Chapter 5. Configuring an RHDH instance with a TLS connection in Kubernetes
Chapter 5. Configuring an RHDH instance with a TLS connection in Kubernetes You can configure a RHDH instance with a Transport Layer Security (TLS) connection in a Kubernetes cluster, such as an Azure Red Hat OpenShift (ARO) cluster, any cluster from a supported cloud provider, or your own cluster with proper configuration. Transport Layer Security (TLS) ensures a secure connection for the RHDH instance with other entities, such as third-party applications, or external databases. However, you must use a public Certificate Authority (CA)-signed certificate to configure your Kubernetes cluster. Prerequisites You have set up an Azure Red Hat OpenShift (ARO) cluster with a public CA-signed certificate. For more information about obtaining CA certificates, refer to your vendor documentation. You have created a namespace and setup a service account with proper read permissions on resources. Example: Kubernetes manifest for role-based access control apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: backstage-read-only rules: - apiGroups: - '*' resources: - pods - configmaps - services - deployments - replicasets - horizontalpodautoscalers - ingresses - statefulsets - limitranges - resourcequotas - daemonsets verbs: - get - list - watch #... You have obtained the secret and the service CA certificate associated with your service account. You have created some resources and added annotations to them so they can be discovered by the Kubernetes plugin. You can apply these Kubernetes annotations: backstage.io/kubernetes-id to label components backstage.io/kubernetes-namespace to label namespaces Procedure Enable the Kubernetes plugins in the dynamic-plugins-rhdh.yaml file: kind: ConfigMap apiVersion: v1 metadata: name: dynamic-plugins-rhdh data: dynamic-plugins.yaml: | includes: - dynamic-plugins.default.yaml plugins: - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes-backend-dynamic disabled: false 1 - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes disabled: false 2 # ... 1 Set the value to false to enable the backstage-plugin-kubernetes-backend-dynamic plugin. 2 Set the value to false to enable the backstage-plugin-kubernetes plugin. Note The backstage-plugin-kubernetes plugin is currently in Technology Preview . As an alternative, you can use the ./dynamic-plugins/dist/backstage-plugin-topology-dynamic plugin, which is Generally Available (GA). Set the kubernetes cluster details and configure the catalog sync options in the app-config-rhdh.yaml file: kind: ConfigMap apiVersion: v1 metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # ... catalog: rules: - allow: [Component, System, API, Resource, Location] providers: kubernetes: openshift: cluster: openshift processor: namespaceOverride: default defaultOwner: guests schedule: frequency: seconds: 30 timeout: seconds: 5 kubernetes: serviceLocatorMethod: type: 'multiTenant' clusterLocatorMethods: - type: 'config' clusters: - url: <target-cluster-api-server-url> 1 name: openshift authProvider: 'serviceAccount' skipTLSVerify: false 2 skipMetricsLookup: true dashboardUrl: <target-cluster-console-url> 3 dashboardApp: openshift serviceAccountToken: USD{K8S_SERVICE_ACCOUNT_TOKEN} 4 caData: USD{K8S_CONFIG_CA_DATA} 5 # ... 1 The base URL to the Kubernetes control plane. You can run the kubectl cluster-info command to get the base URL. 2 Set the value of this parameter to false to enable the verification of the TLS certificate. 3 Optional: The link to the Kubernetes dashboard managing the ARO cluster. 4 Optional: Pass the service account token using a K8S_SERVICE_ACCOUNT_TOKEN environment variable that you can define in your my-rhdh-secrets secret. 5 Pass the CA data using a K8S_CONFIG_CA_DATA environment variable that you can define in your my-rhdh-secrets secret. Save the configuration changes. Verification Run the RHDH application to import your catalog: kubectl -n rhdh-operator get pods -w Verify that the pod log shows no errors for your configuration. Go to Catalog and check the component page in the Developer Hub instance to verify the cluster connection and the presence of your created resources. Note If you encounter connection errors, such as certificate issues or permissions, check the message box in the component page or view the logs of the pod.
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: backstage-read-only rules: - apiGroups: - '*' resources: - pods - configmaps - services - deployments - replicasets - horizontalpodautoscalers - ingresses - statefulsets - limitranges - resourcequotas - daemonsets verbs: - get - list - watch # kind: ConfigMap apiVersion: v1 metadata: name: dynamic-plugins-rhdh data: dynamic-plugins.yaml: | includes: - dynamic-plugins.default.yaml plugins: - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes-backend-dynamic disabled: false 1 - package: ./dynamic-plugins/dist/backstage-plugin-kubernetes disabled: false 2 # kind: ConfigMap apiVersion: v1 metadata: name: app-config-rhdh data: "app-config-rhdh.yaml": | # catalog: rules: - allow: [Component, System, API, Resource, Location] providers: kubernetes: openshift: cluster: openshift processor: namespaceOverride: default defaultOwner: guests schedule: frequency: seconds: 30 timeout: seconds: 5 kubernetes: serviceLocatorMethod: type: 'multiTenant' clusterLocatorMethods: - type: 'config' clusters: - url: <target-cluster-api-server-url> 1 name: openshift authProvider: 'serviceAccount' skipTLSVerify: false 2 skipMetricsLookup: true dashboardUrl: <target-cluster-console-url> 3 dashboardApp: openshift serviceAccountToken: USD{K8S_SERVICE_ACCOUNT_TOKEN} 4 caData: USD{K8S_CONFIG_CA_DATA} 5 # -n rhdh-operator get pods -w