Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ingress removal storage service #554

Merged
merged 6 commits into from
Apr 6, 2023
Merged

Ingress removal storage service #554

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
53a4fb2
tenant service updates
atye Mar 30, 2023
1a76050
fix directory in operator auth deployment
atye Mar 30, 2023
7ee6be4
updating docs to latest changes on storage servicce
IsaiasA1 Mar 31, 2023
78731a7
Merge branch 'release-1.7.0' into Ingress-removal-storage-service
IsaiasA1 Apr 5, 2023
b724eb7
consistant descriptions
IsaiasA1 Apr 6, 2023
a22bf81
Merge branch 'Ingress-removal-storage-service' of https://github.com/…
IsaiasA1 Apr 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 17 additions & 12 deletions content/docs/authorization/cli.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,8 @@ tenant-service 1/1 1 1 59m
redis-primary 1/1 1 1 59m
proxy-server 1/1 1 1 59m
redis-commander 1/1 1 1 59m
storage-service 1/1 1 1 59m
role-service 1/1 1 1 59m
```


Expand Down Expand Up @@ -615,7 +617,9 @@ karavictl storage [flags]
##### Options

```
-h, --help help for storage
--addr string address of the csm-authorization storage service
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that addr is the same for tenant and storage service, lets keep the description consistent to be Address of the server (default "localhost")

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

-h, --help help for storage
--insecure insecure skip verify
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this insecure flag serves the same purpose as the insecure flag for storage, lets keep the description consistent - Skip certificate validation

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

```

##### Options inherited from parent commands
Expand Down Expand Up @@ -652,14 +656,14 @@ karavictl storage get [flags]
-h, --help help for get
-s, --system-id string System identifier (default "systemid")
-t, --type string Type of storage system ("powerflex", "powermax")
--insecure insecure skip verify flag for Helm deployment
--addr address of the container for Helm deployment (pod:port)
```

##### Options inherited from parent commands

```
```
--addr string address of the csm-authorization storage service
--config string config file (default is $HOME/.karavictl.yaml)
--insecure insecure skip verify
```

##### Output
Expand Down Expand Up @@ -696,14 +700,15 @@ karavictl storage list [flags]

```
-h, --help help for list
--insecure insecure skip verify flag for Helm deployment
--addr address of the container for Helm deployment (pod:port)
-t, --type string Type of storage system
```

##### Options inherited from parent commands

```
--addr string address of the csm-authorization storage service
--config string config file (default is $HOME/.karavictl.yaml)
--insecure insecure skip verify
```

##### Output
Expand Down Expand Up @@ -753,14 +758,14 @@ karavictl storage create [flags]
-s, --system-id string System identifier (default "systemid")
-t, --type string Type of storage system ("powerflex", "powermax")
-u, --user string Username (default "admin")
--insecure insecure skip verify flag for Helm deployment
--addr address of the container for Helm deployment (pod:port)
```

##### Options inherited from parent commands

```
--addr string address of the csm-authorization storage service
--config string config file (default is $HOME/.karavictl.yaml)
--insecure insecure skip verify
```

##### Output
Expand Down Expand Up @@ -797,14 +802,14 @@ karavictl storage update [flags]
-s, --system-id string System identifier (default "systemid")
-t, --type string Type of storage system ("powerflex", "powermax")
-u, --user string Username (default "admin")
--insecure insecure skip verify flag for Helm deployment
--addr address of the container for Helm deployment (pod:port)
```

##### Options inherited from parent commands

```
--addr string address of the csm-authorization storage service
--config string config file (default is $HOME/.karavictl.yaml)
--insecure insecure skip verify
```

##### Output
Expand Down Expand Up @@ -838,14 +843,14 @@ karavictl storage delete [flags]
-h, --help help for delete
-s, --system-id string System identifier (default "systemid")
-t, --type string Type of storage system ("powerflex", "powermax")
--insecure insecure skip verify flag for Helm deployment
--addr address of the container for Helm deployment (pod:port)
```

##### Options inherited from parent commands

```
--addr string address of the csm-authorization storage service
--config string config file (default is $HOME/.karavictl.yaml)
--insecure insecure skip verify
```

##### Output
Expand Down
4 changes: 2 additions & 2 deletions content/docs/authorization/configuration/proxy-server/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ The storage administrator must first configure the proxy server with the followi

>__Note__:
> - The `RPM deployment` will use the address of the server.
> - The `Helm deployment` will use the address and port of the Ingress hosts for the storage, tenant, and role services.
> - The `Helm deployment` will use the address and port of the Ingress hosts for the proxy-server and role services.

### Configuring Storage

Expand All @@ -27,7 +27,7 @@ A `storage` entity in CSM Authorization consists of the storage type (PowerFlex,
karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ${systemID} --user ${user} --password ${password} --array-insecure

# Helm Deployment
karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ${systemID} --user ${user} --password ${password} --insecure --array-insecure --addr storage.csm-authorization.com:<ingress-nginx-controller-port>
karavictl storage create --type powerflex --endpoint ${powerflexIP} --system-id ${systemID} --user ${user} --password ${password} --insecure --array-insecure --addr csm-authorization.com:<ingress-nginx-controller-port>
```

>__Note__:
Expand Down
9 changes: 2 additions & 7 deletions content/docs/authorization/deployment/helm/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ The following third-party components are optionally installed in the specified n
| authorization.images.storageService | The image to use for the storage-service. | Yes | dellemc/csm-authorization-storage:nightly |
| authorization.images.opa | The image to use for Open Policy Agent. | Yes | openpolicyagent/opa |
| authorization.images.opaKubeMgmt | The image to use for Open Policy Agent kube-mgmt. | Yes | openpolicyagent/kube-mgmt:0.11 |
| authorization.hostname | The hostname to configure the self-signed certificate (if applicable) and the proxy, role, and storage service Ingresses. | Yes | csm-authorization.com |
| authorization.hostname | The hostname to configure the self-signed certificate (if applicable) and the proxy and role Ingresses. | Yes | csm-authorization.com |
| authorization.logLevel | CSM Authorization log level. Allowed values: “error”, “warn”/“warning”, “info”, “debug”. | Yes | debug |
| authorization.zipkin.collectoruri | The URI of the Zipkin instance to export traces. | No | - |
| authorization.zipkin.probability | The ratio of traces to export. | No | - |
Expand All @@ -76,9 +76,6 @@ The following third-party components are optionally installed in the specified n
| authorization.roleServiceIngress.ingressClassName | The ingressClassName of the role-service Ingress. | Yes | - |
| authorization.roleServiceIngress.hosts | Additional host rules to be applied to the role-service Ingress. | No | - |
| authorization.roleServiceIngress.annotations | Additional annotations for the role-service Ingress. | No | - |
| authorization.storageServiceIngress.ingressClassName | The ingressClassName of the storage-service Ingress. | Yes | - |
| authorization.storageServiceIngress.hosts | Additional host rules to be applied to the storage-service Ingress. | No | - |
| authorization.storageServiceIngress.annotations | Additional annotations for the storage-service Ingress. | No | - |
| **redis** | This section configures Redis. | - | - |
| redis.images.redis | The image to use for Redis. | Yes | redis:6.0.8-alpine |
| redis.images.commander | The image to use for Redis Commander. | Yes | rediscommander/redis-commander:latest |
Expand Down Expand Up @@ -129,7 +126,7 @@ Karavictl commands and intended use can be found [here](../../cli/).

The first part of CSM for Authorization deployment is to configure the proxy server. This is controlled by the Storage Administrator.

Configuration is achieved by using `karavictl` to connect to the proxy, storage, and role services. In this example, we will be referencing an installation using `csm-authorization.com` as the authorization.hostname value and the NGINX Ingress Controller accessed via the cluster's master node.
Configuration is achieved by using `karavictl` to connect to the proxy and role services. In this example, we will be referencing an installation using `csm-authorization.com` as the authorization.hostname value and the NGINX Ingress Controller accessed via the cluster's master node.

Run `kubectl -n authorization get ingress` and `kubectl -n authorization get service` to see the Ingress rules for these services and the exposed port for accessing these services via the LoadBalancer. For example:

Expand All @@ -138,7 +135,6 @@ Run `kubectl -n authorization get ingress` and `kubectl -n authorization get ser
NAME CLASS HOSTS ADDRESS PORTS AGE
proxy-server nginx csm-authorization.com 00, 000 86s
role-service nginx role.csm-authorization.com 00, 000 86s
storage-service nginx storage.csm-authorization.com 00, 000 86s

# kubectl -n auth get service
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
Expand All @@ -159,7 +155,6 @@ On the machine running `karavictl`, the `/etc/hosts` file needs to be updated wi
```
<master_node_ip> csm-authorization.com
<master_node_ip> role.csm-authorization.com
<master_node_ip> storage.csm-authorization.com
```

The port that exposes these services is `30016`.
Expand Down
1 change: 0 additions & 1 deletion content/docs/deployment/csmoperator/modules/authorization.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,6 @@ To deploy the Operator, follow the instructions available [here](../../#installa
| PROXY_INGRESS_CLASSNAME | The ingressClassName of the proxy-service Ingress. | Yes | nginx |
| PROXY_INGRESS_HOSTS | Additional host rules to be applied to the proxy-service Ingress. | No | authorization-ingress-nginx-controller.authorization.svc.cluster.local |
| ROLE_INGRESS_CLASSNAME | The ingressClassName of the role-service Ingress. | Yes | nginx |
| STORAGE_INGRESS_CLASSNAME | The ingressClassName of the storage-service Ingress. | Yes | nginx |
| REDIS_STORAGE_CLASS | The storage class for Redis to use for persistence. If not supplied, the default storage class is used. | Yes | - |
| **ingress-nginx** | This section configures the enablement of the NGINX Ingress Controller. | - | - |
| enabled | Enable/Disable deployment of the NGINX Ingress Controller. Set to false if you already have an Ingress Controller installed. | No | true |
Expand Down