-
Notifications
You must be signed in to change notification settings - Fork 153
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add gitops-ee bootstrap cli user documentation #4073
Changes from 6 commits
8404266
d9d8490
c95e0d6
399509e
2541ce3
41779bb
a86e946
d6d36e3
ff88b6d
2747434
13c21c7
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,161 @@ | ||
--- | ||
title: Install Weave GitOps Enterprise via CLI | ||
hide_title: true | ||
toc_max_heading_level: 4 | ||
--- | ||
|
||
import TierLabel from "../../_components/TierLabel"; | ||
import AlphaWarning from "../../_components/_alpha_warning.mdx"; | ||
import Tabs from "@theme/Tabs"; | ||
import TabItem from "@theme/TabItem"; | ||
|
||
|
||
# Install Weave GitOps Enterprise via CLI | ||
|
||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Given we want to manage user expectations coming to the page they better decide whether they could There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. added #4121 |
||
<AlphaWarning/> | ||
|
||
You could install Weave GitOps Enterprise `gitops-ee bootstrap` which streamlines the installation process. It has two main modes: | ||
|
||
1. `Interactive` or Wizard mode for guiding you step-by-step through the process until Weave GitOps Enterprise is up and running. Ideal for your first installation. | ||
2. `Non-interactive` or automated mode where the process will be executed via configuration. Ideal for your automated workflows. | ||
|
||
For those seeking advanced customization, the flexibility to fine-tune [Weave GitOps Enterprise manual install](../install-enterprise) is also available. | ||
|
||
## Prerequisites | ||
|
||
Before you start make sure the following requirements are met: | ||
|
||
- [ ] **Management Cluster**: a Kubernetes cluster with a Kubeconfig that has Admin permissions to be able to create resources. | ||
- [ ] **Git Repository with SSH access**: this is the configuration repo that WeaveGitOps will use to sync configuration manifests from. | ||
- [ ] **Flux CLI**: is [installed](https://fluxcd.io/flux/installation/#install-the-flux-cli) locally. It will be used for reconciling Flux resources. | ||
- [ ] **Flux Bootstrapped** in your Management cluster via ssh. See [Flux Bootstrap](https://fluxcd.io/flux/installation/bootstrap/generic-git-server/) for more info. | ||
- [ ] **Weave GitOps Enterprise Entitlements** are installed in the management cluster. Contact [Sales](../help-and-support/) for help on getting them. | ||
|
||
## Getting Started | ||
|
||
#### Install `gitops-ee` CLI (> v0.35) | ||
|
||
Weave GitOps Enterprise Bootstrap functionality is available on Weave GitOps Enterprise CLI starting from version v0.35. If you haven't already, please install the latest `gitops-ee` CLI using this command. | ||
|
||
```bash | ||
brew install weaveworks/tap/gitops-ee | ||
``` | ||
|
||
#### Bootstrap Weave GitOps Enterprise | ||
|
||
Please use the following command to start the installation wizard of Weave GitOps Enterprise. | ||
|
||
<Tabs groupId="getStarted" default> | ||
|
||
<TabItem value="interactive" label="Interactive"> | ||
|
||
|
||
```bash | ||
|
||
gitops-ee bootstrap | ||
|
||
``` | ||
|
||
|
||
The bootstrap wizard will take you step-by-step into configuring Weave GitOps Enterprise. To understand more about the CLI configurations experience, check the below sections [here](#cli-configurations). | ||
|
||
</TabItem> | ||
|
||
<TabItem value="nonInteractive" label="Non-Interactive"> | ||
|
||
You could run the bootstrap command in non-interactive mode by providing the required configurations as flags. The following gives you an example to get started that you could adapt to your own context | ||
|
||
```bash | ||
gitops-ee bootstrap \ | ||
--kubeconfig="~/.kube/config" \ # (optional) Management cluster configuration. If not set default kubeconfig resolution is used. | ||
--private-key="~/.ssh/id_rsa" --private-key-password="" \ # Git repository SSH configuration | ||
--version="0.33.0" \ # version to install | ||
--domain-type="localhost" \ # how to expose the dashboard | ||
--username=wego-admin --password=admin123 \ # emergency user configuration | ||
--discovery-url="<oidc discovery url>" --client-id="weave-gitops-enterprise" --client-secret="changeme" \ # (optional) OIDC configuration | ||
``` | ||
For more information about the CLI configurations, check the below sections [here](#cli-configurations) | ||
|
||
|
||
</TabItem> | ||
|
||
</Tabs> | ||
|
||
## Appendix | ||
|
||
### Appendix I: Understanding `gitops-ee bootstrap` | ||
|
||
`gitops-ee bootstrap` is a workflow that will take you through the following stages: | ||
|
||
1. [Verify Flux](#verifying-flux): verify Flux installation on the Management cluster. | ||
2. [Verify Entitlement](#verifying-entitlement): verify the Entitlements secret content (username, password, entitlement). | ||
3. [Configure Git Access](#configure-git-access): configure the access to your configuration repo. | ||
4. [Select WGE version](#selecting-wge-version): from the latest 3 available releases. | ||
5. [Create Cluster User](#create-cluster-user): create a Secret with the username and password for the emergency cluster user. | ||
6. [Configure Dashboard Access](#configure-dashboard-access): choose between 2 methods to access the dashboard either local or external. | ||
7. [Access the dashboard](#access-the-dashboard): via the link from the installation success message. | ||
8. (Optional) [Configure OIDC](#configure-oidc): to enable login to dashboard via OIDC providers. | ||
|
||
#### Verify Entitlement | ||
|
||
Weave GitOps Enterprise Entitlement is your obtained license to use our product. The Entitlements file is a Kubernetes secret that contains your licence. | ||
`Bootstrapping` checks that the secret exists on the management cluster, and that it is valid will check if it has valid content and the entitlement is not expired. | ||
To get the entitlement secret please contact *[email protected]*, then apply it on your management cluster with the name `weave-gitops-enterprise-credentials` under `flux-system` namespace. | ||
|
||
#### Verify Flux | ||
|
||
Weave GitOps Enterprise runs on top of flux, the bootstrap CLI will check if flux is installed on the management cluster, and it will verify that it has the right version with valid git repository setup, and it is able to reconcile flux components properly. | ||
If flux is installed, but doesn't have a valid installation, the bootstrap CLI will terminate pending the fix or uninstall of current flux installation. | ||
If flux is not installed at all, the bootstrap CLI offers the option to bootstrap flux. | ||
|
||
#### Configure Git Access | ||
|
||
In order for `gitops-ee bootstrap` to push WGE resources to the management cluster's git repository, you will be prompted to provide the private key used to access your repo via ssh. If the private key is encrypted, you will also be asked to provide the private key password. | ||
:::info | ||
Disclaimer: The bootstrap CLI will ONLY use the private key to push WGE resources to your repo, and won't use it in any other way that can comprimise your repo or clusters security. | ||
::: | ||
|
||
#### Select WGE version | ||
|
||
The bootstrap CLI will prompt you to choose from the latest 3 versions of Weave GitOps Enterprise. | ||
|
||
#### Create Cluster User | ||
|
||
You will be prompt to provide admin username and password, which will be used to access the dashboard. This will create admin secret with the credentials. If you already have previous admin credentials on your cluster, the installation will prompt you if you want to continue with the old credentials or exit and revoke them and re-run the installation. | ||
|
||
#### Configure Dashboard Access | ||
To access Weave GitOps Enterprise dashboard, you have the two following options available: | ||
|
||
1. **Service**: this option is called `localhost` in the cli and the dashboard will be available through a [ClusterIP Service](https://kubernetes.io/docs/concepts/services-networking/service/#type-clusterip). | ||
2. **Ingress**: this option is called `externaldns` the dashboard will be available through an [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) with the following considerations: | ||
- An Ingress controller needs to exist. | ||
- A host-based ingress will be created of the ingress class `public-nginx`. | ||
- An [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation will be added with the value of the provided domain. | ||
|
||
#### Access the dashboard | ||
|
||
After installation is successful. The CLI will print out the URL where you can access the dashboard. | ||
|
||
#### (Optional) Configure OIDC | ||
|
||
OIDC configuration will enable you to login with OIDC provider beside, or instead of the admin credentials. Afte the installation is complete, you will be prompt if you want to configure OIDC access. If you don't want to set it up right away, you can do it later by running `gitops-ee bootstrap auth --type=oidc` command. | ||
|
||
To configure OIDC access, you will be asked to provide the following values: | ||
`DiscoveryUrl` this will verify that OIDC is accessible and get the issuerUrl from the OIDC settings. | ||
`clientID` & `clientSecret` that you have configured on your OIDC static-clients. | ||
|
||
:::note | ||
Please don't forget to add a new static-client on your OIDC provider settings with the redirectURI `your-domain/oauth2/callback` for example `http://localhost:3000/oauth2/callback` | ||
::: | ||
|
||
### Appendix II: CLI configurations | ||
|
||
- `--kube-config`: allows to choose the Kubeconfig for your cluster, default would be ~/.kube/config | ||
- `-d`, `--domain externaldns`: indicate the domain to use in case of using externaldns | ||
- `-t`, `--domain-type`: dashboard domain type: could be 'localhost' or 'externaldns' | ||
- `-h`, `--help`: help for bootstrap | ||
- `-p`, `--password`: Dashboard admin password | ||
- `-k`, `--private-key`: Private key path. This key will be used to push the Weave GitOps Enterprise's resources to the default cluster repository | ||
- `-c`, `--private-key-password`: Private key password. If the private key is encrypted using password | ||
- `-u`, `--username`: Dashboard admin username | ||
- `-v`, `--version`: Weave GitOps Enterprise version to install |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we could add some notes about maturity
alpha
andsecurity
considerations: do we consider mature and secure enough for running it against your production environment?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do some assessment in terms of security risks