diff --git a/README.md b/README.md index fc62404..1b9f114 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,6 @@ To run HA Netmaker on Kubernetes, your cluster must have the following: - An Ingress Controller and valid TLS certificates - This chart can currently generate ingress for: - Nginx Ingress + LetsEncrypt/Cert-Manager - - Traefik Ingress + LetsEncrypt/Cert-Manager - to generate automatically, make sure one of the two is configured for your cluster - Ability to set up DNS for Secure Web Sockets - Nginx Ingress supports Secure Web Sockets (WSS) by default. If you are not using Nginx Ingress, you must route external traffic from broker.domain to the MQTT service, and provide valid TLS certificates. @@ -29,13 +28,12 @@ Furthermore, the chart will by default install and use a postgresql cluster as i ``` helm repo add netmaker https://gravitl.github.io/netmaker-helm/ helm install netmaker/netmaker --generate-name \ # generate a random id for the deploy ---set wireguard.kernel=true \ # set wireguard to kernel mode (false by default) --set baseDomain=nm.example.com \ # the base wildcard domain to use for the netmaker api/dashboard/mq ingress ---set replicas=3 \ # number of server replicas to deploy (3 by default) ---set ingress.enabled=true \ # deploy ingress automatically (requires nginx or traefik and cert-manager + letsencrypt) ---set ingress.className=nginx \ # ingress class to use ---set ingress.tls.issuerName=letsencrypt-prod \ # LetsEncrypt certificate issuer to use ---set dns.enabled=true \ # deploy and enable private DNS management with CoreDNS +--set server.replicas=3 \ # number of server replicas to deploy (3 by default) +--set ingress.enabled=true \ # deploy ingress automatically (requires nginx and cert-manager + letsencrypt) +--set ingress.kubernetes.io/ingress.class=nginx \ # ingress class to use +--set ingress.cert-manager.io/cluster-issuer=letsencrypt-prod \ # LetsEncrypt certificate issuer to use +--set dns.enabled=false \ # deploy and enable private DNS management with CoreDNS --set dns.clusterIP=10.245.75.75 --set dns.RWX.storageClassName=nfs \ # required fields for DNS --set postgresql-ha.postgresql.replicaCount=2 \ # number of DB replicas to deploy (default 2) ``` @@ -52,7 +50,7 @@ Below, we discuss the considerations for Ingress, Kernel WireGuard, and DNS. #### MQ -The MQ Broker is deployed either with Ingress (Nginx or Traefik) preconfigured, or without. If you are using an ingress controller other than Nginx or Traefik, Netmaker's MQTT will not be complete. "broker.domain" must reach the MQTT service at port 8883 over WSS (Secure Web Sockets). +The MQ Broker is deployed either with Ingress (Nginx ) preconfigured, or without. If you are using an ingress controller other than Nginx, Netmaker's MQTT will not be complete. "broker.domain" must reach the MQTT service at port 8883 over WSS (Secure Web Sockets). #### Ingress To run HA Netmaker, you must have ingress installed and enabled on your cluster with valid TLS certificates (not self-signed). If you are running Nginx as your Ingress Controller and LetsEncrypt for TLS certificate management, you can run the helm install with the following settings: @@ -87,29 +85,34 @@ This will also require specifying a service address for DNS. Choose a valid ipv4 | fullnameOverride | string | `""` | override the full name for netmaker objects | | image.pullPolicy | string | `"Always"` | Pull Policy for images | | image.repository | string | `"gravitl/netmaker"` | The image repo to pull Netmaker image from | -| image.tag | string | `"v0.17.1"` | Override the image tag to pull | -| ingress.annotations.base."kubernetes.io/ingress.allow-http" | string | `"false"` | annotation to generate ACME certs if available | -| ingress.annotations.nginx."nginx.ingress.kubernetes.io/rewrite-target" | string | `"/"` | destination addr for route | -| ingress.annotations.nginx."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | Redirect http to https | -| ingress.annotations.tls."kubernetes.io/tls-acme" | string | `"true"` | use acme cert if available | -| ingress.annotations.traefik."traefik.ingress.kubernetes.io/redirect-entry-point" | string | `"https"` | Redirect to https | -| ingress.annotations.traefik."traefik.ingress.kubernetes.io/redirect-permanent" | string | `"true"` | Redirect to https permanently | -| ingress.annotations.traefik."traefik.ingress.kubernetes.io/rule-type" | string | `"PathPrefixStrip"` | rule type | +| image.tag | string | `"latest"` | Override the image tag to pull | +| ingress.annotations."kubernetes.io/ingress.class" | string | `"nginx"` | ingress class name | +| ingress.annotations."cert-manager.io/cluster-issuer" | string | `"letsencrypt-prod"` | cert manager cluster issuer name | | ingress.enabled | bool | `false` | attempts to configure ingress if true | -| ingress.hostPrefix.mq | string | `"broker."` | broker route subdomain | -| ingress.hostPrefix.rest | string | `"api."` | api (REST) route subdomain | -| ingress.hostPrefix.ui | string | `"dashboard."` | ui route subdomain | -| ingress.tls.enabled | bool | `true` | | -| ingress.tls.issuerName | string | `"letsencrypt-prod"` | | +| ingress.hostPrefix.mq | string | `"broker"` | broker route subdomain | +| ingress.hostPrefix.rest | string | `"api"` | api (REST) route subdomain | +| ingress.hostPrefix.ui | string | `"dashboard"` | ui route subdomain | +| ingress.tls | bool | `true` | | | nameOverride | string | `""` | override the name for netmaker objects | | podAnnotations | object | `{}` | pod annotations to add | | podSecurityContext | object | `{}` | pod security contect to add | | postgresql-ha.persistence.size | string | `"3Gi"` | size of postgres DB | | postgresql-ha.postgresql.database | string | `"netmaker"` | postgress db to generate | -| postgresql-ha.postgresql.password | string | `"netmaker"` | postgres pass to generate | +| postgresql-ha.postgresql.password | string | `"password123"` | postgres pass to generate | | postgresql-ha.postgresql.username | string | `"netmaker"` | postgres user to generate | -| replicas | int | `3` | number of netmaker server replicas to create | +| server.RWX.storageClassName | string | `""` | storage class name of server PVC | +| server.storageSize | string | `"128Mi"` | storage size of server volume | +| server.masterKey | string | `"netmaker"` | master key for netmaker server | +| server.replicas | int | `3` | number of netmaker server replicas to create | +| server.ee.licenseKey | string | `""` | server license key required if using Enterprise version | +| server.ee.tenantId | string | `""` | tenantId of the license required if using Enterprise version | | service.mqPort | int | `443` | public port for MQ service | +| db.type | string | `"postgres"` | type of db server connecting to supported types `"postgres"` `"sqlite"` `"rqlite"` | +| db.host | string | `""` | db host domain | +| db.port | int | `5432` | db port | +| db.username | string | `"postgres"` | db username | +| db.password | string | `"password123"` | db password | +| db.database | string | `"netmaker"` | db password | | service.restPort | int | `8081` | port for API service | | service.type | string | `"ClusterIP"` | type for netmaker server services | | service.uiPort | int | `80` | port for UI service | @@ -117,5 +120,4 @@ This will also require specifying a service address for DNS. Choose a valid ipv4 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created | | serviceAccount.name | string | `""` | Name of SA to use. If not set and create is true, a name is generated using the fullname template | | ui.replicas | int | `2` | how many UI replicas to create | -| wireguard.kernel | bool | `false` | whether or not to use Kernel WG (should be false unless WireGuard is installed on hosts). | -| wireguard.networkLimit | int | `10` | max number of networks that Netmaker will support if running with WireGuard enabled | + diff --git a/dep.sh b/dep.sh new file mode 100755 index 0000000..39a8c75 --- /dev/null +++ b/dep.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +export KUBECONFIG=/Users/abhishekk/Downloads/test-kubeconfig.yaml + +helm install netmaker . --set baseDomain=146.190.9.68.nip.io --set server.replicas=3 --set ingress.enabled=true --set ingress.kubernetes.io/ingress.class=nginx --set ingress.cert-manager.io/cluster-issuer="letsencrypt-prod" --set dns.enabled=false --set dns.clusterIP=10.245.75.75 --set dns.RWX.storageClassName=nfs --set postgresql-ha.postgresql.replicaCount=2 diff --git a/templates/ingress.yaml b/templates/ingress.yaml index a51f9db..ca588d7 100644 --- a/templates/ingress.yaml +++ b/templates/ingress.yaml @@ -6,11 +6,6 @@ {{- $uiSvcPort := .Values.service.uiPort -}} {{- $restSvcPort := .Values.service.restPort -}} {{- $mqSvcPort := 8883 -}} -{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} - {{- end }} -{{- end }} {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} apiVersion: networking.k8s.io/v1 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} diff --git a/values.yaml b/values.yaml index 63f2e0b..30a554d 100644 --- a/values.yaml +++ b/values.yaml @@ -3,7 +3,7 @@ # Declare variables to be passed into your templates. -baseDomain: "" # required value +baseDomain: "nm.example.com" # required value image: # -- The image repo to pull Netmaker image from repository: gravitl/netmaker @@ -83,7 +83,6 @@ ingress: # -- attempts to configure ingress if true enabled: true tls: true - className: "nginx" annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-issuer: letsencrypt-prod