Opstella Installation Overview

Opstella will be on 🟢 Management Kubernetes Cluster.

Certain Services will be installed across Kuberenetes Clusters

• 🟢 Management Kubernetes Cluster
• 🟦 Non-Production Workload Kubernetes Cluster
• 🟥 Production Workload Kubernetes Cluster

Application Dependencies

• 📦PostgreSQL SQL Database
• 📦Redis Pub/Sub Service and In-Memory Cache
• 📦Dapr Microservices Backing Service

Prerequisites

• 🔑 Google Service Account Key (JSON)
  • Download the JSON key file provided by Opstella Support.
  • This key will be used to authenticate with Google Artifact Registry.
• 🔑Pull Credentials from Registry (Harbor, For Air-Gapped Environment).
  • See on Create Robot Account for Opstella Services Deployment

Summary

Opstella compose of multiple services which can be summarise by the following

No.	Tool	Description	Kubernetes Namespace	Kubernetes Cluster
1.	PostgreSQL	Database Service	opstella-system	🟢 Management
2.	Redis	Pub/Sub Service and In-Memory Cache	opstella-system	🟢 Management
3.	Dapr	Opstella Platform Microservices Backing Service	dapr-system	🟢 Management
4.	Dapr Configuration	Configuration for Opstella Platform	opstella-system	🟢 Management
5.	Opstella UI	Frontend Service	opstella-system	🟢 Management
6.	Opstella Core	Backend Service	opstella-system	🟢 Management
7.	Opstella Clear Session	Microservice - Clear User Session with Single Sign-On Process	opstella-system	🟢 Management 🟢 Management 🟦 Non-Production Workload 🟥 Production Workload
8.	Opstella Worker-GitLab	Microservice - GitLab Management	opstella-system	🟢 Management
9.	Opstella Worker-Grafana	Microservice - Grafana Management	opstella-system	🟢 Management
10.	Opstella Worker-Harbor	Microservice - Harbor Management	opstella-system	🟢 Management
11.	Opstella Worker-Kubernetes	Microservice - Kubernetes Management	opstella-system	🟢 Management
12.	Opstella Worker-Keycloak	Microservice - Keycloak Management	opstella-system	🟢 Management
13.	Opstella Worker-Sonarqube	Microservice - Sonarqube Management	opstella-system	🟢 Management
14.	Opstella Worker-Vault	Microservice - Vault Management	opstella-system	🟢 Management
15.	Opstella Worker-ArgoCD	Microservice - ArgoCD Management	opstella-system	🟢 Management
16.	Opstella Worker-DefectDojo	Microservice - DefectDojo Management	opstella-system	🟢 Management
17.	Opstella Worker-Headlamp	Microservice - Headlamp Management	opstella-system	🟢 Management
18.	New Opstella Kubernetes Integration (ok8s-integration)	Opstella Kubernetes Integration System	opstella-system	🟢 Management

Preparation

Create Namespace across Kubernetes Clusters

🟢 Management Kubernetes Cluster

1. Connect to 🟢 Management Kubernetes Cluster ; i.e w/ Kubeconfig File

   Set Kubeconfig File

   Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

   source $HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh

   export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/management_cluster.yaml"

2. Create Kubernetes Namespace dapr-system

   2.1 Create Kubernetes Namespace

   kubectl create namespace dapr-system

   2.2 Add Label for dapr-system namespace for PSA Exception

   AS OF SEP 2024: Dapr is not yet fully compliant to PSA restricted profile, and require to make an exception

   kubectl label namespace/dapr-system pod-security.kubernetes.io/enforce=baseline
   kubectl label namespace/dapr-system pod-security.kubernetes.io/enforce-version=latest

3. Create Kubernetes Namespace opstella-system

   kubectl create namespace opstella-system

4. Create Kubernetes Namespace opstella-shared-runner

   4.1 Create Kubernetes Namespace

   kubectl create namespace opstella-shared-runner

   4.2 Add Label for opstella-shared-runner namespace for PSA Exception

   kubectl label namespace/opstella-shared-runner pod-security.kubernetes.io/enforce=privileged
   kubectl label namespace/opstella-shared-runner pod-security.kubernetes.io/enforce-version=latest

5. Create Kubernetes Secret for TLS Certificate in Namespace opstella-system, before you proceed (if you not have it done).

🟢 Management Kubernetes Cluster

1. Connect to 🟢 Management Kubernetes Cluster ; i.e w/ Kubeconfig File

   Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

   source $HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh

   export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/management_cluster.yaml"

2. Create Kubernetes Namespace opstella-system

   kubectl create namespace opstella-system

🟦 Non-Production Workload Kubernetes Cluster

1. Connect to 🟦 Non-Production Workload Kubernetes Cluster ; i.e w/ Kubeconfig File

   Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

   source $HOME/opstella-installation/shell-values/kubernetes/nonprod_cluster.vars.sh

   export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/nonprod_cluster.yaml"

2. Create Kubernetes Namespace opstella-system

   kubectl create namespace opstella-system

🟥 Production Workload Kubernetes Cluster

1. Connect to 🟥 Production Workload Kubernetes Cluster ; i.e w/ Kubeconfig File

   Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

   source $HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh

   export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/prod_cluster.yaml"

2. Create Kubernetes Namespace opstella-system

   kubectl create namespace opstella-system

Create Image Pull Secret for Pulling Opstella Container Images across Kubernetes Cluster (For online installation)

Note

Repeat for each of Kubernetes Clusters

• 🟢 Management
• 🟦 Non-Production Workload
• 🟥 Production Workload

1. Store Pull Credentials as Kubernetes Secret

   Caution

   Ensure your JSON key file is stored securely and not committed to version control. The username must be exactly _json_key.

   Set the environment variables for your registry location and key file path.

   export ARTIFACT_REGISTRY_DOMAIN="asia-southeast1-docker.pkg.dev"
   
   ## The path to the JSON key file you downloaded
   export GCP_CREDENTIALS="./path/to/your-service-account-key.json"

   Create Kubernetes Secret

   You will be creating a Kubernetes Secret named registry-secret in the opstella-system namespace.

   # Create the secret using the JSON file content as the password
   kubectl create secret docker-registry registry-secret -n opstella-system \
     --docker-server=${ARTIFACT_REGISTRY_DOMAIN} \
     --docker-username=_json_key \
     --docker-password="$(cat ${GCP_CREDENTIALS})"

Create Image Pull Secret for Pulling Opstella Container Images across Kubernetes Cluster (For Air-gapped installation)

Note

Repeat for each of Kubernetes Clusters

• 🟢 Management
• 🟦 Non-Production Workload
• 🟥 Production Workload

1. Store Pull Credentials as Kubernetes Secret

   Caution

   Robot Account will have ”$” character. USE SINGLE QUOTE for character esacpe.

   Ensure HARBOR_DOMAIN is defined as per the Shell Variables guide.

   ## For security reasons turn off bash history momentarily
   set +o history
   export REGISTRY_USERNAME='robot$opstella-deploy'
   export REGISTRY_PASSWORD="CHANGEME"

   Create Kubernetes Secret

   You will be creating Kubernetes Secret named registry-secret

   # Create .dockerconfig JSON file
   kubectl create secret docker-registry registry-secret -n opstella-system \
     --docker-server=${HARBOR_DOMAIN} \
     --docker-username=${REGISTRY_USERNAME} \
     --docker-password=${REGISTRY_PASSWORD}
   
   set -o history