1"use strict";(self.webpackChunkcnoe=self.webpackChunkcnoe||[]).push([[2568],{28453:(e,n,s)=>{s.d(n,{R:()=>o,x:()=>r});var t=s(96540);const l={},i=t.createContext(l);function o(e){const n=t.useContext(i);return t.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(l):e.components||l:o(e.components),t.createElement(i.Provider,{value:n},e.children)}},33775:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>t,toc:()=>c});const t=JSON.parse('{"id":"reference-implementation/aws/docs/installation_flow","title":"Installation Flow","description":"This document describes the installation flow for the CNOE AWS Reference Implementation.","source":"@site/docs/reference-implementation/aws/docs/installation_flow.md","sourceDirName":"reference-implementation/aws/docs","slug":"/reference-implementation/aws/docs/installation_flow","permalink":"/docs/reference-implementation/aws/docs/installation_flow","draft":false,"unlisted":false,"editUrl":"https://github.com/cnoe-io/reference-implementation-aws/blob/main/docs/installation_flow.md","tags":[],"version":"current","sidebarPosition":1,"frontMatter":{"custom_edit_url":"https://github.com/cnoe-io/reference-implementation-aws/blob/main/docs/installation_flow.md","sidebar_position":1},"sidebar":"tutorialSidebar","previous":{"title":"AWS Reference Implementation","permalink":"/docs/reference-implementation/aws/"},"next":{"title":"Troubleshooting","permalink":"/docs/reference-implementation/aws/docs/troubleshooting"}}');var l=s(74848),i=s(28453);const o={custom_edit_url:"https://github.com/cnoe-io/reference-implementation-aws/blob/main/docs/installation_flow.md",sidebar_position:1},r="Installation Flow",a={},c=[{value:"Overview",id:"overview",level:2},{value:"Installation Process",id:"installation-process",level:2},{value:"Addons Dependencies",id:"addons-dependencies",level:2},{value:"Uninstallation Process",id:"uninstallation-process",level:2}];function d(e){const n={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",header:"header",li:"li",mermaid:"mermaid",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.R)(),...e.components};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(n.header,{children:(0,l.jsx)(n.h1,{id:"installation-flow",children:"Installation Flow"})}),"\n",(0,l.jsx)(n.p,{children:"This document describes the installation flow for the CNOE AWS Reference Implementation."}),"\n",(0,l.jsx)(n.h2,{id:"overview",children:"Overview"}),"\n",(0,l.jsxs)(n.p,{children:["The CNOE AWS Reference Implementation uses a GitOps approach to deploy and manage addons on an EKS cluster. The installation process uses ",(0,l.jsx)(n.code,{children:"helm"})," to bootstrap the EKS cluster. Detailed installation sequence is described below."]}),"\n",(0,l.jsx)(n.h2,{id:"installation-process",children:"Installation Process"}),"\n",(0,l.jsxs)(n.ol,{children:["\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.strong,{children:"User Approval"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["User starts by executing the ",(0,l.jsx)(n.code,{children:"scripts/install.sh"})," script which displays details such as target EKS cluster and AWS Region etc. It also requests approval from the user to proceed with installation."]}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Setup Configuration"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["AWS Secrets Manager secrets are created to store configuration and GitHub App credentials using ",(0,l.jsx)(n.code,{children:"create-config-secrets.sh"})," script. These secrets are fetched into the cluster by External Secret Operator."]}),"\n",(0,l.jsxs)(n.li,{children:["The ",(0,l.jsx)(n.code,{children:"config.yaml"})," file is used to configure the installation."]}),"\n",(0,l.jsxs)(n.li,{children:[(0,l.jsx)(n.code,{children:"install.sh"})," script reads the ",(0,l.jsx)(n.code,{children:"config.yaml"})," and based on the specified cluster name, fetches kubeconfig of EKS cluster using AWS CLI. This kubeconfig is used for helm installation by overriding default kubeconfig."]}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"EKS Cluster Bootstrap"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["The script first performs helm installation of Argo CD and External Secret Operator (ESO) on the EKS cluster. It will use the temporary kubeconfig for accessing the EKS cluster. The values used for installation are static values from ",(0,l.jsx)(n.code,{children:"packages/<addon-name>/values.yaml"})," which are the same files used by addons later."]}),"\n",(0,l.jsxs)(n.li,{children:["Then the script applies custom manifests for these addons from the directory ",(0,l.jsx)(n.code,{children:"packages/<addon-name>/manifests/"}),". For ESO, this directory contains the AWS Secret Manager ClusterStore manifest and for Argo CD, it contains manifests for Exter
1nal Secrets of in-cluster Argo CD secret and Github App Argo CD repository credentials. These External Secrets use AWS Secret Manager ClusterStore."]}),"\n",(0,l.jsx)(n.li,{children:"Then ESO will create corresponding kubernetes secrets for Argo CD cluster secret and repository credentials by fetching values from AWS Secret Manager which were created earlier."}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Addons Deployment"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["The script will wait 10 seconds and install the AppSet chart on the EKS cluster which creates ApplicationSets for all the enabled addons based on values in ",(0,l.jsx)(n.code,{children:"packages/addons/values.yaml"}),"."]}),"\n",(0,l.jsxs)(n.li,{children:["Each ApplicationSet will use ",(0,l.jsx)(n.a,{href:"https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Generators-Cluster/",children:"Argo CD Cluster Generator"})," to create respective Argo CD Application. The Cluster Generator will generate one Argo CD Application for each enabled addon as there is only one Argo CD cluster secret."]}),"\n",(0,l.jsxs)(n.li,{children:["Although the Argo CD Applications for each addon are created, each addon will take some time to reach Healthy state due to dependencies explained in the ",(0,l.jsx)(n.a,{href:"#addons-dependencies",children:"dependency section"}),"."]}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Addon Configuration"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Addons are configured using helm values"}),"\n",(0,l.jsxs)(n.li,{children:["Static values are stored in ",(0,l.jsx)(n.code,{children:"packages/<addon-name>/values.yaml"})]}),"\n",(0,l.jsx)(n.li,{children:"Dynamic values from Argo CD cluster secret labels/annotations depend on configuration from AWS Secrets Manager."}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Monitoring and Verification"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"The installation script waits for all Argo CD applications to become healthy"}),"\n",(0,l.jsx)(n.li,{children:"Addons can be accessed through the configured domain based on path routing settings"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"addons-dependencies",children:"Addons Dependencies"}),"\n",(0,l.jsx)(n.p,{children:"The following is the order for addons reaching healthy state when using Path Routing."}),"\n",(0,l.jsx)(n.mermaid,{value:' flowchart LR\n ESO["ESO"] --\x3e ArgoCD["ArgoCD"]\n ArgoCD --\x3e AWSLB["AWS Load Balancer Controller"] & ExternalDNS["External DNS"] & CertManager["Cert Manager"] & Crossplane["Crossplane"] & CrossplaneComp["Crossplane Compositions"] & Keycloak["Keycloak"]\n AWSLB --\x3e NGINX["NGINX"]\n ExternalDNS --\x3e Backstage["Backstage"] & ArgoWorkflows["Argo Workflows"]\n CertManager --\x3e Backstage & ArgoWorkflows\n NGINX --\x3e Backstage & ArgoWorkflows\n Keycloak --\x3e Backstage & ArgoWorkflows\n\n linkStyle 0 stroke:#2962FF\n linkStyle 1 stroke:#00C853,fill:none\n linkStyle 2 stroke:#00C853,fill:none\n linkStyle 3 stroke:#00C853,fill:none\n linkStyle 4 stroke:#00C853,fill:none\n linkStyle 5 stroke:#00C853,fill:none\n linkStyle 6 stroke:#00C853,fill:none\n linkStyle 7 stroke:#E1BEE7,fill:none\n linkStyle 8 stroke:#FF6D00,fill:none\n linkStyle 9 stroke:#FFD600,fill:none\n linkStyle 10 stroke:#FF6D00,fill:none\n linkStyle 11 stroke:#FFD600,fill:none\n linkStyle 12 stroke:#FF6D00,fill:none\n linkStyle 13 stroke:#FFD600,fill:none\n linkStyle 14 stroke:#FF6D00,fill:none\n linkStyle 15 stroke:#FFD600,fill:none'}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"The colors of edges in this diagram indicate the parallel progress of addons to reach healthy state. As seen in the diagram, all the addons will reach the Healthy state in parallel except Cert Manager, Keycloak, Backstage and Argo Workflows."}),"\n",(0,l.jsx)(n.li,{children:"Both Backstage and Argo Workflow addons depend on the Healthy status of External DNS, Cert-Manager, NGINX and Keycloak."}),"\n",(0,l.jsx)(n.li,{children:"This sequential order for these addons is due to dependency of Keycloak Client creation for Backstage and Argo Workflows and both these addons also need to reach
1Keycloak using external URL to verify SSO configuration. Therefore, both Backstage and Argo Workflows will stay unhealthy until Keycloak reaches healthy state."}),"\n",(0,l.jsxs)(n.li,{children:["The Keycloak client creation is done using a Job pod ",(0,l.jsxs)(n.em,{children:["(",(0,l.jsx)(n.code,{children:"packages/keycloak/manifests/user-sso-config-job.yaml"}),")"]}),". This job pod creates the Keycloak clients for Argo CD, Backstage and Argo Workflows. It also creates the kubernetes secret ",(0,l.jsx)(n.code,{children:"keycloak-clients"})," containing client secrets."]}),"\n",(0,l.jsxs)(n.li,{children:["Once the client creation is successful, The ClusterSecretStore ",(0,l.jsxs)(n.em,{children:["(",(0,l.jsx)(n.code,{children:"packages/keycloak/manifests/keycloak-cluster-secret-store.yaml"}),")"]})," is created so that ESO can create kubernetes secrets for Client Secrets in Backstage and Argo Workflows namespace."]}),"\n",(0,l.jsx)(n.li,{children:"When the kubernetes secrets for Keycloak Client Secrets are created in Backstage and Argo Workflows namespace, these addons will reach Healthy state."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"uninstallation-process",children:"Uninstallation Process"}),"\n",(0,l.jsx)(n.p,{children:"The uninstallation process follows these steps:"}),"\n",(0,l.jsxs)(n.ol,{children:["\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Remove idpbuilder Local Cluster"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"The local Kind cluster created by idpbuilder is deleted"}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"Remove Addons"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Addons are removed in a specific order to handle dependencies"}),"\n",(0,l.jsx)(n.li,{children:"ApplicationSets are deleted with orphan deletion policy"}),"\n",(0,l.jsx)(n.li,{children:"PVCs for stateful applications are cleaned up"}),"\n"]}),"\n"]}),"\n",(0,l.jsxs)(n.li,{children:["\n",(0,l.jsxs)(n.p,{children:[(0,l.jsx)(n.strong,{children:"CRD Cleanup (Optional)"}),":"]}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["Custom Resource Definitions can be cleaned up using the ",(0,l.jsx)(n.code,{children:"cleanup-crds.sh"})," script"]}),"\n",(0,l.jsx)(n.li,{children:"This is optional and useful when you want to completely remove all traces of the installation"}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,l.jsx)(n,{...e,children:(0,l.jsx)(d,{...e})}):d(e)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.