Skip to content
This repository has been archived by the owner on Dec 16, 2024. It is now read-only.

Latest commit

 

History

History
98 lines (65 loc) · 5.28 KB

service-protection-installation.md

File metadata and controls

98 lines (65 loc) · 5.28 KB

Installing Kuadrant Service Protection into an existing OCM Managed Cluster

Introduction

This walkthrough will show you how to install and setup the Kuadrant Operator into an OCM Managed Cluster.

Prerequisites

  • Access to an Open Cluster Management(OCM) (>= v0.11.0) Managed Cluster, which has already been bootstrapped and registered with a hub cluster
  • Kubectl (>= v1.14.0)
  • OLM installed on the ManagedCluster where you want to run the Kuadrant Service Protection components
  • Istio operator v1.20.0 installed on the spoke clusters
    • Please see install guide here
  • Gateway API v1
    • To install please use:
     kubectl apply -f "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml"

Install the Kuadrant OCM Add-On

To install the Kuadrant Service Protection components into a spoke ManagedCluster, target your OCM Hub cluster with kubectl and run:

kubectl apply -k "github.com/kuadrant/multicluster-gateway-controller.git/config/service-protection-install-guide?ref=release-0.3" -n namespace-of-your-managed-spoke-cluster-on-the-hub

The above command will install the ManagedClusterAddOn resource needed to install the Kuadrant addon into the namespace representing a spoke cluster, and install the Kuadrant data-plane components into the open-cluster-management-agent-addon namespace.

The Kuadrant addon will install:

  • Kuadrant Operator
  • Limitador (and its associated operator)
  • Authorino (and its associated operator)

For more details, see the Kuadrant components installed by the kuadrant-operator

OLM and OpenShift CatalogSource

The Kuadrant OCM (Open Cluster Management) Add-On depends on the Operator Lifecycle Manager (OLM)'s CatalogSource. By default, this is set to olm/operatorhubio-catalog.

In OpenShift environments, OLM comes pre-installed. However, it is configured to use the openshift-marketplace/community-operators CatalogSource by default, not the olm/operatorhubio-catalog.

To align the Kuadrant add-on with the OpenShift default CatalogSource, you can patch the add-on's CatalogSource configuration. Run the following command (note it needs to be run for each managed cluster where the add-on is installed):

kubectl annotate managedclusteraddon kuadrant-addon "addon.open-cluster-management.io/values"='{"CatalogSource":"community-operators", "CatalogSourceNS":"openshift-marketplace"}' -n managed-cluster-ns

Existing Istio installations and changing the default Istio Operator name

In the case where you have an existing Istio installation on a cluster, you may encounter an issue where the Kuadrant Operator expects Istio's Operator to be named istiocontrolplane.

The istioctl command saves the IstioOperator CR that was used to install Istio in a copy of the CR named installed-state.

To let the Kuadrant operator use this existing installation, set the following:

kubectl annotate managedclusteraddon kuadrant-addon "addon.open-cluster-management.io/values"='{"IstioOperator":"installed-state"}' -n <managed spoke cluster>

This will propagate down and update the Kuadrant Operator, used by the Kuadrant OCM Addon.

Changing the name of the channel to use

If you want to use a different channel with the ManagedClusterAddon to install the kuadrant operator. You can do so by overriding the channel with the follow annotation:

kubectl annotate managedclusteraddon kuadrant-addon "addon.open-cluster-management.io/values"='{"CatalogSourceNS":"openshift-marketplace", "CatalogSource":"community-operators", "Channel":"preview"}' -n managed-cluster-ns

This will propagate down and update the Kuadrant Subscription, used by OLM in the spoke.

Verify the Kuadrant addon installation

To verify the Kuadrant OCM addon has installed currently, run:

kubectl wait --timeout=5m -n kuadrant-system kuadrant/kuadrant-sample --for=condition=Ready

You should see the namespace kuadrant-system, and the following pods come up:

  • authorino-value
  • authorino-operator-value
  • kuadrant-operator-controller-manager-value
  • limitador-value
  • limitador-operator-controller-manager-value

Further Reading

With the Kuadrant data plane components installed, here is some further reading material to help you utilise Authorino and Limitador:

Getting started with Authorino Getting started With Limitador