podman

Deploy with Podman

In this scenario the service and associated components are deployed onto your local host in containers using Podman.

General Requirements

Make sure you have Podman version 3.3+ installed. If you must use an older version of podman, reference the previous documentation and procedure to avoid a podman bug.

Requirements for an HTTP based deployment

Files

No need to clone the whole repo. Use:

• pod.yml
• configmap.yml

Environment Variables

Change IMAGE_SERVICE_BASE_URL and SERVICE_BASE_URL in configmap.yml to match the hostname or IP address of your host. For example if your IP address is 192.168.122.2, then the SERVICE_BASE_URL would be set to http://192.168.122.2:8090. Port 8090 is the assisted-service API that agents will connect to.

Requirements for an HTTPS based deployment

• Assisted UI supports HTTPS starting from UI version v2.10.0

• These instructions will secure the following communication paths:

  1. assisted-installer-ui ↔️ assisted-service
  2. User API queries ↔️ assisted-service
  3. assisted-image-service ↔️ assisted-service
  4. discovery agents ↔️ assisted-service
  5. controller pod ↔️ assisted-service

TLS Certificates

Generate

openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=localhost" -addext 'subjectAltName = IP:127.0.0.1'

Embed to a ConfigMap

Embed both key and certificate in configmap_tls_certs.yml Those will get mounted to assisted-installer-service, assisted-installer-image-service and assisted-installer-ui for encryption.

Files

No need to clone the whole repo. Use:

• pod_tls.yml
• configmap_tls.yml
• configmap_tls_certs.yml

Environment Variables

Change IMAGE_SERVICE_BASE_URL and SERVICE_BASE_URL in configmap_tls.yml to match the hostname or IP address of your host. For example if your IP address is 192.168.122.2, then the SERVICE_BASE_URL would be set to https://192.168.122.2:8090. Port 8090 is the assisted-service API that agents will connect to.

Additionally, make sure to change the following:

ASSISTED_SERVICE_URL: https://127.0.0.1:8090  
HTTPS_CERT_FILE: "/etc/certs/tls.crt" # Need to match certs-configmap-volume mountPath
HTTPS_KEY_FILE: "/etc/certs/tls.key"  # Need to match certs-configmap-volume mountPath
HTTPS_CA_FILE: "/etc/certs/tls.crt"   # Need to match certs-configmap-volume mountPath. Needed if the certificate is not signed by a CA in RHEL's default trust bundle.
ASSISTED_SERVICE_HOST: 127.0.0.1:8090
ASSISTED_SERVICE_SCHEME: https # A must for the UI nginx to be configured with TLS

Optional Configuration

Other environment variables may be set in configmap.yml. For example, custom agent (AGENT_DOCKER_IMAGE), installer (INSTALLER_IMAGE) and controller (CONTROLLER_IMAGE) images can be defined.

Run it

If HTTP based

podman play kube --configmap configmap.yml pod.yml

If HTTPS based

podman play kube --configmap configmap_tls_certs.yml --configmap configmap_tls.yml pod_tls.yml

To preserve data about existing clusters between pod reconfigurations the pod-persistent.yml manifest could be use instead, which creates additional volumes for database and cluster's artifacts:

podman play kube --configmap configmap.yml pod-persistent.yml

If you only want to provision a single cluster at a time, which is a common use case, persistence is not necessary.

The UI will available at: http://<host-ip-address>:8080

Remove it

podman play kube --down pod.yml

OKD configuration

Assisted Service can install OKD clusters using a different set of parameters:

podman play kube --configmap okd-configmap.yml pod.yml

or

make deploy-onprem OKD=true

for developers

Configuration differences are:

• OS_IMAGES should point to Fedora CoreOS (see Fedora CoreOS Release artifacts)
• RELEASE_IMAGES lists available OKD versions (see OKD Releases)
• OKD_RPMS_IMAGE is additional image containing Kubelet/CRI-O RPMs (see example repo)
• ENABLE_OKD_SUPPORT whether OKD support is enabled. Required to be true so that the service setup necessary RPMs on top of discovery ISO