On-premises install guide

This document describes how to set up an Google Distributed Cloud cluster, and then how to install Kf and its dependencies on the cluster.

If you are already familiar with the process of installing Kf on a GKE cluster in the Cloud, the main differences for the on-premises procedure are:

• The Kf on-premises procedure uses the Cloud Service Mesh on-premises installation process.
• You do not have to install the Config Connector for an on-premises install.
• The on-premises procedure uses Docker credentials instead of Workload Identity.

Before you begin

Overview

Google Distributed Cloud requirements

• A user cluster for Google Distributed Cloud that meets Cloud Service Mesh on-premises requirements .

• Configured for logging and monitoring.

• Registered in your GKE Enterprise fleet:

  Go to GKE Enterprise clusters

  Learn how to register a cluster .

Kf requirements:

• Cloud Service Mesh on-premises .

• Tekton for use by Kf. This is not a user facing service.

• A dedicated Google Service Account.

Prepare a new Google Distributed Cloud cluster and related services

Setup environment variables

export PROJECT_ID= YOUR_PROJECT_ID 
export CLUSTER_PROJECT_ID= YOUR_PROJECT_ID 
export CLUSTER_NAME= kf-cluster 
export COMPUTE_ZONE= us-central1-a 
export COMPUTE_REGION= us-central1 
export CLUSTER_LOCATION=${COMPUTE_ ZONE 
} # Replace ZONE with REGION to switch
export NODE_COUNT= 4 
export MACHINE_TYPE= e2-standard-4 
export NETWORK= default 
export CLUSTER_PROJECT_ID= YOUR_PROJECT_ID 
export CLUSTER_NAME= kf-cluster 
export DOCKER_SERVER= YOUR_DOCKER_SERVER_URL 
export SA_NAME=${CLUSTER_NAME}-sa
export SA_EMAIL=${SA_NAME}@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com

Set-Variable -Name PROJECT_ID -Value YOUR_PROJECT_ID 
Set-Variable -Name CLUSTER_PROJECT_ID -Value YOUR_PROJECT_ID 
Set-Variable -Name CLUSTER_NAME -Value kf-cluster 
Set-Variable -Name COMPUTE_ZONE -Value us-central1-a 
Set-Variable -Name COMPUTE_REGION -Value us-central1 
Set-Variable -Name CLUSTER_LOCATION -Value $COMPUTE_ ZONE 
# Replace ZONE with REGION to switch
Set-Variable -Name NODE_COUNT -Value 4 
Set-Variable -Name MACHINE_TYPE -Value e2-standard-4 
Set-Variable -Name NETWORK -Value default 
Set-Variable -Name CLUSTER_PROJECT_ID -Value YOUR_PROJECT_ID 
Set-Variable -Name CLUSTER_NAME -Value kf-cluster 
Set-Variable -Name DOCKER_SERVER -Value YOUR_DOCKER_SERVER_URL 
Set-Variable -Name SA_NAME -Value ${CLUSTER_NAME}-sa
Set-Variable -Name SA_EMAIL -Value ${SA_NAME}@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com

Service account setup

Create the Google Cloud service account (GSA) and service account key used for the builds to read/write from Container Registry. This step is different if you are using a different container registry because it could have a different way of obtaining the credentials to access the registry.

1. Create the service account used by Kf:

   gcloud beta iam service-accounts create ${SA_NAME} \
       --project=${CLUSTER_PROJECT_ID} \
       --description="gcr.io admin for ${CLUSTER_NAME}" \
       --display-name="${CLUSTER_NAME}"

2. Assign the service account the storage.admin role required to read/write from the Container Registry:

   gcloud projects add-iam-policy-binding ${CLUSTER_PROJECT_ID} \
       --member="serviceAccount:${SA_NAME}@${CLUSTER_PROJECT_ID}.iam.gserviceaccount.com" \
       --role="roles/storage.admin"

3. Create the service account key:

   temp_dir=$(mktemp -d) key_path=${temp_dir}/key.json 
    gcloud iam service-accounts keys create --iam-account ${SA_EMAIL} ${key_path} 
    key_json=$(cat ${key_path}) 
    rm -rf ${temp_dir} 
   

Install software dependencies on cluster

1. Install Cloud Service Mesh.

   1. Open the Cloud Service Mesh on-premises install guide .

   2. Follow the guide to install Cloud Service Mesh.

   3. Set the loadBalancerIP to an IP allocated to the cluster as described in Configuring external IP addresses for Cloud Service Mesh on-prem .

2. Install Tekton:

   kubectl apply -f "https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.23.0/release.yaml"

Install Kf

1. Install the Kf CLI:

   Linux

   This command installs the Kf CLI for all users on the system. Follow the instructions in the Cloud Shell tab to install it just for yourself.

    gcloud  
   storage  
   cp  
   gs://kf-releases/v2.5.4/kf-linux  
   /tmp/kf 
    chmod  
   a+x  
   /tmp/kf 
    sudo  
   mv  
   /tmp/kf  
   /usr/local/bin/kf 
   

   Mac

   This command installs kf for all users on the system.

    gcloud  
   storage  
   cp  
   gs://kf-releases/v2.5.4/kf-darwin  
   /tmp/kf 
    chmod  
   a+x  
   /tmp/kf 
    sudo  
   mv  
   /tmp/kf  
   /usr/local/bin/kf 
   

   Cloud Shell

   This command installs kf on your Cloud Shell instance if you use bash , the instructions may need to be modified for other shells.

    mkdir  
   -p  
   ~/bin 
    gcloud  
   storage  
   cp  
   gs://kf-releases/v2.5.4/kf-linux  
   ~/bin/kf 
    chmod  
   a+x  
   ~/bin/kf 
     echo 
     
    "export PATH= 
    $HOME 
    /bin: 
    $PATH 
    " 
    >> 
   ~/.bashrc 
     source 
     
   ~/.bashrc 
   

   Windows

   This command downloads kf to current directory. Add it to the path if you want to call if from anywhere other than the current directory.

    gcloud  
   storage  
   cp  
   gs://kf-releases/v2.5.4/kf-windows.exe  
   kf.exe 
   

2. Install the operator:

   kubectl apply -f "https://storage.googleapis.com/kf-releases/v2.5.4/operator.yaml"

3. Configure the operator for Kf:

   kubectl apply -f "https://storage.googleapis.com/kf-releases/v2.5.4/kfsystem.yaml"

Create a Kubernetes secret for Docker credentials

Create a Kubernetes secret in the Kf namespace for Docker credentials you created above in Service account setup . Then patch the Kubernetes secret to the subresource-apiserver deployment for source uploads.

1. Create the kf namespace.

   kubectl create namespace kf

2. Create a Kubernetes secret for use with Docker registries.

   export secret_name=kf-gcr-key-${RANDOM} kubectl -n kf create secret docker-registry ${secret_name} \
      --docker-username=_json_key --docker-server ${DOCKER_SERVER} \
      --docker-password="${key_json}" 
   

3. Enable and update the Kf operator to use Container Registry as the container registry, and specify the secret containing your Docker credentials..

   export CONTAINER_REGISTRY=gcr.io/${CLUSTER_PROJECT_ID} kubectl patch kfsystem kfsystem \
     --type='json' \
     -p="[{'op': 'replace', 'path': '/spec/kf', 'value': {'enabled': true, 'config': {'spaceContainerRegistry':'${CONTAINER_REGISTRY}', 'secrets':{'build':{'imagePushSecrets':'${secret_name}'}}}}}]" 
   

Validate installation

kf doctor --retries=20