Deploying Eggplant DAI in Containers
Before proceeding with the installation of Eggplant DAI in containers, you should ensure engineers in your organisation are Certified Kubernetes Administrators (https://www.cncf.io/training/certification/cka/) or have equivalent experience.
Eggplant DAI can be installed on Kubernetes using Helm. You will need to meet the following requirements:
Requirement | Notes |
---|---|
Kubernetes cluster | Tested version 1.27. |
ingress-nginx | Tested version 1.10.0 (chart version 4.10.0). |
Keda v2 | Optional, for autoscaling engines. Tested version 2.13.2. |
Eggplant DAI license | Speak to support if needed. |
When you've met those requirements, you can install the default Eggplant DAI deployment by creating a Helm values file. In the example below, substitute all the values to work for your own deployment.
global:
postgresql:
auth:
postgresPassword: postgres
ingress:
host: dai.example.com
keycloak:
host: dai.example.com
devLicense: a-real-license-goes-here
execLicense: a-real-license-goes-here
objectStorage:
minio:
rootUser: "eggplant"
rootPassword: "eggplant"
keycloak:
externalDatabase:
# This must match the value of global.postgresql.auth.postgresPassword
password: postgres
keycloak-user-provisioner:
adminUsers:
daiAdmin:
username: admin-username
email: admin-email
password: admin-password
A few notes:
global.ingress.host
andglobal.keycloak.host
do not have to be the same domain, but they do have to be resolvable. You can do this either by having something like ExternalDNS deployed on your cluster or manually creating the records and pointing them at your cluster.- When running in containers DAI must be used in conjunction with TLS. The TLS can either be terminated within the cluster by adding a certificate to the ingress or on an external loadbalancer. See the TLS configuration section below for details.
- The hostname configured under
global.ingress.host
must be solely for DAI use. Running other applications on the same subdomain is not supported. keycloak-user-provisioner.adminUsers.daiAdmin.password
must be at least 12 characters long. You can add additional admin users by adding extra keys underkeycloak-user-provisioner.adminUsers
.- DAI makes use of configuration snippets within the ingress rules. If you are running a recent version of the ingress-nginx controller, then you must ensure that this is configured to allow-snippet-annotations. This can be achieved by setting
controller.allowSnippetAnnotations
totrue
if installing ingress-nginx with helm.
Full documentation for all values can be found here.
Then deploy it to your Kubernetes cluster:
$ helm upgrade --install \ --namespace dai \ --create-namespace \ dai \ dai \ --repo oci://harbor.dai.eggplant.cloud/charts/dai \ --version 1.13.9 \ --values dai.yaml \ --wait Release "dai" does not exist. Installing it now. NAME: dai LAST DEPLOYED: Fri Feb 17 08:20:17 2023 NAMESPACE: dai STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: Thank you for installing dai.
Your release is named dai.
To learn more about the release, try:
$ helm status dai $ helm get all dai
You can access your DAI instance by visiting dai.example.com.
admin username: admin-username admin password: admin-password
In this installation, required third-party dependencies are installed and configured automatically using Bitnami Helm charts. These dependencies are:
Dependency | Tested Chart Version | Tested App Version |
---|---|---|
RabbitMQ | 11.13.0 | 3.11.13 |
PostgreSQL | 11.9.13 | 14.7.0 |
MinIO | 12.2.6 | 2022.2.5 |
Keycloak | 10.1.6 | 19.0.3 |
The Helm chart installs these dependencies, but it doesn't manage backups of data stored in PostgreSQL or MinIO. You need to arrange backups of these services in a production deployment as part of your disaster recovery plan. There's an example of one approach to backups later in this documentation.
Supported customizations
In the default installation above, all dependencies are deployed to Kubernetes with data stored in persistent volumes for PostgreSQL and MinIO. If you have an existing solution in place for PostgreSQL or AWS S3 compatible object storage you want to use instead, you can customise the Eggplant DAI installation to use these. Further, you may want to pass credentials using Kubernetes secrets rather than in the values file for improved security.
This section of the documentation gives examples showing how to customize your installation. All examples will use secrets for credentials. All the examples given are just snippets that are meant to be added to the default installation values demonstrated above.
Object storage configuration
Eggplant DAI depends on an S3 compatible object storage solution for persisting assets such as test screenshots. The Helm chart gives several options for configuring this.
Bundled MinIO (Default)
By default, the Eggplant DAI Helm chart deploys MinIO as a sub-chart with a random root-user and root-password.
You can override these random values by providing an existing secret. First, prepare an existing secret with credentials in:
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: dai-objectstorage
stringData:
root-user: username
root-password: password
$ kubectl -n dai apply -f dai-objectstorage.yaml
Then update your values file to point to the existing secret and run Helm upgrade:
global:
objectStorage:
minio:
existingSecret: dai-objectstorage
minio:
auth:
existingSecret: dai-objectstorage
$ helm upgrade dai oci://harbor.dai.eggplant.cloud/charts/dai --version 1.13.9 -f dai.yaml --wait
Note global.objectStorage.minio.existingSecret
and minio.auth.existingSecret
must match.
You can further customize your MinIO installation by passing values under the minio
key in your values file. MinIO installation is provided by the Bitnami chart, so please refer to their documentation for available options.
Changes to the MinIO configuration will not be supported by Eggplant.
Existing MinIO
If you have an existing MinIO installation you can use this instead as follows, using the same secret created above.
global:
objectStorage:
minio:
existingSecret: dai-objectstorage
endpoint: my.minio.deployment.example.com
minio:
enabled: false
Note the minio
key setting enabled
to false
. This prevents the bundled MinIO from being deployed.
Eggplant cannot provide support for MinIO installations external to your DAI installation.
S3
AWS S3 can be configured for object storage with an existing secret as follows. First, prepare an existing secret with credentials in:
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: dai-objectstorage
stringData:
aws-access-key-id: my-access-key-id
aws-secret-access-key: my-secret-access-key
$ kubectl -n dai apply -f dai-objectstorage.yaml
Modify your values file to update or add the following keys as follows:
global:
objectStorage:
provider: "aws"
aws:
existingSecret: dai-objectstorage
awsAccessKeyIdKey: aws-access-key-id
awsSecretAccessKeyKey: aws-secret-access-key
region: "eu-west-1"
minio:
enabled: false