kerberos-io/deployment
1
0
Fork 0
mirror of https://github.com/kerberos-io/deployment.git synced 2026-08-23 15:18:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

add kerberos factory

Browse Source
This commit is contained in:
Cedric Verstraeten
2024-10-17 16:19:46 +02:00
parent f776ff322a
commit fec9e3b715
5 changed files with 169 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
README.k8s.md
View File

@@ -4,7 +4,7 @@
💻 **Environment:** tested on Kubernetes `1.28`, `1.29`, `1.30` and `1.31`
[<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
[`<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>`](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
---
@@ -264,7 +264,7 @@ kubectl get po -w -A
### Kerberos Vault
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./kerberos-vault-deployment.yaml` file. Modify the MongoDB credentials in the `./kerberos-vault-deployment.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc.
As mentioned above a managed MongoDB is easier to setup and manage, for example for MongoDB Atlas, you will get a MongoDB URI in the form of `"mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"`. By applying this value into the `MONGODB_URI` field, you will have setup your MongoDB connection successfully.
@@ -288,10 +288,10 @@ Create the `kerberos-vault` namespace.
kubectl create namespace kerberos-vault
```
Apply the deploymentfile, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
Apply the manifests, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./kerberos-vault-configmap.yaml -n kerberos-vault
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-deployment.yaml -n kerberos-vault
kubectl apply -f ./kerberos-vault-service.yaml -n kerberos-vault
```
@@ -333,7 +333,7 @@ With the Kerberos Vault installed, we can proceed to configure the various compo
- Enabled: true
- Integration name: rabbitmq
- Broker: rabbitmq.rabbitmq:5672
- Exchange: <empty>
- Exchange: `<empty>`
- Queue: data-filtering
- Username: yourusername
- Password: yourpassword
@@ -351,7 +351,7 @@ With the Kerberos Vault installed, we can proceed to configure the various compo
### Create a Kerberos Agent
After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Kerberos Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. Please note that you can allow opt for the [Kerberos Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Kerberos Agents. Also please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Kerberos Agent deployment.
After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Kerberos Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Kerberos Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Kerberos Agents. **_(Please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Kerberos Agent deployment)_**
```bash
kubectl apply -f kerberos-agent-deployment.yaml
@@ -366,6 +366,38 @@ kubectl logs -f kerberos-agent...
To validate the Kerberos Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel).
### Create Kerberos Agents through Kerberos Factory
Managing Kerberos Agents through seperate configuration files might feel cumbersome, especially for non-technical users. This is where Kerberos Factory comes into the picture. Kerberos Factory provides a visual view that allows you to rapidly connect cameras through a user interface, which allows users without any technical background about cameras and kubernetes create Kerberos Agents.
Kerberos Factory also requires a mongodb, just like Kerberos Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace.
Create the `kerberos-factory` namespace.
```bash
kubectl create namespace kerberos-factory
```
Apply the manifests, so the Kerberos Factory application is deployed and knows how to connect to the MongoDB.
```bash
kubectl apply -f ./mongodb-configmap.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-deployment.yaml -n kerberos-factory
kubectl apply -f ./kerberos-factory-service.yaml -n kerberos-factory
```
To allow our Kerberos Factory to create Kubernetes resources we will need to apply an additional cluster role. This will allow our Kerberos Factory deployment to read and write resources to our Kubernetes cluster.
```bash
kubectl apply -f ./kerberos-factory-clusterrole.yaml -n kerberos-factory
```
Verify if the pod is running
```bash
kubectl get po -w -A
```
### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance
Once your Kerberos Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained.

21
kerberos-factory-clusterrole.yaml Normal file
View File

@@ -0,0 +1,21 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pods-list
rules:
- apiGroups: ["", "apps"]
resources: ["pods", "pods/log", "deployments", "services", "services/proxy", "endpoints", "nodes"]
verbs: ["get", "list", "create", "update", "delete", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: pods-list
subjects:
- kind: ServiceAccount
name: default
namespace: kerberos-factory
roleRef:
kind: ClusterRole
name: pods-list
apiGroup: rbac.authorization.k8s.io

76
kerberos-factory-deployment.yaml Normal file
View File

@@ -0,0 +1,76 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: factory
spec:
replicas: 1
selector:
matchLabels:
app: factory
minReadySeconds: 10
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
template:
metadata:
labels:
app: factory
spec:
containers:
- name: factory
image: "kerberos/factory:1.0.1049084302" # or you can use "kerberos/factory:latest"
#imagePullPolicy: Always
resources:
limits:
memory: 256Mi
cpu: 500m
ports:
- containerPort: 80
envFrom:
- configMapRef:
name: mongodb
# Injecting the ca-certificates inside the container.
#volumeMounts:
#- name: rootcerts
# mountPath: /etc/ssl/certs/ca-certificates.crt
# subPath: ca-certificates.crt
#- name: custom-layout
# mountPath: /home/factory/www/assets/custom
env:
- name: GIN_MODE
value: release
- name: KERBEROS_LOGIN_USERNAME
value: "root"
- name: KERBEROS_LOGIN_PASSWORD
value: "kerberos"
- name: KERBEROS_AGENT_IMAGE
value: "kerberos/agent:latest"
- name: KERBEROS_AGENT_MEMORY_LIMIT
value: "256Mi"
# Do not touch this, unless you know what you are doing.
- name: NAMESPACE
value: "kerberos-factory"
- name: FACTORY_ENVIRONMENT
value: "kubernetes"
- name: K8S_PROXY
value: http://localhost:80
# Additional certificates can be injected into the Kerberos Agents, through the creation of a configmap.
# A certificate "ca-certificates.crt" is expected in the configmap, and will be added to
# the Kerberos Agent in following directory: /etc/ssl/certs/
#- name: CERTIFICATES_CONFIGMAP
# value: "rootcerts"
#volumes:
#- name: rootcerts
# configMap:
# name: rootcerts
#- name: custom-layout
# persistentVolumeClaim:
# claimName: custom-layout-claim

34
kerberos-factory-service.yaml Normal file
View File

@@ -0,0 +1,34 @@
# You might use a LoadBalancer service instead of a NodePort service.
# If so uncomment the LoadBalancer service below and comment the NodePort service.
apiVersion: v1
kind: Service
metadata:
name: factory-nodeport
labels:
app: factory
spec:
type: NodePort
ports:
- port: 80
targetPort: 80
nodePort: 30080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
name: frontend
protocol: TCP
selector:
app: factory
# ---
# apiVersion: v1
# kind: Service
# metadata:
# name: factory-lb
# labels:
# app: factory
# spec:
# type: LoadBalancer
# ports:
# - port: 80
# targetPort: 80
# name: frontend
# protocol: TCP
# selector:
# app: factory

0
kerberos-vault-configmap.yaml → mongodb-configmap.yaml
View File