Installation of OpenAEV using external backends

Info

Use this installation method when you can provide high-availability backends/databases required by OpenAEV using managed services or in-house deployments managed by an experienced team. This is the recommended scenario, and the OpenAEV helm chart provided by Filigran will solely deploy & configure OpenAEV software, which are mostly stateless by nature (don't require long-lived disk storage).

Requirements

To deploy OpenAEV, the following information is required and will be given as values to the helm chart:

PostgreSQL
- endpoint / URL
- login & password (optional)
- namespace
ElasticSearch or OpenSearch cluster
- endpoint / URL
- login & password
Rabbitmq
- endpoint / URL
- login & password
- virtualhost
S3
- endpoint / URL
- login & password
- bucket name
- bucket region

Air gapped environments

If your deployment will not be directly connected to internet to pull images, you will need to prefetch or whitelist the following repos:

OpenAEV: docker.io/openaev
XTM Composer: docker.io/filigran

Deployment using the helm chart

Create the kubernetes secrets to store backends credentials

OpenAEV components connect to the various backends and thus need to have the credentials configured appropriately. It is recommended to store those credentials in Kubernetes secrets and use the envFromSecrets parameters of the Helm chart to reference those secrets.

You are free to store those secrets as you wish. Below is an example of what is expected if the default values of the Helm chart are used, please update the value of the secrets to reflect your environment:

Create the namespace so that the secrets are placed there

kubectl create ns openaev

Elasticsearch / OpenSearch

Create a file elasticsearch-credentials.yml

apiVersion: v1
kind: Secret
metadata:
  name: elasticsearch-es-elastic-user
  namespace: openaev
type: Opaque
data:
  elastic: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"

Create the secret

kubectl apply -f elasticsearch-credentials.yml

S3 / MinIO

Create a file minio-credentials.yml

apiVersion: v1
kind: Secret
metadata:
  name: minio-credentials
  namespace: openaev
type: Opaque
data:
  accessKey: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"
  secretKey: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"

Create the secret

kubectl apply -f minio-credentials.yml

RabbitMQ

Create a file rabbitmq-credentials.yml

apiVersion: v1
kind: Secret
metadata:
  name: rabbitmq-default-user
  namespace: openaev
type: Opaque
data:
  username: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"
  password: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"

Create the secret

kubectl apply -f rabbitmq-credentials.yml

Create a custom values.yaml file

Create a values.yaml file to overwrite the default Helm configuration to match your environment. Edit the file according to the step below.

Configure the external backends

Below are generic examples. Please, configure it to reflect your actual environments:

PostgreSQL

openaev:
  env:
    SPRING_DATASOURCE_URL: "jdbc:postgresql://..."
  envFromSecrets:
    SPRING_DATASOURCE_USERNAME:
      secretName: postgresql-app
      key: username
    SPRING_DATASOURCE_PASSWORD:
      secretName: postgresql-app
      key: password

Info

For a full list of OpenAEV supported PostgreSQL environment variables, please see the official OpenAEV documentation.

Elasticsearch / OpenSearch

opeaev:
  env: 
    ENGINE_USERNAME: elastic
    ENGINE_URL: "<Your Elasticsearch endpoint>"
  envFromSecrets:
    ENGINE_PASSWORD:
      secretName: elasticsearch-es-elastic-user
      key: elastic

Info

For a full list of OpenAEV supported Elasticsearch / OpenSearch environment variables, please see the official OpenAEV documentation.

S3 / MinIO

openaev
  env:
    # MinIO
    MINIO_ENDPOINT: "<Your MinIO endpoint>"
    MINIO_PORT: 443
    MINIO__BUCKET: "<Your MinIO bucket name>"
    MINIO_BUCKET-REGION: "<Your MinIO bucket region>"
    MINIO_SECURE: "true"
  envFromSecrets:
    MINIO_ACCESS-KEY:
      secretName: minio-credentials
      key: accessKey
    MINIO_ACCESS-SECRET:
      secretName: minio-credentials
      key: secretKey

Info

For a full list of OpenAEV supported S3 / MinIO environment variables, please see the official OpenAEV documentation.

RabbitMQ

openaev:
  env:
    OPENAEV_RABBITMQ_QUEUE-TYPE: "classic"
    OPENAEV_RABBITMQ_HOSTNAME: "<Your RabbitMQ endpoint>"
    OPENAEV_RABBITMQ_PORT: 5672
    OPENAEV_RABBITMQ_MANAGEMENT-PORT: 443
    OPENAEV_RABBITMQ_SSL: "true"
  envFromSecrets:
    OPENAEV_RABBITMQ_USER:
      secretName: rabbitmq-default-user
      key: username
    OPENAEV_RABBITMQ_PASS:
      secretName: rabbitmq-default-user
      key: password

Info

For a full list of OpenAEV supported RabbitMQ environment variables, please see the official OpenAEV documentation.

Configure OpenAEV

openaev:
  version: "2.1.5"
  env:
  # OpenAEV
    OPENAEV_BASE-URL: <Your OpenAEV domain>"
    OPENAEV_ADMIN_EMAIL: admin@openaev.io
    OPENAEV_ADMIN_PASSWORD: ChangeMe
    OPENAEV_ADMIN_TOKEN: "<A valid UUIDv4 token>"
    OPENAEV_HEALTHCHECK_KEY: ChangeMe

Info

OpenAEV can be configured quite extensively, feel free to refer to the OpenAEV documentation for more information.

Configure the OpenAEV ingress to access your instance

openaev:
  ingress:
    enabled: true
    className: "The IngressClassName you want to use"
    annotations: {} # Optional annotations for your Ingress
    hosts:
      - host: "<Your OpenAEV domain>"
        paths:
          - path: /
            pathType: ImplementationSpecific
    tls:
      - secretName: "<The Kubernetes secret containing your certificate>"
        hosts:
          - "<Your OpenAEV domain>"

Info

The tls part is optional but strongly recommended. Feel free to add annotations to this ingress if you rely on external tools to manage your TLS certificates like cert-manager for example.

Collectors / Injectors

The chart gives you the possibility to declare the collectors / injectors that will be deployed alongside your OpenAEV instance.

Example with IP info

openaev:
  colljectors:
    injector-http-query:
    image: openaev/injector-http-query:latest
    environment:
      - OPENAEV_URL=http://localhost
      - OPENAEV_TOKEN=ChangeMe
      - INJECTOR_ID=ChangeMe
      - "INJECTOR_NAME=HTTP query"
      - INJECTOR_LOG_LEVEL=error
    restart: always

Colljector value env can also be stored in a kubernetes secret. * Exemple with the connector env variable OPENAEV_TOKEN

apiVersion: v1
kind: Secret
metadata:
  name: ChangeMe
  namespace: openaev
type: Opaque
data:
  OPENAEV_TOKEN: Y2hhbmdlX21lCg== # Base64-encoded value of "change_me"

Collectors and injectors must be configured appropriately using environment variables. Specific configuration information can be found directly on GitHub, see OpenAEV-Platform/collectors and OpenAEV-Platform/injectors.

For more information about what collectors and injectors are and how do they run on OpenAEV, please refer to the OpenAEV collector documentation and injector documentation.

Deploy!

Login to the Filigran registry with the credentials provided by Filigran

helm registry login -u your_user -p your_password filigran.jfrog.io

You can directly deploy the chart on your cluster with the commands below

Initial deployment (if no version specified, will use latest, to use one just add --version x.x.x) :

helm install openaev oci://filigran.jfrog.io/filigran-ee/openaev -f values.yaml -n openaev --create-namespace

Or, on configuration change / upgrade (if no version specified, will use latest, to use one just add --version x.x.x):
```
helm upgrade openaev oci://filigran.jfrog.io/filigran-ee/openaev --install -f values.yaml -n openaev
```

If you wish to pull the chart beforehand, and apply it later you can run the following commands:

helm pull oci://filigran.jfrog.io/filigran-ee/openaev --version x.x.x
helm apply openaev-x.x.x.tgz -f values.yaml