kerberos-io/deployment
1
0
Fork 0
mirror of https://github.com/kerberos-io/deployment.git synced 2026-08-23 15:18:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4 from kerberos-io/add-kerberos-factory

Browse Source 
Add kerberos factory to deployment guide
This commit is contained in:
Cédric Verstraeten
2024-10-18 15:44:53 +02:00
committed by GitHub
parent 7670ab5f27 f8e3bfcaff
commit a4423b89c5
8 changed files with 200 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
README.k8s.md
View File

@@ -4,7 +4,7 @@
💻 **Environment:** tested on Kubernetes `1.28`, `1.29`, `1.30` and `1.31`
[<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
[`<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>`](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
---
@@ -264,7 +264,7 @@ kubectl get po -w -A
### Kerberos Vault
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./kerberos-vault-deployment.yaml` file. Modify the MongoDB credentials in the `./kerberos-vault-deployment.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
As mentioned above a managed MongoDB is easier to setup and manage, for example for MongoDB Atlas, you will get a MongoDB URI in the form of `"mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"`. By applying this value into the `MONGODB_URI` field, you will have setup your MongoDB connection successfully.
@@ -288,10 +288,10 @@ Create the `kerberos-vault` namespace.
kubectl create namespace kerberos-vault
```
Apply the deploymentfile, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
Apply the manifests, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./kerberos-vault-configmap.yaml -n kerberos-vault
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-deployment.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-service.yaml -n kerberos-vault
```
@@ -333,7 +333,7 @@ With the Kerberos Vault installed, we can proceed to configure the various compo
- Enabled: true
- Integration name: rabbitmq
- Broker: rabbitmq.rabbitmq:5672
- Exchange: <empty>
- Exchange: `<empty>`
- Queue: data-filtering
- Username: yourusername
- Password: yourpassword
@@ -351,7 +351,7 @@ With the Kerberos Vault installed, we can proceed to configure the various compo
### Create a Kerberos Agent
After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Kerberos Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. Please note that you can allow opt for the [Kerberos Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Kerberos Agents. Also please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Kerberos Agent deployment.
After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Kerberos Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Kerberos Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Kerberos Agents. **_(Please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Kerberos Agent deployment)_**
```bash
kubectl apply -f kerberos-agent-deployment.yaml
@@ -366,6 +366,38 @@ kubectl logs -f kerberos-agent...
To validate the Kerberos Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel).
### Create Kerberos Agents through Kerberos Factory
Managing Kerberos Agents through seperate configuration files might feel cumbersome, especially for non-technical users. This is where Kerberos Factory comes into the picture. Kerberos Factory provides a visual view that allows you to rapidly connect cameras through a user interface, which allows users without any technical background about cameras and kubernetes create Kerberos Agents.
Kerberos Factory also requires a mongodb, just like Kerberos Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace.
Create the `kerberos-factory` namespace.
```bash
kubectl create namespace kerberos-factory
```
Apply the manifests, so the Kerberos Factory application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-deployment.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-service.yaml -n kerberos-factory
```
To allow our Kerberos Factory to create Kubernetes resources we will need to apply an additional cluster role. This will allow our Kerberos Factory deployment to read and write resources to our Kubernetes cluster.
```bash
kubectl apply -f ./kerberos-factory-clusterrole.yaml -n kerberos-factory
```
Verify if the pod is running
```bash
kubectl get po -w -A
```
### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance
Once your Kerberos Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.

49
README.microk8s.md
View File

@@ -241,7 +241,7 @@ kubectl get po -w -A
### Kerberos Vault
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./kerberos-vault-deployment.yaml` file. Modify the MongoDB credentials in the `./kerberos-vault-deployment.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
As mentioned above a managed MongoDB is easier to setup and manage, for example for MongoDB Atlas, you will get a MongoDB URI in the form of `"mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"`. By applying this value into the `MONGODB_URI` field, you will have setup your MongoDB connection successfully.
@@ -265,10 +265,10 @@ Create the `kerberos-vault` namespace.
kubectl create namespace kerberos-vault
```
Apply the deployment file, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
Apply the manifest, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./kerberos-vault-configmap.yaml -n kerberos-vault
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-deployment.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-service.yaml -n kerberos-vault
```
@@ -287,13 +287,20 @@ If you have opted for the `NodePort` configuration, you can access the Kerberos
ssh -L 8080:localhost:30080 user@server-ip -p 22
```
#### Login to Kerberos Vault
Once you have access to the Kerberos Vault UI, you should be able to login with a username and password. You will [find the username and password here](https://github.com/kerberos-io/deployment/blob/main/kerberos-vault-deployment.yaml#L36-L39).
- Username: [**view username**](https://github.com/kerberos-io/deployment/blob/main/kerberos-vault-deployment.yaml#L36-L37)
- Password: [**view password**](https://github.com/kerberos-io/deployment/blob/main/kerberos-vault-deployment.yaml#L38-L39)
#### Configure the Kerberos Vault
With the Kerberos Vault installed, we can proceed to configure the various components. Currently, this must be done through the Kerberos Vault UI, but we plan to make it configurable via environment variables, eliminating the need for manual UI configurations.
![Configure Vault](./assets/images/configure-vault.gif)
- Navigate to the `Storage Providers` menu and select the (+ Add Storage Provider) button. A modal will appear where you can input the required details. After entering the information, click the "Verify" button to ensure the configuration is valid. Once you receive a "Configuration is valid and working" message, click the "Add Storage Provider" button to complete the process.
- Navigate to the `Storage Providers` menu and select the (+ Add Storage Provider) button. A modal will appear where you can input the required details. After entering the information, click the "Verify" button to ensure the configuration is valid. Once you receive a "Configuration is valid and working" message, click the "Add Storage Provider" button to complete the process. **_(!You are advised to generate more complex access and secret key for Minio, this is just for demo purposes, do not use this in production)_**
- Minio
- Enabled: true
@@ -304,7 +311,7 @@ With the Kerberos Vault installed, we can proceed to configure the various compo
- Access key: minio
- Secret key: minio123
- Navigate to the `Integrations` menu and select the (+ Add Integration) button. A modal will appear where you can input the required details. After entering the information, click the "Verify" button to ensure the configuration is valid. Once you receive a "Configuration is valid and working" message, click the "Add Integration" button to complete the process.
- Navigate to the `Integrations` menu and select the (+ Add Integration) button. A modal will appear where you can input the required details. After entering the information, click the "Verify" button to ensure the configuration is valid. Once you receive a "Configuration is valid and working" message, click the "Add Integration" button to complete the process. **_(!You are advised to generate more complex username and password for RabbitMQ, this is just for demo purposes, do not use this in production)_**
- RabbitMQ
- Enabled: true
@@ -343,6 +350,38 @@ kubectl logs -f kerberos-agent...
To validate the Kerberos Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel).
### Create Kerberos Agents through Kerberos Factory
Managing Kerberos Agents through seperate configuration files might feel cumbersome, especially for non-technical users. This is where Kerberos Factory comes into the picture. Kerberos Factory provides a visual view that allows you to rapidly connect cameras through a user interface, which allows users without any technical background about cameras and kubernetes create Kerberos Agents.
Kerberos Factory also requires a mongodb, just like Kerberos Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace.
Create the `kerberos-factory` namespace.
```bash
kubectl create namespace kerberos-factory
```
Apply the manifests, so the Kerberos Factory application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-deployment.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-service.yaml -n kerberos-factory
```
To allow our Kerberos Factory to create Kubernetes resources we will need to apply an additional cluster role. This will allow our Kerberos Factory deployment to read and write resources to our Kubernetes cluster.
```bash
kubectl apply -f ./kerberos-factory-clusterrole.yaml -n kerberos-factory
```
Verify if the pod is running
```bash
kubectl get po -w -A
```
### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance
Once your Kerberos Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.

3
data-filtering-deployment.yaml
View File

@@ -37,7 +37,8 @@ spec:
value: yourpassword
- name: STORAGE_URI
value: "http://vault-lb.kerberos-vault/api"
#value: http://vault-lb.kerberos-vault/api
value: http://vault-nodeport.kerberos-vault:80/api
- name: STORAGE_ACCESS_KEY
value: "XJoi2@bgSOvOYBy#"
- name: STORAGE_SECRET_KEY

5
kerberos-agent-deployment.yaml
View File

@@ -39,13 +39,14 @@ spec:
- name: AGENT_CLOUD
value: kstorage
- name: AGENT_KERBEROSVAULT_URI
value: http://vault-lb.kerberos-vault/api
#value: http://vault-lb.kerberos-vault/api
value: http://vault-nodeport.kerberos-vault:80/api
- name: AGENT_KERBEROSVAULT_ACCESS_KEY
value: XJoi2@bgSOvOYBy#
- name: AGENT_KERBEROSVAULT_SECRET_KEY
value: OGGqat4lXRpL@9XBYc8FUaId@5
- name: AGENT_KERBEROSVAULT_PROVIDER
value: mybucket
value: minio
- name: AGENT_KERBEROSVAULT_DIRECTORY
value: myhubaccount
- name: AGENT_CAPTURE_CONTINUOUS

21
kerberos-factory-clusterrole.yaml Normal file
View File

@@ -0,0 +1,21 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pods-list
rules:
- apiGroups: ["", "apps"]
resources: ["pods", "pods/log", "deployments", "services", "services/proxy", "endpoints", "nodes"]
verbs: ["get", "list", "create", "update", "delete", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pods-list
subjects:
- kind: ServiceAccount
name: default
namespace: kerberos-factory
roleRef:
kind: ClusterRole
name: pods-list
apiGroup: rbac.authorization.k8s.io

56
kerberos-factory-deployment.yaml Normal file
View File

@@ -0,0 +1,56 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: factory
spec:
replicas: 1
selector:
matchLabels:
app: factory
minReadySeconds: 10
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
template:
metadata:
labels:
app: factory
spec:
containers:
- name: factory
image: "uugai/factory:v1.0.4"
resources:
requests:
memory: 256Mi
cpu: 500m
limits:
memory: 256Mi
cpu: 500m
ports:
- containerPort: 80
envFrom:
- configMapRef:
name: mongodb
env:
- name: GIN_MODE
value: release
- name: KERBEROS_LOGIN_USERNAME
value: "root"
- name: KERBEROS_LOGIN_PASSWORD
value: "kerberos"
- name: KERBEROS_AGENT_IMAGE
value: "kerberos/agent:latest"
- name: KERBEROS_AGENT_MEMORY_LIMIT
value: "256Mi"
# Do not touch this, unless you know what you are doing.
- name: NAMESPACE
value: "kerberos-factory"
- name: FACTORY_ENVIRONMENT
value: "kubernetes"
- name: K8S_PROXY
value: http://localhost:80

34
kerberos-factory-service.yaml Normal file
View File

@@ -0,0 +1,34 @@
# You might use a LoadBalancer service instead of a NodePort service.
# If so uncomment the LoadBalancer service below and comment the NodePort service.
apiVersion: v1
kind: Service
metadata:
name: factory-nodeport
labels:
app: factory
spec:
type: NodePort
ports:
- port: 80
targetPort: 80
nodePort: 30079 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
name: frontend
protocol: TCP
selector:
app: factory
# ---
# apiVersion: v1
# kind: Service
# metadata:
# name: factory-lb
# labels:
# app: factory
# spec:
# type: LoadBalancer
# ports:
# - port: 80
# targetPort: 80
# name: frontend
# protocol: TCP
# selector:
# app: factory

3
kerberos-vault-configmap.yaml → mongodb-configmap.yaml
View File

@@ -5,6 +5,7 @@ metadata:
data:
# This is the mongodb database where data will be stored, you might use a different name if you want.
MONGODB_DATABASE_STORAGE: "KerberosStorage"
MONGODB_DATABASE_FACTORY: "KerberosFactory"
# MongoDB URI (for example for a SaaS service like MongoDB Atlas)
# If uri is set, the below properties are not used (host, adminDatabase, username, password)
#MONGODB_URI: "mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"
@@ -13,4 +14,4 @@ data:
MONGODB_HOST: "mongodb.mongodb"
MONGODB_DATABASE_CREDENTIALS: "admin"
MONGODB_USERNAME: "root"
MONGODB_PASSWORD: "yourpassword"
MONGODB_PASSWORD: "yourpassword"