Skip to content

Commit 1b33f7b

Browse files
mmoulymmouly
authored
Merge pull request #211 from DecisionsDev/aks-review
Aks review
2 parents 66f517a + a7fc5b3 commit 1b33f7b

9 files changed

+407
-172
lines changed

‎.secrets.baseline

+43-15
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2024-11-22T09:18:32Z",
6+
"generated_at": "2024-11-22T11:14:58Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -292,15 +292,15 @@
292292
"hashed_secret": "d033e22ae348aeb5660fc2140aec35850c4da997",
293293
"is_secret": false,
294294
"is_verified": false,
295-
"line_number": 104,
295+
"line_number": 113,
296296
"type": "Secret Keyword",
297297
"verified_result": null
298298
},
299299
{
300300
"hashed_secret": "c94cfbe098fb5c2eedde2bb22c78fe2cd7e9a0e8",
301301
"is_secret": false,
302302
"is_verified": false,
303-
"line_number": 162,
303+
"line_number": 171,
304304
"type": "Secret Keyword",
305305
"verified_result": null
306306
}
@@ -1111,38 +1111,66 @@
11111111
"verified_result": null
11121112
}
11131113
],
1114-
"platform/azure/README-Azure-SQL-MI.md": [
1114+
"platform/azure/README.md": [
11151115
{
1116-
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1116+
"hashed_secret": "07596f183f5e91b1778d5e47b2752b8d42aa763d",
11171117
"is_secret": false,
11181118
"is_verified": false,
1119-
"line_number": 62,
1119+
"line_number": 174,
11201120
"type": "Secret Keyword",
11211121
"verified_result": null
1122-
}
1123-
],
1124-
"platform/azure/README.md": [
1122+
},
1123+
{
1124+
"hashed_secret": "3ea3f9802accf8817bacd6f3df46a73b93ccddec",
1125+
"is_secret": false,
1126+
"is_verified": false,
1127+
"line_number": 175,
1128+
"type": "Secret Keyword",
1129+
"verified_result": null
1130+
},
11251131
{
11261132
"hashed_secret": "12d57965bd88277e9e9d69dc2b36aae2c0b7e316",
11271133
"is_secret": false,
11281134
"is_verified": false,
1129-
"line_number": 227,
1135+
"line_number": 274,
11301136
"type": "Secret Keyword",
11311137
"verified_result": null
11321138
},
11331139
{
11341140
"hashed_secret": "41b864c967d31ed0bf10562e22faa36324405048",
11351141
"is_secret": false,
11361142
"is_verified": false,
1137-
"line_number": 245,
1143+
"line_number": 292,
11381144
"type": "Secret Keyword",
11391145
"verified_result": null
1140-
},
1146+
}
1147+
],
1148+
"platform/azure/aks-nginx-values.yaml": [
1149+
{
1150+
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1151+
"is_secret": false,
1152+
"is_verified": false,
1153+
"line_number": 21,
1154+
"type": "Secret Keyword",
1155+
"verified_result": null
1156+
}
1157+
],
1158+
"platform/azure/aks-sqlmi-values.yaml": [
1159+
{
1160+
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1161+
"is_secret": false,
1162+
"is_verified": false,
1163+
"line_number": 14,
1164+
"type": "Secret Keyword",
1165+
"verified_result": null
1166+
}
1167+
],
1168+
"platform/azure/aks-values.yaml": [
11411169
{
11421170
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
11431171
"is_secret": false,
11441172
"is_verified": false,
1145-
"line_number": 406,
1173+
"line_number": 14,
11461174
"type": "Secret Keyword",
11471175
"verified_result": null
11481176
}
@@ -1408,15 +1436,15 @@
14081436
"hashed_secret": "ef0ac30957449cec0b3d5cefe691356e5c57bebe",
14091437
"is_secret": false,
14101438
"is_verified": false,
1411-
"line_number": 38,
1439+
"line_number": 39,
14121440
"type": "Secret Keyword",
14131441
"verified_result": null
14141442
},
14151443
{
14161444
"hashed_secret": "08e048ce8880fd249f83a794215df8fd33e58401",
14171445
"is_secret": false,
14181446
"is_verified": false,
1419-
"line_number": 49,
1447+
"line_number": 50,
14201448
"type": "Secret Keyword",
14211449
"verified_result": null
14221450
}

‎platform/azure/README-Azure-SQL-MI.md

+13-12
Original file line numberDiff line numberDiff line change
@@ -51,20 +51,21 @@ kubectl create secret generic <odmdbsecret> --from-literal=db-user=<sqlmiadmin>
5151
5252
Then you can deploy ODM with:
5353

54-
```bash
55-
helm install <release> ibmcharts/ibm-odm-prod \
56-
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=<registrysecret> \
57-
--version 24.1.0 --set service.type=LoadBalancer \
58-
--set externalDatabase.type=sqlserver \
59-
--set externalDatabase.serverName=<sqlminame>.public.<identifier>.database.windows.net \
60-
--set externalDatabase.databaseName=odmdb \
61-
--set externalDatabase.port=3342 \
62-
--set externalDatabase.secretCredentials=<odmdbsecret> \
63-
--set customization.securitySecretRef=<mynicecompanytlssecret> \
64-
--set license=true --set usersPassword=<password>
54+
You can now install the product.
55+
- Get the [aks-sqlmi-values.yaml](./aks-sqlmi-values.yaml) file and replace the following keys:
56+
- `<registrysecret>` is your registry secret name
57+
- `<postgresqlserver>` is your flexible postgres server name
58+
- `<odmdbsecret>` is the database credentials secret name
59+
- `<mynicecompanytlssecret>` is the container certificate
60+
- `<password>` is the password to login with the basic registry users like `odmAmin`
61+
- `<sqlminame>` is the name of the SQL managed instance
62+
- `<identifier>` is the identifier of the dnsZone of the SQL managed instance
63+
64+
```shell
65+
helm install <release> ibmcharts/ibm-odm-prod --version 24.1.0 -f aks-sqlmi-values.yaml
6566
```
6667

67-
Other deployment options (especially using NGINX) and IBM License Service usage are explained in the main [README](README.md).
68+
Other deployment options (especially using NGINX) and IBM License Service usage are explained in the [NGINX README](README-NGINX.md).
6869

6970
## Troubleshooting
7071

‎platform/azure/README-NGINX.md

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Deploying IBM Operational Decision Manager with NGINX Ingress Controller on Azure AKS
2+
3+
The aim of this complementary documentation is to explain how to replace the **AKS default Load Balancer** usage with an **NGINX Ingress Controller**.
4+
5+
## Prerequisites
6+
7+
You must have created an AKS cluster and set up your environment by following steps :
8+
- [Prepare your AKS instance 30 min](README.md#prepare-your-aks-instance-30-min)
9+
- [Create the PostgreSQL Azure instance 10 min](README.md#create-the-postgresql-azure-instance-10-min)
10+
- [Prepare your environment for the ODM installation](README.md#prepare-your-environment-for-the-odm-installation)
11+
12+
## Provision an NGINX Ingress Controller
13+
14+
Installing an NGINX Ingress controller allows you to access ODM components through a single external IP address instead of the different IP addresses as seen above. It is also mandatory to retrieve license usage through the IBM License Service.
15+
16+
1. Use the official YAML manifest:
17+
18+
```shell
19+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.12.0-beta.0/deploy/static/provider/cloud/deploy.yaml
20+
```
21+
22+
> [!NOTE]
23+
> The version will probably change after the publication of our documentation so please refer to the actual [documentation](https://kubernetes.github.io/ingress-nginx/deploy/#azure)!
24+
25+
2. Get the Ingress controller external IP address (it will appear 80 seconds or so after the resource application above):
26+
27+
```shell
28+
kubectl get service --selector app.kubernetes.io/name=ingress-nginx --namespace ingress-nginx
29+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
30+
ingress-nginx-controller LoadBalancer 10.0.78.246 20.19.105.130 80:32208/TCP,443:30249/TCP 2m12s
31+
ingress-nginx-controller-admission ClusterIP 10.0.229.164 <none> 443/TCP 2m12s
32+
```
33+
34+
3. Verify the name of the new IngressClass:
35+
36+
```shell
37+
kubectl get ingressclass
38+
NAME CONTROLLER PARAMETERS AGE
39+
nginx k8s.io/ingress-nginx <none> 5h38m
40+
```
41+
42+
It should be "nginx" but if different please update the next command accordingly.
43+
44+
## Install an ODM release with NGINX Ingress Controller
45+
46+
You can reuse the secret with TLS certificate created [above](README.md#manage-adigital-certificate-10-min):
47+
48+
You can now install the product.
49+
- Get the [aks-nginx-values.yaml](./aks-nginx-values.yaml) file and replace the following keys:
50+
- `<registrysecret>` is your registry secret name
51+
- `<postgresqlserver>` is your flexible postgres server name
52+
- `<odmdbsecret>` is the database credentials secret name
53+
- `<mynicecompanytlssecret>` is the container certificate
54+
- `<password>` is the password to login with the basic registry users like `odmAmin`
55+
56+
```shell
57+
helm install <release> ibmcharts/ibm-odm-prod --version 24.1.0 -f aks-nginx-values.yaml
58+
```
59+
60+
> [!NOTE]
61+
> By default, the NGINX Ingress controller does not enable sticky session. If you want to use sticky session to connect to DC, refer to [Using sticky session for Decision Center connection](../../contrib/sticky-session/README.md)
62+
63+
64+
### Edit the file /etc/hosts on your host
65+
66+
```shell
67+
# vi /etc/hosts
68+
<externalip> mynicecompany.com
69+
```
70+
71+
### Access the ODM services
72+
73+
Check that ODM services are in NodePort type:
74+
75+
```shell
76+
kubectl get services --selector release=<release>
77+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
78+
release-odm-decisioncenter NodePort 10.0.178.43 <none> 9453:32720/TCP 16m
79+
release-odm-decisionrunner NodePort 10.0.171.46 <none> 9443:30223/TCP 16m
80+
release-odm-decisionserverconsole NodePort 10.0.106.222 <none> 9443:30280/TCP 16m
81+
release-odm-decisionserverconsole-notif ClusterIP 10.0.115.118 <none> 1883/TCP 16m
82+
release-odm-decisionserverruntime NodePort 10.0.232.212 <none> 9443:30082/TCP 16m
83+
```
84+
85+
ODM services are available through the following URLs:
86+
87+
<!-- markdown-link-check-disable -->
88+
| SERVICE NAME | URL | USERNAME/PASSWORD
89+
| --- | --- | ---
90+
| Decision Server Console | https://mynicecompany.com/res | odmAdmin/\<password\>
91+
| Decision Center | https://mynicecompany.com/decisioncenter | odmAdmin/\<password\>
92+
| Decision Server Runtime | https://mynicecompany.com/DecisionService | odmAdmin/\<password\>
93+
| Decision Runner | https://mynicecompany.com/DecisionRunner | odmAdmin/\<password\>
94+
<!-- markdown-link-check-enable -->
95+
96+
Where:
97+
98+
* \<password\> is the password provided to the **usersPassword** helm chart parameter
99+
100+
## Install the IBM License Service and retrieve license usage
101+
102+
This section explains how to track ODM usage with the IBM License Service.
103+
104+
Follow the **Installation** section of the [Manual installation without the Operator Lifecycle Manager (OLM)](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=ils-installing-license-service-without-operator-lifecycle-manager-olm) documentation.
105+
106+
### Patch the IBM Licensing instance with Nginx configuration
107+
108+
Get the [licensing-instance-nginx.yaml](./licensing-instance-nginx.yaml) file and run the command:
109+
110+
```bash
111+
kubectl patch IBMLicensing instance --type merge --patch-file licensing-instance-nginx.yaml -n ibm-licensing
112+
```
113+
114+
Wait a couple of minutes for the changes to be applied.
115+
116+
Run the following command to see the status of Ingress instance:
117+
118+
```bash
119+
kubectl get ingress -n ibm-licensing
120+
```
121+
122+
You should be able to see the address and other details about `ibm-licensing-service-instance`.
123+
```
124+
NAME CLASS HOSTS ADDRESS PORTS AGE
125+
ibm-licensing-service-instance nginx * xxx.xxx.xxx.xxx 80 11m
126+
```
127+
128+
You will be able to access the IBM License Service by retrieving the URL with this command:
129+
130+
```bash
131+
export LICENSING_URL=$(kubectl get ingress ibm-licensing-service-instance -n ibm-licensing -o jsonpath='{.status.loadBalancer.ingress[0].ip}')/ibm-licensing-service-instance
132+
export TOKEN=$(kubectl get secret ibm-licensing-token -n ibm-licensing -o jsonpath='{.data.token}' |base64 -d)
133+
```
134+
135+
You can access the `http://${LICENSING_URL}/status?token=${TOKEN}` URL to view the licensing usage.
136+
137+
Otherwise, you can also retrieve the licensing report .zip file by running:
138+
139+
```bash
140+
curl "http://${LICENSING_URL}/snapshot?token=${TOKEN}" --output report.zip
141+
```
142+
143+
If your IBM License Service instance is not running properly, refer to this [troubleshooting page](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=service-troubleshooting-license).
144+
145+
## Troubleshooting
146+
147+
If your ODM instances are not running properly, refer to [our dedicated troubleshooting page](https://www.ibm.com/docs/en/odm/9.0.0?topic=900-troubleshooting-support).
148+
149+
## Getting Started with IBM Operational Decision Manager for Containers
150+
151+
Get hands-on experience with IBM Operational Decision Manager in a container environment by following this [Getting started tutorial](https://github.com/DecisionsDev/odm-for-container-getting-started/blob/master/README.md).
152+
153+
# License
154+
155+
[Apache 2.0](/LICENSE)

0 commit comments

Comments
 (0)