Advanced Deployment Guide

A guide to advance deployment methods for MOTAR

Recommended for Scalable Activation Across Organization

Helm Chart Installation

Helm Chart for Kubernetes

This cloud or local installation method is considered an advanced install option.

You can install MOTAR in a high availability fashion and optionally configure MOTAR components for advanced deployments. (Production, multi-node Kubernetes cluster deployments.)

You will access the MOTAR Helm installation package through Dynepic’s Helm Repository with the login credentials sent to you by Dynepic.

This Helm chart installs MOTAR with all of its dependencies in a Kubernetes cluster. Our Helm chart also employs non-MOTAR supporting charts, such as:

• A custom Minio chart branched from the Minio public chart.

• The Bitnami PostgreSQL chart.

• The ingress-nginx kubernetes chart.

• The nats public chart.

Prerequisites

• Kubernetes 1.23+

• Helm 3.8.0+

• PV provisioner support in the underlying infrastructure

• ReadWriteMany volumes for deployment scaling

The MOTAR Helm chart supports deployments in Kubernetes clusters hosted in nearly any cloud provider, local server, and self-hosted cloud. As such many of the values are left to be filled in by the installing individual.

The default values.yaml should provide information sufficient to help you prepare the installation for your circumstance, if you find anything confusing or not intuitive please reach out to [e-mail].

Below we will provide some recommended values generally, and then some recommend values based on deployment type.

You will be providing the values to the deployment which overrides the default where the values are set.

If MOTAR is already installed, proceed to Section X to upgrade MOTAR with Helm.

If using the Dynepic provided helm chart and images, you will need to authenticate with the Dynepic registry to pull the Helm chart and provide a Secret in the cluster which contains the dockerconfigjson to pull the images. See the section for imagePullSecret below.

Step 1 - Configuration

• Create a values file values.yaml in a known directory

  • Replace: your_directory with your details

touch /your_directory/your_value.yaml

• Add Installation Values to values.yaml

nano /your_directory/your_value.yaml

• Add the following values to your values.yaml. Update and change any values that contain ‘you’ or ‘your’.

• Then, save the file with CTRL-X (if using nano).

Sample values.yaml (Single Node Using Nodeport)

yaml
global:
  motarImageRegistry: harbor.dynepic.net
  domainName: your_domain.com  
  initialAdminEmail: [e-mail]
  environment: development
  mailConfig:
	reportTargets:
  	- [e-mail]
	securityTargets:
  	- [e-mail]
  s3Config:
	source: minio
	url: minio-api.your_domain.com

motar:
  ingress:
	className: nginx
	annotations:
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using certmanager clusterIssuer
  	nginx.ingress.kubernetes.io/cors-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,clientid
  	nginx.ingress.kubernetes.io/enable-cors: "true"
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	tls:
  	enabled: true
  	tlsSecret: "webapps-cert" # Substitute with your tlsSecret
  serviceAccount:
	create: true
	name: motar

storageClass:
  enabled: true
  provisioner: driver.longhorn.io
  parameters:
	fsType: ext4
	numberOfReplicas: "1"
	staleReplicaTimeout: "30"

ingress-nginx:
  enabled: true
  controller:
  	service:
    	type: "NodePort"
    	nodePorts:
      	http: 31080
      	https: 31443

minio:
  ingress:
	enabled: true
	ingressClassName: nginx
	annotations:
  	apiVersion: networking.k8s.io/v1
  	className: nginx
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	hosts:
  	- minio-api.your_domain.com
	tls:
  	- secretName: api-minio-https-certs # Use your existing secret
    	hosts:
      	- minio-api.your_domain.com
  consoleIngress:
	enabled: true
	ingressClassName: "nginx"
	annotations:
  	apiVersion: networking.k8s.io/v1
  	className: nginx
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	hosts:
  	- minio-console.your_domain.com
	tls:
  	- secretName: console-minio-https-certs # Use your existing secret
    	hosts:
      	- minio-console.your_domain.com

Sample values.yaml (AWS EKS)

yaml
global:
  motarImageRegistry: harbor.dynepic.net
  domainName: your_domain.com
  initialAdminEmail: [e-mail]
  environment: development
  mailConfig:
	reportTargets:
  	- [e-mail]
	securityTargets:
  	- [e-mail]
  s3Config:
	source: minio
	url: minio-api.your_domain.com

motar:
  ingress:
	className: nginx
	annotations:
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using certmanager clusterIssuer
  	nginx.ingress.kubernetes.io/cors-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,clientid
  	nginx.ingress.kubernetes.io/enable-cors: "true"
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	tls:
  	enabled: true
  	tlsSecret: "webapps-cert" # Substitute with your tlsSecret
  serviceAccount:
	create: true
	name: motar

storageClass:
  enabled: true
  provisioner: kubernetes.io/aws-ebs
  parameters:
	fsType: ext4
	type: gp3

ingress-nginx:
  enabled: true
  controller:
	config:
  	use-proxy-protocol: false
	service:
  	type: LoadBalancer
  	external:
    	enabled: false
  	internal:
    	externalTrafficPolicy: Local
    	enabled: true
    	annotations:
      	service.beta.kubernetes.io/aws-load-balancer-internal: false
      	service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
      	service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: true
      	service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip

minio:
  ingress:
	enabled: true
	ingressClassName: nginx
	annotations:
  	apiVersion: networking.k8s.io/v1
  	className: nginx
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	hosts:
  	- minio-api.your_domain.com
	tls:
  	- secretName: api-minio-https-certs # Use your existing secret
    	hosts:
      	- minio-api.your_domain.com
  consoleIngress:
	enabled: true
	ingressClassName: "nginx"
	annotations:
  	apiVersion: networking.k8s.io/v1
  	className: nginx
  	cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
  	nginx.ingress.kubernetes.io/proxy-body-size: "0"
	hosts:
  	- minio-console.your_domain.com
	tls:
  	- secretName: console-minio-https-certs # Use your existing secret
    	hosts:
      	- minio-console.your_domain.com          

Step 2 - Deploy the Chart

• Assuming you have created the value file as appropriate from above or for your specific use case the following list of commands should be sufficient to get you from start to finish.

kubectl create ns motar
helm install motar --version  oci://harbor.dynepic.net/helmrepo/motar -f your_values.yaml -n motar

Step 3 - Access the Site

• At this step, if you correctly configured your networking to allow DNS routing to the hosting device , everything is up and running you should be able to access the https://admin.motarghost.com.

You have completed HELM setup and may continue to Step 3 - Access your MOTAR Instance

NodePort

If using a NodePort configuration for your ingress controller you will need to ensure you have the networking appropriately set such that traffic goes to the correct port within your deployed environment. Here is a sample way of setting this all up using an nginx-reverse proxy.

• Install the required services.

bash
sudo apt update
sudo apt install nginx
sudo apt install libnginx-mod-stream
sudo vim /etc/nginx/nginx.conf

• Include the proxy passthrough.

  • Append outside the http block `include /etc/nginx/passthrough.conf;` It should look something like this:

http {
  # default configuration
}
include /etc/nginx/passthrough.conf;

• Declare the proxy passthrough.

  • Now we need to create the /etc/nginx/passthrough.conf and we need to ensure the ports match the NodePort used in the value file. It will look something like:

stream {
  server {
    	listen 80;
    	proxy_pass 127.0.0.1:31080;
	}
	server {
    	listen 443;
    	proxy_pass 127.0.0.1:31443;
	}
}

• Forward http to https with reverse proxy

If you would like to ensure all http traffic to your domain name is transferred to https you will further which to do the following.

• Add the appropriate 301 to the sites-available.

`sudo vim /etc/nginx/sites-available/your.domain`
```
server {
	if ($host ~ ^[^.]+\.your\.domain$) {
    	return 301 https://$host$request_uri;
	}

	listen 80;

}
```

• Remove the default nginx site.

sudo rm /etc/nginx/sites-enab...

Troubleshooting FAQ (As Needed)

• If you are getting ‘bad address at line [any number] of /etc/dnsmasq.conf’ this could be from not having set a HOST_IP in the .env file. Please open your .env and add in your HOST_IP.

Example Error:

dnsmasq     | dnsmasq: bad address at line 680 of /etc/dnsmasq.conf

Following the Installation and Tutorial Guide?

If you are following along with the tutorial, you should be ready to access and configure your MOTAR Instance. Click the link below to return:

3 - Access your MOTAR Instance