This is the Experimental version (Latest). It is under active development and may change. For the most reliable documentation, use the version selector in the top-right to switch to Stable, or click here to go to the Stable version's homepage.

Setup Shell Variable Values

อัพเดทล่าสุด: 2 มี.ค. 2569

เนื้อหานี้ยังไม่มีในภาษาของคุณ

Creating shell variable values helps you store all the necessary configurations and secrets required during the installation process.

Global Shell Variable Values

These values should be determined during the Planning Phase.

Example:

Information	Your Value	Note
Organization Name	`foobar`	Short name
Keycloak Realm Name	`foobar-opstella`	Realm name
Domain Name	`example.com`	Base domain
Storage Service	`seaweedfs`	S3 compatible storage service
TLS Certificate	`example.com`	Wildcard certificate & key for domains

Create Global Variable File

Store all globally applicable variables in the following directory:

$HOME/opstella-installation/shell-values/global.vars.sh

Define your organization name and base domain first, then update other values based on your working environment.

cat <<EOF > $HOME/opstella-installation/shell-values/global.vars.sh
#!/bin/bash

# Set work path (Should contains `assets` directory extracted from `orion-assets`)
export BASE_WORKING_DIR="${HOME}/opstella-installation"

# Global variables
export ORGANIZATION_NAME="foobar"
export BASE_DOMAIN="example.com"
export ARTIFACT_REGISTRY_DOMAIN="asia-southeast1-docker.pkg.dev"

# GCP Credentials used for pulling Docker images from GCP Artifact Registry
export GCP_CREDENTIALS="${BASE_WORKING_DIR}/opstella-example-sa-key.json"

export OPSTELLA_REGISTRY="asia-southeast1-docker.pkg.dev/opstella"

EOF

Kubernetes Cluster-Specific Shell Variables

Store all Kubernetes cluster-specific variables in the following directory:

$HOME/opstella-installation/shell-values/kubernetes/**.vars.sh

🟢 Management

Create $HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh

Update the variable values based on your working environment. Most importantly, update the KUBECONFIG variable to point to the correct kubeconfig file for your management cluster.

cat <<EOF > $HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh
#!/bin/bash

source $HOME/opstella-installation/shell-values/global.vars.sh

# Set kubeconfig file path
export KUBECONFIG=$BASE_WORKING_DIR/local_artifacts/rke2-mgmt.yaml
# Set name of secret that contains TLS certificate and key for Ingress resources.
export K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME="wildcard-example.com-tls"
export K8S_INTERNAL_DOMAIN="cluster.local"
# Name of the cluster DNS Service in namespace `kube-system`.
# Upstream Kubernetes / most distributions: `kube-dns` (even when backed by CoreDNS).
# RKE2: `rke2-coredns-rke2-coredns`. Verify with `kubectl get svc -n kube-system`.
export K8S_INTERNAL_DNS_SERVICE="kube-dns"
export K8S_INGRESSCLASS_NAME="nginx"
export K8S_STORAGECLASS_NAME="longhorn"

# load tools shell variables
source $HOME/opstella-installation/shell-values/tools/01-base.vars.sh
source $HOME/opstella-installation/shell-values/tools/02-override-mgmt.vars.sh
EOF

🟦 Non-Production Workload

Create $HOME/opstella-installation/shell-values/kubernetes/nonprod_cluster.vars.sh

Update the variable values based on your working environment. Most importantly, update the KUBECONFIG variable to point to the correct kubeconfig file for your non-production cluster.

cat <<EOF > $HOME/opstella-installation/shell-values/kubernetes/nonprod_cluster.vars.sh
#!/bin/bash

source $HOME/opstella-installation/shell-values/global.vars.sh

# Set kubeconfig file path
export KUBECONFIG=$BASE_WORKING_DIR/local_artifacts/rke2-nonprod.yaml
# Set name of secret that contains TLS certificate and key for Ingress resources.
export K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME="wildcard-example.com-tls"
export K8S_INTERNAL_DOMAIN="cluster.local"
# Name of the cluster DNS Service in namespace `kube-system`.
# Upstream Kubernetes / most distributions: `kube-dns` (even when backed by CoreDNS).
# RKE2: `rke2-coredns-rke2-coredns`. Verify with `kubectl get svc -n kube-system`.
export K8S_INTERNAL_DNS_SERVICE="kube-dns"
export K8S_INGRESSCLASS_NAME="nginx"
export K8S_STORAGECLASS_NAME="longhorn"

# load tools shell variables
source $HOME/opstella-installation/shell-values/tools/01-base.vars.sh
source $HOME/opstella-installation/shell-values/tools/02-override-nonprod.vars.sh
EOF

### 🟥 Production Workload

    Create `$HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh`

Update the variable values based on your working environment. Most importantly, update the `KUBECONFIG` variable to point to the correct kubeconfig file for your production cluster.

```sh
cat <<EOF > $HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh
#!/bin/bash

source $HOME/opstella-installation/shell-values/global.vars.sh

# Set kubeconfig file path
export KUBECONFIG=$BASE_WORKING_DIR/local_artifacts/rke2-prod.yaml
# Set name of secret that contains TLS certificate and key for Ingress resources.
export K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME="wildcard-example.com-tls"
export K8S_INTERNAL_DOMAIN="cluster.local"
# Name of the cluster DNS Service in namespace `kube-system`.
# Upstream Kubernetes / most distributions: `kube-dns` (even when backed by CoreDNS).
# RKE2: `rke2-coredns-rke2-coredns`. Verify with `kubectl get svc -n kube-system`.
export K8S_INTERNAL_DNS_SERVICE="kube-dns"
export K8S_INGRESSCLASS_NAME="nginx"
export K8S_STORAGECLASS_NAME="longhorn"

# load tools shell variables
source $HOME/opstella-installation/shell-values/tools/01-base.vars.sh
source $HOME/opstella-installation/shell-values/tools/02-override-prod.vars.sh
EOF

## Tool-Specific Shell Variables

Store all tool-specific variables in the following directory:

- `$HOME/opstella-installation/shell-values/tools/**.vars.sh`

:::tip[Empty Files]
These files are initially empty. You can touch these files to prevent errors when other scripts dynamically source everything in this directory.

 ```sh
 touch $HOME/opstella-installation/shell-values/tools/01-base.vars.sh
 touch $HOME/opstella-installation/shell-values/tools/02-override-mgmt.vars.sh
 touch $HOME/opstella-installation/shell-values/tools/02-override-nonprod.vars.sh
 touch $HOME/opstella-installation/shell-values/tools/02-override-prod.vars.sh

:::

#!/bin/bash
cat <<EOF > $HOME/opstella-installation/shell-values/tools/01-base.vars.sh
# CNPG Operator

# Redis Operator
REDIS_PASSWORD="CHANGEME"

# SeaweedFS Bootstrap
export SEAWEEDFS_BOOTSTRAP_FILER_DOMAIN="seaweedfs-bootstrap.${BASE_DOMAIN}"
export SEAWEEDFS_BOOTSTRAP_API_DOMAIN="bootstrap-s3.${BASE_DOMAIN}"
export SEAWEEDFS_BOOTSTRAP_API_INTERNAL_DOMAIN="seaweedfs-s3.seaweedfs-bootstrap.svc:9000"
export SEAWEEDFS_BOOTSTRAP_ADMIN_DOMAIN="bootstrap-s3-console.${BASE_DOMAIN}"
export SEAWEEDFS_BOOTSTRAP_ADMIN_PASSWORD="CHANGEME"

# SeaweedFS Bootstrap S3
export SEAWEEDFS_BOOTSTRAP_S3_ADMIN_PASSWORD="CHANGEME"
export SEAWEEDFS_BOOTSTRAP_S3_POSTGRES_BACKUP_PASSWORD="CHANGEME"

# SeaweedFS HA
export SEAWEEDFS_HA_FILER_DOMAIN="seaweedfs-ha.${BASE_DOMAIN}"
export SEAWEEDFS_HA_API_DOMAIN="s3.${BASE_DOMAIN}"
export SEAWEEDFS_HA_API_INTERNAL_DOMAIN="seaweedfs-s3.apps-supporting-services.svc:9000"
export SEAWEEDFS_HA_ADMIN_DOMAIN="s3-console.${BASE_DOMAIN}"
export SEAWEEDFS_HA_ADMIN_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_POSTGRES_USER_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_BACKUP_S3_ENDPOINT_URL="http://${SEAWEEDFS_BOOTSTRAP_API_INTERNAL_DOMAIN}/"

# SeaweedFS HA S3
export SEAWEEDFS_HA_S3_TEMPLATE_PREFIX="S3_ha"
export SEAWEEDFS_HA_S3_ADMIN_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_POSTGRES_BACKUP_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_VAULT_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_HARBOR_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_OPSTELLA_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GITLAB_CI_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GITLAB_BACKUP_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GITLAB_SECRETS_BACKUP_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_VELERO_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GRAFANA_MIMIR_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GRAFANA_LOKI_PASSWORD="CHANGEME"
export SEAWEEDFS_HA_S3_GRAFANA_TEMPO_PASSWORD="CHANGEME"

# Velero

# Harbor
export HARBOR_DOMAIN="harbor.${BASE_DOMAIN}"
export HARBOR_ADMIN_USERNAME="admin"
export HARBOR_ADMIN_PASSWORD="CHANGEME"
export HARBOR_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export HARBOR_POSTGRES_USER_PASSWORD="CHANGEME"
export REGISTRY_PASSWD="Harbor_registry_password"
# This creates the format: harbor_registry_user:$apr1$hash
export REGISTRY_HTPASSWD=$(openssl passwd -apr1 -salt $(openssl rand -hex 4) "$REGISTRY_PASSWD" | awk -v user="harbor_registry_user" '{print user ":" $0}')

# Keycloak
export KEYCLOAK_DOMAIN="idp.${BASE_DOMAIN}"
export KEYCLOAK_IMAGE_REPOSITORY="opstella/platform/opstella-keycloak"
export KEYCLOAK_IMAGE_TAG="24.0.5-otv5.1.0"
export KEYCLOAK_ADMIN_USERNAME="admin"
export KEYCLOAK_ADMIN_PASSWORD="CHANGEME"
export KEYCLOAK_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export KEYCLOAK_POSTGRES_USER_PASSWORD="CHANGEME"
export KEYCLOAK_REALM_ADMIN_PASSWORD="CHANGEME"

# Keycloak realm setup
export KEYCLOAK_REALM="example"
export KEYCLOAK_DISPLAY_NAME="Opstella Example"
export KEYCLOAK_REALM_OPSTELLA_GROUP="Opstella"
export KEYCLOAK_REALM_OPSTELLA_GROUP_PATH="opstella"
export KEYCLOAK_REALM_ADMIN_USERNAME="realm-admin"
export KEYCLOAK_REALM_ADMIN_EMAIL="opstella-realm-admin@${BASE_DOMAIN}"
export KEYCLOAK_REALM_ADMIN_PASSWORD="CHANGEME"
export GLOBAL_OIDC_ISSUER_ENDPOINT="https://${KEYCLOAK_DOMAIN}/realms/${KEYCLOAK_REALM}"

# Per-environment ArgoCD hostnames.
# Both are required when rendering kc-realm.yaml, because the Keycloak Realm holds one OIDC
# client per workload cluster and each carries its own redirectUris. The per-cluster
# overrides below set ARGOCD_DOMAIN, which is not visible while rendering the Realm file.
export ARGOCD_NONPROD_DOMAIN="argocd-nonprod.${BASE_DOMAIN}"
export ARGOCD_PROD_DOMAIN="argocd-prod.${BASE_DOMAIN}"

# Keycloak OIDC for Opstella's components
export KEYCLOAK_SIGNING_PUBKEY="WAIT_FOR_UPDATE" # from creds.txt
export DEFECTDOJO_OIDC_CLIENT_ID="defectdojo"
export DEFECTDOJO_OIDC_CLIENT_SECRET="WAIT_FOR_UPDATE" # from creds.txt

# DefectDojo
export DEFECTDOJO_DOMAIN="defectdojo.${BASE_DOMAIN}"
export DEFECTDOJO_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export DEFECTDOJO_POSTGRES_USER_PASSWORD="CHANGEME"
# Cannot change admin username from DefectDojo's default admin
export DEFECTDOJO_ADMIN_PASSWORD="CHANGEME"
export DEFECTDOJO_ADMIN_EMAIL="defectdojo-admin@${BASE_DOMAIN}"

# DefectDojo credentials
export DEFECTDOJO_ADMIN_API_KEY="WAIT_FOR_UPDATE" # from DefectDojo admin user API key on UI after installed

# Sonarqube
export SONARQUBE_DOMAIN="sonarqube.${BASE_DOMAIN}"
export SONARQUBE_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export SONARQUBE_POSTGRES_USER_PASSWORD="CHANGEME"
export SONARQUBE_ADMIN_USERNAME="admin"
export SONARQUBE_ADMIN_PASSWORD="CHANGEME"
export SONARQUBE_OIDC_PLUGIN_URL="https://github.com/vaulttec/sonar-auth-oidc/releases/download/v2.1.1/sonar-auth-oidc-plugin-2.1.1.jar" # update this to your internal server's S3 or HTTP server when air-gapped

# Gitlab
export GITLAB_DOMAIN="gitlab.${BASE_DOMAIN}"
export GITLAB_CLIENT_ID="gitlab"
export GITLAB_CLIENT_SECRET="WAIT_FOR_UPDATE" # from creds.txt
export GITLAB_ROOT_PAT="WAIT_FOR_UPDATE" # from Personal Access Tokens (root user) on GitLab UI

# Grafana Dashboard
export GRAFANA_DASHBOARD_DOMAIN="grafana.${BASE_DOMAIN}"

# Vault
export VAULT_DOMAIN="vault.${BASE_DOMAIN}"
export VAULT_S3_URL="http://${SEAWEEDFS_HA_API_INTERNAL_DOMAIN}/"
export VAULT_S3_ACCESS_KEY="vault"
export VAULT_S3_ACCESS_SECRET="${SEAWEEDFS_HA_S3_VAULT_PASSWORD}"
export VAULT_S3_BUCKET_NAME="vault"
export VAULT_IMAGE_REPOSITORY="${OPSTELLA_REGISTRY}/platform/vault"
export VAULT_IMAGE_TAG="1.20.1-mc-jq"

# Vault rootToken
export VAULT_ROOT_TOKEN="WAIT_FOR_UPDATE" # get from s3 bucket

# Vault OIDC configs
export VAULT_URL="https://${VAULT_DOMAIN}"
export VAULT_OIDC_ISSUER_ENDPOINT="${GLOBAL_OIDC_ISSUER_ENDPOINT}"
export VAULT_OIDC_CLIENT_ID="vault"
export VAULT_OIDC_CLIENT_SECRET="WAIT_FOR_UPDATE" # from creds.txt
# export VAULT_TRUST_ROOT_CA_PATH="${BASE_WORKING_DIR}/cert_key_opstella/Root.crt" # for environment with self-signed CA

# Opstella
# Release Channel Registry. The repository path is assigned per site - confirm it,
# and the version, with Opstella before pulling anything.
export OPSTELLA_SOURCE_REGISTRY="${ARTIFACT_REGISTRY_DOMAIN}/opstella/platform"
export OPSTELLA_VERSION="v5.2.1"
# The UI is built per customer: the tag carries a customer suffix, the other
# components do not. Ask Opstella for the suffix assigned to this site.
export OPSTELLA_UI_IMAGE_TAG="${OPSTELLA_VERSION}"
export OPSTELLA_UI_DOMAIN="opstella.${BASE_DOMAIN}"
export OPSTELLA_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export OPSTELLA_POSTGRES_USER_PASSWORD="CHANGEME"
export OPSTELLA_REDIS_HOST="redis-sentinel-opstella-sentinel.opstella-system.svc:26379"
export OPSTELLA_REDIS_PASSWORD="CHANGEME"
export OPSTELLA_CORE_ADMIN_PASSWORD="CHANGEME"

# Opstella Clear Session
export OPSTELLA_CLEAR_SESSION_DOMAIN="opstella-clear-session.${BASE_DOMAIN}"
export OPSTELLA_CLEAR_SESSION_IMAGE_REPOSITORY="${OPSTELLA_REGISTRY}/platform/clear-session"
export OPSTELLA_CLEAR_SESSION_IMAGE_TAG="v5.2.1"
export OPSTELLA_CLEAR_SESSION_ALLOWED_ORIGINS="https://${OPSTELLA_UI_DOMAIN}"

# Opstella Core License (ok8s)
export OPSTELLA_CORE_LICENSE_SVC="opstella-ok8s.opstella-system.svc"
export OPSTELLA_CORE_LICENSE_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export OPSTELLA_CORE_LICENSE_POSTGRES_USER_PASSWORD="CHANGEME"
export OPSTELLA_CORE_LICENSE_IMAGE_REPOSITORY="${OPSTELLA_REGISTRY}/platform/core-license"
export OPSTELLA_CORE_LICENSE_IMAGE_TAG="v5.2.1"
export OPSTELLA_CORE_LICENSE_POSTGRES_HOST="ok8s-integration-postgres-rw.opstella-system.svc"
export OPSTELLA_CORE_LICENSE_POSTGRES_PORT="5432"
export OPSTELLA_CORE_LICENSE_POSTGRES_DB="ok8s_intergration"
export OPSTELLA_CORE_LICENSE_POSTGRES_USER="ok8s_intergration_user"

# Opstella Core (Backend)
export OPSTELLA_CORE_DOMAIN="opstella-backend.${BASE_DOMAIN}"
export OPSTELLA_CORE_IMAGE_REPOSITORY="${OPSTELLA_REGISTRY}/platform/core"
export OPSTELLA_CORE_IMAGE_TAG="v5.2.1"
export OPSTELLA_POSTGRES_HOST="opstella-postgres-rw.opstella-system.svc"
export OPSTELLA_POSTGRES_PORT="5432"
export OPSTELLA_POSTGRES_DB="opstella_platform"
export OPSTELLA_POSTGRES_USER="opstella_platform_user"
export OPSTELLA_CORE_S3_ENDPOINT_URL="https://${SEAWEEDFS_HA_API_DOMAIN}"
export OPSTELLA_CORE_S3_ADDRESSING_STYLE="path"
export OPSTELLA_CORE_S3_BUCKET_NAME="opstella-web"
export OPSTELLA_CORE_S3_REGION="us-east-1"
export OPSTELLA_CORE_S3_ACCESS_KEY="opstella"
export OPSTELLA_CORE_S3_ACCESS_SECRET="${SEAWEEDFS_HA_S3_OPSTELLA_PASSWORD}"
export OPSTELLA_CORE_CSRF_TRUSTED_ORIGINS="https://*.${BASE_DOMAIN}"

# Opstella UI
export OPSTELLA_UI_IMAGE_REPOSITORY="${OPSTELLA_REGISTRY}/platform/ui" # update to site-specific repo
export OPSTELLA_UI_IMAGE_TAG="v5.2.1" # update to site-specific tag

# Opstella Workers
export OPSTELLA_ENABLED_INSTRUMENTS=(keycloak \
        argocd-nonprod \
        argocd-prod \
        kubernetes \
        defectdojo \
        harbor \
        sonarqube \
        github \
        headlamp-nonprod \
        headlamp-prod \
        vault)
export OPSTELLA_WORKER_IMAGE_TAG="v5.2.1"

# Observability
export GRAFANA_DASHBOARD_DOMAIN="grafana.${BASE_DOMAIN}"
export GRAFANA_DASHBOARD_ADMIN_USERNAME="admin"
export GRAFANA_DASHBOARD_ADMIN_PASSWORD="CHANGEME"

export GRAFANA_DASHBOARD_POSTGRES_USER_PASSWORD="CHANGEME"
export GRAFANA_DASHBOARD_POSTGRES_SUPERUSER_PASSWORD="CHANGEME"
export GRAFANA_DASHBOARD_PASSWORD="CHANGEME"
export GRAFANA_DASHBOARD_OIDC_CLIENT_SECRET="WAIT_FOR_UPDATE" # from creds.txt

export GRAFANA_MIMIR_DOMAIN="mimir.${BASE_DOMAIN}"

export GRAFANA_LOKI_DOMAIN="loki.${BASE_DOMAIN}"

export GRAFANA_TEMPO_DOMAIN="tempo.${BASE_DOMAIN}"

EOF

Per-Cluster Tool Overrides

🟦 Non-Production Workload

#!/bin/bash
cat <<EOF > $HOME/opstella-installation/shell-values/tools/02-override-nonprod.vars.sh

# ArgoCD
export ARGOCD_DOMAIN="argocd-nonprod.${BASE_DOMAIN}"
export ARGOCD_OIDC_ISSUER_ENDPOINT="${GLOBAL_OIDC_ISSUER_ENDPOINT}"
export ARGOCD_OIDC_CLIENT_ID="argocd-nonprod"
export ARGOCD_OIDC_CLIENT_SECRET="WAIT_FOR_UPDATE"

# Headlamp
export HEADLAMP_DOMAIN="headlamp-nonprod.${BASE_DOMAIN}"

EOF

🟥 Production Workload

#!/bin/bash
cat <<EOF > $HOME/opstella-installation/shell-values/tools/02-override-prod.vars.sh

# ArgoCD
export ARGOCD_DOMAIN="argocd-prod.${BASE_DOMAIN}"
export ARGOCD_OIDC_ISSUER_ENDPOINT="${GLOBAL_OIDC_ISSUER_ENDPOINT}"
export ARGOCD_OIDC_CLIENT_ID="argocd-prod"
export ARGOCD_OIDC_CLIENT_SECRET="WAIT_FOR_UPDATE"

# Headlamp
export HEADLAMP_DOMAIN="headlamp-prod.${BASE_DOMAIN}"

EOF

Load Environment

Load your Global Shell Variables and all Tool Variables in your shell session according to the cluster you want to operate by executing the shell script of the cluster.

For example, if you want to operate on the management cluster:

$HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh

Note: You might need to allow execute permission on the shell script first.

chmod +x $HOME/opstella-installation/shell-values/kubernetes/management_cluster.vars.sh

Finished?

Use the below navigation to proceed

ก่อนหน้า
Setup Working Environment ถัดไป
Prepare Access to Kubernetes Cluster(s)

Setup Shell Variable Values

Global Shell Variable Values

Create Global Variable File

Kubernetes Cluster-Specific Shell Variables

🟢 Management

🟦 Non-Production Workload

Share tool shell variables

Per-Cluster Tool Overrides

🟦 Non-Production Workload

🟥 Production Workload

Load Environment

Finished?