Preparing Azure for installing Che

Procedure

To set up the Azure environment for Che:

  1. Install the Azure command-line tool. For details, see Install the Azure CLI.

    For example, on macOS:

    $ brew update && brew install azure-cli
  2. Log in to Azure:

    $ az login
  3. Create an Azure group (to list the locations, use the az account list-locations command):

    $ az group create --name eclipseCheResourceGroup --location francecentral
    {
      "id": "/subscriptions/ab0f7986-a280-481c-a47d-98fa45ff94ca/resourceGroups/eclipseCheResourceGroup",
      "location": "francecentral",
      "managedBy": null,
      "name": "eclipseCheResourceGroup",
      "properties": {
        "provisioningState": "Succeeded"
      },
      "tags": null,
      "type": null
    }
  4. Create the cluster:

    $ az aks create --resource-group eclipseCheResourceGroup \
      --name eclipse-che --node-count 1 --enable-addons monitoring --generate-ssh-keys
  5. Configure kubectl:

    $ az aks get-credentials --name eclipse-che --resource-group eclipseCheResourceGroup
    Merged "eclipse-che" as current context in /Users/benoitf/.kube/config
  6. Check the Kubernetes context:

    $ kubectl config current-context
    eclipse-che
    
    $ kubectl get pods --all-namespaces

    All the pods in the running state are displayed.

Installing Ingress on Kubernetes

Eclipse Che uses Ingress.

Procedure

To install Ingress-nginx:

  1. Install the default configuration:

    $ kubectl apply \
      -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml
  2. Install the configuration for cloud:

    $ kubectl apply \
      -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/cloud-generic.yaml

    The following output confirms that the Ingress controller is running:

    $ kubectl get pods --namespace ingress-nginx
    NAME                                        READY   STATUS    RESTARTS   AGE
    nginx-ingress-controller-76c86d76c4-gswmg   1/1     Running   0          9m3s

    Wait for the container to run.

  3. Wait for the external IP. Note that a <pending> status for the external IP is shown before the exact external IP address is displayed.

    $ kubectl get services  --namespace ingress-nginx
    NAME           TYPE          CLUSTER-IP   EXTERNAL-IP    PORT(S)                     AGE
    ingress-nginx  LoadBalancer  10.0.97.244  40.89.129.194  80:31107/TCP,443:30629/TCP  8m59s
  4. Get the external IP of Ingress-nginx.

    $ kubectl get services --namespace ingress-nginx \
      -o jsonpath='{.items[].status.loadBalancer.ingress[0].ip}'
    40.89.129.194

Configuring DNS on Azure

Procedure

To configure DNS on Azure:

  1. In the Azure web console, navigate to HomeDNS zones.

    dns zone in microsoft azure
  2. Create a new zone.

    1. In the Resource group drop-down list, click eclipseCheResourceGroup.

      selecting the resource group
    2. In the Instance details section, in the Name field, type the name of the domain (azr.my-ide.cloud, in this case).

    3. Click the Review + create button.

      entering the name fo the domain
  3. Click the Create button.

    completing the creation of the zone

    The created zone and the list of name servers (NS) are displayed in the DNS Zones section.

    list of created zones and NS

    These servers must be configured with the registrar of the domain.

  4. Navigate to the Azure DNS zone, and click the + Record set button (record set button).

  5. To add a record set:

    1. In the Name field, type *.

    2. In the IP Address field, select the external IP of Ingress-nginx controller that the user had obtained in the [installing-ingress-on-azure] section (40.89.129.194, in this case).

      adding a record set

      The following is an example of an added DNS zone:

      example of an added dns zone

Enabling the TLS and DNS challenge on Azure

To use Azure DNS and TLS, permissions must be granted to have cert-manager managing the DNS challenge for the Let’s Encrypt service.

Procedure
  1. Set the variable for the domain:

    AZURE_CERT_MANAGER_DNS_NAME=azr.my-ide.cloud
  2. Generate the secrets:

    AZURE_CERT_MANAGER_SP_APP_ID=$(az ad sp create-for-rbac --name cert-manager-eclipse-che --query "appId" --output tsv)
    AZURE_CERT_MANAGER_SP_PASSWORD=$(az ad sp create-for-rbac --name cert-manager-eclipse-che --query "password" --output tsv)
  3. Lower the permissions of the service principal (SP):

    $ az role assignment delete --assignee $AZURE_CERT_MANAGER_SP_APP_ID --role Contributor
  4. Give access to the DNS zone:

    DNS_ID=$(az network dns zone show --name $AZURE_CERT_MANAGER_DNS_NAME --resource-group eclipseCheResourceGroup --query "id" --output tsv)
    
    $ az role assignment create --assignee $AZURE_CERT_MANAGER_SP_APP_ID \
      --role "DNS Zone Contributor" --scope $DNS_ID
  5. Check the permissions:

    $ az role assignment list --assignee $AZURE_CERT_MANAGER_SP_APP_ID
  6. Get the Service Principal App ID and password for the configuration:

    $ echo ID=$AZURE_CERT_MANAGER_SP_APP_ID
    $ echo PASSWORD=$AZURE_CERT_MANAGER_SP_PASSWORD

Creating a Service Account Secret on Azure

The secret must be in the cert-manager namespace. Otherwise the secret cannot be found, and cert-manager reports errors.

Procedure

To create the secret, run the following command:

$ kubectl create secret generic azuredns-config \
  --from-literal=CLIENT_SECRET=$AZURE_CERT_MANAGER_SP_PASSWORD -n cert-manager

Installing cert-manager on Azure

Procedure
  1. To install the cert-manager on Azure, create the cert-manager namespace:

    $ kubectl create namespace cert-manager
    namespace/cert-manager created
    
    $ kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
  2. Set validate=false. Without it, cert-manager only works with the latest Kubernetes version:

    $ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v0.8.1/cert-manager.yaml --validate=false
  3. Create the che namespace if it does not already exist:

    $ kubectl create namespace che
    namespace/che created
  4. Create the certificate issuer. Enter your email address in the email field:

    cat <<EOF | kubectl apply -f -
    apiVersion: certmanager.k8s.io/v1alpha1
    kind: ClusterIssuer
    metadata:
      name: che-certificate-issuer
    spec:
      acme:
        dns01:
          providers:
          - azuredns:
              # Service principal clientId (It's the value printed in the previous lines: echo ID=$AZURE_CERT_MANAGER_SP_APP_ID )
              clientID: <AZURE_CERT_MANAGER_SP_APP_ID>
              # A secretKeyRef to a service principal ClientSecret (password)
              # ref: https://docs.microsoft.com/en-us/azure/container-service/kubernetes/container-service-kubernetes-service-principal
              clientSecretSecretRef:
                name: azuredns-config
                key: CLIENT_SECRET
              # Azure subscription Id that can be obtained with command:
              # $ az account show  | jq -r '.id'
              subscriptionID: <SUBSCRIPTION_ID>
              # Azure AD tenant Id that can be obtained with command:
              # $ az account show  | jq -r '.tenantId'
              tenantID: <TENANT_ID>
              resourceGroupName: eclipseCheResourceGroup
              # The DNS Zone to use
              hostedZoneName: azr.my-ide.cloud
            name: azuredns
        email: florent@example.com
        privateKeySecretRef:
          name: letsencrypt
        server: https://acme-v02.api.letsencrypt.org/directory
    EOF
  5. Create the certificate. Edit the domain name:

    cat <<EOF | kubectl apply -f -
    apiVersion: certmanager.k8s.io/v1alpha1
    kind: Certificate
    metadata:
     name: che-tls
     namespace: che
    spec:
     secretName: che-tls
     issuerRef:
       name: che-certificate-issuer
       kind: ClusterIssuer
     dnsNames:
       - '*.azr.my-ide.cloud'
     acme:
       config:
         - dns01:
             provider: azuredns
           domains:
             - '*.azr.my-ide.cloud'
    EOF
  6. Check that the issuerRef name is the same as the ClusterIssuer. A new DNS challenge is added to the DNS zone for Let’s Encrypt.

    new dns challenge added

    The cert-manager logs should contain information about the DNS challenge.

  7. Obtain the logs using the following command (here, cert-manager-8d478bb45-2924h is the name of the cert-manager pod):

    $  kubectl logs -f -n cert-manager cert-manager-8d478bb45-2924h
  8. Ensure that the certificate is ready:

    $ kubectl describe certificate/che-tls -n che
    
    Status:
      Conditions:
        Last Transition Time:  2019-07-29T13:50:35Z
        Message:               Certificate issuance in progress. Temporary certificate issued.
        Reason:                TemporaryCertificate
        Status:                False
        Type:                  Ready
    
    Events:
      Type    Reason              Age   From          Message
      ----    ------              ----  ----          -------
      Normal  Generated           47s   cert-manager  Generated new private key
      Normal  GenerateSelfSigned  47s   cert-manager  Generated temporary self signed certificate
      Normal  OrderCreated        47s   cert-manager  Created Order resource "che-tls-3529929423”
  9. Wait for the status to show OK and ensure that the log contains the following:

    $ kubectl describe certificate/che-tls -n che
    Name:         che-tls
    Namespace:    che
    Labels:       <none>
    Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                    {"apiVersion":"certmanager.k8s.io/v1alpha1","kind":"Certificate","metadata":{"annotations":{},"name":"che-tls","namespace":"che"},"spec":{...
    API Version:  certmanager.k8s.io/v1alpha1
    Kind:         Certificate
    Metadata:
      Creation Timestamp:  2019-07-30T08:22:13Z
      Generation:          1
      Resource Version:    76822
      Self Link:           /apis/certmanager.k8s.io/v1alpha1/namespaces/che/certificates/che-tls
      UID:                 225a1cfb-b2a3-11e9-9e1c-76b96a78248b
    Spec:
      Acme:
        Config:
          dns01:
            Provider:  azuredns
          Domains:
            *.azr.my-ide.cloud
      Dns Names:
        *.azr.my-ide.cloud
      Issuer Ref:
        Kind:       ClusterIssuer
        Name:       che-certificate-issuer
      Secret Name:  che-tls
    Status:
      Conditions:
        Last Transition Time:  2019-07-30T08:23:21Z
        Message:               Certificate is up to date and has not expired
        Reason:                Ready
        Status:                True
        Type:                  Ready
      Not After:               2019-10-28T07:23:19Z
    Events:
      Type    Reason         Age   From          Message
      ----    ------         ----  ----          -------
      Normal  OrderCreated   102s  cert-manager  Created Order resource "che-tls-3633081213"
      Normal  OrderComplete  34s   cert-manager  Order "che-tls-3633081213" completed successfully
      Normal  CertIssued     34s   cert-manager  Certificate issued successfully

Installing Che on Azure using the chectl command

Prerequisites
Procedure
  • To install Che, run the following chectl command:

    $ chectl server:start --installer=helm --platform=k8s --tls \
      --domain=azr.my-ide.cloud --multiuser
      ✔ ✈️  Kubernetes preflight checklist
        ✔ Verify if kubectl is installed
        ✔ Verify remote kubernetes status...done.
        ✔ Verify domain is set...set to azr.my-ide.cloud.
      ✔ 🏃‍  Running Helm to install Che
        ✔ Verify if helm is installed
        ✔ Check for TLS secret prerequisites...che-tls secret found.
        ✔ Create Tiller Role Binding...done.
        ✔ Create Tiller Service Account...done.
        ✔ Create Tiller RBAC
        ✔ Create Tiller Service...done.
        ✔ Preparing Che Helm Chart...done.
        ✔ Updating Helm Chart dependencies...done.
        ✔ Deploying Che Helm Chart...done.
      ✔ ✅  Post installation checklist
        ✔ PostgreSQL pod bootstrap
          ✔ scheduling...done.
          ✔ downloading images...done.
          ✔ starting...done.
        ✔ Keycloak pod bootstrap
          ✔ scheduling...done.
          ✔ downloading images...done.
          ✔ starting...done.
        ✔ Che pod bootstrap
          ✔ scheduling...done.
          ✔ downloading images...done.
          ✔ starting...done.
        ✔ Retrieving Che Server URL...https://che-che.azr.my-ide.cloud
        ✔ Che status check
    Command server:start has completed successfully.

Keycloak and Che now have valid wildcard certificates.

wildcard certificates for keycloak che
che user dashboard
Figure 1. Che user dashboard
Tags: