Installing DevOps Loop on IBM Cloud Kubernetes Service (IKS)

1. Provide a domain name in the format, <custom_name>.<region>.containers.appdomain.com, by using the region noted down in the previous step.
2. Provide the IP address of the public ingress controller noted down in step 2.
3. Set the domain as the default domain.

You must use the IBM Secrets Manager to manage the life cycle of the certificate. You must also note down the name of the secret that contains the TLS certificate and key. For more information, refer to See https://cloud.ibm.com/docs/containers?topic=containers-secrets&interface=ui#tls-custom.

1. Run the following commands to set the Ambassador Edge Stack Helm chart:

   helm repo add datawire https://app.getambassador.io 
   helm repo update

2. Run the following commands to create a namespace and install the Ambassador Edge stack:

   kubectl create namespace emissary && \
   kubectl apply -f https://app.getambassador.io/yaml/emissary/3.9.1/emissary-crds.yaml
   kubectl wait --timeout=90s --for=condition=available deployment emissary-apiext -n emissary-system

3. Perform the following step to create emissary-ports.yaml:

   cat <<EOF > emissary-ports.yaml
   service:
     ports:
       - name: https
         port: 443
         targetPort: 8443
         #nodePort: <optional>
       - name: http
         port: 80
         targetPort: 8080
         #nodePort: <optional>
       - name: deploy-wss
         port: 7919
         targetPort: 7919
         #nodePort: <optional>
       - name: build-wss
         port: 7920
         targetPort: 7920
         #nodePort: <optional>
       - name: control-ssh
         port: 9022
         targetPort: 9022
         #nodePort: <optional>
   EOF
   

4. Install Emissary-ingress:

   helm install emissary-ingress --namespace emissary datawire/emissary-ingress -f emissary-ports.yaml && \
   kubectl -n emissary wait --for condition=available --timeout=90s deploy -lapp.kubernetes.io/instance=emissary-ingress

You can navigate to Containers > Cluster Management > Clusters > Ingress > Domains in the IBM Cloud console or run the following command to list the domains in your cluster:

ibmcloud ks ingress domain ls --cluster <CLUSTER_NAME>

1. Get a key to the IBM Entitled Registry.
2. Log in to My IBM Container Software Library with the IBM ID and password that are associated with the entitled software.
3. Select the Copy key option to copy the entitlement key in the Entitlement keys section to the clipboard.
4. Create a secret in the target namespace with the secret name ibm-entitlement-key to pull images from the IBM Entitled Registry:

   kubectl create secret docker-registry ibm-entitlement-key \
       --namespace [namespace_name] \
       --docker-username=cp \
       --docker-password=<EntitlementKey> \
       --docker-server=cp.icr.io

   Note: Secrets are namespace-specific and they are required to install DevOps Plan.

helm repo add ibm-helm https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm --force-update

helm show readme ibm-helm/ibm-devops-loop

• DOMAIN
• TLS_CERT_SECRET_NAME
• RWO_STORAGE_CLASS=ibmc-block-gold
• RWX_STORAGE_CLASS=ibmc-file-gold-gid

For DOMAIN and TLS_CERT_SECRET_NAME, you must provide the values noted down in the previous steps.

1. Run the following command to display the IP of the L4 load balancer installed as part of DevOps Loop:

   kubectl get svc --namespace emissary emissary-ingress -o jsonpath='{.status.loadBalancer.ingress[0].ip}'

2. Perform the following steps to create a new domain by using the IP of the L4 load balancer:
   1. Navigate to Cluster Management > Clusters > Ingress > Domains > .
   2. Copy the default domain name.
   3. Click Create.
   4. Enter service-<copied_domain_name> in Name.
   5. Enter the IP of the L4 load balancer in IP address.
   6. Click Create.
   You can also run the following command from CLI:

   ibmcloud ks ingress domain create --cluster CLUSTER [--crn CRN] [--is-default] [--domain DOMAIN] [--hostname HOSTNAME] [--ip IP] [--output OUTPUT] [--domain-provider PROVIDER] [-q] [--secret-namespace NAMESPACE] [--zone ZONE]

   Note: You must ensure that the domain created in this step is not the default domain.