mirror of
https://github.com/freedbygrace/ActiveDirectoryManager.git
synced 2026-08-13 20:28:45 +00:00
Reorganize infrastructure as code and implement versioning schema
This commit is contained in:
Alphaeus Mote
@@ -0,0 +1,324 @@
|
||||
# Kubernetes Deployment Guide
|
||||
|
||||
This guide provides detailed instructions for deploying the Active Directory Management application on Kubernetes.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes cluster (v1.19+)
|
||||
- kubectl configured to communicate with your cluster
|
||||
- [Kustomize](https://kustomize.io/) (v4.0+) or kubectl v1.14+ which includes kustomize
|
||||
- Optional: Ingress controller (e.g., NGINX Ingress Controller)
|
||||
- Optional: cert-manager for TLS certificates
|
||||
|
||||
## Deployment Architecture
|
||||
|
||||
The Kubernetes deployment consists of:
|
||||
|
||||
- **Application Deployment**: The main application with multiple replicas
|
||||
- **PostgreSQL StatefulSet**: Database with persistent storage
|
||||
- **Redis StatefulSet**: Cache and session storage with persistent storage
|
||||
- **Services**: For internal communication between components
|
||||
- **Ingress**: For external access to the application
|
||||
- **ConfigMap and Secrets**: For configuration and sensitive data
|
||||
|
||||
All Kubernetes manifests are located in the `iac/kubernetes/` directory.
|
||||
|
||||
## Step-by-Step Deployment
|
||||
|
||||
### 1. Customize Configuration
|
||||
|
||||
Before deploying, customize the configuration files in the `iac/kubernetes/` directory:
|
||||
|
||||
#### ConfigMap (`iac/kubernetes/configmap.yaml`)
|
||||
|
||||
Update environment variables according to your environment:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ad-management-config
|
||||
namespace: ad-management
|
||||
data:
|
||||
NODE_ENV: "production"
|
||||
PORT: "5000"
|
||||
BASE_URL: "https://your-domain.com" # Update this
|
||||
DEFAULT_ADMIN_USERNAME: "admin"
|
||||
DEFAULT_ADMIN_FULLNAME: "System Administrator"
|
||||
DISABLE_REGISTRATION: "false"
|
||||
POSTGRES_DB: "admgr"
|
||||
POSTGRES_USER: "postgres"
|
||||
```
|
||||
|
||||
#### Secrets (`kubernetes/secrets.yaml`)
|
||||
|
||||
Update the secrets with your own base64-encoded values:
|
||||
|
||||
```bash
|
||||
# Generate base64-encoded secrets
|
||||
echo -n "your-jwt-secret" | base64
|
||||
echo -n "your-session-secret" | base64
|
||||
echo -n "your-admin-password" | base64
|
||||
echo -n "admin@your-domain.com" | base64
|
||||
echo -n "your-postgres-password" | base64
|
||||
```
|
||||
|
||||
Then update `iac/kubernetes/secrets.yaml`:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: ad-management-secrets
|
||||
namespace: ad-management
|
||||
type: Opaque
|
||||
data:
|
||||
JWT_SECRET: "base64-encoded-jwt-secret"
|
||||
SESSION_SECRET: "base64-encoded-session-secret"
|
||||
DEFAULT_ADMIN_PASSWORD: "base64-encoded-admin-password"
|
||||
DEFAULT_ADMIN_EMAIL: "base64-encoded-admin-email"
|
||||
POSTGRES_PASSWORD: "base64-encoded-postgres-password"
|
||||
```
|
||||
|
||||
#### Ingress (`iac/kubernetes/ingress.yaml`)
|
||||
|
||||
Update the hostname and TLS configuration:
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ad-management-ingress
|
||||
namespace: ad-management
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- your-domain.com # Update this
|
||||
secretName: ad-management-tls
|
||||
rules:
|
||||
- host: your-domain.com # Update this
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: ad-management
|
||||
port:
|
||||
name: http
|
||||
```
|
||||
|
||||
### 2. Deploy the Application
|
||||
|
||||
Deploy all resources using Kustomize:
|
||||
|
||||
```bash
|
||||
# Navigate to the iac/kubernetes directory
|
||||
cd iac/kubernetes
|
||||
|
||||
# Apply all resources
|
||||
kubectl apply -k .
|
||||
|
||||
# Or from anywhere in the project
|
||||
kubectl apply -k iac/kubernetes
|
||||
```
|
||||
|
||||
### 3. Verify Deployment
|
||||
|
||||
Check that all resources are created and running:
|
||||
|
||||
```bash
|
||||
# Check namespace
|
||||
kubectl get namespace ad-management
|
||||
|
||||
# Check pods
|
||||
kubectl get pods -n ad-management
|
||||
|
||||
# Check services
|
||||
kubectl get services -n ad-management
|
||||
|
||||
# Check deployments and statefulsets
|
||||
kubectl get deployment,statefulset -n ad-management
|
||||
|
||||
# Check ingress
|
||||
kubectl get ingress -n ad-management
|
||||
```
|
||||
|
||||
### 4. Access the Application
|
||||
|
||||
If you've configured the Ingress, the application will be available at your specified domain.
|
||||
|
||||
Without Ingress, use port-forwarding:
|
||||
|
||||
```bash
|
||||
kubectl port-forward -n ad-management svc/ad-management 5000:80
|
||||
```
|
||||
|
||||
Then access the application at http://localhost:5000.
|
||||
|
||||
## Common Operations
|
||||
|
||||
### Scaling the Application
|
||||
|
||||
To scale the application horizontally:
|
||||
|
||||
```bash
|
||||
kubectl scale -n ad-management deployment/ad-management --replicas=3
|
||||
```
|
||||
|
||||
### Updating the Application
|
||||
|
||||
To update the application to a new version:
|
||||
|
||||
```bash
|
||||
# Update the image
|
||||
kubectl set image -n ad-management deployment/ad-management ad-management=ad-management:new-tag
|
||||
|
||||
# Check rollout status
|
||||
kubectl rollout status -n ad-management deployment/ad-management
|
||||
```
|
||||
|
||||
### Viewing Logs
|
||||
|
||||
To view application logs:
|
||||
|
||||
```bash
|
||||
# View logs from all pods
|
||||
kubectl logs -n ad-management -l app=ad-management
|
||||
|
||||
# View logs from a specific pod
|
||||
kubectl logs -n ad-management pod/ad-management-xxxx-yyyy
|
||||
```
|
||||
|
||||
### Restarting Components
|
||||
|
||||
To restart the application:
|
||||
|
||||
```bash
|
||||
kubectl rollout restart -n ad-management deployment/ad-management
|
||||
```
|
||||
|
||||
To restart PostgreSQL or Redis:
|
||||
|
||||
```bash
|
||||
kubectl rollout restart -n ad-management statefulset/postgres
|
||||
kubectl rollout restart -n ad-management statefulset/redis
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Pod Startup Issues
|
||||
|
||||
If pods are not starting:
|
||||
|
||||
```bash
|
||||
# Check pod status
|
||||
kubectl get pods -n ad-management
|
||||
|
||||
# Describe the pod for more details
|
||||
kubectl describe pod -n ad-management pod/ad-management-xxxx-yyyy
|
||||
|
||||
# Check container logs
|
||||
kubectl logs -n ad-management pod/ad-management-xxxx-yyyy
|
||||
```
|
||||
|
||||
### Database Connection Issues
|
||||
|
||||
If the application can't connect to the database:
|
||||
|
||||
1. Check if the PostgreSQL pod is running:
|
||||
```bash
|
||||
kubectl get pods -n ad-management -l app=postgres
|
||||
```
|
||||
|
||||
2. Check PostgreSQL logs:
|
||||
```bash
|
||||
kubectl logs -n ad-management pod/postgres-0
|
||||
```
|
||||
|
||||
3. Verify the connection from the application pod:
|
||||
```bash
|
||||
kubectl exec -it -n ad-management pod/ad-management-xxxx-yyyy -- nc -zv postgres 5432
|
||||
```
|
||||
|
||||
### Ingress Issues
|
||||
|
||||
If the Ingress is not working:
|
||||
|
||||
1. Check the Ingress status:
|
||||
```bash
|
||||
kubectl describe ingress -n ad-management ad-management-ingress
|
||||
```
|
||||
|
||||
2. Check the Ingress controller logs:
|
||||
```bash
|
||||
kubectl logs -n ingress-nginx deployment/ingress-nginx-controller
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
### Example: Setting Up TLS with cert-manager
|
||||
|
||||
1. Install cert-manager:
|
||||
```bash
|
||||
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml
|
||||
```
|
||||
|
||||
2. Create a ClusterIssuer for Let's Encrypt:
|
||||
```yaml
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: your-email@example.com
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
```
|
||||
|
||||
3. Apply the ClusterIssuer:
|
||||
```bash
|
||||
kubectl apply -f cluster-issuer.yaml
|
||||
```
|
||||
|
||||
### Example: Setting Up Monitoring with Prometheus and Grafana
|
||||
|
||||
1. Install Prometheus Operator:
|
||||
```bash
|
||||
kubectl apply -f https://github.com/prometheus-operator/kube-prometheus/releases/download/v0.10.0/manifests-0.10.0.tar.gz
|
||||
```
|
||||
|
||||
2. Create a ServiceMonitor for the application:
|
||||
```yaml
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: ad-management
|
||||
namespace: monitoring
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ad-management
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- ad-management
|
||||
endpoints:
|
||||
- port: http
|
||||
path: /metrics
|
||||
interval: 15s
|
||||
```
|
||||
|
||||
3. Apply the ServiceMonitor:
|
||||
```bash
|
||||
kubectl apply -f service-monitor.yaml
|
||||
```
|
||||
Reference in New Issue
Block a user