Skip to content

Commit

Permalink
update
Browse files Browse the repository at this point in the history
  • Loading branch information
karl-johan-grahn committed Jan 15, 2025
1 parent 13a05a8 commit 96242c9
Show file tree
Hide file tree
Showing 33 changed files with 44 additions and 44 deletions.
2 changes: 1 addition & 1 deletion content/about/cloud-providers/aws.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ An AWS account is needed to create and manage cluster on AWS. The following crit
|Type | Limit |
|------------|------------|
| Virtual Machines | Varies. The limit should be 12 initially. (Initial deployment is 3 control plane + 3 infra + 3 worker)|
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMS (worker + infra + control plane), B = vCPUs per VM) |
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMs (worker + infra + control plane), B = vCPUs per VM) |
| Elastic IPs (EIPs) | 5 |
| Virtual Private Clouds (VPCs) | 5 |
| Elastic Load Balancing (ELB/NLB) | 3 |
Expand Down
2 changes: 1 addition & 1 deletion content/about/cloud-providers/azure.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ An Azure subscription is needed to create and manage cluster on Azure. The follo
|Type | Limit |
|------------|------------|
| Virtual Machines | Varies. The limit should be 12 initially. (Initial deployment is 3 control plane + 3 infra + 3 worker) |
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMS (worker + infra + control plane), B = vCPUs per VM) |
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMs (worker + infra + control plane), B = vCPUs per VM) |
| Public IP addresses | 5 |
| Private IP Addresses | 7 |
| Network Interfaces | 6 |
Expand Down
2 changes: 1 addition & 1 deletion content/about/cloud-providers/binero.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,6 @@ An OpenStack account is needed to run SAAP on [Binero](https://binero.com/en/).

## Cloud network configuration

### Floating Ips
### Floating IPs

- 20 SEK per IPV4 IP Address
2 changes: 1 addition & 1 deletion content/about/cloud-providers/gcp.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ A GCP account is needed to create and manage cluster on GCP. The following crite
|Type | Limit |
|------------|------------|
| Virtual Machines | Varies. The limit should be 12 initially. (Initial deployment is 3 control plane + 3 infra + 3 worker)|
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMS (worker + infra + control plane), B = vCPUs per VM) |
| Regional vCPUs | The limit should be A x B x 2 , where A = no. of VMs (worker + infra + control plane), B = vCPUs per VM) |
| In-use global IP addresses | 4 |
| Service accounts | 5 |
| Firewall Rules | 11|
Expand Down
2 changes: 1 addition & 1 deletion content/for-administrators/help/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,5 @@

## Why do we reserve memory/CPU on each node?

An OpenShift/Kubernetes Node consist system services that ensure the smooth running of cluster e.g. Kubelet, KubeAPIServer and other OS processes/services. These services can be starved by the workloads running on these nodes and can be starved of CPU time or can cause unexpected Out of Memory (OOM) Exceptions. In order to prevent these issues, a small chunk of resources needs to be permanently allocated to these services so they can run smoothly.
An OpenShift/Kubernetes Node consist system services that ensure the smooth running of cluster e.g. kubelet, KubeAPIServer and other OS processes/services. These services can be starved by the workloads running on these nodes and can be starved of CPU time or can cause unexpected Out of Memory (OOM) Exceptions. In order to prevent these issues, a small chunk of resources needs to be permanently allocated to these services so they can run smoothly.
In order to fully utilize resources. An automatic script calculates and allocates CPU/memory resources according to the node utilization. For more details see [capacity reservation docs](https://docs.openshift.com/container-platform/latest/nodes/nodes/nodes-nodes-resources-configuring.html#nodes-nodes-resources-configuring-auto_nodes-nodes-resources-configuring) for OpenShift.
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,9 @@ The permissions for the Customer Admin role includes:

#### Compute

- can view machines, machinesets, nodes, machine configs, machine config pools, imagestreams
- can view machines, MachineSets, nodes, machine configs, machine config pools, imagestreams
- can start `anyuid` and `nonroot` SCCs
- can not delete machines, machinesets, nodes, machine configs, machine config pools, imagestreams
- can not delete machines, MachineSets, nodes, machine configs, machine config pools, imagestreams

#### User Management

Expand Down
2 changes: 1 addition & 1 deletion content/for-administrators/user-stories.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,4 @@ As an administrator, I want to configure node autoscaling, including scale-up to

![type:video](https://www.youtube.com/embed/c3FvQXgZdRE)

Tags: AutoScaling
Tags: Autoscaling
2 changes: 1 addition & 1 deletion content/for-cisos-dpos/cis.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ The CIS Kubernetes Benchmark provides over **120 recommendations** for securing
- Enforcing Role-Based Access Control (RBAC) to restrict unauthorized access.
- Securing API server communication with TLS encryption.
- **Node Security**:
- Disabling anonymous Kubelet access (--anonymous-auth=false).
- Disabling anonymous `kubelet` access (`--anonymous-auth=false`).
- Restricting workload communications with NetworkPolicies.
- **Data Protection**:
- Encrypting Secrets in etcd using Kubernetes encryption providers.
Expand Down
2 changes: 1 addition & 1 deletion content/for-developers/explanation/deploying-secrets.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ The following secrets are needed for running a fully functional pipeline using p
* _Used for_: Communicating with RHACS API to scan images and deployments
* _Lifecycle_: Created at the time of RHACS deployment. The secret is then copied over to build namespaces of tenants.
* _Comment_: Needs to be deployed in build namespace. We deploy it using TGI.
* _Deployment Process_: After StackRox is installed on the SAAP cluster. An api token is created and stored in the rox-creds secret in the `stakater-stackrox` namespaces. We then use a Template and a TemplateGroupInstance with the same name to distribute the secret in the build namespace of tenants.
* _Deployment Process_: After StackRox is installed on the SAAP cluster. An API token is created and stored in the rox-creds secret in the `stakater-stackrox` namespaces. We then use a Template and a TemplateGroupInstance with the same name to distribute the secret in the build namespace of tenants.

## Customer Managed Secrets

Expand Down
4 changes: 2 additions & 2 deletions content/for-developers/explanation/plan-your-deployment.md
Original file line number Diff line number Diff line change
Expand Up @@ -106,9 +106,9 @@ See [StatefulSet Updates](https://kubernetes.io/docs/concepts/workloads/controll

There can be multiple ways to scale your application.

- Use Horizontal Pod Autoscaler (HPA) to specify how OpenShift Container Platform should automatically increase or decrease the scale of a replication controller or deployment configuration, based on metrics collected from the pods that belong to that replication controller or deployment configuration. See [Horizontal Pod AutoScaling Kubernetes](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) & [Horizontal Pod AutoScaling OpenShift](https://docs.openshift.com/container-platform/4.9/nodes/pods/nodes-pods-autoscaling.html)
- Use Horizontal Pod Autoscaler (HPA) to specify how OpenShift Container Platform should automatically increase or decrease the scale of a replication controller or deployment configuration, based on metrics collected from the pods that belong to that replication controller or deployment configuration. See [Horizontal Pod Autoscaling Kubernetes](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) & [Horizontal Pod Autoscaling OpenShift](https://docs.openshift.com/container-platform/4.9/nodes/pods/nodes-pods-autoscaling.html)

- Use Vertical Pod Autoscaler Operator (VPA) to automatically reviews the historic and current CPU and memory resources for containers in pods and can update the resource limits and requests based on the usage values it learns. See [Vertical Pod AutoScaling](https://docs.openshift.com/container-platform/4.9/nodes/pods/nodes-pods-vertical-autoscaler.html)
- Use Vertical Pod Autoscaler Operator (VPA) to automatically reviews the historic and current CPU and memory resources for containers in pods and can update the resource limits and requests based on the usage values it learns. See [Vertical Pod Autoscaling](https://docs.openshift.com/container-platform/4.9/nodes/pods/nodes-pods-vertical-autoscaler.html)

### How can I automate my app deployment?

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,6 @@ Implement logging, tracing, and monitoring mechanisms to gain visibility into th

- Pod security policies are configurations that define which security-related conditions a Kubernetes pod has to meet in order to be accepted into a cluster

## Documentation and Runbook
## Documentation and runbook

Create detailed documentation or a runbook that outlines the deployment process, including all necessary steps and configurations. Include troubleshooting guides, common issues, and solutions for reference during the go-live process and ongoing maintenance.
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@

### Login to Image Registry

1. Find the Image registry URL [here](../../../managed-addons/nexus/explanation/routes.md) or Navigate to the cluster Forecastle, search `nexus` using the search bar on top menu and copy the nexus url.
1. Find the Image registry URL [here](../../../managed-addons/nexus/explanation/routes.md) or Navigate to the cluster Forecastle, search `nexus` using the search bar on top menu and copy the nexus URL.

- `nexus-docker-reg-url`: Remove `https://` from the start and add `-docker` in URL after `nexus`. This URL points to Docker Registry referred as `nexus-docker-reg-url` in this tutorial for example `nexus-docker-stakater-nexus.apps.clustername.random123string.kubeapp.cloud`.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Exposing Your Application to Internet over httpS and custom hostname
# Exposing Your Application to Internet over https and custom hostname

This guide provides a step-by-step process to configure an OpenShift `Route` resource to expose your application to the internet.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Enable metrics for Spring Boot Application

We need Prometheus metrics to be exposed by our application to be able to monitor it.
How an application exposes its metrics depends upon how it is built. We will take the example of a spring boot application and expose its metrics on a Url for Prometheus to monitor.
How an application exposes its metrics depends upon how it is built. We will take the example of a spring boot application and expose its metrics on a URL for Prometheus to monitor.

## Enabling metrics for a Spring Boot Application

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
Find Nexus Helm Registry URL [here](../../../managed-addons/nexus/explanation/routes.md).

Alternatively, Navigate to the cluster Forecastle, search `nexus` using the search bar on top menu and copy the nexus url.
Alternatively, Navigate to the cluster Forecastle, search `nexus` using the search bar on top menu and copy the nexus URL.

- `nexus-helm-reg-url` : Add `-helm` in URL after `nexus` and append `/repository/helm-charts/`. This URL points to Helm Registry referred as `nexus-helm-reg-url` in this tutorial for example `https://nexus-helm-stakater-nexus.apps.clustername.random123string.kubeapp.cloud/repository/helm-charts/`

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ Now let's add a PrometheusRule for the application. In the previous section, we
Now we need to tell Alert Manager where to send the alert. For this, we will need to add an AlertManagerConfig.
1. If you need to send an alert to a Slack channel. You will first need to [add a webhook for that channel in Slack](https://docs.stakater.com/saap/managed-addons/monitoring-stack/log-alerts.html)
Once you have the webhook Url, you can add the AlertManagerConfig. The Alertmanager uses a secret to pick up details of the endpoint to send the alerts to.
Once you have the webhook URL, you can add the AlertManagerConfig. The Alertmanager uses a secret to pick up details of the endpoint to send the alerts to.
1. Let's create the secret first. Log in to SAAP > Administrator > Workloads > Secrets in your namespace. Create a secret from YAML. Replace "namespace" with the namespace in which your application is deployed and "api_url" with base64 encoded webhook URL:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ This comprehensive tutorial will walk you through the process of effectively uti

## Objective

- Define secrets and configMaps in the `values.yaml` file for your application.
- Define secrets and Configmaps in the `values.yaml` file for your application.
- Set environment variables using secrets defined in the `values.yaml` file.
- Configure volumes and mounts to access secrets and configmaps as files within your application.

Expand Down Expand Up @@ -94,15 +94,15 @@ This comprehensive tutorial will walk you through the process of effectively uti
Look at the different colors that indicates indentation.

!!! note
The indentation follows for `configmap` is **application.configMap**.
The indentation follows for `configmap` is **`application.configMap`**.

1. Save the file and run `tilt up` at the root of your directory. Hit the space bar and the browser with `TILT` logs will be shown. If everything is green then the changes will be deployed on the cluster.

1. login to SAAP, there should be a Configmap created in your project/namespace.

![Configmap show](images/configmap-show.png)

Let's see the data in this configMap.
Let's see the data in this Configmap.

![Configmap data](images/configmap-data.png)

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ To check if our `Network Policy` is working properly, let's create a random pod

1. Go to the `review-mongodb` pod and copy the `Pod IP`.

![MongoDB pod ip](images/mongodb-pod-ip.png)
![MongoDB pod IP](images/mongodb-pod-ip.png)

Let's find the port for the `review-mongodb` pod. Once you copy the IP, scroll down to find the container. Click the `review` container.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ Login to Vault to view your tenant path.

1. Scroll up to see the owner, which manages your secret.

![external secret cr](images/external-secret-cr.png)
![external secret CR](images/external-secret-cr.png)

1. Click on `review-mongodb-creds`, to see the `External Secret` CR. Click on resources to verify what `External Secret` is managing.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ The webhook setup acts as a bridge between your code repository and the CI/CD pi

1. Now open up the `build` folder.

1. Create a file named `github-webhook-config.yaml` and add in the below content. Replace the Url with your application repository's Url.
1. Create a file named `github-webhook-config.yaml` and add in the below content. Replace the URL with your application repository's URL.
```yaml
apiVersion: external-secrets.io/v1beta1
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Let's walk you through creating a Tekton `PipelineRun` using a `Pipeline-as-Code
```

1. Provide values for `image_registry`, and helm_registry parameters. You can find the URLs from [here](../../../../managed-addons/nexus/explanation/routes.md).
`image_registry` url should be succeeded by your application name. Example: nexus-docker-stakater-nexus.apps.lab.kubeapp.cloud/**review-api**
`image_registry` URL should be succeeded by your application name. Example: `nexus-docker-stakater-nexus.apps.lab.kubeapp.cloud/review-api`

1. Now create a pull request on the repository with these changes. This should trigger a pipeline on your cluster.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ You have already created a PipelineRun in the previous tutorial. Let's now add a
catalog, please visit [`stakater-tekton-catalog`](https://github.com/stakater-tekton-catalog).

1. Provide values for `image_registry`, and `helm_registry` parameters. You can find the URLs from [here](../../../../managed-addons/nexus/explanation/routes.md)
`image_registry` url should be succeeded by your application name. Example: nexus-docker-stakater-nexus.apps.lab.kubeapp.cloud/**review-api**
`image_registry` URL should be succeeded by your application name. Example: `nexus-docker-stakater-nexus.apps.lab.kubeapp.cloud/review-api`

!!! note
Remember to add the remote task in the annotations
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,16 @@ You have already created a PipelineRun in the previous tutorial. Let's now add a
{% include "https://raw.githubusercontent.com/NordMart/review-api/main/.tekton/sonarqube_scan.yaml" %}
```

**Notice** we have provided a parameter **SONAR_HOST_URL** to the sonar-scan task. You need to provide your SonarQube url here. You can get it from Forecastle.
**Notice** we have provided a parameter **`SONAR_HOST_URL`** to the `sonar-scan` task. You need to provide your SonarQube URL here. You can get it from Forecastle.

!!! note
Remember to add the remote task in the annotations
![sonar-scan](images/sonar-scan-annotation.png)
![`sonar-scan`](images/sonar-scan-annotation.png)

1. Create a pull request with you changes. This should trigger the pipeline in the build namespace.

![sonar-scan](images/sonar-scan.png)
![`sonar-scan`](images/sonar-scan.png)

![sonar-scan-logs](images/sonar-scan-logs.png)
![`sonar-scan-logs`](images/sonar-scan-logs.png)

Great! Let's add more tasks in our pipelineRun in coming tutorials.
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ You have already created a PipelineRun in the previous tutorial. Let's now add a
!!! note
Remember to add the remote task in the annotations

1. Remember to update the NAMESPACE and CD_REPO_URL parameter in the newly added task.
1. Remember to update the `NAMESPACE` and `CD_REPO_URL` parameter in the newly added task.

1. Create a pull request with you changes. This should trigger the pipeline in the build namespace.

Expand Down
2 changes: 1 addition & 1 deletion content/for-developers/user-stories.md
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ As a developer, I want to use the OpenShift Console to easily scale resources up

![type:video](https://www.youtube.com/embed/aoCD2zI_Cww)

Tags: sre, OpenShift Console, scale up, scale down
Tags: SRE, OpenShift Console, scale up, scale down

## User Story # 16

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
selfHeal: true
```
1. Once pushed, ArgoCD will automatically detect changes in the Infra GitOps repository and deploy the ClusterTasks defined in the Clustertask CR files.
1. Once pushed, ArgoCD will automatically detect changes in the Infra GitOps repository and deploy the ClusterTasks defined in the ClusterTask CR files.
### Step 3: Validating ClusterTask Deployment via ArgoCD UI
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ By properly configuring the permissions and access levels for the PAT, you can e

### Create a Kubernetes Secret with Token or SSH key

Create a Kubernetes Secret in ArgoCD namespace with repository credentials. Each repository secret must have a url field and, depending on whether you connect using https, SSH, username and password (for https), sshPrivateKey (for SSH).
Create a Kubernetes Secret in ArgoCD namespace with repository credentials. Each repository secret must have a URL field and, depending on whether you connect using https, SSH, username and password (for https), sshPrivateKey (for SSH).

Example for https:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

## Objective

Add a clusterTask to enhance Tekton pipeline.
Add a ClusterTask to enhance Tekton pipeline.

## Key Results

Expand All @@ -19,7 +19,7 @@ Add a clusterTask to enhance Tekton pipeline.

1. Login to the OpenShift console, Select `Pipelines > Tasks` from the left bar and then select `ClusterTasks` tab in right pane.

![`clustertasks-in-OpenShift-console`](../images/clustasks-in-openshift-console.png)
![`ClusterTasks-in-OpenShift-console`](../images/clustasks-in-openshift-console.png)

1. Verify that your Task exists on the cluster by searching its name.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ This AppProject will be used to sync all the Applications in `Infra Gitops Confi
```

!!! note
Remember to replace the Helm registry Url in ArgoCD source repositories. You can find the URLs from [here](../../../managed-addons/nexus/explanation/routes.md)
Remember to replace the Helm registry URL in ArgoCD source repositories. You can find the URLs from [here](../../../managed-addons/nexus/explanation/routes.md)

1. We also need to add a quota for our `arsenal` tenant in our `quotas` folder created in step 4. So let's do it using the file below. The name of this quota need to match the name you specified in tenant CR.

Expand Down
Loading

0 comments on commit 96242c9

Please sign in to comment.