Headlamp Production Environment Installation

Prerequisites

Kubernetes Cluster

Prepare Shell Variables

Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

1. Connect to 🟥 Production Workload Kubernetes Cluster ; i.e w/ Kubeconfig File

   Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

   source $HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh

   export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/prod_cluster.yaml"

2. Create Kubernetes Secret for 🛡️ TLS Certificate for Headlamp (Production) in Namespace devsecops-system.

   Create one using from .crt and .key file.

   kubectl create secret tls $K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME \
     --cert=/path/to/cert/file --key=/path/to/key/file \
     --namespace devsecops-system

   💡 Should return secret/wildcard-...-tls created message.

Pre-Installation

Prepare Headlamp (Production) Configurations

1. Create Helm Values Configurations

   cat <<EOF > $HOME/opstella-installation/helm-values/headlamp-prod-full-values.yaml
   ingress:
     # -- Enable ingress controller resource
     enabled: true
     ingressClassName: ${K8S_INGRESSCLASS_NAME}
     # -- Hostname(s) for the Ingress resource
     hosts:
       - host: ${HEADLAMP_DOMAIN}
         paths:
           - path: /
             type: Prefix
     # -- Ingress TLS configuration
     tls:
       - secretName: ${K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME}
         hosts:
           - ${HEADLAMP_DOMAIN}
   
   # -- Headlamp containers Security Context
   securityContext:
     seccompProfile:
       type: RuntimeDefault
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
     privileged: false
     allowPrivilegeEscalation: false
     runAsUser: 100
     runAsGroup: 101
   
   EOF

Installation

1. Add Headlamp Helm Repository

   # Add Helm Repository
   helm repo add headlamp https://kubernetes-sigs.github.io/headlamp/
   helm repo update

2. Install a Helm Release with specific Helm Chart Version --version 0.28.1 (App Version: 0.28.1)

   helm install headlamp headlamp/headlamp --version 0.28.1 \
       --namespace devsecops-system \
       -f $HOME/opstella-installation/helm-values/headlamp-prod-full-values.yaml

Post-Installation

Headlamp Testing

1. Get Pod Status - Headlamp

   kubectl get pods -n devsecops-system

   Headlamp should be Running

   NAME                      READY   STATUS    RESTARTS   AGE
   ... (deducted)
   headlamp-XXXXXXXX-YYYYY   1/1     Running   0          Xd

2. Visit https://${HEADLAMP_DOMAIN}

   • It should be accessible.
   • TLS Certificate should be valid and coresponding to your TLS Certificate Installed