Skip to content

Commit

Permalink
update
Browse files Browse the repository at this point in the history
  • Loading branch information
karl-johan-grahn committed Oct 31, 2024
1 parent 7799951 commit b7c5a78
Show file tree
Hide file tree
Showing 9 changed files with 123 additions and 122 deletions.
2 changes: 1 addition & 1 deletion content/for-administrators/plan-your-environment/sizing.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Resource requirements for a single SAAP cluster is as follows:

The overall minimum resource requirements are:

| Machine pool role | Minimum size (vCPU x Memory x Storage) | Minimum pool size | Total vCPUs | Total Memory (GiB) | Total Storage (GiB)
| Machine pool role | Minimum size (vCPU x Memory x Storage) | Minimum pool size | Total vCPUs | Total Memory (GiB) | Total Storage (GiB) |
|:---|:---|---:|---:|---:|---:|
| Control plane | 8 x 32 x 350 | 3 | 24 | 96 | 1050 (Provisioned IOPS 1000) |
| Infra | 8 x 32 x 300 | 3 | 24 | 96 | 900 (General Purpose SSD) |
Expand Down
6 changes: 3 additions & 3 deletions content/for-administrators/secure-your-cluster/azure-gso.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,6 @@ For Azure AD, two applications are needed, one for group synchronization, and on

Please provide the secrets via password manager:

- `Application (client) ID`
- `Directory (tenant) ID`
- `Client Secret`
* `Application (client) ID`
* `Directory (tenant) ID`
* `Client Secret`
8 changes: 4 additions & 4 deletions content/for-administrators/secure-your-cluster/azure-idp.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ For Azure AD, two applications are needed, one for group synchronization, and on

## Items provided by Stakater Support

- `Redirect URIs`
* `Redirect URIs`

## Items to be provided to Stakater Support

Please provide the secrets via password manager:

- `Application (client) ID`
- `Directory (tenant) ID`
- `client Secret`
* `Application (client) ID`
* `Directory (tenant) ID`
* `client Secret`
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Welcome to the Nordmart Review 101 guide! In this section, we'll explore the arc

The Nordmart Review is designed with a modular architecture that consists of three crucial components, each playing a unique role in delivering an exceptional user experience:

<div style="text-align:center"><img src="images/nordmart-architecture.png" /></div>
![Nordmart architecture](images/nordmart-architecture.png)

### Review UI

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -68,25 +68,25 @@ The webhook setup acts as a bridge between your code repository and the CI/CD pi
1. Access Vault from `Forecastle` console, search `Vault` and open the `Vault` tile.
<div style="text-align:center"><img src="images/forecastle.png" /></div>
![Forecastle](images/forecastle.png)
1. From the drop-down menu under `Method`, select `OIDC` and click on `Sign in with OIDC Provider`.
<div style="text-align:center"><img src="images/login-oidc.png" /></div>
![login-oidcs](images/login-oidc.png)
1. You will be brought to the `Vault` console. You should see the key/value path for <your-tenant>.
<div style="text-align:center"><img src="images/vault-tenant.png" /></div>
![Vault tenant](images/vault-tenant.png)
1. Click on `<your-tenant>/kv/`.
1. You will now be brought to the `secrets` and the `configurations` in Vault for <your-tenant>. Click on `create secret`.
<div style="text-align:center"><img src="images/create-secret.png" /></div>
![create-secret](images/create-secret.png)
1. Let's create a `github-webhook-config` secret for our webhook secret. Write the name of the secret in `path` which is `github-webhook-config`. Add `secret data`, key: `webhook.secret`, value: (your webhook secret). Hit save.

<div style="text-align:center"><img src="images/webhook-secret.png" /></div>
![webhook secret](images/webhook-secret.png)

### Add External Secret

Expand All @@ -101,41 +101,41 @@ The webhook setup acts as a bridge between your code repository and the CI/CD pi
1. Create a file named `github-webhook-config.yaml` and add in the below content. Replace the Url with your application repository's Url.
```yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: github-webhook-config
spec:
secretStoreRef:
name: tenant-vault-secret-store
kind: SecretStore
refreshInterval: "1m0s"
target:
name: github-webhook-config
spec:
secretStoreRef:
name: tenant-vault-secret-store
kind: SecretStore
refreshInterval: "1m0s"
target:
name: github-webhook-config
creationPolicy: 'Owner'
template:
data:
provider.token: "{{ .password | toString }}"
webhook.secret: "{{ .secret | toString }}"
creationPolicy: 'Owner'
template:
data:
- secretKey: password
remoteRef:
key: github-webhook-config
property: provider.token
- secretKey: secret
remoteRef:
key: github-webhook-config
property: webhook.secret
provider.token: "{{ .password | toString }}"
webhook.secret: "{{ .secret | toString }}"
data:
- secretKey: password
remoteRef:
key: github-webhook-config
property: provider.token
- secretKey: secret
remoteRef:
key: github-webhook-config
property: webhook.secret
```
<div style="text-align:center"><img src="images/github-webhook-config-es.png" /></div>
![GitHub-webhook-config-es](images/github-webhook-config-es.png)
1. Now open up ArgoCD and look for this External Secret. If everything was added correctly, you will see a secret created from this External Secret.
<div style="text-align:center"><img src="images/github-webhook-config-argo.png" /></div>
![GitHub-webhook-config-argo](images/github-webhook-config-argo.png)
1. You can also check this secret by navigation to `<tenant>-build` namespace and searching for the secret.
<div style="text-align:center"><img src="images/github-webhook-config-secret.png" /></div>
![GitHub-webhook-config-secret](images/github-webhook-config-secret.png)
Great! We have everything set up for creating the Repository CR.
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,11 @@ Alternatively, Navigate to the cluster Forecastle, search `nexus` using the sear

- `nexus-helm-reg-url` : Add `-helm` in URL after `nexus` and append `/repository/helm-charts/`. This URL points to Helm Registry referred as `nexus-helm-reg-url` in this tutorial for example `https://nexus-helm-stakater-nexus.apps.clustername.random123string.kubeapp.cloud/repository/helm-charts/`

![nexus-Forecastle](../images/nexus-forecastle.png)
![nexus-Forecastle](../images/nexus-forecastle.png)

### Login to Docker Registry

Run following command to log into the registry.
Run following command to log into the registry:

```sh
buildah login <nexus-docker-reg-url>
Expand Down Expand Up @@ -117,7 +117,8 @@ Lets push the image to nexus docker repo. Make sure to get credentials from Stak
buildah push <nexus-docker-reg-url>/stakater-nordmart-review-web:1.0.0 docker://<nexus-docker-reg-url>/stakater-nordmart-review-web:1.0.0
```

> **Note: Nexus docker registry URL is the one we extract in the above section. Make sure you are logged in to the Nexus docker registry before building and pushing the application image.**
!!! note
Nexus docker registry URL is the one we extract in the above section. Make sure you are logged in to the Nexus docker registry before building and pushing the application image.**

## 3. Add Helm Chart to application repository

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,43 +29,43 @@

1. Navigate to `SSH and GPG Keys`

<div style="text-align:center"><img src="images/ssh-key.png" /></div>
![ssh-key](images/ssh-key.png)

1. Click `Add New Key` in SSH Key section.

<div style="text-align:center"><img src="images/new-ssh-key.png" /></div>
![new-ssh-key](images/new-ssh-key.png)

1. Now add the public key of the keypair you generated earlier.

<div style="text-align:center"><img src="images/add-public-key.png" /></div>
![add-public-key](images/add-public-key.png)

### Adding Private Key to Vault

Now that we have added the public key to GitHub, let's add the private key to Vault.

1. Access Vault from `Forecastle` console, search `Vault` and open the `Vault` tile.

<div style="text-align:center"><img src="images/forecastle.png" /></div>
![Forecastle](images/forecastle.png)

1. From the drop-down menu under `Method`, select `OIDC` and click on `Sign in with OIDC Provider`.

<div style="text-align:center"><img src="images/login-oidc.png" /></div>
![login-oidc](images/login-oidc.png)

1. You will be brought to the `Vault` console. You should see `common-shared-secrets` folder.

<div style="text-align:center"><img src="images/common-shared-secrets.png" /></div>
![common-shared-secrets](images/common-shared-secrets.png)

1. Click on `common-shared-secrets`.

1. You will now be brought to the `secrets` and the `configurations`. Click on `create secret`.

<div style="text-align:center"><img src="images/create-secret.png" /></div>
![create-secret](images/create-secret.png)

1. Let's create a `git-ssh-creds` secret for our webhook secret. Write the name of the secret in `path` which is `git-ssh-creds`. Add `secret data`
* key: `id_rsa`, value: (The SSH Private Key).
Hit save.

<div style="text-align:center"><img src="images/git-ssh-creds.png" /></div>
![git-ssh-creds](images/git-ssh-creds.png)

### Adding External Secret

Expand All @@ -75,7 +75,7 @@ Since we want the `git-ssh-creds` secret to be deployed in all of the tenant nam

1. Open the `tenant-operator-config` folder and create a `templates` folder inside it:

<div style="text-align:center"><img src="images/template.png" /></div>
![template](images/template.png)

1. Now create a file named `git-ssh-creds-template.yaml` and add the following content:

Expand Down
Loading

0 comments on commit b7c5a78

Please sign in to comment.