{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"eb2910ff-b5a5-47d9-b78d-0e1a9cf1b301"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"c543f519-f0e0-4f9a-8814-cf7bcba73b00"}},{"type":"paragraph","content":[{"text":"The Kloudfuse helm chart supports 2 options for setting up HTTPS/TLS on the Kloudfuse Stack: 1. Configuring HTTPS/TLS on the Kubernetes Ingress rules. 2. TLS termination before traffic hits the Kloudfuse stack. ","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Note that, if TLS is enabled, the Grafana settings for alerts need to be updated. Instructions is at the end of this document.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Instructions for Setting HTTPS/TLS on the Kloudfuse Ingress","type":"text"}]},{"type":"paragraph","content":[{"text":"Note. If using AWS Certificate Manager (ACM) to terminate the tls on the AWS NLB, skip to the next section for instructions.","type":"text"}]},{"type":"paragraph","content":[{"text":"This section describes setting up HTTPS/TLS on the Ingress rules. The Kloudfuse helm chart supports creation of the certificates, using cert-manager and lets-encrypt or use an existing certificate. ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A DNS host name is required.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A static external IP address associated with the DNS host name that can be used by the ingress load balancer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For GKE, refer to ","type":"text"},{"text":"https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address"}}]},{"text":" for reserving a static external IP.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For AWS, refer to ","type":"text"},{"text":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html"}}]},{"text":" for allocating IP addresses from AWS Elastic IP.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Step 3.a.","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"fe387524-6dc6-4d16-bc61-e7149b19371a"}},{"type":"em"}]},{"text":" is only needed if SSL certificate will be created as part of Kfuse installation. Certificate will be created by the cert-manager using lets-encrypt.","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"3. a. cert-manager must already be installed in the kubernetes cluster. Refer to https://cert-manager.io/docs/installation/ or follow the instructions below.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":507,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":243,"alt":"image-20240612-144933.png","id":"d1103e9c-b394-4776-bc82-3ae2486eefa0","collection":"contentId-789774337","type":"file","height":125}}]},{"type":"paragraph"},{"type":"codeBlock","content":[{"text":"helm repo add jetstack https://charts.jetstack.io\nhelm repo update\nhelm install cert-manager jetstack/cert-manager --create-namespace --namespace kfuse --version v1.7.1 --set installCRDs=true","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Step 3.b. is needed if existing SSL certificate will be used.","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"3.b. Create a Kubernetes secret of type TLS with the server.crt and server.key files (SSL certificates).","type":"text"}]},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"center","width":453,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":243,"alt":"image-20240612-145258.png","id":"e5a3f9de-efa9-4b41-8357-b5cc7638a32d","collection":"contentId-789774337","type":"file","height":125}}]},{"type":"paragraph"},{"type":"codeBlock","content":[{"text":"kubectl create secret tls kfuse-tls --namespace kfuse --key server.key --cert server.crt","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Helm Values Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following entries in the custom_values.yaml depending on the cloud provider.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"GCP/Azure","type":"text"}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: true\n host: \n email: \n # If Step 3.a.\n clusterIssuer: \n # If Step 3.b.\n secretName: \n\ningress-nginx:\n controller:\n ingressClassResource:\n enabled: true\n name: kfuse-ingress\n ingressClass: kfuse-ingress\n watchIngressWithoutClass: false\n service:\n loadBalancerIP: \n external:\n enabled: true","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"AWS","type":"text"}]},{"type":"paragraph","content":[{"text":"For AWS, instead of directly specifying the IP address, in the ingress loadbalancerIP, assignment is done through","type":"text"},{"type":"hardBreak"},{"text":"service annotations.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that the number of Elastic IP allocations must match the number of subnets the AWS NLB uses (defaults to 3).","type":"text"},{"type":"hardBreak"},{"text":"Refer to ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html"}},{"text":" and","type":"text"},{"type":"hardBreak"},{"type":"inlineCard","attrs":{"url":"https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/service/annotations/"}},{"text":" ","type":"text"}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: true\n host: \n # If Step 3.a.\n clusterIssuer: \n # If Step 3.b.\n secretName: \n\ningress-nginx:\n controller:\n ingressClassResource:\n enabled: true\n name: kfuse-ingress\n ingressClass: kfuse-ingress\n watchIngressWithoutClass: false\n service:\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-type: external\n service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip\n service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-eip-allocations: \n external:\n enabled: true","type":"text"}]},{"type":"paragraph","content":[{"text":"Note: on some older cluster of EKS, the following annotation:","type":"text"}]},{"type":"codeBlock","content":[{"text":" service.beta.kubernetes.io/aws-load-balancer-type: external\n service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip","type":"text"}]},{"type":"paragraph","content":[{"text":"may need to be replaced with","type":"text"}]},{"type":"codeBlock","content":[{"text":" service.beta.kubernetes.io/aws-load-balancer-type: nlb","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Disable HTTP traffic","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want to disable HTTP traffic completely, add the following to ","type":"text"},{"text":"ingress-nginx","type":"text","marks":[{"type":"code"}]},{"text":"section in ","type":"text"},{"text":"values.yaml","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"ingress-nginx:\n controller:\n service:\n enableHttp: false ","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Note that this will disable HTTP traffic on both internal and external ingress. So use this config if you want to disable HTTP, and you’re not using internal ingress.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Instructions to Configure Kloudfuse stack to work with TLS Termination","type":"text"}]},{"type":"paragraph","content":[{"text":"The Kloudfuse stack can be configured to work on clusters that have TLS termination (e.g., using OKTA, AWS ACM).","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Minimal instructions","type":"text"}]},{"type":"paragraph","content":[{"text":"Note: Skip to the next section for more detailed instructions if using AWS Certificate Manager and AWS NLB for TLS termination.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":342,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":214,"alt":"image-20240611-131009.png","id":"a5ae670c-e1e1-40b7-9b9a-0bbdbd833449","collection":"contentId-789774337","type":"file","height":101}}]},{"type":"paragraph","content":[{"text":"At the minimum, add the following entries in the custom_values.yaml. ","type":"text"}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: false\n awsAcmEnabled: true\n\ningress-nginx:\n controller:\n service:\n targetPorts:\n https: http","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"The third-party service that does the TLS termination will need to be updated to point to the external ip of the ","type":"text"},{"text":"kfuse-ingress-controller","type":"text","marks":[{"type":"code"}]},{"text":" service.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Instructions to configure TLS termination on AWS NLB using AWS Certificate Manager","type":"text"}]},{"type":"paragraph","content":[{"text":"AWS supports configuring the TLS termination directly on the AWS NLB created that backs the Kfuse ingress service.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A DNS host name is required.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A certificate associated with the above DNS host name issued by the AWS Certificate Manager.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refer to ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html"}},{"text":" ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Elastic IP(s) associated with the DNS host name that can be used by the ingress load balancer.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Refer to ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html"}},{"text":" for allocating IP addresses from AWS Elastic IP.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Helm Values Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Following are the example configurations for nginx-ingress with their use-cases","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Minimal configuration of nginx-ingress controller with ACM","type":"text"}]},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"center","width":342,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":214,"alt":"image-20240611-131009.png","id":"a5ae670c-e1e1-40b7-9b9a-0bbdbd833449","collection":"contentId-789774337","type":"file","height":101}}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: false\n awsAcmEnabled: true\n\ningress-nginx:\n controller:\n service:\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-type: external\n service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip\n service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-eip-allocations: \n service.beta.kubernetes.io/aws-load-balancer-ssl-cert: \"\"\n service.beta.kubernetes.io/aws-load-balancer-ssl-ports: \"443\"\n service.beta.kubernetes.io/aws-load-balancer-backend-protocol: \"tcp\"\n external:\n enabled: true\n targetPorts:\n https: http","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Configuration of nginx-ingress controller, enabling host based routing (Only External Load Balancer)","type":"text"}]},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"center","width":496,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":214,"alt":"image-20240611-131153.png","id":"568cda46-d55b-4ed7-8de7-4bc809e74f0e","collection":"contentId-789774337","type":"file","height":101}}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This will restrict the Kfuse access only to the host specified in the configuration. ","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: false\n awsAcmEnabled: true\n host: <>\n\ningress-nginx:\n controller:\n service:\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-type: external\n service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip\n service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-eip-allocations: \n service.beta.kubernetes.io/aws-load-balancer-ssl-cert: \"\"\n service.beta.kubernetes.io/aws-load-balancer-ssl-ports: \"443\"\n service.beta.kubernetes.io/aws-load-balancer-backend-protocol: \"tcp\"\n external:\n enabled: true\n targetPorts:\n https: http","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Configuration of nginx-ingress controller, enabling host based routing (Both Internal and External Load Balancer)","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"center","width":591,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":281,"alt":"image-20240611-131410.png","id":"cd9612b7-aded-4c36-a6db-d703c1b7418f","collection":"contentId-789774337","type":"file","height":186}}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This will restrict the Kfuse access only to the host (internal & external) specified in the configuration. In this configuration the the internal load balancer can only be used for ","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"50fabd20-0fd1-4ab5-8069-ee7cb60dd63a"}}]},{"text":"ingest path","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"50fabd20-0fd1-4ab5-8069-ee7cb60dd63a"}},{"type":"strong"}]},{"text":" i.e. ingesting MELT data and ","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"50fabd20-0fd1-4ab5-8069-ee7cb60dd63a"}}]},{"text":"query path","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"50fabd20-0fd1-4ab5-8069-ee7cb60dd63a"}},{"type":"strong"}]},{"text":" is only available via external load balancer.","type":"text","marks":[{"type":"annotation","attrs":{"annotationType":"inlineComment","id":"50fabd20-0fd1-4ab5-8069-ee7cb60dd63a"}}]}]}]},{"type":"codeBlock","content":[{"text":"tls:\n enabled: false\n awsAcmEnabled: true\n host: <>\n ingestInternalHost : <>\n\ningress-nginx:\n controller:\n service:\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-type: external\n service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip\n service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-eip-allocations: \n service.beta.kubernetes.io/aws-load-balancer-ssl-cert: \"\"\n service.beta.kubernetes.io/aws-load-balancer-ssl-ports: \"443\"\n service.beta.kubernetes.io/aws-load-balancer-backend-protocol: \"tcp\"\n external:\n enabled: true\n targetPorts:\n https: http\n internal:\n enabled: true\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-internal: \"true\"\n service.beta.kubernetes.io/aws-load-balancer-type: nlb\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-ssl-cert: \"\"\n service.beta.kubernetes.io/aws-load-balancer-ssl-ports: \"443\"\n service.beta.kubernetes.io/aws-load-balancer-backend-protocol: \"http\"\n targetPorts:\n https: http","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure internal load balancer for sending agent data on internal network","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure that the certificate created for external load balancer has been updated to contain the domain-name for the internal load balancer. Update the DNS entries as required. ","type":"text"},{"text":"ACM","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html"}}]},{"text":" only allows immediate subdomains (*.domain.com) or sibling domains (","type":"text"},{"text":"internal.domain.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://internal.domain.com"}}]},{"text":"). For example; if the kfuse stack is hosted at ","type":"text"},{"text":"observability.domain.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://observability.domain.com"}}]},{"text":"; internal traffic can be routed to ","type":"text"},{"text":"internal.observability.domain.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://internal.observability.domain.com"}}]},{"text":"; For this the certificate can contain the two domain names. Once the ACM certificate has been resolved; update the custom_values.yaml ingress section for internal controller.","type":"text"}]},{"type":"codeBlock","content":[{"text":"ingress-nginx:\n controller:\n service:\n annotations:\n <<< external annotations done before >>>\n external:\n enabled: true\n internal:\n enabled: true\n annotations:\n service.beta.kubernetes.io/aws-load-balancer-internal: \"true\"\n service.beta.kubernetes.io/aws-load-balancer-type: nlb\n service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\n service.beta.kubernetes.io/aws-load-balancer-ssl-cert: \"\"\n service.beta.kubernetes.io/aws-load-balancer-ssl-ports: \"443\"\n service.beta.kubernetes.io/aws-load-balancer-backend-protocol: \"http\"\n targetPorts:\n https: http","type":"text"}]}],"version":1}

Browser not supported