Installing the Instana Enterprise operator

By default, cert-manager is used to automatically provision the secret. This works out-of-the-box if cert-manager is installed on the cluster. In this case, Issuer and Certificate objects are created upon installation, which causes cert-manager to provision and inject the certificates.

For more information about cert-manager installation, see cert-manager documentation.

You are recommended to use cert-manager. However, if you prefer to provision the certificates yourself, you can do so. The secret must contain the following entries:

• ca.crt
• tls.crt
• tls.key

The certificate (tls.crt) must contain the following DNS names:

• instana-operator.<namespace>.svc
• instana-operator.<namespace>.svc.<clusterDomain>

• Replace <namespace> with the namespace name where the Instana Enterprise operator will be installed.
• Replace <clusterDomain> with the domain name of the cluster where the Instana Enterprise operator will be installed.

To create a TLS secret instana-operator-webhook of type kubernetes.io/tls, use either of the following ways:

• Create the secret directly.

  kubectl create secret generic instana-operator-webhook \
      --type=kubernetes.io/tls \
      --from-file=tls.key=path/to/tls.key \
      --from-file=tls.crt=path/to/tls.crt \
      --from-file=ca.crt=path/to/ca.crt
  

• Create the YAML for the secret without applying. The secret is printed without creation.

  kubectl create secret generic instana-operator-webhook \
      --type=kubernetes.io/tls \
      --from-file=tls.key=path/to/tls.key \
      --from-file=tls.crt=path/to/tls.crt \
      --from-file=ca.crt=path/to/ca.crt \
      --dry-run=client \
      --output=yaml
  

  Then, create the secret.

  kubectl create -f <secret-file-name.yaml>
  

Ensure that the system requirements for self-hosted Custom Edition on IBM Z® and LinuxONE (s390x) are met. For more information, see System requirements for Custom Edition on IBM Z® and LinuxONE (s390x).

To install Custom Edition on IBM Z® and LinuxONE (s390x), add the following lines in the operator values.yaml file:

operator:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/monitor
            operator: In
            values:
            - "true"
  tolerations:
    - key: node.instana.io/monitor
      operator: "Exists"
      effect: "NoSchedule"
webhook:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: node-role.kubernetes.io/monitor
            operator: In
            values:
            - "true"
  tolerations:
    - key: node.instana.io/monitor
      operator: "Exists"
      effect: "NoSchedule"

This option creates CRDs and installs the Operator deployment and associated resources on the Kubernetes cluster.

• To install the Instana Enterprise operator in a specified namespace such as instana-operator, run the following command:

  kubectl instana operator apply --values values.yaml --namespace=instana-operator
  

• To install the Instana Enterprise operator in a specified namespace by using custom certificates, run the following command:

  kubectl instana operator apply --values values.yaml --ca-bundle-base64=<base64-encoded ca.crt file> --namespace=instana-operator
  

  Replace <base64-encoded ca.crt file> with the base64-encoded CA bundle file name.

Render the manifests and write them to either standard output (STDOUT) or to files in a specific directory first. To render manifests, perform on of the following steps:

• To render the YAML files with a specified namespace and write them to a specified directory:

  kubectl instana operator template --values values.yaml --namespace=instana-operator --output-dir <dir>
  

• To render YAML files with a specified namespace and write them to a specified directory by using a custom cluster domain:

  kubectl instana operator template --values values.yaml --cluster-domain=my-domain.local --namespace=instana-operator --output-dir <dir>
  

• To render YAML files with a specified namespace and write them to a specified directory by using custom certificates:

  kubectl instana operator template --values values.yaml --ca-bundle-base64=<base64-encoded ca.crt file> --namespace=instana-operator --output-dir <dir>
  

  Replace <base64-encoded ca.crt file> with the base64-encoded CA bundle file name.

Then, you can apply the manifests by using the commands in the Applying manifests directly.

The Instana backend is deployed with a default release version. Ideally, use the latest patch release or update to an available higher Instana backend version.

You can use the instana-kubectl versions commands to upgrade the Instana backend. For more information, see upgrade procedure.

The available options that you can configure are listed in the Instana Enterprise operator configuration options table.