Deploy Services

This page explains how to deploy the FRIDGE services to a FRIDGE tenancy. This process includes configuration for various components such as Argo Workflows, MinIO, network policies, and other infrastructure settings. It does not deploy the Kubernetes clusters within the FRIDGE tenancy; instead, it assumes that Kubernetes clusters have already been deployed.

Deployment¶

A FRIDGE consists of two Kubernetes clusters: an access cluster and an isolated cluster. The access cluster hosts the Harbor container registry and an SSH server for accessing the isolated cluster. The isolated cluster hosts the FRIDGE services.

The deployment process uses Pulumi to manage the infrastructure as code.

Currently, FRIDGE is configured to support deployment on Azure Kubernetes Service (AKS) and on DAWN. The isolated cluster can also be deployed to a local k3s instance.

You will require appropriate Kubernetes contexts set up for both clusters. The FRIDGE hosting organisation should provide you with the required Kubernetes credentials.

Access cluster¶

You will deploy the access cluster first, as it hosts the Harbor container registry and SSH server required to access the isolated cluster. Navigate to the infra/fridge/access-cluster/ folder.

Create a stack¶

The infra/fridge/access-cluster/ folder already contains a Pulumi project configuration file (Pulumi.yaml), so you do not need to run pulumi new to create a new project. The Pulumi.yaml file defines the project name and a schema for the configurations for individual stacks.

To create a new stack, you can use the following command:

pulumi stack init <stack-name>

Configure the stack¶

Each stack has its own configuration settings, defined in the Pulumi.<stack-name>.yaml files. The configuration can be manually edited, or you can use the Pulumi CLI to set configuration values. You can set individual configuration values for the stack using the following command:

pulumi config set <key> <value>

Some of the configuration keys must be set as secrets, such as the MinIO access key and secret key. Those must be set using the Pulumi CLI using the --secret flag. For example, the following command sets the minio_root_password:

pulumi config set --secret minio_root_password <your-minio-secret-key>

It is critical that you set all required configuration keys before deploying the stack. In particular, you will need to supply a public SSH key that will be added to the SSH server in the access cluster. If you do not do this, you will not be able to access the isolated cluster later.

For a complete list of configuration keys, see the Pulumi.yaml file.

Kubernetes context¶

Pulumi requires that the Kubernetes context is set for the stack. This must match one of the Kubernetes contexts in your local kubeconfig. You can check the available contexts with kubectl:

kubectl config get-contexts

For example, to set the Kubernetes context for the dawn stack, you can use:

pulumi config set kubernetes:context dawn

Deploying with Pulumi¶

Ensure that you are able to connect to the Kubernetes API of the access cluster.

On AKS, the Kubernetes API is publicly accessible during development/testing, so no changes to your local kubeconfig are required.

On Dawn, you will need to set up an SSH connection to the bastion host on the access cluster’s local network.

Once you have set up the stack and its configuration, you can deploy the stack using the following command:

pulumi up

Isolated cluster¶

You will deploy the isolated cluster next, as it hosts the FRIDGE services. Navigate to the infra/fridge/isolated-cluster/ folder.

Two additional steps are required before deploying FRIDGE to the isolated cluster.

SSH port forwarding: You must set up SSH port forwarding from your deployment machine to the isolated cluster via the SSH server in the access cluster. The isolated cluster has a private API server endpoint, which is not directly accessible from outside the access cluster. You can use the following command to set up SSH port forwarding:
```
ssh -i <path-to-your-private-ssh-key> -L 6443:<isolated-cluster-api-server>:443 fridgeoperator@<access-cluster-ssh-server-ip> -p 2222 -N
```
Replace <path-to-your-private-ssh-key>, <isolated-cluster-api-server>, and <access-cluster-ssh-server-ip> with the appropriate values for your setup.
Kubernetes context: You must set the Kubernetes context for the isolated cluster stack to use the local port forwarded to the isolated cluster’s API server. We recommend that you make a dedicated copy of the kubeconfig file for the isolated cluster, and edit it to point to https://localhost:6443 for the API server endpoint. Then, set the Kubernetes context for the stack using the Pulumi CLI:
```
pulumi config set kubernetes:context <isolated-cluster-context>
```

Once thee stack is configured and the SSH tunnel set up, you can deploy the isolated cluster stack using pulumi up.

Note that pulumi up can safely be repeated if any errors arise. Sometimes errors during deployment are due to race conditions that Pulumi cannot mitigate, and a repeated attempt will be successful.