1.5. Installing Trusted Profile Analyzer by using Helm with Red Hat services

Procedure

1. On your workstation, open a terminal, and log in to OpenShift by using the command-line interface:

   oc login --token=TOKEN --server=SERVER_URL_AND_PORT

   $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443

   注意

   You can find your login token and URL from the OpenShift web console to use on the command line. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, and click Display Token to view the command.

2. Create a new project for the RHTPA deployment:

   oc new-project PROJECT_NAME

   $ oc new-project trusted-profile-analyzer

3. Open a new file for editing:

   $ vi values-rhtpa.yaml

4. Copy and paste the RHTPA values file template into the new values-rhtpa.yaml file.

5. Update the values-rhtpa.yaml file with your information.

   1. Replace S3_ENDPOINT_URL with your relevant S3 storage information.
   2. Replace OIDC_ISSUER_URL, FRONTEND_CLIENT_ID and CLI_CLIENT_ID with your relevant OIDC information.
   3. Save the file, and quit the editor.

6. Create the S3 storage secret resource with your credentials:

   apiVersion: v1
   kind: Secret
   metadata:
     name: storage-credentials
     namespace: PROJECT_NAME
   type: Opaque
   data:
     user: ACCESS_KEY
     password: SECRET_KEY

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: storage-credentials
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     user: root
     password: example123
   EOF

7. Create a OIDC client secret resource:

   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-cli
     namespace: PROJECT_NAME
   type: Opaque
   data:
     client-secret: SECRET

   $ cat <<EOF | oc apply -f -
   apiVersion: v1
   kind: Secret
   metadata:
     name: oidc-cli
     namespace: trusted-profile-analyzer
   type: Opaque
   data:
     client-secret: 5460cc91-4e20-4edd-881c-b15b169f8a79
   EOF

8. Create the two PostgreSQL database secret resources with your database credentials.

   1. A PostgreSQL standard user secret resource:

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: postgresql.example.com
        db.name: rhtpadb
        db.user: jdoe
        db.password: example1234
        db.port: 5432
      EOF

   2. A PostgreSQL administrator secret resource:

      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: PROJECT_NAME
      type: Opaque
      data:
        db.host: DB_HOST
        db.name: DB_NAME
        db.user: USERNAME
        db.password: PASSWORD
        db.port: PORT

      $ cat <<EOF | oc apply -f -
      apiVersion: v1
      kind: Secret
      metadata:
        name: postgresql-admin-credentials
        namespace: trusted-profile-analyzer
      type: Opaque
      data:
        data:
        db.host: postgresql.example.com
        db.name: rhtpadb
        db.user: admin
        db.password: example1234
        db.port: 5432
      EOF

9. Open a new file for editing:

   $ vi values-importers.yaml

   1. Copy and paste the RHTPA importers values file template into the new values-importers.yaml file.
   2. Save the file, and quit the editor.

10. Set up your shell environment:

    $ export NAMESPACE=trusted-profile-analyzer
    $ export APP_DOMAIN_URL=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')

11. Add the OpenShift Helm chart repository:

    $ helm repo add openshift-helm-charts https://charts.openshift.io/

12. Get the latest chart information from the Helm chart repositories:

    $ helm repo update

13. Run the Helm chart:

    helm upgrade --install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values PATH_TO_VALUES_FILE --values PATH_TO_IMPORTER_VALUES_FILE --set-string appDomain=$APP_DOMAIN_URL

    $ helm upgrade --install redhat-trusted-profile-analyzer openshift-helm-charts/redhat-trusted-profile-analyzer -n $NAMESPACE --values values-rhtpa.yaml --values values-importers.yaml --set-string appDomain=$APP_DOMAIN_URL

    注意

    You can run this Helm chart many times to apply the currently configured state from the values file.

14. Once the installation finishes, you can log in to the RHTPA console by using the user credentials from your OIDC provider. You can find the RHTPA console URL by running the following command:

    $ oc -n $NAMESPACE get route --selector app.kubernetes.io/name=server -o jsonpath='https://{.items[0].status.ingress[0].host}{"\n"}'