Chapter 1. Installing the Developer Hub Operator with the OLM framework

Procedure

1. Create a app-config.yaml config map containing the app-config.yaml Developer Hub configuration file by using the following template:

   app-config.yaml fragment

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: my-rhdh-app-config
   data:
     "app-config.yaml": |
       app:
         title: Red Hat Developer Hub
         baseUrl: https://<rhdh_domain_name>
       backend:
         auth:
           externalAccess:
               - type: legacy
                 options:
                   subject: legacy-default-config
                   secret: "${BACKEND_SECRET}"
         baseUrl: https://<rhdh_domain_name>
         cors:
           origin: https://<rhdh_domain_name>

   Copy to Clipboard Toggle word wrap

2. Create a <my_product_secrets> secret and add a key named BACKEND_SECRET with a Base64-encoded string value as shown in the following example:

   apiVersion: v1
   kind: Secret
   metadata:
     name: <my_product_secrets> 

   1

   
   stringData:
     # TODO: See https://backstage.io/docs/auth/service-to-service-auth/#setup
     BACKEND_SECRET: "xxx"

   Copy to Clipboard Toggle word wrap

   1

   <my_product_secrets> is your preferred Developer Hub secret name, where <my_product_secrets> specifies the identifier for your secret configuration within Developer Hub.

   Important

   Ensure that you use a unique value of BACKEND_SECRET for each Developer Hub instance.

   You can use the following command to generate a key:

   node-p'require("crypto").randomBytes(24).toString("base64")'

   Copy to Clipboard Toggle word wrap

3. To enable pulling the PostgreSQL image from the Red Hat Ecosystem Catalog, add the image pull secret in the default service account within the namespace where the Developer Hub instance is being deployed:

   kubectl patch serviceaccount default \
       -p '{"imagePullSecrets": [{"name": "rhdh-pull-secret"}]}' \
       -n <your_namespace>

   Copy to Clipboard Toggle word wrap

4. Create your Backstage custom resource (CR) file using the following template:

   Custom resource fragment

   apiVersion: rhdh.redhat.com/v1alpha3
   kind: Backstage
   metadata:
     # This is the name of your Developer Hub instance
     name: my-rhdh
   spec:
     application:
       imagePullSecrets:
       - "rhdh-pull-secret"
       route:
         enabled: false
       appConfig:
         configMaps:
           - name: my-rhdh-app-config
       extraEnvs:
         secrets:
           - name: <my_product_secrets> 

   1

   Copy to Clipboard Toggle word wrap

   1

   <my_product_secrets> is your preferred Developer Hub secret name, where <my_product_secrets> specifies the identifier for your secret configuration within Developer Hub.

5. Set up a Google-managed certificate by creating a ManagedCertificate object which you must attach to the Ingress as shown in the following example:

   apiVersion: networking.gke.io/v1
   kind: ManagedCertificate
   metadata:
     name: <rhdh_certificate_name>
   spec:
     domains:
       - <rhdh_domain_name>

   Copy to Clipboard Toggle word wrap

   For more information about setting up a Google-managed certificate, see Setting up a Google-managed certificate.

6. Create a FrontendConfig object to set a policy for redirecting to HTTPS. You must attach this policy to the Ingress.

   Example of a FrontendConfig object

   apiVersion: networking.gke.io/v1beta1
   kind: FrontendConfig
   metadata:
     name: <ingress_security_config>
   spec:
     sslPolicy: gke-ingress-ssl-policy-https
     redirectToHttps:
       enabled: true

   Copy to Clipboard Toggle word wrap

   For more information about setting a policy to redirect to HTTPS, see HTTP to HTTPS redirects.

7. Create an ingress resource using the following template, customizing the names as needed:

   Example of an ingress resource configuration

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     # TODO: this the name of your Developer Hub Ingress
     name: my-rhdh
     annotations:
       # If the class annotation is not specified it defaults to "gce".
       kubernetes.io/ingress.class: "gce"
       kubernetes.io/ingress.global-static-ip-name: <ADDRESS_NAME>
       networking.gke.io/managed-certificates: <rhdh_certificate_name>
       networking.gke.io/v1beta1.FrontendConfig: <ingress_security_config>
   spec:
     ingressClassName: gce
     rules:
       # TODO: Set your application domain name.
       - host: <rhdh_domain_name>
         http:
           paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 # TODO: my-rhdh is the name of your `Backstage` custom resource.
                 # Adjust if you changed it!
                 name: backstage-my-rhdh
                 port:
                   name: http-backend

   Copy to Clipboard Toggle word wrap