From 57fec07dabf840744d784da464d6d9d0da873465 Mon Sep 17 00:00:00 2001 From: Mike Williamson Date: Wed, 12 May 2021 21:23:44 -0400 Subject: [PATCH] Update GKE deployment instructions --- app/gke/README.md | 49 ++++++++++------------------------------------- 1 file changed, 10 insertions(+), 39 deletions(-) diff --git a/app/gke/README.md b/app/gke/README.md index db8ed1062a..0a02031da2 100644 --- a/app/gke/README.md +++ b/app/gke/README.md @@ -4,49 +4,20 @@ The files in this folder are patches and additions to the base configuration stored in the bases folder. These patches and additions provide all the needed tweaks and configuration needed to run the app on GKE. -The `istio.yaml` file in this folder is generated with the following command: +## Deploying on GKE -```sh -istioctl manifest generate --set meshConfig.accessLogFile=/dev/stdout --set meshConfig.accessLogEncoding=JSON > platform/base/istio.yaml -``` +Deploying to GKE looks pretty much like our other deployments. -## Creating the cluster +You will need proper credentials for this, including referencing all the right templates on [Notify](https://notification.canada.ca/) and `make credentials mode=prod` can give you a head start. -Currently we are just creating the cluster with the following command. +The rest is pretty much the same: ```sh -gcloud beta container --project "track-compliance" clusters create "tracker" \ - --region "northamerica-northeast1" --no-enable-basic-auth --release-channel "regular" \ - --machine-type "e2-highcpu-4" --image-type "COS_CONTAINERD" --disk-type "pd-standard" \ - --disk-size "50" --metadata disable-legacy-endpoints=true \ - --service-account "gke-node-service-account@track-compliance.iam.gserviceaccount.com" \ - --num-nodes "2" --enable-stackdriver-kubernetes --enable-ip-alias \ - --network "projects/track-compliance/global/networks/default" \ - --subnetwork "projects/track-compliance/regions/northamerica-northeast1/subnetworks/default" \ - --no-enable-master-authorized-networks \ - --addons HorizontalPodAutoscaling,HttpLoadBalancing,CloudRun \ - --enable-autoupgrade --enable-autorepair --max-surge-upgrade 1 --max-unavailable-upgrade 0 \ - --workload-pool "track-compliance.svc.id.goog" --enable-shielded-nodes --shielded-secure-boot +make cluster name=tracker +make secrets env=gke +make platform env=gke +make app env=gke +make deploy env=gke ``` -The number of options here testify to our increasingly opinionated take on -cluster creation, as well as our attention to the [hardening guidelines for -GKE](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster). -This will soon be captured in real code in a proper Infrastructure as Code type -of way. - -With the cluster up and running, you will need to provide the env files as -described in the minikube setup: - -```sh -api.env -kiali.env -kiali.yaml -postgres.env -scanners.env -``` -With those in place, the config can now be generated. - -```sh -kustomize build platform/overlays/gke | kubectl apply -f - -``` +The last command `make deploy` sets up [Flux](https://fluxcd.io/) inside the cluster, so it can automate deployments.