Skip to content

Commit

Permalink
5024 doc/update kubeapps on tce tutorial (#5307)
Browse files Browse the repository at this point in the history
* Update Kubeapps on TCE tutorial to comply style guidelines

* Update outcome for steps 1 to 3

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/01-TCE-cluster-preparation.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-managed-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/03-preparing-kubeapps-deployment.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

* Update site/content/docs/latest/tutorials/kubeapps-on-tce/02-TCE-unmanaged-cluster.md

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>

Co-authored-by: Antonio Gámez, PhD <antgamdia@gmail.com>
  • Loading branch information
ppbaena and antgamdia committed Sep 7, 2022
1 parent f09692d commit cfeac1c
Show file tree
Hide file tree
Showing 8 changed files with 83 additions and 33 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ The main components are:

Offer a single node, local workstation cluster suitable for a development/test environment. You can read more about [unmanaged clusters in the official Tanzu Community Edition documentation](https://tanzucommunityedition.io/docs/v0.12/planning/#unmanaged-cluster).

In this step of the tutorial, we will prepare the installation of the TCE cluster.
In this step, the goal is to prepare the installation of the TCE cluster.

## Step 1.1: Install Tanzu CLI

Expand Down Expand Up @@ -51,3 +51,11 @@ or
- Do you want a full-featured, scalable Kubernetes implementation suitable for a development or production environment? If so, continue the tutorial by deploying an [managed cluster](./02-TCE-managed-cluster.md).

If you want to know more about planning your deployment check out [the official TCE documentation](https://tanzucommunityedition.io/docs/v0.12/planning/).

## Tutorial index

1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Step 2B: Deploy a VMware Tanzu™ Community Edition managed cluster

In this step of the tutorial, we will install a [managed TCE cluster](https://tanzucommunityedition.io/docs/v0.12/planning/#managed-cluster).
In this step, the goal is to install a [managed TCE cluster](https://tanzucommunityedition.io/docs/v0.12/planning/#managed-cluster).

VMware Tanzu™ Community Edition supports the following infrastructure providers for managed clusters:

Expand All @@ -13,25 +13,25 @@ TCE offers a UI for setting up all the different parameters needed.

## Preparing the OpenID Connect (OIDC) authentication

Before creating the cluster, we will need to set up a proper OIDC provider that Kubernetes will use to authenticate requests.
Before creating the cluster, it is necessary to set up a proper OIDC provider that Kubernetes use to authenticate requests.

For this tutorial we will use _Google Identity Platform_ OIDC provider, but there are more options of [using an OAuth2/OIDC Provider with Kubeapps](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/tutorials/using-an-OIDC-provider.md).
This tutorial addresses the configuration of the _Google Identity Platform_ OIDC provider, but there are more options of [using an OAuth2/OIDC Provider with Kubeapps](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/tutorials/using-an-OIDC-provider.md).

### Setting up the Google credentials client

In the case of Google, we can use an OAuth 2.0 client.
Create a new "Web Application" client following [this steps](https://support.google.com/cloud/answer/6158849?hl=en).
You can use an OAuth 2.0 client.
Create a new "Web Application" client following [these steps](https://support.google.com/cloud/answer/6158849?hl=en).

At the end of this section, we should have:
At the end of this section, you should have:

- _Issuer URL_: The IP or DNS address of the OIDC server. In our case, this might be `https://accounts.google.com`.
- _Issuer URL_: The IP or DNS address of the OIDC server. In this case, it might be `https://accounts.google.com`.
- _Client ID_: The client_id value that you obtain from your OIDC provider.
- _Client Secret_: The secret value that you obtain from your OIDC provider.
- _Scopes_: A comma-separated list of additional scopes to request in the token response.
- _Username Claim_: The name of your username claim. This is used to set a user’s username in the JSON Web Token (JWT) claim.
- _Groups Claim_: The name of your group's claim. This is used to set a user’s group in the JWT claim.

This information will be used to both set up the Kubernetes cluster, and in a further step, configure Kubeapps so that both use Google as an identity provider.
This information is used to both set up the Kubernetes cluster, and in a further step, configure Kubeapps so that both use Google as an identity provider.

## Deploying the cluster

Expand All @@ -51,7 +51,7 @@ This information will be used to both set up the Kubernetes cluster, and in a fu
tanzu management-cluster get
```

The output will look similar to the following:
The output should be similar to the following:

```bash
NAME NAMESPACE STATUS CONTROLPLANE WORKERS KUBERNETES ROLES PLAN
Expand Down Expand Up @@ -97,8 +97,18 @@ This information will be used to both set up the Kubernetes cluster, and in a fu
tanzu package repository add tce-repo --url projects.registry.vmware.com/tce/main:0.12.0 --namespace tanzu-package-repo-global
```

The outcome of the actions above will be a management, managed TCE cluster running on your preferred infrastructure provider. Starting with that, _workload_ clusters could be created and be controlled from this _management_ cluster. For simplicity reasons, we will continue the tutorial using only the management cluster, but it is not a recommended strategy for production setups.
The outcome of the actions above is a _managed_ TCE cluster running on your preferred infrastructure provider. From this _management_ cluster, new _workload_ clusters can be spun up and attached to it.

For the sake of simplicity, this tutorial only uses a single _management_ cluster with no attached _workload: clusters, but note that it is not a recommended strategy for production setups.

For further information on how to create TCE workload clusters please check [the official documentation](https://tanzucommunityedition.io/docs/v0.12/getting-started/#deploy-a-workload-cluster).

> Continue the tutorial by [preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md).
## Tutorial index

1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Step 2A: Deploy a VMware Tanzu™ Community Edition unmanaged cluster

In this step of the tutorial, we will install an [unmanaged TCE cluster](https://tanzucommunityedition.io/docs/v0.12/planning/#unmanaged-cluster).
In this step, the goal is to install an [unmanaged TCE cluster](https://tanzucommunityedition.io/docs/v0.12/planning/#unmanaged-cluster).

By default, unmanaged clusters run locally via kind (default) or minikube with Tanzu components installed atop.

Expand Down Expand Up @@ -89,14 +89,14 @@ By default, unmanaged clusters run locally via kind (default) or minikube with T

## Authentication for an unmanaged cluster

Unmanaged clusters are meant for development/testing mainly, and for this tutorial we will use the **service account authentication**.
Unmanaged clusters are meant for development/testing mainly, and this tutorial uses the **service account authentication**.

Please remember that for any user-facing installation you should [configure an OAuth2/OIDC provider](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/tutorials/using-an-OIDC-provider.md) to enable secure user authentication with Kubeapps and the cluster.

### Credentials creation

Let's continue by creating a demo credential with which to access Kubeapps and Kubernetes.
Service account will be named `kubeapps-operator` and will have `cluster-admin` role.
Service account named `kubeapps-operator` with a `cluster-admin` role.

```bash
kubectl create --namespace default serviceaccount kubeapps-operator
Expand All @@ -119,7 +119,7 @@ EOF
### Credentials retrieval

In order to access Kubeapps, a token will be required. Given that we are using plain service account authentication, it is straightforward to obtain a token.
In order to access Kubeapps, a token is required. Given that you are using plain service account authentication, it is straightforward to obtain a token.
Keep the obtained token for later steps of the tutorial.

#### On Linux/macOS
Expand All @@ -137,3 +137,11 @@ Open a Powershell terminal and run:
```

> Continue the tutorial by [preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md).
## Tutorial index

1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
# Step 3: Preparing Kubeapps deployment

Before Kubeapps is deployed to the TCE cluster, there are some decisions that need to be taken. This will shape the installation structure and functioning of the application.
Before Kubeapps is deployed to the TCE cluster, there are some decisions to take in order to shape the installation structure and functioning of the application.

Some relevant topics like routing traffic into Kubeapps, TLS, or which plugins need to be enabled, will be set up in a _configuration values file_.
A configuration values file is a Yaml file that allows you to customize the deployment of Kubeapps. TCE makes use of [Carvel](https://carvel.dev/) for installing applications, and in the case of the Kubeapps package, the configuration file uses exactly the same parameters specified in the [Bitnami Kubeapps Helm chart.](https://github.com/bitnami/charts/tree/master/bitnami/kubeapps#parameters) It is highly recommended that you take a look at the possible parameters and get familiar with them.
Some relevant topics like routing traffic into Kubeapps, TLS, or which plugins need to be enabled, are set up in a _configuration values file_.
A configuration values file is a Yaml file that allows you to customize the deployment of Kubeapps. TCE makes use of [Carvel](https://carvel.dev/) for installing applications, and in the case of the Kubeapps package, the configuration file uses exactly the same parameters specified in the [Bitnami Kubeapps Helm chart](https://github.com/bitnami/charts/tree/master/bitnami/kubeapps#parameters). It is highly recommended that you take a look at the possible parameters and get familiar with them.

The outcome of this tutorial step will be:
The outcome of this step is:

- A configuration values file that matches your desired setup for Kubeapps
- Required packages ready to make the configuration work (for example, installing the actual Ingress provider)
- A configuration values file that matches your desired setup for Kubeapps.
- Required packages ready to make the configuration work (for example, installing the actual Ingress provider).

## Option A: Getting traffic into Kubeapps using a LoadBalancer

Expand All @@ -26,7 +26,7 @@ Using an [ingress](https://kubernetes.io/docs/concepts/services-networking/ingre

In order to do so, you need to define a _fully qualified domain name_ (FQDN), and preferably a TLS certificate available so that clients, like browsers, can safely navigate the UI.

In this tutorial we will use the FQDN `kubeapps.foo.com` to access Kubeapps as an example.
This tutorial uses the FQDN `kubeapps.foo.com` to access Kubeapps as an example.

Add a TLS certificate with the following command:

Expand Down Expand Up @@ -139,7 +139,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main
## Configuring OIDC
In case you selected OIDC as your authentication method, you will need to set some parameters in the configuration values file. This is needed so that the OAuth proxy used in Kubeapps can contact the OIDC provider and exchange the tokens.
In case you selected OIDC as your authentication method, you need to set some parameters in the configuration values file. This is needed so that the OAuth proxy used in Kubeapps can contact the OIDC provider and exchange the tokens.
Please retrieve the values obtained in the [Setting up Google credentials client](./02-TCE-managed-cluster.md#setting-up-the-google-credentials-client) section and set them in your configuration values:
Expand All @@ -161,7 +161,7 @@ authProxy:
## Configuring selected plugins
Kubeapps offers three plugins for managing packages and repositories: [Helm](https://helm.sh/docs/topics/chart_repository/), [Carvel](https://carvel.dev/kapp-controller/docs/develop/packaging/#package-repository) and [Flux](https://fluxcd.io/docs/components/source/helmrepositories/).
Kubeapps offers three plugins for managing packages and repositories: [Helm](https://helm.sh/docs/topics/chart_repository/), [Carvel](https://carvel.dev/kapp-controller/docs/develop/packaging/#package-repository) and [Helm via Flux](https://fluxcd.io/docs/components/source/helmrepositories/).
You need to define in the configuration values which plugins you want have installed, for example:
```yaml
Expand All @@ -177,3 +177,11 @@ packaging:
At this point, you should have a proper Yaml file with configuration values.
> Continue the tutorial by [deploying Kubeapps](./04-deploying-kubeapps.md).
## Tutorial index
1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
Once your TCE cluster is up and running and you have a valid configuration values file, you can proceed to deploy Kubeapps.

One of the key features of Tanzu is its use of _Carvel_.
[Carvel](https://carvel.dev/) is a project that provides a set of reliable, single-purpose, composable tools that aid in your application building, configuration, and deployment to Kubernetes. In this tutorial, you will use the Carvel packaging format to install Kubeapps.
[Carvel](https://carvel.dev/) is a project that provides a set of reliable, single-purpose, composable tools that aid in your application building, configuration, and deployment to Kubernetes. This tutorial uses the Carvel packaging format to install Kubeapps.

1. Check that Kubeapps is an available package in the cluster with:

Expand Down Expand Up @@ -53,7 +53,7 @@ One of the key features of Tanzu is its use of _Carvel_.
kapp inspect -a kubeapps-ctrl -n kubeapps
```

5. At this point, Kubeapps should be deployed and running in the TCE cluster.
5. At this point, Kubeapps is deployed and running in the TCE cluster.

If you chose a **LoadBalancer** to access Kubeapps: wait for your cluster to assign a `LoadBalancer` IP or Hostname to the kubeapps Service and access it on that address:

Expand All @@ -63,6 +63,14 @@ One of the key features of Tanzu is its use of _Carvel_.

If you chose an **Ingress** to access Kubeapps: open a browser and navigate to the FQDN defined for Kubeapps, for example [https://tce-cluster.foo.com](https://tce-cluster.foo.com).

> When using OIDC, you will need to configure your OAuth2 client to admit the `LoadBalancer` IP/Host or the `Ingress` FQDN as authorized origins and redirects. Please add the suffix `/oauth2/callback` to the redirect URLs in your OIDC provider setup.
> When using OIDC, you need to configure your OAuth2 client to admit the `LoadBalancer` IP/Host or the `Ingress` FQDN as authorized origins and redirects. Please add the suffix `/oauth2/callback` to the redirect URLs in your OIDC provider setup.
> Continue the tutorial by [managing applications with Kubeapps](./05-managing-applications.md).
## Tutorial index

1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,11 @@ You can explore the existing documentation for operating Kubeapps and all its fu
- [Listing applications running in your cluster](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/howto/dashboard.md#list-all-the-applications-running-in-your-cluster)
- [Remove existing applications](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/howto/dashboard.md#remove-existing-application-deployments)
- [Use private repositories with Kubeapps](https://github.com/vmware-tanzu/kubeapps/blob/main/site/content/docs/latest/howto/private-app-repository.md#using-a-private-repository-with-kubeapps)

## Tutorial index

1. [TCE cluster deployment preparation](./01-TCE-cluster-preparation.md)
2. [Deploying a managed cluster](./02-TCE-managed-cluster.md) or [Deploy an unmanaged cluster](./02-TCE-unmanaged-cluster.md)
3. [Preparing the Kubeapps deployment](./03-preparing-kubeapps-deployment.md)
4. [Deploying Kubeapps](./04-deploying-kubeapps.md)
5. [Further documentation for managing applications in Kubeapps](./05-managing-applications.md)
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@

[VMware Tanzu™ Community Edition (TCE)](https://tanzucommunityedition.io) is a full-featured, easy-to-manage Kubernetes platform for learners and users, especially those working in small-scale or preproduction environments.

[Kubeapps](https://kubeapps.com/) provides a web-based dashboard to deploy, manage, and upgrade applications on a Kubernetes cluster. It is a one-time install that gives you a number of important benefits, including the ability to browse and deploy Helm charts from public or private chart repositories and upgrade, manage and delete deployments from your Web browser.
[Kubeapps](https://kubeapps.com/) provides a web-based dashboard to deploy, manage, and upgrade applications on a Kubernetes cluster. It is a one-time install that gives you a number of important benefits, including the ability to browse and deploy Helm charts and Carvel packages from public or private repositories and upgrade, manage and delete deployments from your Web browser.

[This guide](introduction.md) walks you through the process of configuring, deploying and using Kubeapps on VMware Tanzu™ Community Edition.

0 comments on commit cfeac1c

Please sign in to comment.