Self-Hosting configure8
Configure8 Self-Hosted Helm Chart Deployment Guide
This guide delineates the steps to deploy the Configure8 (C8) application on a Kubernetes cluster using a Helm chart.
Requirements
A running Kubernetes version 1.22 or above is required to guarantee compatibility with the C8 App. Ensure the cluster has public internet access to fetch Docker images from repositories, specifically from GitHub.
A Kubernetes user with sufficient cluster access privileges is required to install the C8 app.
The Helm Package Manager.
The Kubectl
The AWS CLI
A token provided by the C8 team is required for adding image pull secrets to the cluster.
A MongoDB version 6.0 or above must be set up and accessible by the Kubernetes cluster.
A RabbitMQ version 3.13 or above must be set up for managing message queues within the C8 application.
An OpenSearch cluster version 2.5 or above must be set up for robust search functionality and data analytics within the C8 app.
A Snowflake account must be set up to provide fast search capabilities and the ability to perform complex aggregations.
Step 1: Creating a Namespace
Isolate the C8 application by creating a Kubernetes namespace named "c8":
Step 2: Create Docker Registry Secret
Create a Kubernetes secret to access the C8 Docker registry. Replace and with your specific token and email address, respectively:
Step 3: Create C8 Application Secret
Generate a Kubernetes secret for the C8 application, which will contain sensitive data such as API keys and database credentials. Replace 'value' with the actual values:
Secrets Description
Name | Type | Required | Default | Description |
---|---|---|---|---|
API_KEY | string | True |
| Unique secret key |
string | True |
| Crypto initialization vector | |
CRYPTO_SECRET | string | True |
| Crypto password |
DB_PASSWORD | string | True |
| Database password |
DB_USERNAME | string | True |
| Database username |
GITHUB_APP_CLIENT_ID | string | False |
| GitHub application client id. Should be created per installation in advance (optional) |
GITHUB_APP_CLIENT_SECRET | string | False |
| GitHub application client secret. |
GITHUB_APP_INSTALL_URL | string | False |
| GitHub application installation url. |
GOOGLE_KEY | string | False |
| Google application key. Required for the sign in with google |
GOOGLE_SECRET | string | False |
| Google application secret. Required for the login with google |
JWT_SECRET | string | True |
| Unique secret used for sign user's JWT tokens |
RABBITMQ_PASSWORD | string | True |
| RabbitMQ password |
RABBITMQ_USERNAME | string | True |
| RabbitMQ user |
SMTP_USERNAME | string | True |
| Username for SMTP server. |
SMTP_PASSWORD | string | True |
| Password or token for SMTP authentication. |
SF_USERNAME | string | True |
| Username for Snowflake db access. |
SF_PASSWORD | string | True |
| Password for Snowflake db access. |
SEGMENT_KEY | string | False |
| Segment key for application analytics. |
AWS_ACCESS_KEY_ID | string | False |
| A unique identifier associated with an AWS User. |
AWS_SECRET_ACCESS_KEY | string | False |
| A secret string associated with the AWS_ACCESS_KEY_ID for an AWS IAM user or role. |
Warning You need to generate your own API_KEY, CRYPTO_IV, JWT_SECRET, and CRYPTO_SECRET which can be any cryptographically secure random string. Feel free to refer to Open Web Application Security Project (OWASP) for secure random number generation recommendations: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
CRYPTO_IV:
The initialization vector (iv
) should be 16 bytes. You can generate it using Node.js's crypto
module's randomBytes
function. Here's how you might do it:
This will generate a new, random 16-byte initialization vector each time it's run. Remember, each encryption operation should use a unique IV.
Step 4: Install the C8 Helm Chart
Step 4.1: Configure access for the discovery job
AWS
GCP (It can be configured after chart installation)
Azure (It can be configured after chart installation)
Step 4.2: Add Configure8 Chart Repository
Add the Configure8 chart repository and update it:
Install the Helm chart with the desired configurations. Replace the placeholders with your specific values:
Note The example below the uses discovery access type using GCP ServiceAccount (GKE) to access AWS
Note The example below uses the discovery access type Using service account (EKS)
Note The example below uses the discovery access type: Azure application, GCP service account, and AWS access keys.
Note Depending on the chosen discovery access type, the serviceAccount parameters can be overridden
Once you successfully install a Helm chart that includes Ingress configurations, the next vital step is to establish a CNAME record in your DNS settings. This is essential to map your domain name to the Ingress controller's service endpoint.
Ensuring that the DNS propagates the new record correctly and securely linking it via TLS/SSL certificates (if applicable) will bolster both usability and security for end-users navigating to your c8 applications.
Application Variables
The table below lists the key application variables that can be configured during deployment:
Key | Type | Required | Default | Description |
---|---|---|---|---|
variables.AWS_REGION | string | Yes |
| The region that we actually use with AWS integration |
variables.DB_AUTH_MECHANISM | string | Yes |
| The mechanism of how to authenticate with the database. Might be SCRAM-SHA-1 or any other supported by MongoDB |
variables.DB_DATABASE | string | Yes |
| Database name |
variables.DB_HOST | string | Yes |
| Database host |
variables.DB_PORT | string | Yes |
| Database port |
variables.DB_CONNECTION_ADDITIONAL_PARAMS | string | No |
| Additional parameters for the database connection, should be provided in query params format like "key1=value&key2=value2". If no params provided should be an empty string. |
variables.DEEPLINK_URL | string | No |
| Url on which the application will be available. For example https://configure8.my-company.io |
variables.DJW_APP_URL | string | Yes | "" | The DJW_APP_URL has the same value as DEEPLINK_URL. |
variables.DEFAULT_SENDER | string | Yes |
| Default email for sending notifications. |
variables.DISABLE_ANALYTICS | string | No |
| Enable or disable analytics |
variables.HOOKS_CALLBACK_URL | string | Yes |
| Url on which the application will be available. Usually should be the same as DEEPLINK_URL. For example https://configure8.my-company.io |
variables.MONGO_DRIVER_TYPE | string | Yes |
| Type of the driver. For atlas mongoDbAtlas and mongoDb for the regular instance |
variables.OLAP_DB | string | Yes |
| Online analytical processing DB type |
variables.OPENSEARCH_NODE | string | Yes |
| ElasticSearch url |
variables.OPENSEARCH_AWS_AUTHENTICATE | string | Yes |
| Enable or disable AWS authentication |
variables.OPENSEARCH_AWS_SERVICE | string | Yes |
| Specify the AWS OpenSearch service type, either 'es' for OpenSearch or 'aoss' for serverless OpenSearch Service. |
variables.RABBITMQ_HOST | string | Yes |
| RabbitMQ host |
variables.RABBITMQ_PORT | int | Yes |
| RabbitMQ port |
variables.RABBITMQ_USE_SSL | string | No |
| RabbitMQ SSL flag |
variables.SF_ACCOUNT | string | Yes |
| Snowflake account name |
variables.SF_DATABASE | string | Yes |
| Snowflake DB name |
variables.SF_POOLSIZE | string | No |
| Snowflake pool size |
variables.SF_SCHEMA | string | Yes |
| Snowflake DB schema |
variables.SF_WAREHOUSE | string | Yes |
| Snowflake warehouse name |
variables.SMTP_HOST | string | Yes |
| Address of the SMTP server (e.g., SendGrid's server). |
variables.SMTP_PORT | string | Yes |
| Port for connecting to the SMTP server |
variables.SSA_SWAGGER_ENABLED | string | No |
| Enable or disable swagger documentation |
variables.SWAGGER_ENABLED | string | No |
| Enable or disable swagger documentation |
variables.TZ | string | Yes |
| Application timezone |
The C8 Helm Chart Parameters
The table below shows configurable parameters when deploying the C8 Helm chart:
Key | Type | Default | Description |
---|---|---|---|
backend.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
backend.autoscaling.enabled | bool |
| |
backend.autoscaling.maxReplicas | int |
| |
backend.autoscaling.minReplicas | int |
| |
backend.autoscaling.targetCPUUtilizationPercentage | int |
| |
backend.autoscaling.targetMemoryUtilizationPercentage | int |
| |
backend.enabled | bool |
| |
backend.image.pullPolicy | string |
| |
backend.image.repository | string |
| |
backend.image.tag | string |
| |
backend.livenessProbe.failureThreshold | int |
| |
backend.livenessProbe.httpGet.path | string |
| |
backend.livenessProbe.httpGet.port | int |
| |
backend.livenessProbe.periodSeconds | int |
| |
backend.livenessProbe.timeoutSeconds | int |
| |
backend.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
backend.podAnnotations | object |
| |
backend.podDisruptionBudget.enabled | bool |
| Specifies whether pod disruption budget should be created |
backend.podDisruptionBudget.minAvailable | string |
| Number or percentage of pods that must be available |
backend.podSecurityContext.fsGroup | int |
| |
backend.podSecurityContext.runAsGroup | int |
| |
backend.podSecurityContext.runAsNonRoot | bool |
| |
backend.podSecurityContext.runAsUser | int |
| |
backend.readinessProbe.failureThreshold | int |
| |
backend.readinessProbe.httpGet.path | string |
| |
backend.readinessProbe.httpGet.port | int |
| |
backend.readinessProbe.periodSeconds | int |
| |
backend.readinessProbe.timeoutSeconds | int |
| |
backend.replicaCount | int |
| |
backend.resources | object |
| Define resources requests and limits for Pods. https://kubernetes.io/docs/user-guide/compute-resources/ |
backend.securityContext.allowPrivilegeEscalation | bool |
| |
backend.securityContext.capabilities.drop[0] | string |
| |
backend.securityContext.readOnlyRootFilesystem | bool |
| |
backend.service | object |
| Configuration for backend service |
backend.serviceAccount.annotations | object |
| Annotations to add to the service account |
backend.serviceAccount.create | bool |
| Specifies whether a service account should be created |
backend.serviceAccount.name | string |
| The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
backend.startupProbe.failureThreshold | int |
| |
backend.startupProbe.httpGet.path | string |
| |
backend.startupProbe.httpGet.port | int |
| |
backend.startupProbe.initialDelaySeconds | int |
| |
backend.startupProbe.periodSeconds | int |
| |
backend.startupProbe.timeoutSeconds | int |
| |
backend.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
common.C8_SECRET_NAME | string |
| |
common.IMAGE_PULL_SECRET | string |
| image pull secrets |
common.ingress.annotations | object |
| |
common.ingress.enabled | bool |
| Enable ingress object for external access to the resources . Do not forget to add common.ingress.ingressClassName="" |
common.ingress.ingressClassName | string |
| |
common.ingress.labels | object |
| |
common.ingress.pathType | string |
| |
common.revisionHistoryLimit | int |
| |
common.ttlSecondsAfterFinished | int |
| |
commonLabels | object |
| Labels to apply to all resources |
djm.DJW_IMAGE | string |
| Discovery job worker image |
djm.DJW_NODE_SELECTOR_KEY | string |
| Discovery job worker NodeSelector key |
djm.DJW_NODE_SELECTOR_VALUE | string |
| Discovery job worker NodeSelector value |
djm.DJW_POD_SECURITY_CONTEXT | string |
| Discovery job worker pod security context |
djm.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
djm.container.port | string |
| |
djm.enabled | bool |
| |
djm.image.pullPolicy | string |
| |
djm.image.repository | string |
| c8 docker image repository |
djm.image.tag | string |
| |
djm.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
djm.podAnnotations | object |
| |
djm.podSecurityContext.fsGroup | int |
| |
djm.podSecurityContext.runAsGroup | int |
| |
djm.podSecurityContext.runAsNonRoot | bool |
| |
djm.podSecurityContext.runAsUser | int |
| |
djm.replicaCount | int |
| |
djm.resources | object |
| Define resources requests and limits for Pods. https://kubernetes.io/docs/user-guide/compute-resources/ |
djm.securityContext.allowPrivilegeEscalation | bool |
| |
djm.securityContext.capabilities.drop[0] | string |
| |
djm.securityContext.readOnlyRootFilesystem | bool |
| |
djm.serviceAccount.annotations | object |
| Annotations to add to the service account |
djm.serviceAccount.create | bool |
| Specifies whether a service account should be created |
djm.serviceAccount.job_worker.annotations | object |
| Annotations to add to the service account |
djm.serviceAccount.job_worker.create | bool |
| Specifies whether a service account should be created |
djm.serviceAccount.job_worker.name | string |
| The name of the djw service account to use. If not set and create is true, a name is generated using the fullname template |
djm.serviceAccount.name | string |
| The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
djm.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
frontend.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
frontend.autoscaling.enabled | bool |
| |
frontend.autoscaling.maxReplicas | int |
| |
frontend.autoscaling.minReplicas | int |
| |
frontend.autoscaling.targetCPUUtilizationPercentage | int |
| |
frontend.autoscaling.targetMemoryUtilizationPercentage | int |
| |
frontend.enabled | bool |
| |
frontend.image.pullPolicy | string |
| |
frontend.image.repository | string |
| |
frontend.image.tag | string |
| |
frontend.livenessProbe.failureThreshold | int |
| |
frontend.livenessProbe.httpGet.path | string |
| |
frontend.livenessProbe.httpGet.port | int |
| |
frontend.livenessProbe.periodSeconds | int |
| |
frontend.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
frontend.podAnnotations | object |
| |
frontend.podDisruptionBudget.enabled | bool |
| |
frontend.podDisruptionBudget.minAvailable | string |
| |
frontend.podSecurityContext.fsGroup | int |
| |
frontend.podSecurityContext.runAsGroup | int |
| |
frontend.podSecurityContext.runAsNonRoot | bool |
| |
frontend.podSecurityContext.runAsUser | int |
| |
frontend.readinessProbe.failureThreshold | int |
| |
frontend.readinessProbe.httpGet.path | string |
| |
frontend.readinessProbe.httpGet.port | int |
| |
frontend.readinessProbe.initialDelaySeconds | int |
| |
frontend.readinessProbe.periodSeconds | int |
| |
frontend.replicaCount | int |
| |
frontend.resources | object |
| Define resources requests and limits for Pods. https://kubernetes.io/docs/user-guide/compute-resources/ |
frontend.securityContext.allowPrivilegeEscalation | bool |
| |
frontend.securityContext.capabilities.drop[0] | string |
| |
frontend.service | object |
| Configuration for frontend service |
frontend.serviceAccount.annotations | object |
| |
frontend.serviceAccount.create | bool |
| |
frontend.serviceAccount.name | string |
| |
frontend.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
fullnameOverride | string |
| Provide a name to substitute for the full names of resources |
migration.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
migration.image.pullPolicy | string |
| |
migration.image.repository | string |
| |
migration.image.tag | string |
| |
migration.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
migration.podSecurityContext.fsGroup | int |
| |
migration.podSecurityContext.runAsGroup | int |
| |
migration.podSecurityContext.runAsNonRoot | bool |
| |
migration.podSecurityContext.runAsUser | int |
| |
migration.securityContext.allowPrivilegeEscalation | bool |
| |
migration.securityContext.capabilities.drop[0] | string |
| |
migration.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
nameOverride | string |
| Provide a name in place of c8 for |
pns.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
pns.autoscaling.enabled | bool |
| |
pns.autoscaling.maxReplicas | int |
| |
pns.autoscaling.minReplicas | int |
| |
pns.autoscaling.targetCPUUtilizationPercentage | int |
| |
pns.autoscaling.targetMemoryUtilizationPercentage | int |
| |
pns.container.port | string |
| |
pns.enabled | bool |
| |
pns.image.pullPolicy | string |
| |
pns.image.repository | string |
| |
pns.image.tag | string |
| |
pns.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
pns.podAnnotations | object |
| |
pns.podDisruptionBudget.enabled | bool |
| |
pns.podDisruptionBudget.minAvailable | string |
| |
pns.podSecurityContext.fsGroup | int |
| |
pns.podSecurityContext.runAsGroup | int |
| |
pns.podSecurityContext.runAsNonRoot | bool |
| |
pns.podSecurityContext.runAsUser | int |
| |
pns.replicaCount | int |
| |
pns.resources | object |
| Define resources requests and limits for Pods. https://kubernetes.io/docs/user-guide/compute-resources/ |
pns.securityContext.allowPrivilegeEscalation | bool |
| |
pns.securityContext.capabilities.drop[0] | string |
| |
pns.securityContext.readOnlyRootFilesystem | bool |
| |
pns.service | object |
| Configuration for pns service |
pns.serviceAccount.annotations | object |
| Annotations to add to the service account |
pns.serviceAccount.create | bool |
| Specifies whether a service account should be created |
pns.serviceAccount.name | string |
| The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
pns.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
ssa.affinity | object |
| Affinity for pod assignment https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
ssa.container.port | string |
| |
ssa.enabled | bool |
| |
ssa.image.pullPolicy | string |
| |
ssa.image.repository | string |
| |
ssa.image.tag | string |
| |
ssa.ingress.annotations | object |
| |
ssa.ingress.enabled | bool |
| |
ssa.ingress.ingressClassName | string |
| |
ssa.ingress.labels | object |
| |
ssa.ingress.pathType | string |
| |
ssa.livenessProbe.failureThreshold | int |
| |
ssa.livenessProbe.httpGet.path | string |
| |
ssa.livenessProbe.httpGet.port | int |
| |
ssa.livenessProbe.httpGet.scheme | string |
| |
ssa.livenessProbe.periodSeconds | int |
| |
ssa.livenessProbe.timeoutSeconds | int |
| |
ssa.nodeSelector | object |
| Node labels for pod assignment https://kubernetes.io/docs/user-guide/node-selection/ |
ssa.podAnnotations | object |
| |
ssa.podDisruptionBudget.enabled | bool |
| Specifies whether pod disruption budget should be created |
ssa.podDisruptionBudget.minAvailable | string |
| Number or percentage of pods that must be available |
ssa.podSecurityContext.fsGroup | int |
| |
ssa.podSecurityContext.runAsGroup | int |
| |
ssa.podSecurityContext.runAsNonRoot | bool |
| |
ssa.podSecurityContext.runAsUser | int |
| |
ssa.readinessProbe.failureThreshold | int |
| |
ssa.readinessProbe.httpGet.path | string |
| |
ssa.readinessProbe.httpGet.port | int |
| |
ssa.readinessProbe.httpGet.scheme | string |
| |
ssa.readinessProbe.periodSeconds | int |
| |
ssa.readinessProbe.timeoutSeconds | int |
| |
ssa.replicaCount | int |
| |
ssa.resources | object |
| Define resources requests and limits for Pods. https://kubernetes.io/docs/user-guide/compute-resources/ |
ssa.securityContext.allowPrivilegeEscalation | bool |
| |
ssa.securityContext.capabilities.drop[0] | string |
| |
ssa.securityContext.readOnlyRootFilesystem | bool |
| |
ssa.service | object |
| Configuration for ssa service |
ssa.serviceAccount.annotations | object |
| Annotations to add to the service account |
ssa.serviceAccount.create | bool |
| Specifies whether a service account should be created |
ssa.serviceAccount.name | string |
| The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
ssa.tolerations | list |
| Tolerations for pod assignment https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
Last updated