Page History

...

Single-node, LoadBalancer + TLS

These steps have all been implemented in https://github.com/craig-willis/ndslabs-startup/ndslabs-up.sh

• • Prerequisites
    • Kubernetes is running
    • Assumes single-node installation
    • Wildcard CNAME entry for *.test.ndslabs.org pointing to single node IP
  • Test steps
    • Generate wildcard TLS certificate and key

openssl genrsa 2048 > certs/ndslabs.key
openssl req -new -x509 -nodes -sha1 -days 3650 -key certs/ndslabs.key > certs/ndslabs.cert
#[enter *.test.ndslabs.org for the Common Name]
cat certs/ndslabs.cert certs/ndslabs.key > certs/ndslabs.pem
chmod 400 certs/ndslabs.key certs/ndslabs.pem

• • • git clone https://github.com/craig-willis/ndslabs-startup
    • cd
  Create secret in default namespace (
  • • ndslabs-startup
    • ./
  create
  • • ndslabs-
  tls-secret
  • • up.sh
  )

kubectl create secret generic ndslabs-tls-secret --from-file=tls.crt=certs/ndslabs.cert --from-file=tls.key=certs/ndslabs.key --namespace=default

...

• kubectl create -f ndslabs/loadbalancer.yaml
• kubectl create -f ndslabs/default-backend.yaml
• kubectl create -f ndslabs/default-ingress.yaml

...

• DOMAIN = test.ndslabs.org
• CORS_ORIGIN_ADDR = https://www.$DOMAIN
• INGRESS = LoadBalancer

...

• APISERVER_SECURE = true
• APISERVER_PORT = 443
• UI_BASE_PATH = /ui

...

• kubectl create -f gui.yaml
• kubectl create -f apiserver.yaml

...

• • • • Domain name: test.ndslabs.org
      • Internal IP: accept default
    • Open browser to:
      • https://www.test.ndslabs.org/ui/  (Accept certificate)
      • Configure basic Clowder, launch stack
      • Confirm endpoint URI link points to ingress host (https://stackservice.test.ndslabs.org)
    • A few kubectl checks
      • kubectl get secrets --namespace=default 
        • ndslabs-tls-secret
      • kubectl get ingress --namespace=default
        • ndslabs-ingress with rules for /api and /ui
      • kubectl get secret --namespace=demo 
        • demo-tls-secret
      • kubectl get ingress --namespace=demo
        • stack-clowder-ingress with rule for clowder "/"
    • Stop the stack
      • Confirm ingress deleted
        • kubectl get ingress --namespace=demo
    • Delete project
      • ndslabsctl delete project demo
      • Confirm secret deleted
        • kubectl get secret --namespace=demo 

Multi-node, LoadBalancer + TLS

• • Prerequisites
    • Kubernetes is running 
    • Assumes multi-node installation
    • Wildcard CNAME entry for *.test.ndslabs.org pointing to load balancer node
    • Assumes loadbalancer and default-backend services already deployed
  • Test steps
    • Generate wildcard TLS certificate and key

openssl genrsa 2048 > certs/ndslabs.key
openssl req -new -x509 -nodes -sha1 -days 3650 -key certs/ndslabs.key > certs/ndslabs.cert
#[enter *.test.ndslabs.org for the Common Name]
cat certs/ndslabs.cert certs/ndslabs.key > certs/ndslabs.pem
chmod 400 certs/ndslabs.key certs/ndslabs.pem

• • • git clone https://github.com/craig-willis/ndslabs-startup
    • cd ndslabs-startup
    • ./ndslabs-up-multinode.sh
      • Domain name: test.ndslabs.org
      • Internal IP: accept default
    • Open browser to:
      • https://www.test.ndslabs.org/ui/  (Accept certificate)
      • Configure basic Clowder, launch stack
      • Confirm endpoint URI link points to ingress host (https://stackservice.test.ndslabs.org)
    • A few kubectl checks
      • kubectl get secrets --namespace=default 
        • ndslabs-tls-secret
      • kubectl get ingress --namespace=default
        • ndslabs-ingress with rules for /api and /ui
      • kubectl get secret --namespace=demo 
        • demo-tls-secret
      • kubectl get ingress --namespace=demo
        • stack-clowder-ingress with rule for clowder "/"
    • Stop the stack
      • Confirm ingress deleted
        • kubectl get ingress --namespace=demo
    • Delete project
      • ndslabsctl delete project demo
      • Confirm secret deleted
        • kubectl get secret --namespace=demo 

...

...