Skip to main content

Use the Helm chart to run the Primer as a Kubernetes job

Deploying a Corsha Primer​

The Primer must be used to prime Corsha Authenticators at deployment. In this guide we will run the Primer as a Kubernetes job which will store the generated Authenticator Secret in Kubernetes secrets.

Corsha Primer Secret​

The Corsha Primer Helm Chart needs a pre-placed secret value called a Primer Secret. A Primer Secret is generated in the Console.

Primer Configuration​

The Corsha Primer Helm Chart requires configuration values for your environment. To organize all the charts you are going to configure, let's create a directory for each component, here's it's the corsha-primer:

mkdir corsha-primer
cd corsha-primer

Below is a sample content for a yaml file values.yaml you need to create in corsha-primer to configure the Corsha Primer.

For documentation on the configuration values, the Helm configuration guide contains a detailed list of all configurable properties. Open up this page as you are setting up your yaml files. The PRIMER_SERVICE_HOST is provided by Corsha in the deployment documentation you received.

The machines section defines one or more Authenticators that this Primer primes. As explained in the Helm configuration guide, you will need to define the machine's secretsName and use this same name in a corresponding Corsha Authenticator's authenticatorSecretName. If you wish to deploy more than one Authenticator, you will need to define multiple machines.

machines:
  - machineId: "<fill in>"
    jobId: "<fill in>"
    buildId: "<fill in>"
    secretsName: "<fill in>"
  - machineId: "<fill in>"
    jobId: "<fill in>"
    buildId: "<fill in>"
    secretsName: "<fill in>"

env:
  PRIMER_SERVICE_HOST: "<fill in>"
Primer Secret Configuration​

Now let's use sops to store secret configuration values in an encrypted format.

To encrypt the secret values, we will need to get the fingerprint of the PGP key that was provided in your Deployment Guide:

$ gpg --list-secret-keys
/home/ubuntu/.gnupg/pubring.kbx
-------------------------------
sec   rsa4096 2022-01-10 [SC] [expires: 2023-01-10]
      E989D51B08C9C5BE0DD5CCA64F3A2320CA653FBB
uid           [ultimate] acorn (Used for Helm secret)

The hexadecimal string is the fingerprint that we will use to identify which key is encrypting our Helm secrets.

To create the Helm secrets file and replace the default values with the values we need to store in encrypted format, run the following:

sops --pgp <fingerprint> secrets.yaml

This will open an editor in which we can insert our secret values to be encrypted.

The Primer Secret is generated in the Console and the Artifactory credentials are provided by Corsha in the Deployment Guide you received.

primerSecret: "<fill in>"

imageCredentials:
  username: <Artifactory username>
  password: <Artifactory password>
note

If you require the addition of extra Certificate Authority (CA) roots of trust, you will need to include the additional value below in your secrets.yaml file. Your Corsha TPOC will let you know if this is required and send you the required certs.

  trustedCAs: |
    -----BEGIN CERTIFICATE-----
    <REDACTED>
    -----END CERTIFICATE-----
note

If you later need to make updates to this secrets.yaml file that was created, you can simply run sops to edit the encrypted values.

sops secrets.yaml

Install the Corsha Primer​

Add the Corsha Helm repository, if you have not already, using the username and password you have been provided in your Deployment Guide. If this command returns "repository name (corsha) already exists" then you have already logged in to the repository.

helm repo add corsha https://corsha.jfrog.io/corsha/corsha --username #<Artifactory username>

You will be prompted to input your Corsha Artifactory password.

Install the Primer's chart with Helm, using the version provided by your Corsha TPOC:

helm -n $NS secrets upgrade --install \
corsha-primer corsha/mstream-primer \
 -f values.yaml -f secrets.yaml \
--verify --version <version>
Verify that the Primer has run​

Make sure that the secrets that you have defined for your machines have been created in your namespace

For an Authenticator Secret named authenticator-secret:

$ kubectl  -n $NS get secrets | grep authenticator-secret
authenticator-secret                  Opaque                                1      38s