label: "Install VerteX" -title: "Install VerteX" +title: "Install Airgap Self-Hosted Palette VerteX" description: "Learn how to deploy airgap VerteX to a Kubernetes cluster using a Helm Chart." icon: "" hide_table_of_contents: false @@ -9,899 +9,134 @@ tags: ["vertex", "enterprise"] keywords: ["self-hosted", "vertex"] --- -You can use the Palette VerteX Helm Chart to install VerteX in a multi-node Kubernetes cluster in your airgap production -environment. +You can use the Palette VerteX Helm chart to install Palette VerteX in a multi-node Kubernetes cluster in your +production environment. -This installation method is common in secure environments with restricted network access that prohibits using VerteX -SaaS. Review our [architecture diagrams](../../../../architecture/networking-ports.md) to ensure your Kubernetes cluster -has the necessary network connectivity for VerteX to operate successfully. - -:::warning - -Complete the [Environment Setup](./kubernetes-airgap-instructions.md) steps before proceeding with the installation. - -::: +This installation method is common in secure environments with restricted network access that prohibits using Palette +VerteX SaaS. Review our [architecture diagrams](../../../../architecture/networking-ports.md) to ensure your Kubernetes +cluster has the necessary network connectivity for Palette VerteX to operate successfully. ## Prerequisites -- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) is installed and available. - -- [Helm](https://helm.sh/docs/intro/install/) is installed and available. - -- Access to the target Kubernetes cluster's kubeconfig file. You must be able to interact with the cluster using - `kubectl` commands and have sufficient permissions to install VerteX. We recommend using a role with `cluster-admin` - permissions to install VerteX. - -- Ensure `unzip` or a similar extraction utility is installed on your system. - -- The Kubernetes cluster must be set up on a version of Kubernetes that is compatible to your upgraded version. Refer to - the [Kubernetes Requirements](../../install-palette-vertex.md#kubernetes-requirements) section to find the version - required for your Palette installation. - -- Ensure the Kubernetes cluster does not have Cert Manager installed. VerteX requires a unique Cert Manager - configuration to be installed as part of the installation process. If Cert Manager is already installed, you must - uninstall it before installing VerteX. - -- Palette requires a Container Storage Interface (CSI) to create Persistent Volumes, which are used to store persistent - data. You may install any CSI that is compatible with your Kubernetes cluster. - -- If you are using a _self-hosted MongoDB_ instance, such as MongoDB Atlas, ensure the MongoDB database has a user named - `hubble` with the permission `readWriteAnyDatabase`. Refer to the - [Add a Database User](https://www.mongodb.com/docs/guides/atlas/db-user/) guide for guidance on how to create a - database user in Atlas. - -- We recommended the following resources for VerteX. Refer to the - [VerteX size guidelines](../../../install-palette-vertex/install-palette-vertex.md#size-guidelines) for additional - sizing information. - - - 8 CPUs per node. - - - 16 GB Memory per node. - - - 110 GB Disk Space per node. - - - A minimum of three worker nodes or three untainted control plane nodes. - - - AMD64 (also known as x86_64) architecture. ARM-based nodes are not supported. - -- The following network ports must be accessible for VerteX to operate successfully. - - - TCP/443: Inbound and outbound to and from the VerteX management cluster. - - - TCP/6443: Outbound traffic from the VerteX management cluster to the deployed clusters' Kubernetes API server. - -- Ensure you have an SSL certificate that matches the domain name you will assign to VerteX. You will need this to - enable HTTPS encryption for VerteX. Reach out to your network administrator or security team to obtain the SSL - certificate. You need the following files: - - - x509 SSL certificate file in the base64 format. - - - x509 SSL certificate key file in the base64 format. - - - x509 SSL certificate authority file in the base64 format. - -- Ensure the OS and Kubernetes cluster you are installing VerteX onto is FIPS-compliant. Otherwise, VerteX and its - operations will not be FIPS-compliant. - -- A [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to manage persistent storage, with the - annotation `storageclass.kubernetes.io/is-default-class` set to `true`. To override the default StorageClass for a - workload, modify the `storageClass` parameter. Check out the - [Change the default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) - page to learn more about modifying StorageClasses. - -- Palette VerteX uses Traefik as the ingress controller. If you already have an ingress controller deployed in the - cluster, set the `ingress.enabled` parameter to `false` in the `values.yaml` file. - -- A custom domain and the ability to update Domain Name System (DNS) records. You will need this to enable HTTPS - encryption for VerteX. - -- If you are installing VerteX behind a network proxy server, ensure you have the Certificate Authority (CA) certificate - file in the base64 format. You will need this to enable VerteX to communicate with the network proxy server. - -- Access to the VerteX Helm Charts. Refer to the [Access VerteX](../../../vertex.md#access-palette-vertex) for - instructions on how to request access to the Helm Chart. - :::warning -Do not use a VerteX-managed Kubernetes cluster when installing VerteX. VerteX-managed clusters contain the VerteX agent -and VerteX-created Kubernetes resources that will interfere with the installation. - -::: - -## Install VerteX - -The following instructions are agnostic to the Kubernetes distribution you are using. Depending on the underlying -infrastructure provider and your Kubernetes distribution, you may need to modify the instructions to match your -environment. Reach out to our support team if you need assistance. - -1. Open a terminal session and navigate to the directory where you downloaded the VerteX installation zip file provided - by our support. Unzip the file to a directory named **vertex-install**. - - ```shell - unzip release-*.zip -d vertex-install - ``` - -2. Navigate to the release folder inside the **vertex-install** directory. - - ```shell - cd vertex-install/charts/release-* - ``` - -3. Open the file **extras/cert-manager/values.yaml** in a text editor and append the URL to your OCI registry, which - also includes the namespace or project that is hosting the Spectro Cloud images. The URL should be in the format - `/`. In the example configuration below, the value `my-oci-registry.com/spectro-images` is - prefixed to each URL. Save the file after you have appended the URL. - - ```yaml hideClipboard - image: - cainjectorImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" - ``` - -4. Install Cert Manager using the following command. Replace the actual file name of the Cert Manager Helm Chart with - the one you downloaded, as the version number may be different. - - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install - ``` - - ```shell hideClipboard - Release "cert-manager" does not exist. Installing it now. - NAME: cert-manager - LAST DEPLOYED: Mon Jan 29 16:32:33 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -5. Open the file **extras/image-swap/values.yaml** in a text editor and append the URL to your OCI registry that also - includes the namespace or project that is hosting the Spectro Cloud images. - - ```yaml hideClipboard - config: - imageSwapImages: - imageSwapInitImage: "my-oci-registry.com/spectro-images/gcr.io/spectro-images-public/release/thewebroot/imageswap-init:v1.5.3-spectro-4.5.1" - imageSwapImage: "my-oci-registry.com/spectro-images/gcr.io/spectro-images-public/release/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - ``` - -6. Update the `ociImageRegistry` section with the proper configuration values to your OCI registry. The - `ociImageRegistry` section should look similar to the following example. - - :::info - - Include `/v2` in your endpoints if you are using a - [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. - Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other - registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` - for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - - ::: - - ```yaml hideClipboard - ociImageRegistry: - endpoint: "my-oci-registry.com" - name: "Airgap Images OCI" - password: "" - username: "" - baseContentPath: "spectro-images" - insecureSkipVerify: true - caCert: "" - mirrorRegistries: "docker.io::my-oci-registry.com/spectro-images/docker.io,gcr.io::my-oci-registry.com/spectro-images/gcr.io,ghcr.io::my-oci-registry.com/spectro-images/ghcr.io,k8s.gcr.io::my-oci-registry.com/spectro-images/k8s.gcr.io,registry.k8s.io::my-oci-registry.com/spectro-images/registry.k8s.io,quay.io::my-oci-registry.com/spectro-images/quay.io,us-docker.pkg.dev::my-oci-registry.com/spectro-images/us-docker.pkg.dev" - ``` - -7. Go ahead and install the image-swap chart using the following command. Point to the **values.yaml** file you - configured in steps five through six. - - ```shell - helm upgrade --values extras/image-swap/values.yaml \ - image-swap extras/image-swap/image-swap-*.tgz --install - ``` - - ```shell hideClipboard - Release "image-swap" does not exist. Installing it now. - NAME: image-swap - LAST DEPLOYED: Mon Jan 29 17:04:23 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - :::tip - - If you need to override the image-swap registry configuration post-deployment, refer to the - [Override Registry Configuration](../../../system-management/registry-override.md) page for instructions. - - ::: - -8. Install the Spectro Management CRDs chart. This chart contains Custom Resource Definitions (CRDs) required by - VerteX, including Traefik CRDs, and must be installed before the main VerteX Helm Chart. - - ```shell - helm upgrade --install spectro-mgmt-crds extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz - ``` - - ```shell hideClipboard - Release "spectro-mgmt-crds" does not exist. Installing it now. - NAME: spectro-mgmt-crds - LAST DEPLOYED: Mon Jan 29 16:35:00 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -9. Open the **values.yaml** file in the **spectro-mgmt-plane** folder with a text editor of your choice. The - **values.yaml** file contains the default values for the VerteX installation parameters. However, you must populate - the following parameters before installing VerteX. You can learn more about the parameters on the **values.yaml** - file on the [Helm Configuration Reference](../vertex-helm-ref.md) page. - - Ensure you provide the proper `ociImageRegistry.mirrorRegistries` values if you are using a self-hosted OCI - registry. You can find the placeholder string in the `ociImageRegistry` section of the **values.yaml** file. - - | **Parameter** | **Description** | **Type** | - | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | - | `env.rootDomain` | The URL name or IP address you will use for the VerteX installation. | string | - | `config.installationMode` | The installation mode for VerteX. The values can be `connected` or `airgap`. Set this value to `airgap`. | string | - | `ociPackEcrRegistry` | The OCI registry credentials for the VerteX FIPS packs repository. | object | - | `ociImageRegistry` | The OCI registry credentials for the VerteX images repository. | object | - | `ociImageRegistry.mirrorRegistries` | A comma-separated list of mirror registries in [image swap format](https://github.com/phenixblue/imageswap-webhook/blob/master/docs/configuration.md) to use for pulling images. For example: `docker.io::harbor.example.org/airgap-images/docker.io,gcr.io::harbor.example.org/airgap-images/gcr.io`.

    **NOTE:** Include `/v2` in your endpoints if you are using a [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. | string | - | `imageSwapImages` | The image swap configuration for VerteX. If you are using an OCI registry, such as Harbor. Replace the prefix URLs with your OCI registry URL that includes the image namespace or project: `/`. | object | - | `imageSwapConfig.isEKSCluster` | If you are NOT installing VerteX on an EKS cluster, set this value to `false`. | boolean | - | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | - | `reach-system` | Set `reach-system.enabled` to `true` and configure the `reach-system.proxySettings` parameters for VerteX to use a network proxy in your environment. | object | - - :::info - - If you are installing VerteX by pulling required images from a private mirror registry, you will need to provide the - credentials to your registry in the **values.yaml** file. For more information, refer to - [Helm Configuration Reference](../vertex-helm-ref.md#image-pull-secret). - - ::: - - Save the **values.yaml** file after you have populated the required parameters mentioned in the table. - - :::warning - - VerteX VerteX does not support insecure connections. Ensure you have the Certificate Authority (CA) available, in - PEM format, when using a custom packs and image registry. Otherwise, VerteX will not be able to pull packs and - images from the registry. Use the `caCert` parameter to provide the base64-encoded CA certificate. - - ::: - - Select one of the following tabs to review an example of the **values.yaml** file with the required parameters - highlighted. - - - - - - - ```yaml {30,60,75-82,94-102,117-119} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "airgap" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: false - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "vertex.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackRegistry: - endpoint: "my-oci-registry.com" # - name: "Airgap Packs OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-packs" # - insecureSkipVerify: false - caCert: "" - - # ociPackEcrRegistry: - # endpoint: "" # - # name: "" # - # accessKey: "" # - # secretKey: "" # - # baseContentPath: "" # - # isPrivate: true - # insecureSkipVerify: false - # caCert: "" - - ociImageRegistry: - endpoint: "my-oci-registry.com" # - name: "Airgap Images OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-images" # - insecureSkipVerify: true - caCert: "" - mirrorRegistries: "docker.io::my-oci-registry.com/spectro-images/docker.io,gcr.io::my-oci-registry.com/spectro-images/gcr.io,ghcr.io::my-oci-registry.com/spectro-images/ghcr.io,k8s.gcr.io::my-oci-registry.com/spectro-images/k8s.gcr.io,registry.k8s.io::my-oci-registry.com/spectro-images/registry.k8s.io,quay.io::my-oci-registry.com/spectro-images/quay.io,us-docker.pkg.dev::my-oci-registry.com/spectro-images/us-docker.pkg.dev" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - imageSwapImage: "my-oci-registry.com/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt : LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - ```yaml {30,60,84-92,94-102,117-119} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "airgap" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: false - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "vertex.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - # ociPackRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackEcrRegistry: - endpoint: "123456789.dkr.ecr.us-east-1.amazonaws.com" # - name: "Airgap Packs OCI" # - accessKey: "**************" # - secretKey: "**************" # - baseContentPath: "production-fips" # - isPrivate: true - insecureSkipVerify: true - caCert: "" - - ociImageRegistry: - endpoint: "public.ecr.aws/123456789" # - name: "Airgap Images OCI" # - password: "" # - username: "" # - baseContentPath: "spectro-images" # - insecureSkipVerify: false - caCert: "" - mirrorRegistries: "docker.io::public.ecr.aws/123456789/spectro-images/docker.io,gcr.io::public.ecr.aws/123456789/spectro-images/gcr.io,ghcr.io::public.ecr.aws/123456789/spectro-images/ghcr.io,k8s.gcr.io::public.ecr.aws/123456789/spectro-images/k8s.gcr.io,registry.k8s.io::public.ecr.aws/123456789/spectro-images/registry.k8s.io,quay.io::public.ecr.aws/123456789/spectro-images/quay.io,us-docker.pkg.dev::public.ecr.aws/123456789/spectro-images/us-docker.pkg.dev" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "public.ecr.aws/123456789/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - imageSwapImage: "public.ecr.aws/123456789/us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt : LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - :::warning - - Ensure you configure the `values.yaml` file with the required parameters before proceeding. For the parameter - `ociImageRegistry.mirrorRegistries`, include `/v2` in your endpoints if you are using a - [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. - Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other - registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` - for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - - ::: - -10. This step is only required if you are installing VerteX in an environment where a network proxy must be configured - for VerteX to access the internet. If you are not using a network proxy, skip to the next step. - - Install the reach-system chart using the following command. Point to the **values.yaml** file you configured in - step 9. - - ```shell - helm upgrade --values vertex/values.yaml \ - reach-system extras/reach-system/reach-system-*.tgz --install - ``` - - ```shell hideClipboard - Release "reach-system" does not exist. Installing it now. - NAME: reach-system - LAST DEPLOYED: Mon Jan 29 17:04:23 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - -
    - How to update containerd to use proxy configurations - - If your Kubernetes cluster is behind a network proxy, ensure the containerd service is configured to use proxy - settings. You can do this by updating the containerd configuration file on each node in the cluster. The - configuration file is typically located at ` /etc/systemd/system/containerd.service.d/http-proxy.conf`. Below is an - example of the configuration file. Replace the values with your proxy settings. Ask your network administrator for - guidance. - - ``` - [Service] - Environment="HTTP_PROXY=http://example.com:9090" - Environment="HTTPS_PROXY=http://example.com:9090" - Environment="NO_PROXY=127.0.0.1,localhost,100.64.0.0/17,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,,.cluster.local" - ``` - -
    - -11. Install the VerteX Helm Chart using the following command. - - ```shell - helm upgrade --values vertex/values.yaml \ - hubble vertex/spectro-mgmt-plane-*.tgz --install - ``` - - ```shell hideClipboard - Release "hubble" does not exist. Installing it now. - NAME: hubble - LAST DEPLOYED: Mon Jan 29 17:07:51 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -12. Track the installation process using the command below. VerteX is ready when the deployments in the namespaces - `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` reach the _Ready_ state. The - installation takes between two to three minutes to complete. - - - - ```shell - kubectl get pods --all-namespaces --watch - ``` - - :::tip - - For a more user-friendly experience, use the open source tool [k9s](https://k9scli.io/) to monitor the installation - process. - - ::: +- Complete the [Environment Setup](./kubernetes-airgap-instructions.md) steps before proceeding with the installation. -13. Create a DNS CNAME record that is mapped to the VerteX `traefik-ingress-controller` load balancer. You can use the - following command to retrieve the load balancer IP address. You may require the assistance of your network - administrator to create the DNS record. +- Do not use a VerteX-managed Kubernetes cluster when installing VerteX. VerteX-managed clusters contain the VerteX + agent and VerteX-created Kubernetes resources that will interfere with the installation of VerteX. - ```shell - kubectl get service traefik-ingress-controller --namespace ingress-traefik \ - --output jsonpath='{.status.loadBalancer.ingress[0].hostname}' - ``` - - :::warning - - If Palette VerteX has only one tenant and you use local accounts with Single Sign-On (SSO) disabled, you can access - Palette VerteX using the IP address or any domain name that resolves to that IP. However, once you enable SSO, users - must log in using the tenant-specific subdomain. For example, if you create a tenant named `tenant1` and the domain - name you assigned to Palette VerteX is `vertex.example.com`, the tenant URL will be `tenant1.vertex.example.com`. We - recommend you create an additional wildcard DNS record to map all tenant URLs to the Palette VerteX load balancer. - For example, `*.vertex.example.com`. - - ::: - -14. Use the custom domain name or the IP address of the load balancer to visit the VerteX system console. To access the - system console, open a web browser, paste the custom domain URL in the address bar, and append the value `/system`. - - The first time you visit the VerteX system console, a warning message about a not-trusted SSL certificate may - appear. This is expected, as you have not yet uploaded your SSL certificate to VerteX. You can ignore this warning - message and proceed. - - ![Screenshot of the VerteX system console showing Username and Password fields.](/vertex_install-on-kubernetes_install_system-console.webp) - -15. Log in to the system console using the following default credentials. Refer to the - [password requirements](../../../system-management/account-management/credentials.md#password-requirements-and-security) - documentation page to learn more about password requirements. - - | **Parameter** | **Value** | - | ------------- | --------- | - | Username | `admin` | - | Password | `admin` | - - After login, you will be prompted to create a new password. Enter a new password and save your changes. You will be - redirected to the VerteX system console. Use the username `admin` and your new password to log in to the system - console. You can create additional system administrator accounts and assign roles to users in the system console. - Refer to the [Account Management](../../../system-management/account-management/account-management.md) documentation - page for more information. - -16. After login, a summary page is displayed. VerteX is installed with a self-signed SSL certificate. To assign a - different SSL certificate, you must upload the SSL certificate, SSL certificate key, and SSL certificate authority - files to VerteX. You can upload the files using the VerteX system console. Refer to the - [Configure HTTPS Encryption](../../../system-management/ssl-certificate-management.md) page for instructions on how - to upload the SSL certificate files to Palette. - - :::warning - - If you plan to deploy host clusters into different networks, you may require a reverse proxy. Check out the - [Configure Reverse Proxy](../../../system-management/reverse-proxy.md) guide for instructions on how to configure a - reverse proxy for VerteX. - - ::: +::: -You now have a self-hosted instance of VerteX installed in a Kubernetes cluster. Make sure you retain the -**values.yaml** file, as you may need it for future upgrades. +### Kubernetes Cluster + + + +- _(FIPS compliance only)_ The OS and Kubernetes cluster you are installing Palette VerteX onto must be FIPS-compliant. + Otherwise, Palette VerteX and its operations will not be FIPS-compliant. + +### Local Environment + + + +### Other Prerequisites + + + +## Install Palette VerteX + + + +### Cert-Manager Helm Chart + +3. + +### Spectro Management CRDs Helm Chart + +7. + +### VerteX Helm Chart + +8. + +### Image Swap Helm Chart + +11. + +### Reach System Helm Chart + +12. + +### Installation + +13. ## Validate -Use the following steps to validate the VerteX installation. - -1. Open up a web browser and navigate to the VerteX system console. To access the system console, open a web browser, - paste the `env.rootDomain` value you provided in the address bar, and append the value `/system` in the following - format: `/system`. You can also use the IP address of the load balancer. - -2. Log in using the credentials you received from our support team. After login, you will be prompted to create a new - password. Enter a new password and save your changes. You will be redirected to the VerteX system console. - -3. Open a terminal session and issue the following command to verify the VerteX installation. The command should return - a list of deployments in the `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` - namespaces. - - ```shell - kubectl get pods --all-namespaces --output custom-columns="NAMESPACE:metadata.namespace,NAME:metadata.name,STATUS:status.phase" \ - | grep --extended-regexp '^(cp-system|hubble-system|ingress-traefik|jet-system|ui-system)\s' - ``` - - Your output should look similar to the following. - - ```shell hideClipboard - cp-system spectro-cp-ui-689984f88d-54wsw Running - hubble-system auth-85b748cbf4-6drkn Running - hubble-system auth-85b748cbf4-dwhw2 Running - hubble-system cloud-fb74b8558-lqjq5 Running - hubble-system cloud-fb74b8558-zkfp5 Running - hubble-system configserver-685fcc5b6d-t8f8h Running - hubble-system event-68568f54c7-jzx5t Running - hubble-system event-68568f54c7-w9rnh Running - hubble-system foreq-6b689f54fb-vxjts Running - hubble-system hashboard-897bc9884-pxpvn Running - hubble-system hashboard-897bc9884-rmn69 Running - hubble-system hutil-6d7c478c96-td8q4 Running - hubble-system hutil-6d7c478c96-zjhk4 Running - hubble-system mgmt-85dbf6bf9c-jbggc Running - hubble-system mongo-0 Running - hubble-system mongo-1 Running - hubble-system mongo-2 Running - hubble-system msgbroker-6c9b9fbf8b-mcsn5 Running - hubble-system oci-proxy-7789cf9bd8-qcjkl Running - hubble-system packsync-28205220-bmzcg Succeeded - hubble-system spectrocluster-6c57f5775d-dcm2q Running - hubble-system spectrocluster-6c57f5775d-gmdt2 Running - hubble-system spectrocluster-6c57f5775d-sxks5 Running - hubble-system system-686d77b947-8949z Running - hubble-system system-686d77b947-cgzx6 Running - hubble-system timeseries-7865bc9c56-5q87l Running - hubble-system timeseries-7865bc9c56-scncb Running - hubble-system timeseries-7865bc9c56-sxmgb Running - hubble-system user-5c9f6c6f4b-9dgqz Running - hubble-system user-5c9f6c6f4b-hxkj6 Running - ingress-traefik traefik-ingress-controller-9dmzq Running - ingress-traefik traefik-ingress-controller-tpwtf Running - ingress-traefik traefik-ingress-controller-xz4jf Running - jet-system jet-6599b9856d-t9mr4 Running - ui-system spectro-ui-76ffdf67fb-rkgx8 Running - ``` + ## Next Steps diff --git a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/install.md b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/install.md index 4551f48fffb..60d76a98051 100644 --- a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/install.md +++ b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/install.md @@ -9,96 +9,15 @@ tags: ["vertex", "enterprise"] keywords: ["self-hosted", "vertex"] --- -You can use the Palette VerteX Helm Chart to install VerteX in a multi-node Kubernetes cluster in your production -environment. +You can use the Palette VerteX Helm chart to install Palette VerteX in a multi-node Kubernetes cluster in your +production environment. -This installation method is common in secure environments with restricted network access that prohibits using VerteX -SaaS. Review our [architecture diagrams](../../../architecture/networking-ports.md) to ensure your Kubernetes cluster -has the necessary network connectivity for VerteX to operate successfully. +This installation method is common in secure environments with restricted network access that prohibits using Palette +VerteX SaaS. Review our [architecture diagrams](../../../architecture/networking-ports.md) to ensure your Kubernetes +cluster has the necessary network connectivity for Palette VerteX to operate successfully. ## Prerequisites -- [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl) is installed and available. - -- [Helm](https://helm.sh/docs/intro/install/) is installed and available. - -- Access to the target Kubernetes cluster's kubeconfig file. You must be able to interact with the cluster using - `kubectl` commands and have sufficient permissions to install VerteX. We recommend using a role with cluster-admin - permissions to install VerteX. - -- Ensure `unzip` or a similar extraction utility is installed on your system. - -- The Kubernetes cluster must be set up on a version of Kubernetes that is compatible to your upgraded version. Refer to - the [Kubernetes Requirements](../install-palette-vertex.md#kubernetes-requirements) section to find the version - required for your Palette installation. - -- Ensure the Kubernetes cluster does not have Cert Manager installed. VerteX requires a unique Cert Manager - configuration to be installed as part of the installation process. If Cert Manager is already installed, you must - uninstall it before installing VerteX. - -- Palette requires a Container Storage Interface (CSI) to create Persistent Volumes, which are used to store persistent - data. You may install any CSI that is compatible with your Kubernetes cluster. - -- If you are using a _self-hosted MongoDB_ instance, such as MongoDB Atlas, ensure the MongoDB database has a user named - `hubble` with the permission `readWriteAnyDatabase`. Refer to the - [Add a Database User](https://www.mongodb.com/docs/guides/atlas/db-user/) guide for guidance on how to create a - database user in Atlas. - -- We recommend the following resources for VerteX. Refer to the - [VerteX size guidelines](../install-palette-vertex.md#size-guidelines) for additional sizing information. - - - 8 CPUs per node. - - - 16 GB Memory per node. - - - 110 GB Disk Space per node. - - - A minimum of three worker nodes or three untainted control plane nodes. - - - AMD64 (also known as x86_64) architecture. ARM-based nodes are not supported. - -- The following network ports must be accessible for VerteX to operate successfully. - - - TCP/443: Inbound and outbound to and from the VerteX management cluster. - - - TCP/6443: Outbound traffic from the VerteX management cluster to the deployed clusters' Kubernetes API server. - -- Ensure you have an SSL certificate that matches the domain name you will assign to VerteX. You will need this to - enable HTTPS encryption for VerteX. Reach out to your network administrator or security team to obtain the SSL - certificate. You need the following files: - - - x509 SSL certificate file in base64 format. - - - x509 SSL certificate key file in base64 format. - - - x509 SSL certificate authority file in base64 format. - -- Ensure the OS and Kubernetes cluster you are installing VerteX onto is FIPS-compliant. Otherwise, VerteX and its - operations will not be FIPS-compliant. - -- A [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/) to manage persistent storage, with the - annotation `storageclass.kubernetes.io/is-default-class` set to `true`. To override the default StorageClass for a - workload, modify the `storageClass` parameter. Check out the - [Change the default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) - page to learn more about modifying StorageClasses. - -- Palette VerteX uses Traefik as the ingress controller. If you already have an ingress controller deployed in the - cluster, set the `ingress.enabled` parameter to `false` in the `values.yaml` file. - -- A custom domain and the ability to update Domain Name System (DNS) records. You will need this to enable HTTPS - encryption for VerteX. - -- Ensure VerteX has access to the required domains and ports. Refer to the - [Required Domains](../install-palette-vertex.md#proxy-requirements) section for more information. - -- If you are installing VerteX behind a network proxy server, ensure you have the Certificate Authority (CA) certificate - file in the base64 format. You will need this to enable VerteX to communicate with the network proxy server. - -- Access to the VerteX Helm Charts. Refer to the [Access VerteX](../../vertex.md#access-palette-vertex) for instructions - on how to request access to the Helm Chart. - -
    - :::warning Do not use a VerteX-managed Kubernetes cluster when installing VerteX. VerteX-managed clusters contain the VerteX agent @@ -106,715 +25,123 @@ and VerteX-created Kubernetes resources that will interfere with the installatio ::: -## Install VerteX - -The following instructions are written agnostic to the Kubernetes distribution you are using. Depending on the -underlying infrastructure provider and your Kubernetes distribution, you may need to modify the instructions to match -your environment. Reach out to our support team if you need assistance. - -1. Open a terminal session and navigate to the directory where you downloaded the Palette install zip file provided by - our support. Unzip the file to a directory named **vertex-install**. - - ```shell - unzip release-*.zip -d vertex-install - ``` - -2. Navigate to the release folder inside the **vertex-install** directory. - - ```shell - cd vertex-install/charts/release-* - ``` - -3. Install Cert Manager using the following command. Replace the actual file name of the Cert Manager Helm Chart with - the one you downloaded, as the version number may be different. - - ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install - ``` - - ```shell hideClipboard - Release "cert-manager" does not exist. Installing it now. - NAME: cert-manager - LAST DEPLOYED: Mon Jan 29 16:32:33 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -4. Install the Spectro Management CRDs chart. This chart contains Custom Resource Definitions (CRDs) required by - Palette VerteX, including Traefik CRDs, and must be installed before the main Palette VerteX Helm chart. When the - chart is installed, the custom resource types are registered with the Kubernetes API server; no pods are deployed. - - ```shell - helm upgrade --install spectro-mgmt-crds \ - extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ - --values extras/spectro-mgmt-crds/values.yaml - ``` - - ```shell hideClipboard title="Example output" - Release "spectro-mgmt-crds" does not exist. Installing it now. - NAME: spectro-mgmt-crds - LAST DEPLOYED: Mon Jan 29 16:35:00 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -5. Open the **values.yaml** in the **spectro-mgmt-plane** folder with a text editor of your choice. The **values.yaml** - contains the default values for the VerteX installation parameters. However, you must populate the following - parameters before installing VerteX. You can learn more about the parameters in the **values.yaml** file in the - [Helm Configuration Reference](vertex-helm-ref.md) page. - - | **Parameter** | **Description** | **Type** | - | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | - | `env.rootDomain` | The URL name or IP address you will use for the VerteX installation. | string | - | `ociPackRegistry` or `ociPackEcrRegistry` | The OCI registry credentials for VerteX FIPS packs. These credentials are provided by our support team. | object | - | `ingress.enabled` | Whether to install the Traefik ingress controller. Set to `false` if you already have an ingress controller deployed in the cluster. | boolean | - | `reach-system` | Set `reach-system.enabled` to `true` and configure the `reach-system.proxySettings` parameters to configure VerteX to use a network proxy in your environment | object | - - :::info - - If you are installing VerteX by pulling required images from a private mirror registry, you will need to provide the - credentials to your registry in the **values.yaml** file. For more information, refer to - [Helm Configuration Reference](vertex-helm-ref.md#image-pull-secret). - - ::: - - Save the **values.yaml** file after you have populated the required parameters mentioned in the table. - - Select one of the following tabs to review an example of the **values.yaml** file with the required parameters - highlighted. - - - - - - - ```yaml {60,84-92} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "connected" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: false - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "vertex.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - # ociPackRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackEcrRegistry: - endpoint: "15789037893.dkr.ecr.us-east-1.amazonaws.com" # - name: "VerteX Packs OCI" # - accessKey: "**************" # - secretKey: "**************" # - baseContentPath: "production-fips" # - isPrivate: true - insecureSkipVerify: false - caCert: "" - - # ociImageRegistry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # baseContentPath: "" # - # insecureSkipVerify: false - # caCert: "" - # mirrorRegistries: "" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap-init:v1.5.3-spectro-4.5.1" - imageSwapImage: "us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - ```yaml {60,75-82,94-102} - ######################### - # Spectro Cloud Palette # - ######################### - - global: - imagePullSecret: - create: false - # Provide your own base64 encoded dockerconfigjson value below if using ImagePullSecret for Private registry Authentication - dockerConfigJson: "" - - # MongoDB Configuration - mongo: - # Whether to deploy MongoDB in-cluster (internal == true) or use Mongo Atlas - internal: true - - # Mongodb URL. Only change if using Mongo Atlas. - databaseUrl: "mongo-0.mongo.hubble-system.svc.cluster.local,mongo-1.mongo.hubble-system.svc.cluster.local,mongo-2.mongo.hubble-system.svc.cluster.local" - # Mongo Atlas password, base64 encoded. Only enter if using Mongo Atlas. - databasePassword: "" - - #No. of mongo replicas to run, default is 3 - replicas: 3 - # The following only apply if mongo.internal == true - cpuLimit: "2000m" - memoryLimit: "4Gi" - pvcSize: "20Gi" - storageClass: "" # leave empty to use the default storage class - - config: - installationMode: "connected" #values can be connected or airgap. - - # SSO SAML Configuration (Optional for self-hosted type) - sso: - saml: - enabled: false - acsUrlRoot: "myfirstpalette.spectrocloud.com" - acsUrlScheme: "https" - audienceUrl: "https://www.spectrocloud.com" - entityId: "https://www.spectrocloud.com" - apiVersion: "v1" - - # Email Configurations. (Optional for self-hosted type) - email: - enabled: false - emailId: "noreply@spectrocloud.com" - smtpServer: "smtp.gmail.com" - smtpPort: 587 - insecureSkipVerifyTls: false - fromEmailId: "noreply@spectrocloud.com" - password: "" # base64 encoded SMTP password - - env: - # rootDomain is a DNS record which will be mapped to the traefik-ingress-controller load balancer - # E.g., myfirstpalette.spectrocloud.com - # - Mandatory if ingress.internal == false - # - Optional if ingress.internal == true (leave empty) - # - # IMPORTANT: a DNS record must be created separately and it must be a wildcard to account for Organization prefixes - # E.g., *.myfirstpalette.spectrocloud.com - rootDomain: "vertex.example.com" - - # stableEndpointAccess is used when deploying EKS clusters in Private network type. - # When your Saas installed instance have connectivity to the private VPC where you want to launch the cluster set the stableEndpointAccess to true - cluster: - stableEndpointAccess: false - - # registry: - # endpoint: "" # - # name: "" # - # password: "" # - # username: "" # - # insecureSkipVerify: false - # caCert: "" - - ociPackRegistry: - endpoint: "example.harbor.org" # - name: "VerteX Packs OCI" # - password: "**************" # - username: "**************" # - baseContentPath: "spectro-packs" # - insecureSkipVerify: false - caCert: "" - - # ociPackEcrRegistry: - # endpoint: "" # - # name: "" # - # accessKey: "" # - # secretKey: "" # - # baseContentPath: "" # - # isPrivate: true - # insecureSkipVerify: false - # caCert: "" - - ociImageRegistry: - endpoint: "example.harbor.org" # - name: "VerteX Images OCI" # - password: "**************" # - username: "**************" # - baseContentPath: "spectro-images" # - insecureSkipVerify: false - caCert: "" - mirrorRegistries: "" # See instructions below. - - # Instruction for mirrorRegistries. - # ---------------------------------- - # Please provide the registry endpoint for the following registries, separated by double colons (::): - # docker.io - # gcr.io - # ghcr.io - # k8s.gcr.io - # registry.k8s.io - # quay.io - # For each registry, follow this example format: - # docker.io::/v2/,gcr.io::/v2/,ghcr.io::/v2/,k8s.gcr.io::/v2/,registry.k8s.io::/v2/,quay.io::/v2/,us-docker.pkg.dev::/v2/ - # Replace with your actual registry endpoint and , , , , , and with the specific endpoint details for each registry. - - imageSwapImages: - imageSwapInitImage: "us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap-init:v1.5.3-spectro-4.5.1" - imageSwapImage: "us-docker.pkg.dev/palette-images-fips/palette/thewebroot/imageswap:v1.5.3-spectro-4.5.1" - - imageSwapConfig: - isEKSCluster: true #If the Cluster you are trying to install is EKS cluster set value to true else set to false - - grpc: - external: false - endpoint: "" #Please provide DNS endpoint with the port eg: msg.spectrocloud.com:443 - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the GRPC load balancer service. If empty, a dynamic IP will be generated. - grpcStaticIP: "" - caCertificateBase64: "" #Please provide caCertificate for the grpc server Cert - serverCrtBase64: "" - serverKeyBase64: "" - insecureSkipVerify: false - - ingress: - # When enabled, the Traefik ingress controller is installed. - enabled: true - - ingress: - # Default SSL certificate and key for the ingress controller (Optional) - # A wildcard cert for config.env.rootDomain, e.g., *.myfirstpalette.spectrocloud.com - # If left blank, a self-signed cert is generated. - certificate: "" - key: "" - - #If ACM is enabled please use grpc as a non internal and bring grpc on different LB. Provide certificate and dns for it. - annotations: {} - # AWS example - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - # service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp - # service.beta.kubernetes.io/aws-load-balancer-ssl-cert: - # service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https" - - # Azure example - # service.beta.kubernetes.io/azure-load-balancer-internal: "true" - # service.beta.kubernetes.io/azure-dns-label-name: myserviceuniquelabel - - # Static IP for the Ingress load balancer service. If empty, a dynamic IP will be generated. - ingressStaticIP: "" - - # For Service like AWS Load Balancer using https we would want to terminate the HTTPS at Load Balancer. - terminateHTTPSAtLoadBalancer: false - - frps: - frps: - enabled: false - frpHostURL: proxy.sample.spectrocloud.com - server: - crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURqekNDQW5lZ0F3SUJBZ0lVZTVMdXBBZGljd0Z1SFJpWWMyWEgzNTFEUzJJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk1qY3hNREV6TVRNeU5ERXlXakI3TVFzd0NRWURWUVFHRXdKVlV6RUxNQWtHCkExVUVDQk1DUTBFeEV6QVJCZ05WQkFjVENsTmhiblJoUTJ4aGNtRXhGVEFUQmdOVkJBb1RERk53WldOMGNtOUQKYkc5MVpERUxNQWtHQTFVRUN4TUNTVlF4SmpBa0JnTlZCQU1USFhCeWIzaDVMbk5oYlhCc1pTNXpjR1ZqZEhKdgpZMnh2ZFdRdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXd5bEt3MmlxClBXM2JrQU0wV3RhaEFLbEppcWFHd05LUDVRRTZ6ZW5NM2FURko3TjIwN0dWcUNGYzJHTDNodmNhTDFranZjeEkKK2lybHpkbm9hcVhUSmV3ZkJiTGs2SGVhZmdXUVp3NHNNeE5QRUVYYlNXYm54Mm03Y2FlbVJiUWZSQWhPWXRvWgpIWG1IMzQ1Q25mNjF0RnhMeEEzb0JRNm1yb0JMVXNOOUh2WWFzeGE5QUFmZUNNZm5sYWVBWE9CVmROalJTN1VzCkN5NmlSRXpEWFgvem1nOG5WWFUwemlrcXdoS3pqSlBJd2FQa2ViaXVSdUJYdEZ0VlQwQmFzS3VqbURzd0lsRFQKVmR4SHRRQUVyUmM4Q2Nhb20yUkpZbTd1aHNEYlo2WVFzS3JiMmhIbU5rNENVWUd5eUJPZnBwbzR2bFd1S2FEcgpsVFNYUXlPN0M0ejM1d0lEQVFBQm8xNHdYREJhQmdOVkhSRUVVekJSZ2dsc2IyTmhiR2h2YzNTSEJIOEFBQUdDCkhYQnliM2g1TG5OaGJYQnNaUzV6Y0dWamRISnZZMnh2ZFdRdVkyOXRnaDhxTG5CeWIzaDVMbk5oYlhCc1pTNXoKY0dWamRISnZZMnh2ZFdRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUEvRFJFVm54SWJRdi9uMDEvSQpJd1d0ekhKNGNHOUp6UlB6dmszNUcvRGJOVzZYZ0M3djBoWlFIVHg5bzMrckxoSUFiWTNmbjc1VEtlN3hMRWpiCkI3M3pGWURJSStkYzM5NkQzZU51M2NxRGIvY01kYmlFalhod2ttZk9NRm9qMnpOdHJIdzFsSjA0QlNFMWw1YWgKMDk0Vy9aaEQ2YTVLU3B0cDh1YUpKVmNrejRYMEdRWjVPYjZadGdxZVVxNytqWVZOZ0tLQzJCMW1SNjMyMDNsZwozVFZmZEkrdmI3b292dVdOOFRBVG9qdXNuS25WMmRMeTFBOWViWXYwMEM3WWZ6Q0NhODgrN2dzTGhJaUJjRHBPClJkWjU3QStKanJmSU5IYy9vNm5YWFhDZ2h2YkFwUVk1QnFnMWIzYUpUZERNWThUY0hoQVVaQzB5eU04bXcwMnQKWHRRQwotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBd3lsS3cyaXFQVzNia0FNMFd0YWhBS2xKaXFhR3dOS1A1UUU2emVuTTNhVEZKN04yCjA3R1ZxQ0ZjMkdMM2h2Y2FMMWtqdmN4SStpcmx6ZG5vYXFYVEpld2ZCYkxrNkhlYWZnV1FadzRzTXhOUEVFWGIKU1dibngybTdjYWVtUmJRZlJBaE9ZdG9aSFhtSDM0NUNuZjYxdEZ4THhBM29CUTZtcm9CTFVzTjlIdllhc3hhOQpBQWZlQ01mbmxhZUFYT0JWZE5qUlM3VXNDeTZpUkV6RFhYL3ptZzhuVlhVMHppa3F3aEt6akpQSXdhUGtlYml1ClJ1Qlh0RnRWVDBCYXNLdWptRHN3SWxEVFZkeEh0UUFFclJjOENjYW9tMlJKWW03dWhzRGJaNllRc0tyYjJoSG0KTms0Q1VZR3l5Qk9mcHBvNHZsV3VLYURybFRTWFF5TzdDNHozNXdJREFRQUJBb0lCQUFPVVZFeTFOTG9mczdFMgpmZFZVcm10R3I1U2RiVWRJRlYrTDREbzZtWWxQSmxhT0VoWGI0ZlROZDloNEtEWVBmaWwwSnhXcUU0U1RHTmZuCnNUMlRnUVhuQ01LZi8xYk1Lc2M0N3VjVStYYU9XaHJnVFI5UmhkckFjN0duODRLL3hQc0ljL2VZTEhHLzh1QUUKeWUvLzVmRkM2QmpXY0hUM1NkTlZnd3duamJudG5XTXIzTFJBVnJBamZBckxveWUwS0F2YytYdXJLTEVCcmMyVQpjaHlDbitZemJKN0VlSG44UXdQNGdBNXVSK0NCMFJPeFErYXIzS3M5YUhkZTQ1OEVNNEtLMnpUOXA4RWZRc1lFCkFtNUpxWjliR0JEVHV1dEkyNm9GK0pLQ1IzZzhXNERRcHVYRUZoVjlya0pMSm13RDhQb0JaclF6UzZvdmJhdkkKRk42QVM4RUNnWUVBOEcxQzFxZVh4dTQ4aEYxak5MTCswRmxkeWdFem9SMmFoRGJCai8weUZkQVVjU2pYTzk0NAozN1dORTBUUG10WG1Vc3NZTlBTR21XaWI2OUhicEFoMTY3SWVwNE9LaVlZdkozYm1oUC9WNzFvK3M0SWJlSHh1CkVJbWVVckFOZWRoQURVQnZ4c1lXRWxlVlVJSFFRcjY1VHM2ZjIrWkpTKzg4TU05bUorL3BmcmNDZ1lFQXo4MXgKR3JiSE5oak56RjhZMjhiK0hMNW5rdDR0SUdkU3hnbW9PMFFJeGkrQVNZTzB0WW42VFk0ZHI5ZXErMzE3b21ZawpMbDNtNENORDhudG1vYzRvWnM4SUpDQ0IrZjNqcTY4OHdoQU9vVHZ4dDhjZVJqOFRhRHl1SHZwS043OVNsVVd2CjBJd2ZRNDNIemd3SWJiSWhjcTRJVGswanI0VHdWbThia283VElGRUNnWUJoNnUzVXhHN0JHeGZVaE1BNW4waSsKREJkeGhPbkZEV3gzdW1FOHhrN1dxV2NaNnhzMWk3eTRCNVhNS2pNdkNUeURyYWxQTCtOOXFTZ1BjK216TmFybwo4aU1mOENmRStMeE5vMVFoQ0p6Vm5YaDUzVnhZeHJ5QXlidU1TNTFCYVh3MHFYQ2NrT0krV0NNOHBaSHZEUVFsCmYydUZ3SlZMY3NTZDBHbjNpL01ab3dLQmdBY1BzUjg2Uk15MnpROTd6OGx3R3FSNVorV2F2U2ZUdXdGVnhLeTIKNUNGdjdja1J1NnRMbEFEY3FtK1dRWTRvTm5KUFREMXpIV3hTWm5XdjhjM2Z4b212MFZRQThzbSs4ZVNjb05EcgpZTVBqMkpQcEpVTTMwMzRBU2Q1dG5PWUdEMVZaTjk4N1U3aWs4Ynd6dG5tYnl2MHRvc1NlWkc4TGNtdE5mVDllCnNSZnhBb0dCQUpTV1lDellyTlRMNnRUSnh5M2FqWm5jZkxrMEV0eWNCd05FRXZHVzVSVE9LOUFYTE96RzN0eHUKajZqWlRpaUFRU09aaVd0clJHU0U0bEkyQ1MvcjNjd3VuSGlnZlovd1dKZldkZ0JpRnZqOTVFbUVQWUZaRDRobQpkT3l5UHhRRXFTRmprQ21BS2plOFBpTDdpU01GbGhBZTZQWFljQlExdCtzd01UeXBnY3RrCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ca: - crt : LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURNVENDQWhtZ0F3SUJBZ0lVSHhWK0ljVGZHUElzdW8yY3dqQ0Q0Z2RSTFFRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0tERW1NQ1FHQTFVRUF3d2RjSEp2ZUhrdWMyRnRjR3hsTG5Od1pXTjBjbTlqYkc5MVpDNWpiMjB3SGhjTgpNakl4TURFME1UTXlOREV5V2hjTk16WXdOakl5TVRNeU5ERXlXakFvTVNZd0pBWURWUVFEREIxd2NtOTRlUzV6CllXMXdiR1V1YzNCbFkzUnliMk5zYjNWa0xtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0MKQVFvQ2dnRUJBSy90WXBHVi9HRURUWnZzL25QQ2lOK0U3K1dOQ21GeU1NQjdkazVOT3JzQWZIaVVvZ1JRVUo0WQptSjhwVmYrSzhTRFBsdGNYcW40WVVTbmxiUERsVlBkWU5zOTEwT3RaS1EwNW96aUtGV2pNbS85NHlLSjVyVzNsCndDNEN0ayttUm9Ib0ZQQS81dmFVbVZHdlVadjlGY0JuL0pKN2F4WnRIQk1PRiticXQ0Zmd0ci9YMWdOeWhPVzUKZTVScGpESkozRjJTVnc5NUpBQSt4a3V3UitFSmVseEtnQVpxdDc0ejB4U2ROODZ0QzNtK0wxRGs2WVVlQWEzZApvM3Rsa3ZkeDV6dUJvSmI2QmpZWEV4UE1PbThRcHFNVWRLK3lDZUdrem9XQStDOUtFdGtVaERCWktENStNWXRZCktVMUh1RXJCbmw2Z3BuWTRlbzJjVTRxdkNwZzZ4S3NDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRklKMkRkTjgKc2ZtVjRCT1ZFL0FjZ0VEejArNmlNQjhHQTFVZEl3UVlNQmFBRklKMkRkTjhzZm1WNEJPVkUvQWNnRUR6MCs2aQpNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQWhQVi9RMVl1YWVTOTZVCmhjVGQ4RWdJaHhpbHFiTWlTQm5WaVdrdlJzWk94UUIwNTFScWtwT3g0UTRsckdaOGVJWWc3T0trTTdzejhuTVQKL2pxS21sZDY0MzJCcURCMlNkNVp5ZFdReHAwU1laRTlnVWszYk9KRGtZVXQ4b1cvZDBWeG9uU05LQVN3QmZKaApWV1VZUUlpNm55K0ZZZmtuRFNvRnFlY2Z3SDBQQVUraXpnMkI3KzFkbko5YisyQ21IOUVCallOZ2hoNlFzVlFQCkh2SkdQQURtandPNkJOam5HK0Z3K0Z6cmFXUTNCTjAwb08zUjF6UmgxZERmTTQzR3oxRmZGRW5GSXI5aGFuUnQKWHJFZm8vZWU5bjBLWUFESEJnV1g4dlhuNHZrRmdWRjgwYW9MUUJSQTBxWXErcW1pVlp6YnREeE9ldFEyRWFyTQpyNmVWL0lZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - service: - annotations: {} - - ui-system: - enabled: true - ui: - nocUI: - enable: true - mapBoxAccessToken: "" # Leave Empty to use Default Access Token from Palette - mapBoxStyledLayerID: "" # Leave Empty to use Default Style Layer ID - - reachSystem: - enabled: false - proxySettings: - http_proxy: "" - https_proxy: "" - no_proxy: "" - ca_crt_path: "" # Set the 'ca_crt_path' parameter to the location of the certificate file on each node. This file should contain the Proxy CA Certificate, in case the Proxy being used requires a certificate. - scheduleOnControlPlane: true - ``` - - - - - - :::warning - - Ensure you have configured the **values.yaml** file with the required parameters before proceeding to the next - steps. - - ::: - -6. This step is only required if you are installing Palette in an environment where a network proxy must be configured - for Palette to access the internet. If you are not using a network proxy, skip to the next step. - - Install the reach-system chart using the following command. Point to the **values.yaml** file you configured in - step 5. Make sure you configure the `reach-system.enable` section in the **values.yaml** file. - - ```shell - helm upgrade --values vertex/values.yaml \ - reach-system extras/reach-system/reach-system-*.tgz --install - ``` - - ```shell hideClipboard - Release "reach-system" does not exist. Installing it now. - NAME: reach-system - LAST DEPLOYED: Mon Jan 29 17:04:23 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - - -
    - How to update containerd to use proxy configurations - - If your Kubernetes cluster is behind a network proxy, ensure the containerd service is configured to use proxy - settings. You can do this by updating the containerd configuration file on each node in the cluster. The - configuration file is typically located at ` /etc/systemd/system/containerd.service.d/http-proxy.conf`. Below is an - example of the configuration file. Replace the values with your proxy settings. Ask your network administrator for - guidance. - - ``` - [Service] - Environment="HTTP_PROXY=http://example.com:9090" - Environment="HTTPS_PROXY=http://example.com:9090" - Environment="NO_PROXY=127.0.0.1,localhost,100.64.0.0/17,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,,.cluster.local" - ``` - -
    - -7. Install the VerteX Helm Chart using the following command. - - ```shell - helm upgrade --values vertex/values.yaml \ - hubble vertex/spectro-mgmt-plane-*.tgz --install - ``` - - ```shell hideClipboard - Release "hubble" does not exist. Installing it now. - NAME: hubble - LAST DEPLOYED: Mon Jan 29 17:07:51 2024 - NAMESPACE: default - STATUS: deployed - REVISION: 1 - TEST SUITE: None - ``` - -8. Track the installation process using the command below. VerteX is ready when the deployments in the namespaces - `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` reach the _Ready_ state. The - installation takes between two to three minutes to complete. - - - - ```shell - kubectl get pods --all-namespaces --watch - ``` - - :::tip - - For a more user-friendly experience, use the open source tool [k9s](https://k9scli.io/) to monitor the installation - process. - - ::: - -9. Create a DNS CNAME record that is mapped to the VerteX `traefik-ingress-controller` load balancer. You can use the - following command to retrieve the load balancer IP address. You may require the assistance of your network - administrator to create the DNS record. - - ```shell - kubectl get service traefik-ingress-controller --namespace ingress-traefik \ - --output jsonpath='{.status.loadBalancer.ingress[0].hostname}' - ``` - - :::warning - - If Palette VerteX has only one tenant and you use local accounts with Single Sign-On (SSO) disabled, you can access - Palette VerteX using the IP address or any domain name that resolves to that IP. However, once you enable SSO, users - must log in using the tenant-specific subdomain. For example, if you create a tenant named `tenant1` and the domain - name you assigned to Palette VerteX is `vertex.example.com`, the tenant URL will be `tenant1.vertex.example.com`. We - recommend you create an additional wildcard DNS record to map all tenant URLs to the Palette VerteX load balancer. - For example, `*.vertex.example.com`. - - ::: - -10. Use the custom domain name or the IP address of the load balancer to visit the VerteX system console. To access the - system console, open a web browser and paste the custom domain URL in the address bar and append the value - `/system`. Replace the domain name in the URL with your custom domain name or the IP address of the load balancer. - Alternatively, you can use the load balancer IP address with the appended value `/system` to access the system - console. - - The first time you visit the VerteX system console, a warning message about a not-trusted SSL certificate may - appear. This is expected, as you still need to upload your SSL certificate to VerteX. You can ignore this warning - message and proceed. - - ![Screenshot of the VerteX system console showing Username and Password fields.](/vertex_install-on-kubernetes_install_system-console.webp) - -11. Log in to the system console using the following default credentials. Refer to the - [password requirements](../../system-management/account-management/credentials.md#password-requirements-and-security) - documentation page to learn more about password requirements. - - | **Parameter** | **Value** | - | ------------- | --------- | - | Username | `admin` | - | Password | `admin` | - - After login, you will be prompted to create a new password. Enter a new password and save your changes. You will be - redirected to the VerteX system console. Use the username `admin` and your new password to log in to the system - console. You can create additional system administrator accounts and assign roles to users in the system console. - Refer to the [Account Management](../../system-management/account-management/account-management.md) documentation - page for more information. - -12. After login, a summary page is displayed. VerteX is installed with a self-signed SSL certificate. To assign a - different SSL certificate you must upload the SSL certificate, SSL certificate key, and SSL certificate authority - files to VerteX. You can upload the files using the VerteX system console. Refer to the - [Configure HTTPS Encryption](../../system-management/ssl-certificate-management.md) page for instructions on how to - upload the SSL certificate files to VerteX. - - :::warning - - If you plan to deploy host clusters into different networks, you may require a reverse proxy. Check out the - [Configure Reverse Proxy](../../system-management/reverse-proxy.md) guide for instructions on how to configure a - reverse proxy for VerteX. - - ::: - -You now have a self-hosted instance of VerteX installed in a Kubernetes cluster. Make sure you retain the -**values.yaml** file as you may need it for future upgrades. +### Kubernetes Cluster + + + +- _(FIPS compliance only)_ The OS and Kubernetes cluster you are installing Palette VerteX onto must be FIPS-compliant. + Otherwise, Palette VerteX and its operations will not be FIPS-compliant. + +### Local Environment + + + +- An image pull secret from Spectro Cloud customer support, required to pull images from Spectro Cloud OCI registries. + This is not required if you plan to use [mirror registries](../../system-management/registry-override.md) or + [image swap](../../../clusters/cluster-management/image-swap.md) when pulling images. Refer to + [Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for + more information. + +### Other Prerequisites + + + +## Install Palette VerteX + + + +### Cert-Manager Helm Chart + +3. + +### Spectro Management CRDs Helm Chart + +6. + +### VerteX Helm Chart + +7. + +### Image Swap Helm Chart + +10. + +### Reach System Helm Chart + +11. + +### Installation + +12. ## Validate -Use the following steps to validate the VerteX installation. - -1. To access the VerteX system console, open a web browser and paste the `env.rootDomain` value you provided in the - address bar and append the value `/system`. You can also use the IP address of the load balancer. - -2. Log in using the credentials you received from our support team. After login, you will be prompted to create a new - password. Enter a new password and save your changes. You will be redirected to the VerteX system console. - -3. Open a terminal session and issue the following command to verify the VerteX installation. The command should return - a list of deployments in the `cp-system`, `hubble-system`, `ingress-traefik`, `jet-system`, and `ui-system` - namespaces. - - ```shell - kubectl get pods --all-namespaces --output custom-columns="NAMESPACE:metadata.namespace,NAME:metadata.name,STATUS:status.phase" \ - | grep --extended-regexp '^(cp-system|hubble-system|ingress-traefik|jet-system|ui-system)\s' - ``` - - Your output should look similar to the following. - - ```shell hideClipboard - cp-system spectro-cp-ui-689984f88d-54wsw Running - hubble-system auth-85b748cbf4-6drkn Running - hubble-system auth-85b748cbf4-dwhw2 Running - hubble-system cloud-fb74b8558-lqjq5 Running - hubble-system cloud-fb74b8558-zkfp5 Running - hubble-system configserver-685fcc5b6d-t8f8h Running - hubble-system event-68568f54c7-jzx5t Running - hubble-system event-68568f54c7-w9rnh Running - hubble-system foreq-6b689f54fb-vxjts Running - hubble-system hashboard-897bc9884-pxpvn Running - hubble-system hashboard-897bc9884-rmn69 Running - hubble-system hutil-6d7c478c96-td8q4 Running - hubble-system hutil-6d7c478c96-zjhk4 Running - hubble-system mgmt-85dbf6bf9c-jbggc Running - hubble-system mongo-0 Running - hubble-system mongo-1 Running - hubble-system mongo-2 Running - hubble-system msgbroker-6c9b9fbf8b-mcsn5 Running - hubble-system oci-proxy-7789cf9bd8-qcjkl Running - hubble-system packsync-28205220-bmzcg Succeeded - hubble-system spectrocluster-6c57f5775d-dcm2q Running - hubble-system spectrocluster-6c57f5775d-gmdt2 Running - hubble-system spectrocluster-6c57f5775d-sxks5 Running - hubble-system system-686d77b947-8949z Running - hubble-system system-686d77b947-cgzx6 Running - hubble-system timeseries-7865bc9c56-5q87l Running - hubble-system timeseries-7865bc9c56-scncb Running - hubble-system timeseries-7865bc9c56-sxmgb Running - hubble-system user-5c9f6c6f4b-9dgqz Running - hubble-system user-5c9f6c6f4b-hxkj6 Running - ingress-traefik traefik-ingress-controller-9dmzq Running - ingress-traefik traefik-ingress-controller-tpwtf Running - ingress-traefik traefik-ingress-controller-xz4jf Running - jet-system jet-6599b9856d-t9mr4 Running - ui-system spectro-ui-76ffdf67fb-rkgx8 Running - ``` + ## Next Steps - - -## Resources - -- [Enterprise Install Troubleshooting](../../../troubleshooting/enterprise-install.md) + diff --git a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/uninstall.md b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/uninstall.md index 48fe4c7a67c..f4b114f0209 100644 --- a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/uninstall.md +++ b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/uninstall.md @@ -40,28 +40,35 @@ install VerteX, this process does not apply. kubectl config current-context ``` -2. Issue the following command to start uninstalling the Vertex management plane. This will only remove the resources - managed by Helm and the remaining resources will require additional manual intervention. +2. Issue the following command to start uninstalling the Palette VerteX management plane. This will only remove the + resources managed by Helm. The remaining resources will require additional manual intervention. ```shell helm uninstall hubble ``` -3. Issue the following command to remove the namespace and custom resource definitions related to Vertex management - plane. +3. Remove the namespace and custom resource definitions related to the Palette VerteX management plane. ```shell - kubectl delete namespace hubble-system || kubectl delete crd spectroclusteractions.jet.cluster.spectrocloud.com + kubectl delete namespace hubble-system + kubectl delete crd spectroclusteractions.jet.cluster.spectrocloud.com ``` -4. Issue the following command to uninstall Cert Manager. Cert Manager does not reply on any Helm hooks and the Helm - uninstall command will uninstall all related resources. +4. Uninstall Cert Manager. ```shell helm uninstall cert-manager + kubectl delete namespace cert-manager ``` -5. (Optional) If you installed Reach, issue the following command to start uninstalling Reach. This will remove all +5. Uninstall the Spectro Management CRDs chart. + + ```shell + helm uninstall spectro-mgmt-crds + ``` + +6. _(Proxy environments only)_ If you installed Palette VerteX in an environment where a network proxy is configured for + Palette VerteX to access the internet, issue the following command to start uninstalling Reach. This will remove all resources related to Reach that are managed by Helm. However, some resources created by Helm hooks are not managed by Helm and will require additional manual intervention to remove. @@ -69,7 +76,7 @@ install VerteX, this process does not apply. helm uninstall reach-system ``` -6. (Optional) Issue the following commands to remove the remaining Reach system resources. +7. _(Proxy environments only)_ Issue the following commands to remove the remaining Reach system resources. ```shell kubectl delete ns reach-system @@ -83,13 +90,15 @@ install VerteX, this process does not apply. kubectl delete clusterrole reach-proxy-role ``` -7. (Optional) If you installed Image Swap, issue the following command to remove the `image-swap` chart. +8. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, issue the following command + to remove the `image-swap` chart. ```shell helm uninstall image-swap ``` -8. (Optional) Issue the following commands to remove the remaining resources related to `image-swap`. +9. _(Self-hosted OCI registry only)_ Issue the following commands to remove the remaining resources related to + `image-swap`. ```shell kubectl delete ns imageswap-system diff --git a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/vertex-helm-ref.md b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/vertex-helm-ref.md index 1b3d2df8270..782e535692c 100644 --- a/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/vertex-helm-ref.md +++ b/docs/docs-content/vertex/install-palette-vertex/install-on-kubernetes/vertex-helm-ref.md @@ -37,36 +37,51 @@ The global block allows you to provide configurations that apply globally to the ### Image Pull Secret -This section is only relevant if you are using your own private registry to host the images required for the Palette -installation process. +:::warning -The `imagePullSecret` block allows you to provide image pull secrets that will be used to authenticate with private -registries to obtain the images required for Palette VerteX installation. +Spectro Cloud's image pull secret will be required in an upcoming release for any users pulling images from a Spectro +Cloud-owned registry. This is a breaking change. We recommend obtaining your secret as soon as possible to avoid service +disruptions. Refer to +[Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for +more information. -| **Parameters** | **Description** | **Type** | **Default value** | -| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------- | -| `create` | Specifies whether to create a secret containing credentials to your own private image registry. | Boolean | `false` | -| `dockerConfigJson` | The **config.json** file value containing the registry URL and credentials for your image registry in base64 encoded format on a single line. For more information about the **config.json** file, refer to [Kubernetes Documentation](https://kubernetes.io/docs/concepts/containers/images/#config-json). | String | None | +::: -:::info +The `imagePullSecret` block configures the image pull secret used to authenticate with private registries. Palette +VerteX always creates a Kubernetes Secret named `spectro-image-pull-secret` from this value and distributes it to the +management plane, workload clusters, and PCGs. The secret serves the following purposes: -To obtain the base-64 encoded version of the credential `config.json` file, you can issue the following command. Replace -`` with the path to your `config.json` file. The `tr -d '\n'` removes new line characters -and produce the output on a single line. +- **Spectro Cloud registry authentication** - Authenticates with Spectro Cloud's registries to pull security-hardened + images. These images are used by the management plane, workload clusters, and PCGs. To obtain this secret, contact + your Spectro Cloud customer support representative. Refer to + [Configure Image Pull Secret for Security-Hardened Images](../../system-management/configure-image-pull-secret.md) for + more information. -```shell -cat | base64 | tr -d '\n' -``` +- **Private registry authentication** - If you host Palette images in your own private registry, the secret provides the + credentials needed to pull those images. -::: +| **Parameters** | **Description** | **Type** | **Default value** | +| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------- | +| `dockerConfigJson` | The values of the `config.json` file encoded in base64 as a single string, containing the registry URL and credentials for your image registry. For more information about the `config.json` file, refer to the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/containers/images/#config-json). | String | `""` | ```yaml global: imagePullSecret: - create: true dockerConfigJson: ewoJImF1dGhzHsKCQkiaG9va3......MiOiAidHJ1ZSIKCX0KfQ # Base64 encoded config.json ``` +:::info + +To obtain the base64-encoded version of your `config.json` file, use the following command. Replace +`` with the path to your `config.json` file. The `tr --delete '\n'` removes new line +characters and produces the output on a single line. + +```shell +cat | base64 | tr --delete '\n' +``` + +::: + ## MongoDB Palette VerteX uses MongoDB Enterprise as its internal database and supports two modes of deployment: diff --git a/docs/docs-content/vertex/system-management/configure-image-pull-secret.md b/docs/docs-content/vertex/system-management/configure-image-pull-secret.md new file mode 100644 index 00000000000..346eaf7f8a9 --- /dev/null +++ b/docs/docs-content/vertex/system-management/configure-image-pull-secret.md @@ -0,0 +1,110 @@ +--- +sidebar_label: "Configure Image Pull Secret" +title: "Configure Image Pull Secret for Security-Hardened Images" +description: + "Learn how to request and configure an image pull secret from Spectro Cloud, used for retrieving security hardened + images." +icon: "" +hide_table_of_contents: false +sidebar_position: 29 +tags: ["self-hosted", "account", "image pull secret", "hardened images", "security"] +keywords: ["self-hosted", "vertex", "image pull secret", "hardened images", "security"] +--- + + + +## When to Configure Image Pull Secret + +Depending on how your environment retrieves images, you may or may not need to configure Spectro Cloud's image pull +secret. + +### Configuration Required + + + +### Configuration Not Required + + + +## Configure Image Pull Secret + +Depending on your installation method, you can configure Spectro Cloud's image pull secret during or after installing +self-hosted Palette. + +### During Installation + + + +#### Helm Chart Installations + + + +### Post-Installation + + + +#### Prerequisites + + + +#### Enablement + + + +#### Validate + + diff --git a/docs/docs-content/vertex/upgrade/upgrade-k8s/airgap.md b/docs/docs-content/vertex/upgrade/upgrade-k8s/airgap.md index 4b5ca983f6a..2893d22aed0 100644 --- a/docs/docs-content/vertex/upgrade/upgrade-k8s/airgap.md +++ b/docs/docs-content/vertex/upgrade/upgrade-k8s/airgap.md @@ -250,50 +250,53 @@ Kubernetes. ::: -8. Navigate to the directory with the Palette VerteX installation zip file. Unzip the file to a **palette-install** - directory. +8. Navigate to the directory where you downloaded the Palette VerteX install zip file provided by our support team. + Unzip the file to a directory named `vertex-install`. ```shell - unzip release-*.zip -d palette-install + unzip charts.zip -d vertex-install ``` -9. Navigate to the release directory inside **palette-install**. +9. Navigate to the `vertex-install` directory. ```shell - cd palette-install/charts/release-* + cd vertex-install ``` -10. In a code editor of your choice, open the **extras/cert-manager/values.yaml** file and replace the - `cainjectorImage`,`controllerImage`, `webhookImage`, and `amceResolverImage` image URLs and with your OCI image - registry URL and the `/spectro-images/` namespace. - - ```yaml {2-5} - image: - cainjectorImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" +10. Open the file `extras/cert-manager/values.yaml` with a text editor of your choice. This example uses Vim. - featureGates: "AdditionalCertificateOutputFormats=true" + ```shell + vim extras/cert-manager/values.yaml ``` - Consider the following example for reference. + Append `` to each image, along with the `` where you want to store your images. - ```yaml {2-5} + ```yaml image: - cainjectorImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.17.0-spectro-4.6.1" - controllerImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.17.0-spectro-4.6.1" - webhookImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.17.0-spectro-4.6.1" - amceResolverImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.17.0-spectro-4.6.1" + cainjectorImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "//us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" + ``` - featureGates: "AdditionalCertificateOutputFormats=true" + In the example below, we used `harbor.docs.spectro.dev` for the registry and `spectro-images` for the repository. + + ```yaml {2-5} hideClipboard title="Example output" + image: + cainjectorImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-cainjector:v1.19.3-spectro-4.8.b" + controllerImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-controller:v1.19.3-spectro-4.8.b" + webhookImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-webhook:v1.19.3-spectro-4.8.b" + amceResolverImage: "harbor.docs.spectro.dev/spectro-images/us-docker.pkg.dev/palette-images-fips/palette/spectro-cert-manager/cert-manager-acmesolver:v1.19.3-spectro-4.8.b" ``` 11. Update the cert-manager chart using the following command. ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml ``` You should receive an output similar to the following. @@ -311,7 +314,9 @@ Kubernetes. 12. Upgrade the Spectro Management CRDs chart. ```shell - helm upgrade --install spectro-mgmt-crds extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz + helm upgrade --install spectro-mgmt-crds \ + extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ + --values extras/spectro-mgmt-crds/values.yaml ``` You should receive an output similar to the following. @@ -339,10 +344,11 @@ Kubernetes. ::: -14. Upgrade the image-swap chart with the following command. Point to the `palette/values.yaml` file from step 13. +14. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, upgrade the image-swap chart + with the following command. Point to the `vertex/values.yaml` file from step 13. ```shell - helm upgrade --values palette/values.yaml \ + helm upgrade --values vertex/values.yaml \ image-swap extras/image-swap/image-swap-*.tgz --install ``` @@ -358,11 +364,13 @@ Kubernetes. TEST SUITE: None ``` -15. Upgrade the reach-system chart with the following command. Point to the `palette/values.yaml` file from step 13. +15. _(Proxy environments only)_ If you are upgrading a Palette VerteX instance in an environment where a network proxy + must be configured for Palette VerteX to access the internet, upgrade the reach-system chart with the following + command. Point to the `vertex/values.yaml` file from step 13. ```shell - helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-\*.tgz --install + helm upgrade --values vertex/values.yaml \ + reach-system extras/reach-system/reach-system-*.tgz --install ``` You should receive an output similar to the following. @@ -380,8 +388,8 @@ Kubernetes. 16. Upgrade Palette VerteX with the following command. ```shell - helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-\*.tgz --install + helm upgrade --values vertex/values.yaml \ + hubble vertex/spectro-mgmt-plane-*.tgz --install ``` You should receive an output similar to the following. diff --git a/docs/docs-content/vertex/upgrade/upgrade-k8s/non-airgap.md b/docs/docs-content/vertex/upgrade/upgrade-k8s/non-airgap.md index 4114d7068b9..ad26290ff1d 100644 --- a/docs/docs-content/vertex/upgrade/upgrade-k8s/non-airgap.md +++ b/docs/docs-content/vertex/upgrade/upgrade-k8s/non-airgap.md @@ -56,24 +56,27 @@ match your environment. ::: -1. Open a terminal session and navigate to the directory with the Palette VerteX installation zip file. Unzip the file - to a **palette-install** directory. +1. Open a terminal session and navigate to the directory where you downloaded the Palette VerteX install ZIP file + provided by our support team. Unzip the file to a directory named `vertex-install`. ```shell - unzip release-*.zip -d palette-install + unzip charts.zip -d vertex-install ``` -2. Navigate to the release directory inside **palette-install**. +2. Navigate to the `vertex-install` directory. ```shell - cd palette-install/charts/release-* + cd vertex-install ``` 3. Update the cert-manager chart using the following command. ```shell - helm upgrade --values extras/cert-manager/values.yaml \ - cert-manager extras/cert-manager/cert-manager-*.tgz --install + helm upgrade --install cert-manager \ + ./extras/cert-manager/cert-manager-*.tgz \ + --namespace cert-manager \ + --create-namespace \ + --values ./extras/cert-manager/values.yaml ``` You should receive an output similar to the following. @@ -91,7 +94,9 @@ match your environment. 4. Upgrade the Spectro Management CRDs chart. ```shell - helm upgrade --install spectro-mgmt-crds extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz + helm upgrade --install spectro-mgmt-crds \ + extras/spectro-mgmt-crds/spectro-mgmt-crds-*.tgz \ + --values extras/spectro-mgmt-crds/values.yaml ``` You should receive an output similar to the following. @@ -121,15 +126,25 @@ match your environment. Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. Including `/v2` for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. For example: - `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. - ::: +- Ensure that the `values.yaml` file is ready before proceeding. If you are using a self-hosted OCI registry, make sure + that the `ociImageRegistry.mirrorRegistries` parameter in your `values.yaml` includes the necessary mirror links. + +- Include `/v2` in your endpoints if you are using a + [Harbor registry with a proxy cache](https://goharbor.io/docs/2.1.0/administration/configure-proxy-cache/) project. + Harbor proxy cache projects use `/v2` as part of their internal URL routing for cached images. For all other + registries, omit `/v2`, as the container runtime automatically appends `/v2` when making API calls. + + Including `/v2` for non-proxy-cache registries results in a doubled `/v2/v2/` path, which causes image pull failures. + For example: `docker.io::harbor.example.org/v2/proxy-cache-project/docker.io`. + + ::: -6. If you are using a self-hosted OCI registry, upgrade the image-swap chart with the following command. Point to the - `palette/values.yaml` file from step 5. +6. _(Self-hosted OCI registry only)_ If you use image swap for self-hosted OCI registries, upgrade the image-swap chart + with the following command. Point to the `vertex/values.yaml` file from step 5. ```shell - helm upgrade --values palette/values.yaml \ + helm upgrade --values vertex/values.yaml \ image-swap extras/image-swap/image-swap-*.tgz --install ``` @@ -145,12 +160,13 @@ match your environment. TEST SUITE: None ``` -7. If you are upgrading a Palette VerteX instance in an environment that requires network proxy configuration, upgrade - the reach-system chart with the following command. Point to the `palette/values.yaml` file from step 5. +7. _(Proxy environments only)_ If you are upgrading a Palette VerteX instance in an environment where a network proxy + must be configured for Palette VerteX to access the internet, upgrade the reach-system chart with the following + command. Point to the `vertex/values.yaml` file from step 5. ```shell - helm upgrade --values palette/values.yaml \ - reach-system extras/reach-system/reach-system-\*.tgz --install + helm upgrade --values vertex/values.yaml \ + reach-system extras/reach-system/reach-system-*.tgz --install ``` You should receive an output similar to the following. @@ -168,8 +184,8 @@ match your environment. 8. Upgrade Palette VerteX with the following command. ```shell - helm upgrade --values palette/values.yaml \ - hubble palette/spectro-mgmt-plane-\*.tgz --install + helm upgrade --values vertex/values.yaml \ + hubble vertex/spectro-mgmt-plane-*.tgz --install ``` You should receive an output similar to the following. diff --git a/redirects.js b/redirects.js index 81b2be99b04..458005fc89e 100644 --- a/redirects.js +++ b/redirects.js @@ -1004,6 +1004,17 @@ let redirects = [ from: `/clusters/edge/edgeforge-workflow/palette-canvos/build-rhel-stig-image/`, to: `/clusters/edge/edgeforge-workflow/palette-canvos/build-provider-images/build-rhel-stig-image/`, }, + + // Image Pull Secret + + { + from: `/enterprise-version/configure-image-pull-secret/`, + to: `/enterprise-version/system-management/configure-image-pull-secret/`, + }, + { + from: `/vertex/configure-image-pull-secret/`, + to: `/vertex/system-management/configure-image-pull-secret/`, + }, ]; if (packRedirects.length > 0) { diff --git a/src/theme/MDXComponents/MDXComponents.ts b/src/theme/MDXComponents/MDXComponents.ts index 8c86b4095e7..1ea3d8990d5 100644 --- a/src/theme/MDXComponents/MDXComponents.ts +++ b/src/theme/MDXComponents/MDXComponents.ts @@ -1,5 +1,6 @@ import MDXComponents from "@theme-original/MDXComponents"; import customMdxComponents from "@site/src/components/mdx/index"; +import CodeBlock from "@theme/CodeBlock"; import Tabs from "@theme/Tabs"; import TabItem from "@theme/TabItem"; import Tooltip from "@site/src/components/Tooltip/Tooltip"; @@ -30,6 +31,7 @@ import FullUrlLink from "@site/src/components/FullUrlLink"; export default { ...MDXComponents, ...customMdxComponents, + CodeBlock, Accordion, AccordionPanel, Tabs, diff --git a/static/assets/docs/images/configure-image-pull-secret_palette.webp b/static/assets/docs/images/configure-image-pull-secret_palette.webp new file mode 100644 index 00000000000..fe5f5eec640 Binary files /dev/null and b/static/assets/docs/images/configure-image-pull-secret_palette.webp differ diff --git a/static/assets/docs/images/configure-image-pull-secret_vertex.webp b/static/assets/docs/images/configure-image-pull-secret_vertex.webp new file mode 100644 index 00000000000..956b775ad81 Binary files /dev/null and b/static/assets/docs/images/configure-image-pull-secret_vertex.webp differ diff --git a/static/assets/docs/images/palette_installation_install-on-vmware_palette-system-console.webp b/static/assets/docs/images/palette_installation_install-on-vmware_palette-system-console.webp index ed93c439499..2ba0851a80e 100644 Binary files a/static/assets/docs/images/palette_installation_install-on-vmware_palette-system-console.webp and b/static/assets/docs/images/palette_installation_install-on-vmware_palette-system-console.webp differ diff --git a/static/assets/docs/images/vertex_install-on-kubernetes_install_system-console.webp b/static/assets/docs/images/vertex_install-on-kubernetes_install_system-console.webp index a356fc00717..c046e264af6 100644 Binary files a/static/assets/docs/images/vertex_install-on-kubernetes_install_system-console.webp and b/static/assets/docs/images/vertex_install-on-kubernetes_install_system-console.webp differ