sttlab
112 lines
4.5 KiB
Bash
112 lines
4.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Deploy Gravitee APIM OSS on a single-node k3s cluster.
|
|
# - Domain: *.gravitee.sttlab.pc
|
|
# - Ingress: nginx
|
|
# - TLS: cert-manager with namespace-scoped self-signed CA Issuer
|
|
# - Secrets: pre-created by secrets-create.sh
|
|
|
|
set -euo pipefail
|
|
|
|
NAMESPACE="gravitee-apim"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
echo "==> Checking prerequisites"
|
|
command -v kubectl >/dev/null || { echo "kubectl not found"; exit 1; }
|
|
command -v helm >/dev/null || { echo "helm not found"; exit 1; }
|
|
command -v htpasswd >/dev/null || { echo "htpasswd not found (required for admin BCrypt hash)"; exit 1; }
|
|
|
|
echo "==> Verifying cluster reachable"
|
|
kubectl cluster-info
|
|
|
|
echo "==> Verifying cert-manager is installed"
|
|
kubectl get crd certificates.cert-manager.io >/dev/null 2>&1 || {
|
|
echo "ERROR: cert-manager CRDs not found. Install cert-manager first."
|
|
exit 1
|
|
}
|
|
|
|
echo "==> Verifying nginx ingress controller is installed"
|
|
kubectl get ingressclass nginx >/dev/null 2>&1 || {
|
|
echo "WARNING: 'nginx' IngressClass not found. Ensure nginx-ingress is installed."
|
|
}
|
|
|
|
echo "==> Step 1/6 : Create namespace"
|
|
kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo "==> Step 2/6 : Create credential secrets (first install only)"
|
|
if kubectl -n "${NAMESPACE}" get secret gravitee-admin >/dev/null 2>&1; then
|
|
echo " Secrets already exist — skipping. Delete them manually to recreate."
|
|
else
|
|
"${SCRIPT_DIR}/secrets-create.sh"
|
|
fi
|
|
|
|
echo "==> Step 3/6 : Apply cert-manager Issuers + Certificates"
|
|
kubectl apply -f "${SCRIPT_DIR}/certificates.yml"
|
|
|
|
echo "==> Waiting for CA Issuer to be Ready"
|
|
kubectl -n "${NAMESPACE}" wait --for=condition=Ready issuer/gravitee-ca-issuer --timeout=120s
|
|
|
|
echo "==> Waiting for all Certificates to be Ready"
|
|
for cert in gravitee-ca console-tls portal-tls api-tls gateway-tls \
|
|
mongodb-tls elasticsearch-tls gateway-internal-tls api-internal-tls; do
|
|
echo " - waiting for ${cert}"
|
|
kubectl -n "${NAMESPACE}" wait --for=condition=Ready "certificate/${cert}" --timeout=180s
|
|
done
|
|
|
|
echo "==> Creating gravitee-ca-trust secret (CA only, for nginx proxy-ssl-secret)"
|
|
kubectl -n "${NAMESPACE}" get secret gravitee-ca-tls -o jsonpath='{.data.ca\.crt}' | base64 -d | \
|
|
kubectl -n "${NAMESPACE}" create secret generic gravitee-ca-trust \
|
|
--from-file=ca.crt=/dev/stdin \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo "==> Step 4/6 : Configure nginx ingress controller (enable snippets)"
|
|
kubectl patch configmap ingress-nginx-controller -n ingress-nginx \
|
|
--type merge \
|
|
-p '{"data":{"allow-snippet-annotations":"true","annotations-risk-level":"Critical"}}'
|
|
kubectl rollout restart deployment/ingress-nginx-controller -n ingress-nginx
|
|
kubectl rollout status deployment/ingress-nginx-controller -n ingress-nginx --timeout=60s
|
|
|
|
echo "==> Step 5/6 : Add Helm repos"
|
|
helm repo add bitnami https://charts.bitnami.com/bitnami 2>/dev/null || true
|
|
helm repo add elastic https://helm.elastic.co 2>/dev/null || true
|
|
helm repo add graviteeio https://helm.gravitee.io 2>/dev/null || true
|
|
helm repo update
|
|
|
|
echo "==> Installing MongoDB"
|
|
helm upgrade --install mongodb bitnami/mongodb \
|
|
--namespace "${NAMESPACE}" \
|
|
--values "${SCRIPT_DIR}/mongo-values.yml" \
|
|
--wait --timeout 10m
|
|
|
|
echo "==> Installing Elasticsearch"
|
|
helm upgrade --install elasticsearch elastic/elasticsearch \
|
|
--namespace "${NAMESPACE}" \
|
|
--values "${SCRIPT_DIR}/elastic-values.yml" \
|
|
--wait --timeout 10m
|
|
|
|
echo "==> Step 6/6 : Installing Gravitee APIM"
|
|
helm upgrade --install graviteeio-apim graviteeio/apim \
|
|
--namespace "${NAMESPACE}" \
|
|
--values "${SCRIPT_DIR}/apim-values.yml" \
|
|
--wait --timeout 15m
|
|
|
|
echo ""
|
|
echo "==> Deployment complete"
|
|
echo ""
|
|
kubectl get pods -n "${NAMESPACE}"
|
|
echo ""
|
|
echo "Add to /etc/hosts (replace <NODE_IP> with your node IP):"
|
|
echo " <NODE_IP> console.gravitee.sttlab.pc portal.gravitee.sttlab.pc api.gravitee.sttlab.pc gateway.gravitee.sttlab.pc"
|
|
echo ""
|
|
echo "Import the CA into your browser:"
|
|
echo " kubectl -n ${NAMESPACE} get secret gravitee-ca-tls -o jsonpath='{.data.ca\\.crt}' | base64 -d > gravitee-ca.crt"
|
|
echo ""
|
|
echo "Admin credentials:"
|
|
echo " Username: admin"
|
|
echo " Password: $(kubectl -n ${NAMESPACE} get secret gravitee-admin -o jsonpath='{.data.admin-password-plain}' | base64 -d)"
|
|
echo ""
|
|
echo "URLs:"
|
|
echo " Console : https://console.gravitee.sttlab.pc"
|
|
echo " Portal : https://portal.gravitee.sttlab.pc"
|
|
echo " API : https://api.gravitee.sttlab.pc/management"
|
|
echo " Gateway : https://gateway.gravitee.sttlab.pc"
|