Prerequisites

When scaling AEW based on your expected package and file volume, use the information about Sizing and guidelines by workload profile as a reference.

• macOS
• Linux — RedHat, CentOS
• Linux — Ubuntu

Download and install the Kubernetes client (kubectl), the required client version is 1.33 or later. For installation instructions refer to the official kubernetes documentation.

• Verify Kubernetes cluster access

  kubectl get nodes

• Verify cluster permissions

  kubectl auth can-i '*' '*' --all-namespaces

AEW requires an external load balancer to route incoming HTTPs traffic to the Emissary ingress service inside your Kubernetes cluster. You can choose one of the following depending on your environment:

• Self-managed load balancer: For example, an HA proxy or MetalLB running on a virtual machine or physical server.
  • Suitable for bare-metal or virtual machine deployments.
  • Forwards external HTTPs traffic to each worker node’s Emissary ingress NodePort.
• Cloud-managed load balancer: For example, AWS Elastic Load Balancer, Azure Load Balancer, Google Cloud Platform Load Balancer.
  • Automatically integrates with Kubernetes Service type LoadBalancer.
  • No manual configuration is required for AEW beyond creating the service.
  Note: For HAProxy, MetalLB, or cloud load balancer configuration instructions, refer to each platform's official documentation.

Storage for On-Prem Clusters: Installing CSI (Container Storage Interface) drivers

For any non-cloud storage (NFS, vSphere, Ceph, etc.), the corresponding CSI (Container Storage Interface) driver must be installed in your cluster before you can create a StorageClass. The driver is the software that allows Kubernetes to communicate with your storage hardware.

How to Install a CSI Driver and create a simple Shared Storage (NFS)

1. Identify your storage type. Determine what storage infrastructure you have (either an NFS server, a vSphere environment, or a Ceph cluster).
2. Find the correct CSI driver. Locate the official CSI driver for that system. Common examples include: NFS, vSPhere, CephFS (File), Ceph RBD (Block).
3. Follow the driver's installation guide. Each driver has its own installation steps. This task should be performed by your cluster administrator.
   1. Install the NFS CSI Driver (for File Storage)

      # 1. Clone the driver repository 
      
      git clone https://github.com/kubernetes-csi/csi-driver-nfs.git 
      
      cd csi-driver-nfs 
      
      # 2. Deploy the driver to your cluster 
      
      ./deploy/install-driver.sh v4.8.0 local 
      
      # 3. Verify the pods are running 
      
      kubectl get pods -n kube-system | grep nfs 

   2. Install the vSphere CSI Driver (for Block Storage)

      # Example steps for vSphere (simplified). The exact process is more complex.
      
      # 1. Add the VMware Helm chart repository
      helm repo add vmware-tanzu https://vmware-tanzu.github.io/helm-charts
      
      # 2. Install the vSphere CSI Driver using Helm
      helm install vsphere-csi vmware-tanzu/vsphere-csi --namespace kube-system \
        --set config.vCenterHost="vcenter.example.com"
      

   3. Verify that your driver is installed

      # List all CSI Drivers registered in the cluster
      kubectl get csidrivers
      
      # Look for pods related to your driver (e.g., nfs, vsphere)
      kubectl get pods -n kube-system | grep -E '(nfs|vsphere)'
      

4. To proceed to create the StorageClass that is referenced in the provisioner field, you must first verify that the CSI driver is running successfully.

   apiVersion: storage.k8s.io/v1
   kind: StorageClass
   metadata:
     name: my-nfs-storage
     annotations:
       storageclass.kubernetes.io/is-default-class: "true" # Optional: set as default
   provisioner: nfs.csi.k8s.io # Container Storage Interface identifier
   parameters:
     server: my-nfs-server.local # IP or hostname of your NFS server
     share: /path/to/share       # Base path on the server to use
   

5. When prompted for rwxStorageClass during the installation, enter the name of your Storage Class (for example, my-nfs-storage). To find the available Storage Class in your cluster, run:

   kubectl get storageclass

   Note: If you are using EFS (Amazon Elastic File System), update the storage class:

   Remove the following entries:

   • gidRangeEnd
   • gidRangeStart

   Add the following entries:

   • gid: "1000"
   • uid: "1000"

Parameters to provide

• org_name: A short, lowercase identifier for your organization (for example, entertainment). This value is used as a prefix in subdomains.
• subdomain: The DNS subdomain under which the app will be hosted (for example, it.company.com)
• domain_name: The root domain name (for example, company.com). Typically used for certificate generation.

• Common name (commonName): Matches the fully qualified domain name (FQDN). For example: entertainment.it.company.com
• DNS names (dnsNames): This field lists all the domain names that the certificate should be valid for. It can include specific domains, such as:entertainment.it.company.com, api.it.company.com, or it can use a wildcard to cover multiple subdomains under the same domain like *.it.company.com.

Using any CA-issued certificate

Before deployment, verify that your certificate’s SAN list includes every domain name AEW will use. If a hostname is missing, users will see a browser warning. An example SAN block might include it.company.com, entertainment.it.company.com, api.it.company.com.

openssl x509 -in tls.crt -text -noout | grep DNS 

DNS:*.it.company.com, DNS:entertainment.company.com, api.it.compnay.com, DNS:it.company.com