Chapter 1. Installing on OpenShift Container Platform

Procedure

1. In the left navigation menu, click Ecosystem > Software Catalog.
2. In the Filter by keyword text box, enter Connectivity to find the Red Hat Connectivity Link Operator.
3. Read the information about the Operator, and click Install to display the Operator subscription page.

4. Select your subscription settings as follows:

   • Update Channel: stable
   • Version: 1.3.0
   • Installation mode: All namespaces on the cluster (default).
   • Installed namespace: Select the namespace where you want to install the Operator, for example, kuadrant-system. If the namespace does not already exist, click this field and select Create Project to create the namespace.
   • Approval Strategy: Select Automatic or Manual.
5. Click Install, and wait a few moments until the Operator is installed and ready for use.
6. Click Ecosystem > Installed Operators > Red Hat Connectivity Link.
7. Click the Kuadrant tab, and click Create Kuadrant to create a Kuadrant custom resource (CR).
8. In the Configure via field, click YAML view to edit the definition, for example, the Kuadrant CR name.

9. Click Create and wait for the deployment to be displayed in the list.

   Note

   If you are using OpenShift Service Mesh, no additional configuration is required. Connectivity Link automatically detects and uses OpenShift Service Mesh as your Gateway object controller.

Procedure

1. Create the namespace where you want to install Connectivity Link by running the following command:

   $ oc create ns <kuadrant_system>

   You can replace the default <kuadrant_system> with the namespace you want to use.

2. Install Connectivity Link by creating and applying Subscription and OperatorGroup custom resources (CRs) by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhcl-operator
     namespace: <kuadrant_system>
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: rhcl-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
   ---
   kind: OperatorGroup
   apiVersion: operators.coreos.com/v1
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   spec:
     upgradeStrategy: Default
   EOF

   Replace <kuadrant_system> with the namespace you used.

3. Confirm that the Connectivity Link installation has finished by running one of the following commands:

   $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
   ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})

   $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

   Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

4. Create your Connectivity Link custom resource (CR) by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: kuadrant.io/v1beta1
   kind: Kuadrant
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   EOF

   Replace <kuadrant_system> with the namespace you used.

Procedure

1. Create the namespace where you want to install Connectivity Link by running the following command:

   $ oc create ns <kuadrant-system>

   You can replace the default <kuadrant-system> with the namespace you want to use.

2. Install Connectivity Link by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhcl-operator
     namespace: kuadrant-system
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: rhcl-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       env:
       - name: ISTIO_GATEWAY_CONTROLLER_NAMES
         value: istio.io/gateway-controller
   ---
   kind: OperatorGroup
   apiVersion: operators.coreos.com/v1
   metadata:
     name: kuadrant
     namespace: kuadrant-system
   spec:
     upgradeStrategy: Default
   EOF

   Replace <kuadrant-system> with the namespace you used.

3. Confirm that the Connectivity Link installation has finished by running one of the following commands:

   $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
   ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})

   $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

   Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

4. Create your Connectivity Link custom resource (CR) by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: kuadrant.io/v1beta1
   kind: Kuadrant
   metadata:
     name: kuadrant
     namespace: <kuadrant-system>
   EOF

   Replace <kuadrant-system> with the namespace you used.

Procedure

1. Optional: Set up your environment variables as follows:

   1. Assign AWS_ACCESS_KEY_ID, which is the key ID from AWS with Route 53 access:

      $ export AWS_ACCESS_KEY_ID=xxxxxxx

   2. Assign AWS_SECRET_ACCESS_KEY`, which is the key from AWS with Route 53 access.

      $ export AWS_SECRET_ACCESS_KEY=xxxxxxx

   3. Assign AWS_REGION, which is your AWS region, for example, us-east-2 or eu-west-1.

      $ export AWS_REGION=your-aws-region

2. Create a Secret resource for your credentials as follows:

   $ oc create secret generic aws-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
     --from-literal=AWS_REGION=$AWS_REGION

   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Optional: Specify your GOOGLE environment variable by running the following commands:

   $ export GOOGLE=xxxxxxx

   where:

   • GOOGLE: The GOOGLE variable specifies the JSON credentials generated by the gcloud CLI or by the service account. For example, $HOME/.config/gcloud/application_default_credentials.json, which has the following credentials:

     {"client_id": "***","client_secret": "***","refresh_token": "***","type": "authorized_user"}

2. Optional: Specify your PROJECT_ID environment variable by running the following commands:

   $ export PROJECT_ID=xxxxxxx

   PROJECT_ID: Google project ID.

3. Create a Secret resource for your credentials by running the following command:

   $ oc create secret generic test-gcp-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/gcp \
     --from-literal=PROJECT_ID=$PROJECT_ID \
     --from-file=GOOGLE=$GOOGLE

   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Create a new Azure service principal for managing DNS by setting the following environment variables:

   $ DNS_NEW_SP_NAME=kuadrantDnsPrincipal \
     DNS_SP=$(az ad sp create-for-rbac --name $DNS_NEW_SP_NAME) \
     DNS_SP_APP_ID=$(echo $DNS_SP | jq -r '.appId') \
     DNS_SP_PASSWORD=$(echo $DNS_SP | jq -r '.password')

   For more details on service principals, see the Microsoft Azure documentation.

2. Set the resource group environment variable by running the following command:

   $ DNS_RESOURCE_GROUP="ExampleDNSResourceGroup"

   Replace "ExampleDNSResourceGroup" with the DNS resource group that you want to use.

3. To grant read and contributor access to the zones that you want managed for the service principal you are using, perform the following steps:

   1. Fetch the DNS ID used to grant access to the service principal as follows:

      $ DNS_ID=$(az network dns zone show --name example.com \
       --resource-group $DNS_RESOURCE_GROUP --query "id" --output tsv)

   2. Get your resource group ID by running the following command:

      $ RESOURCE_GROUP_ID=$(az group show --resource-group $DNS_RESOURCE_GROUP | jq ".id" -r)

   3. Give reader access to the resource group as follows:

      $ az role assignment create --role "Reader" --assignee $DNS_SP_APP_ID --scope $DNS_ID

   4. Give contributor access to the DNS zone as follows:

      $ az role assignment create --role "Contributor" --assignee $DNS_SP_APP_ID --scope $DNS_ID

4. Because you are setting up advanced traffic rules for geographic and weighted responses, you must also grant traffic manager and DNS zone access:

   1. Create the role assignment for the traffic manager contributor by running the following command:

      $ az role assignment create --role "Traffic Manager Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

   2. Create the role assignment for the DNA zone contributor by running the following command:

      $ az role assignment create --role "DNS Zone Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

   3. Configure the DNS zone access by running the following command:

      $ cat <<-EOF > /local/path/to/azure.json
      {
        "tenantId": "$(az account show --query tenantId -o tsv)",
        "subscriptionId": "$(az account show --query id -o tsv)",
        "resourceGroup": "$DNS_RESOURCE_GROUP",
        "aadClientId": "$DNS_SP_APP_ID",
        "aadClientSecret": "$DNS_SP_PASSWORD"
      }
      EOF

5. Create a Secret resource for your credentials by running the following command:

   $ oc create secret generic test-azure-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/azure \
     --from-file=azure.json=/local/path/to/azure.json

   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Set the following environment variable to your shared Redis-based instance URL:

   $ export REDIS_URL=rediss://user:xxxxxx@some-redis.com:10340

   Include the appropriate URI scheme for your environment:

   • Secure Redis: rediss://
   • Standard Redis: redis://

2. Create a Secret resource for your Redis URL as follows:

   $ oc -n kuadrant-system create secret generic redis-config \
     --from-literal=URL=$REDIS_URL

3. Update your Limitador custom resource to use the secret that you created as follows:

   $ oc patch limitador limitador --type=merge -n kuadrant-system -p '
   spec:
     storage:
       redis:
         configSecretRef:
           name: redis-config
   '

Procedure

1. In the left navigation menu, select the Administrator perspective.
2. Click Home > Overview.
3. In the Status panel, click Dynamic Plugins > View all.
4. On the Console plugins tab, find the kuadrant-console-plugin entry in the table, which should be listed but disabled.
5. In the kuadrant-console-plugin row, click Disabled.
6. Select the Enable option, and click Save.
7. Wait for the plugin status to change to Loaded.

Verification

1. Refresh the OpenShift Container Platform web console. A new Connectivity Link menu item is displayed in the navigation sidebar.

   1. You can click Connectivity Link > Overview to explore the available resources and to get started with creating a Gateway and configuring policies in the OpenShift Container Platform web console.

1. Go to access.redhat.com.
2. If you do not already have an account, create one.
3. Log in to your account.
4. In the menu bar, click Subscriptions to view and manage your subscriptions.