diff --git a/README.md b/README.md index 78a2177..2d75733 100644 --- a/README.md +++ b/README.md @@ -19,44 +19,13 @@ The OCI Service Broker is an open source implementation of [Open service broker See the [Installation](charts/oci-service-broker/docs/installation.md) instructions for detailed installation and configuration of OCI Service Broker. -### Build - -**Pre-requisites:** - -* JDK 10 & above -* [Gradle](https://gradle.org/) - (Recommended Gradle version: v4.10.3) -* Docker - -The source code for OCI Service Broker is written in java and the code, can be found [here](oci-service-broker). - - **Step 1:** Download [oci-javasdk v1.3.1](https://github.com/oracle/oci-java-sdk/releases/download/v1.3.1/oci-java-sdk.zip) archive file. - - The OCI Service Broker internally uses [oci-java-sdk](https://github.com/oracle/oci-java-sdk) to manage OCI services. But they are not published to any public maven repositories yet. In order to build the project, users are required to download oci-java-sdk archive file and add the dependent libraries to libs directory of oci-service-broker. The can be done by running [download_SDK_libs.sh](oci-service-broker/download_SDK_libs.sh) script. - - ```bash - bash oci-service-broker/download_SDK_libs.sh - ``` - - **Step 2:** Compile and build oci-service-broker docker image. Gradle Build Tool is used for building the oci-service-broker. - -```bash -gradle -b oci-service-broker/build.gradle clean build docker -``` - - **Step 3:** The docker image oci-service-broker is available in the local docker repository. We should push this docker image to [OCIR](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryoverview.htm) or customer's docker repository and refer this image in the Helm Chart. - - **Step 4:** Install oci-service-broker chart - -Update the chart to use the image that was built in **Step 3** by editing the values `image.repository` and `image.tag` in the [values.yaml](charts/oci-service-broker/values.yaml) and deploy the chart. - ## Documentation See the [Documentation](charts/oci-service-broker/README.md#oci-service-broker) for complete details on installation, security and service related configurations of OCI Service Broker. ## Charts -The OCI Service Broker is packaged as Helm chart for making it easy to install in Kubernetes Clusters. Please refer to [Documentation](#Documentation) for detailed instructions. +The OCI Service Broker is packaged as Helm chart for making it easy to install in Kubernetes Clusters. Please refer to [Documentation](#documentation) for detailed instructions. ## Samples diff --git a/charts/oci-service-broker/README.md b/charts/oci-service-broker/README.md index 9ef022e..f60a73f 100644 --- a/charts/oci-service-broker/README.md +++ b/charts/oci-service-broker/README.md @@ -6,6 +6,7 @@ - [Install Service Catalog](docs/installation.md#install-service-catalog) - [Install svcat tool](docs/installation.md#install-svcat-tool) - [Deploy OCI Service Broker](docs/installation.md#deploy-oci-service-broker) + - [Build OCI Service Broker Image from the Source](docs/installation.md#build-oci-service-broker-image-from-the-source) - [Install service-broker chart](docs/installation.md#install-service-broker-chart) - [OCI credentials](docs/installation.md#oci-credentials) - [Quick Setup](docs/installation.md#quick-setup) diff --git a/charts/oci-service-broker/docs/adw.md b/charts/oci-service-broker/docs/adw.md index b251182..7a03d31 100644 --- a/charts/oci-service-broker/docs/adw.md +++ b/charts/oci-service-broker/docs/adw.md @@ -34,7 +34,7 @@ Right now we expose a `standard` plan where the user can specify CPU count and s ## OCI User Permission requirement -The OCI user for OCI Service Broker should have permission `manage` for resoruce type `autonomous-data-warehouse` +The OCI user for OCI Service Broker should have permission `manage` for resource type `autonomous-data-warehouse` **Sample Policy:** @@ -44,7 +44,7 @@ Allow group to manage autonomous-data-warehouse in compar ## Service Provision Request Parameters -To provision, an ADW service user needs to provide the following details +To provision, an ADW service user needs to provide the following details: | Parameter | Description | Type | Mandatory | | ---------------- | ------------------------------------------------------------------- | ------ | --------- | @@ -53,10 +53,10 @@ To provision, an ADW service user needs to provide the following details | `compartmentId` | The OCI compartment where the ADW instance will be provisioned. | string | yes | | `cpuCount` | Number of CPU cores to have. | int | yes | | `storageSizeTBs` | Size of the DB Storage in Terrabytes. | int | yes | -| `password` | ADW Service will pre-provision a DB Admin user when it provisions an ADW instance. The user needs to provide a password to be set for this Admin user.
The OCI ADW service requires the password to satisfy the below rules.
| string | yes | +| `password` | ADW Service will pre-provision a DB Admin user when it provisions an ADW instance. The user needs to provide a password to be set for this Admin user.
The OCI ADW service requires the password to satisfy the below rules.
| string | yes | | `licenseType` | Use your existing database software licenses(BYOL) or Subscribe to new database software licenses and the Database Cloud Service.
Valid values are:. | string | yes | | `freeFormTags` | free form tags that are to be used for tagging the ADW instance. | object | no | -| `definedTags` | The defined tags that are to be used for tagging the ADW instance. | object | No | +| `definedTags` | The defined tags that are to be used for tagging the ADW instance. | object | no | ## Service Binding Request Parameters @@ -68,7 +68,7 @@ The user needs to pass the following parameters to get the binding details: ## Service Binding Response Credentials -Users can create binding to get the credentials to use the ADW. The following files/details will be made available to the user +Users can create binding to get the credentials to use the ADW. The following files/details will be made available to the user: | Parameter | Description | Type | | ------------------ | ------------------------------------------------------------------------ | ------ | @@ -110,7 +110,7 @@ If no brokers are listed then it means the OCI Service Broker is not installed. #### Sample files -The sample files for ADW are available under [`oci-service-broker/samples/adw`](charts/oci-service-broker/samples/adw) directory. +The sample files for ADW are available under [`oci-service-broker/samples/adw`](../samples/adw) directory. ### Provisioning @@ -130,7 +130,7 @@ Please refer [Use Secret to pass passwords](#use-secret-to-pass-passwords) secti The `adw-instance-plain.yaml` files contain the compartment OCID in which the user wants to provision the ADW instance. The user needs to update it with their compartment OCID. ```bash -kubectl create -f oci-service-broker/samples/adw/adw-instance-plain.yaml +kubectl create -f charts/oci-service-broker/samples/adw/adw-instance-plain.yaml ``` #### Get instance status @@ -162,10 +162,10 @@ Once the ADW Instance is provisioned the applications will require credentials/c - Creating a ServiceBinding resource. This will create a Kubernetes secret with the credentials/configurations. - The user needs to mount the credentials/configurations into the containers so that application can use this configuration. -A sample Kubernetes resource yaml to create binding. +A sample Kubernetes resource yaml to create binding: ```bash -cat oci-service-broker/samples/adw/adw-binding-plain.yaml +cat charts/oci-service-broker/samples/adw/adw-binding-plain.yaml ``` **Note:** @@ -175,7 +175,7 @@ instanceRef should be same as the instance name for which binding is required. #### Creating an ADW ServiceBinding resource ```bash -kubectl create -f oci-service-broker/samples/adw/adw-binding-plain.yaml +kubectl create -f charts/oci-service-broker/samples/adw/adw-binding-plain.yaml ``` #### Get Binding status @@ -198,7 +198,7 @@ When the ServiceBinding request completes successfully the user should see a sec kubectl get secrets adw-demo-binding -o yaml ``` -Output +Output: ```yaml apiVersion: v1 @@ -237,7 +237,7 @@ User need to create secret with DB Admin user password and wallet password. Edit Create the Secret. ```bash -kubectl create -f oci-service-broker/samples/adw/adw-demo-secret.yaml +kubectl create -f charts/oci-service-broker/samples/adw/adw-demo-secret.yaml ``` #### Deploy sample application @@ -332,7 +332,7 @@ Important things to note: Deploy the app. ```bash -kubectl create -f oci-service-broker/samples/adw/adw-demo.yaml +kubectl create -f charts/oci-service-broker/samples/adw/adw-demo.yaml ``` View the logs @@ -341,7 +341,7 @@ View the logs kubectl logs $(kubectl get pod | grep ^adw-demo | grep Running | cut -d" " -f 1) ``` -Output +Output: ```plain -------- Oracle JDBC Connection Testing ------ @@ -378,13 +378,13 @@ DEFAULT_TABLESPACE:SYSTEM Deleting the Service binding created in the previous step will result in the secret(that has the credentials) getting deleted. All Service Bindings for a ServiceInstance should be deleted before deleting the ServiceInstance. ```bash -kubectl delete -f oci-service-broker/samples/adw/adw-binding-plain.yaml +kubectl delete -f charts/oci-service-broker/samples/adw/adw-binding-plain.yaml ``` #### Delete Service Instance ```bash -kubectl delete -f oci-service-broker/samples/adw/adw-instance-plain.yaml +kubectl delete -f charts/oci-service-broker/samples/adw/adw-instance-plain.yaml ``` ```bash @@ -420,17 +420,17 @@ Create Secret: Edit the values of 'password:' and 'walletPassword:' in `oci-service-broker/samples/adw/adw-secret.yaml` with appropriate base64 encoded strings ```bash -kubectl create -f oci-service-broker/samples/adw/adw-secret.yaml +kubectl create -f charts/oci-service-broker/samples/adw/adw-secret.yaml ``` Yaml to provision ADW instance with password loaded from Kubernetes Secret (notice parametersFrom part) ```bash -cat oci-service-broker/samples/adw/adw-instance.yaml +cat charts/oci-service-broker/samples/adw/adw-instance.yaml ``` Yaml to provision ADW instance with password loaded from Kubernetes Secret (notice parametersFrom part) ```bash -cat oci-service-broker/samples/adw/adw-binding.yaml +cat charts/oci-service-broker/samples/adw/adw-binding.yaml ``` diff --git a/charts/oci-service-broker/docs/atp.md b/charts/oci-service-broker/docs/atp.md index cda4f60..689d089 100644 --- a/charts/oci-service-broker/docs/atp.md +++ b/charts/oci-service-broker/docs/atp.md @@ -34,7 +34,7 @@ Right now we expose a `standard` plan where the user can specify CPU count and s ## OCI User Permission requirement -The OCI user for OCI Service Broker should have permission `manage` for resoruce type `autonomous-database` +The OCI user for OCI Service Broker should have permission `manage` for resource type `autonomous-database`. **Sample Policy:** @@ -44,7 +44,7 @@ Allow group to manage autonomous-database in compartment ## Service Provision Request Parameters -To provision, an ATP service user needs to provide the following details +To provision, an ATP service user needs to provide the following details: | Parameter | Description | Type | Mandatory | | ---------------- | ------------------------------------------------------------------- | ------ | --------- | @@ -53,10 +53,10 @@ To provision, an ATP service user needs to provide the following details | `compartmentId` | The OCI compartment where the ATP instance will be provisioned. | string | yes | | `cpuCount` | Number of CPU cores to have. | int | yes | | `storageSizeTBs` | Size of the DB Storage in Terrabytes. | int | yes | -| `password` | ATP Service will pre-provision a DB Admin user when it provisions an ATP instance. The user needs to provide a password to be set for this Admin user.
The OCI ATP service requires the password to satisfy the below rules.
| string | yes | +| `password` | ATP Service will pre-provision a DB Admin user when it provisions an ATP instance. The user needs to provide a password to be set for this Admin user.
The OCI ATP service requires the password to satisfy the below rules.
| string | yes | | `licenseType` | Use your existing database software licenses(BYOL) or Subscribe to new database software licenses and the Database Cloud Service.
Valid values are:. | string | yes | | `freeFormTags` | free form tags that are to be used for tagging the ATP instance. | object | no | -| `definedTags` | The defined tags that are to be used for tagging the ATP instance. | object | No | +| `definedTags` | The defined tags that are to be used for tagging the ATP instance. | object | no | ## Service Binding Request Parameters @@ -68,7 +68,7 @@ The user needs to pass the following parameters to get the binding details: ## Service Binding Response Credentials -Users can create binding to get the credentials to use the ATP. The following files/details will be made available to the user +Users can create binding to get the credentials to use the ATP. The following files/details will be made available to the user: | Parameter | Description | Type | | ------------------ | ------------------------------------------------------------------------ | ------ | @@ -110,7 +110,7 @@ If no brokers are listed then it means the OCI Service Broker is not installed. #### Sample files -The sample files for ATP are available under [`oci-service-broker/samples/atp`](charts/oci-service-broker/samples/atp) directory. +The sample files for ATP are available under [`oci-service-broker/samples/atp`](../samples/atp) directory. ### Provisioning @@ -130,7 +130,7 @@ Please refer [Use Secret to pass passwords](#use-secret-to-pass-passwords) secti The `atp-instance-plain.yaml` files contain the compartment OCID in which the user wants to provision the ATP instance. The user needs to update it with their compartment OCID. ```bash -kubectl create -f oci-service-broker/samples/atp/atp-instance-plain.yaml +kubectl create -f charts/oci-service-broker/samples/atp/atp-instance-plain.yaml ``` #### Get instance status @@ -162,7 +162,7 @@ Once the ATP Instance is provisioned the applications will require credentials/c - Creating a ServiceBinding resource. This will create a Kubernetes secret with the credentials/configurations. - The user needs to mount the credentials/configurations into the containers so that application can use this configuration. -A sample Kubernetes resource yaml to create binding. +A sample Kubernetes resource yaml to create binding: ```bash cat oci-service-broker/samples/atp/atp-binding-plain.yaml @@ -174,7 +174,7 @@ cat oci-service-broker/samples/atp/atp-binding-plain.yaml #### Creating an ATP ServiceBinding resource ```bash -kubectl create -f oci-service-broker/samples/atp/atp-binding-plain.yaml +kubectl create -f charts/oci-service-broker/samples/atp/atp-binding-plain.yaml ``` #### Get Binding status @@ -197,7 +197,7 @@ When the ServiceBinding request completes successfully the user should see a sec kubectl get secrets atp-demo-binding -o yaml ``` -Output +Output: ```yaml apiVersion: v1 @@ -236,7 +236,7 @@ User need to create secret with DB Admin user password and wallet password. Edit Create the Secret. ```bash -kubectl create -f oci-service-broker/samples/atp/atp-demo-secret.yaml +kubectl create -f charts/oci-service-broker/samples/atp/atp-demo-secret.yaml ``` #### Deploy sample application @@ -331,7 +331,7 @@ Important things to note: Deploy the app. ```bash -kubectl create -f oci-service-broker/samples/atp/atp-demo.yaml +kubectl create -f charts/oci-service-broker/samples/atp/atp-demo.yaml ``` View the logs. @@ -340,7 +340,7 @@ View the logs. kubectl logs $(kubectl get pod | grep ^atp-demo | grep Running | cut -d" " -f 1) ``` -Output +Output: ```plain -------- Oracle JDBC Connection Testing ------ @@ -377,13 +377,13 @@ DEFAULT_TABLESPACE:SYSTEM Deleting the Service binding created in the previous step will result in the secret(that has the credentials) getting deleted. All Service Bindings for a ServiceInstance should be deleted before deleting the ServiceInstance. ```bash -kubectl delete -f oci-service-broker/samples/atp/atp-binding-plain.yaml +kubectl delete -f charts/oci-service-broker/samples/atp/atp-binding-plain.yaml ``` #### Delete Service Instance ```bash -kubectl delete -f oci-service-broker/samples/atp/atp-instance-plain.yaml +kubectl delete -f charts/oci-service-broker/samples/atp/atp-instance-plain.yaml ``` ```bash @@ -419,17 +419,17 @@ Create Secret: Edit the values of 'password:' and 'walletPassword:' in `oci-service-broker/samples/atp/atp-secret.yaml` with appropriate base64 encoded strings. ```bash -kubectl create -f oci-service-broker/samples/atp/atp-secret.yaml +kubectl create -f charts/oci-service-broker/samples/atp/atp-secret.yaml ``` Yaml to provision ATP instance with password loaded from Kubernetes Secret (notice parametersFrom part). ```bash -cat oci-service-broker/samples/atp/atp-instance.yaml +cat charts/oci-service-broker/samples/atp/atp-instance.yaml ``` Yaml to provision ATP instance with password loaded from Kubernetes Secret (notice parametersFrom part). ```bash -cat oci-service-broker/samples/atp/atp-binding.yaml +cat charts/oci-service-broker/samples/atp/atp-binding.yaml ``` diff --git a/charts/oci-service-broker/docs/installation.md b/charts/oci-service-broker/docs/installation.md index 6bc98cf..5249e21 100644 --- a/charts/oci-service-broker/docs/installation.md +++ b/charts/oci-service-broker/docs/installation.md @@ -6,7 +6,7 @@ * [Install Service Catalog](#install-service-catalog) * [Install svcat tool](#install-svcat-tool) * [Deploy OCI Service Broker](#deploy-oci-service-broker) - * [Building OCI Service Broker Image from the Source](#building-oracle-service-broker-image-from-the-source) + * [Build OCI Service Broker Image from the Source](#build-oci-service-broker-image-from-the-source) * [Install oci-service-broker chart](#install-oci-service-broker-chart) * [OCI credentials](#oci-credentials) * [Quick Setup](#quick-setup) @@ -53,10 +53,7 @@ Install the Kubernetes Service Catalog helm chart: helm install svc-cat/catalog --set controllerManager.verbosity="4" --timeout 300 --name catalog --version 0.1.34 ``` -Please note that the above command will run the Service Catalog using an embedded `etcd` instance. It is not recommended to run the Service Catalog using an embedded etcd instance in production environments, instead a separate etcd cluster should be setup and used by the Service Catalog. The open source [etcd operator project](https://github.com/coreos/etcd-operator) or the [bitnami etcd helm chart](https://github.com/bitnami/charts/tree/master/bitnami/etcd) may be used to setup a production quality etcd cluster. - - -production quality `etcd` cluster should be setup using or the and used by the Service Catalog. +Please note that the above command will run the Service Catalog using an embedded `etcd` instance. It is not recommended to run the Service Catalog using an embedded etcd instance in production environments, instead a separate etcd cluster should be setup and used by the Service Catalog. The open source [etcd operator project](https://github.com/coreos/etcd-operator) or a commercial offering may be used to setup a production quality etcd cluster. ## Install svcat tool @@ -70,29 +67,29 @@ brew update && brew install kubernetes-service-catalog-client ## Deploy OCI Service Broker -### Building OCI Service Broker Image from the Source +### Build OCI Service Broker Image from the Source After cloning the `oci-service-broker` source code run following command to build the Docker Image for OCI Service Broker ```bash -cd oci-service-broker +cd oci-service-broker/oci-service-broker #The OCI Service Broker internally uses [oci-java-sdk](https://github.com/oracle/oci-java-sdk) to manage OCI services. But they are not published to any public maven repositories yet. In order to build the project, users are required to download oci-java-sdk archive file and add the dependent libraries to libs directory of oci-service-broker. Below command will download the required libraries and add to the libs directory. bash download_SDK_libs.sh -#Gradle is the build tool used in OCI Service Broker. Recommended version v4.10.3. Please execute the below command to compile, build and generate a docker image. +#Gradle is the build tool used in OCI Service Broker. Please execute the below command to compile, build and generate a docker image. gradle -b build.gradle clean build docker ``` If gradle build failed with error('Task :spotbugsMain FAILED'), please provide '-x spotbugsMain' option in above command. This is known issue due to latest JDK version. -After successful build, a new docker image will be created having name 'oci-service-broker'. User need to push this image to [OCIR](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryoverview.htm) or their docker repository and refer the same in the Chart during deployment. +After successful build, a new docker image will be created having name 'oci-service-broker'. Push this image to [OCIR](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryoverview.htm) or your own docker repository and refer this image in the Chart during deployment. ### Install oci-service-broker chart -The OCI Service Broker is packaged as Helm chart for making it easy to install in Kubernetes. The chart is available at [charts/oci-service-broker](charts/oci-service-broker) directory. +The OCI Service Broker is packaged as Helm chart for making it easy to install in Kubernetes. The chart is available at [charts/oci-service-broker](../) directory. #### OCI credentials @@ -100,15 +97,15 @@ The OCI Service Broker needs OCI user credentials details to provision and manag **Important:** Please check the guidelines [here](security.md#restrict-access-of-the-oci-user-used-by-service-broker) for configuring the OCI user credentials for OCI Service Broker. -The secret should have the below Keys and respective values for it. +The secret should have the below Keys and respective values for it: | Key | Description | | --------- | ----------- | | `tenancy` | The OCID of your tenancy | | `fingerprint` | The Fingerprint of your OCI user | | `user` | OCID of the user | -| `passphrase` | The passphrase of the private key(if passphrase is set then set the value to an empty string) | -| `privatekey` | The OCI User private key` | +| `passphrase` | The passphrase of the private key(if passphrase is set, then set the value to an empty string) | +| `privatekey` | The OCI User private key | | `region` | The region in which the OKE cluster is running. The value should be in OCI region format. Example: us-ashburn-1 | Run the below command to create Secret by name `ociCredentials`. (Replace values with your user credentials) @@ -142,7 +139,7 @@ It is strongly recommended to configure OCI Service Broker with [TLS](#enable-tl #### etcd for persistence -The OCI Service Broker stores service instance related metadata in an etcd instance. By default an embedded etcd instance is available in this chart and will be used for storing the same. But it is NOT recommended to use the embedded etcd instance in PRODUCTION environments. +The OCI Service Broker stores service instance related metadata in an etcd instance. By default an embedded etcd instance is available in this chart and will be used for storing the same. But it is NOT recommended to use the embedded etcd instance in PRODUCTION environments. The etcd cluster that was setup to be used by the Service Catalog, as explained in the [Install Service Catalog](#install-service-catalog) section above can be shared by the OCI Service Broker as well. Otherwise, a separate etcd cluster can be setup to be used by the OCI Service Broker. The values under `storage.etcd` should be used to configure etcd. @@ -155,7 +152,7 @@ The etcd cluster that was setup to be used by the Service Catalog, as explained | `storage.etcd.tls.enabled` | Set this value to true if TLS needs to be used to communicate with the etcd servers | | `storage.etcd.tls.clientCertSecretName` | The Kubernetes secret containing the necessary files to communicate with etcd using TLS | -If TLS is to be used to communicate with the etcd servers, another Kubernetes secret needs to be provided. The secret should have the following values +If TLS is to be used to communicate with the etcd servers, another Kubernetes secret needs to be provided. The secret should have the following values: | File Name | Description | | --------- | ----------- | @@ -180,7 +177,7 @@ client needs to use to communicate with an etcd server in a TLS setup. #### Enable TLS -In order to enable TLS for OCI Service Broker, the following values needs to be configured. +In order to enable TLS for OCI Service Broker, the following values needs to be configured: | values | Description | | --------- | ----------- | @@ -223,18 +220,18 @@ helm install charts/oci-service-broker/. --name oci-service-broker \ ## RBAC -If RBAC is enabled in your cluster then the following permissions are required by the user +If RBAC is enabled in your cluster then the following permissions are required by the user: ### RBAC required for OCI Service Broker During chart installation, a service account by the name 'oci-osb' is created and assigned to the OCI Service Broker pod. -OCI Service Broker also requires access to the 'nodes' API in Kubernetes in order -to discover the ClusterId of the Kubernetes cluster (ClusterId is used to tag the services created by the OCI Service Broker for auditing purposes). ClusterId is part of node labels in Oracle Container Engine for Kubernetes(OKE). Hence the required RBAC rules i.e. RBAC ClusterRole and RBAC ClusterRoleBinding are also created during chart installation. +OCI Service Broker also requires access to the Kubernete's 'nodes' API in order +to discover the ClusterId of the Kubernetes cluster. ClusterId is used to tag the services created by the OCI Service Broker for auditing purposes. ClusterId is part of node labels in Oracle Container Engine for Kubernetes(OKE). The OCI Service Broker chart creates a [ClusterRole](../templates/role.yaml) and [ClusterRoleBinding](../templates/role-binding.yaml) that allows the OCI Service Broker to read the node labels and read the ClusterId. ### RBAC Permissions for registering OCI Service Broker -Typically registering a OCI Service Broker is done by cluster-admin. The normal users then create/manage services offered by the Broker. Please ensure that the user that is registering the broker has `cluster-admin` role. +Typically, registering a OCI Service Broker is done by cluster-admin. The normal users then create/manage services offered by the Broker. Please ensure that the user that is registering the broker has `cluster-admin` role. Sample command for mapping `cluster-admin` to an user: @@ -248,7 +245,7 @@ Refer [Restrict access to Service Catalog resources using RBAC](security.md#rest ## Register OCI Service Broker -Sample files for various services are available under [`oci-service-broker/samples`](charts/oci-service-broker/samples) directory. +Sample files for various services are available under [`oci-service-broker/samples`](../samples) directory. Create a `ClusterServiceBroker` resource. diff --git a/charts/oci-service-broker/docs/object-storage.md b/charts/oci-service-broker/docs/object-storage.md index 37f4e37..7e176ea 100644 --- a/charts/oci-service-broker/docs/object-storage.md +++ b/charts/oci-service-broker/docs/object-storage.md @@ -27,7 +27,7 @@ These plans map directly to OCI Object Storage [Service Storage Tiers](https://d ## OCI User Permission requirement -The OCI user for OCI Service Broker should have permission `manage` for resoruce type `buckets` +The OCI user for OCI Service Broker should have permission `manage` for resource type `buckets` **Sample Policy:** @@ -37,7 +37,7 @@ Allow group to manage buckets in compartment ``` -#### Service Catalog and Service Broker are in different namesapces +#### Service Catalog and Service Broker are in different namespaces Kubernetes Service Catalog and OCI Service Broker are in different namespaces. For example @@ -67,19 +67,21 @@ different-ns oci-service-broker-oci-service-broker-57b76b66f7-lnvmw 2/2 ``` **Solution:** -User should ensure after OCI Service Broker is up and running using the below command. + +If the Kubernetes Service Catalog and OCI Service Broker are running in different Kubernetes namespaces then, the below modifications need to be made to the `oci-service-broker.yaml` while [registering the `oci-service-broker`](installation.md#register-oci-service-broker): ```bash -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -catalog-catalog-apiserver-5bd5cbffd7-76629 2/2 Running 11 7d -catalog-catalog-controller-manager-f7cdfcd9c-7jrp7 1/1 Running 0 7d -oci-service-broker-oci-service-broker-57b76b66f7-zd855 2/2 Running 0 1d +apiVersion: servicecatalog.k8s.io/v1beta1 +kind: ClusterServiceBroker +metadata: + name: oci-service-broker +spec: + url: http://oci-service-broker.:8080 ``` #### Missing OCI Credentials Secret -Kuberentes secret for OCI Service Broker is not created. As part of the [OCI Credentials](charts/oci-service-broker/docs/installation.md#oci-credentials) in Installation instructions. This might lead to OCI Service Broker pod in `ContainerCreating` status +Kuberentes secret for OCI Service Broker is not created. As part of the [OCI Credentials](installation.md#oci-credentials) in Installation instructions. This might lead to OCI Service Broker pod in `ContainerCreating` status ```bash kubectl get pods @@ -90,17 +92,22 @@ oci-service-broker-oci-service-broker-57b76b66f7-g269x 0/2 ContainerCreati ``` **Solution:** -Customer must ensure both the Kubernetes Service Catalog and OCI Service Broker should run in the same namespace. If in case, both cannot run in the same namespace. We need to make below modifications to the `oci-service-broker.yaml` while [registering the `oci-service-broker`](charts/oci-service-broker/docs/installation.md#register-oci-service-broker) +Ensure the [OCI Credentials Kubernetes secret](installation.md#oci-credentials) is created and passed correctly in the `helm` install command. + +Command to check the secret: ```bash -apiVersion: servicecatalog.k8s.io/v1beta1 -kind: ClusterServiceBroker -metadata: - name: oci-service-broker -spec: - url: http://oci-service-broker.:8080 +kubectl get secret ocicredentials -o yaml ``` +In the helm install command the secret should have been passed as shown below: + + ```bash + helm install charts/oci-service-broker/. --name oci-service-broker \ + --set ociCredentials.secretName=ocicredentials \ + ... + ``` + ## Common Steps to Debug ### 1. Logs of the OCI Service Broker Container @@ -116,7 +123,8 @@ kubectl logs $(kubectl get pods | grep oci-service-broker | cut -d" " -f1) -c oc ``` kubectl logs $(kubectl get pods | grep oci-service-broker | cut -d" " -f1) -c oci-service-broker | grep "Authentication failed" ``` -If we see the above "Authentication Failed" message in the logs. It indicates the user credentials in [Kubernetes secret](charts/oci-service-broker/docs/installation.md#oci-credentials) is invalid. Please verify the credentials and restart the OCI Service Broker pod. + +`Authentication Failed` message in the logs indicates that the user credentials in [Kubernetes secret](installation.md#oci-credentials) is invalid. Please verify the credentials and restart the OCI Service Broker pod. ### 2. Helm values used for creating the OCI Service Broker @@ -142,7 +150,7 @@ tls: enabled: ``` -**Note:** The above command gives only the overriden helm values. To get all the values add `-a` optiont. Example: `helm get values -a oci-service-broker` +**Note:** The above command gives only the overriden helm values. To get all the values add `-a` option. Example: `helm get values -a oci-service-broker` ### 3. Command to get status of pods diff --git a/charts/oci-service-broker/values.yaml b/charts/oci-service-broker/values.yaml index 92403eb..848e659 100644 --- a/charts/oci-service-broker/values.yaml +++ b/charts/oci-service-broker/values.yaml @@ -11,9 +11,11 @@ replicaCount: 1 # Image of the broker image: # Repository of the image - repository: iad.ocir.io/oci-cnp-dev/oci-service-broker + #repository: /oci-service-broker + # Tag of the image - tag: 1.0.0 + #tag: 1.0.0 + # The image pull policy pullPolicy: Always diff --git a/oci-service-broker/download_SDK_libs.sh b/oci-service-broker/download_SDK_libs.sh index 1f2e676..53806de 100755 --- a/oci-service-broker/download_SDK_libs.sh +++ b/oci-service-broker/download_SDK_libs.sh @@ -14,8 +14,10 @@ TEMP_DIR="/tmp/oci-java-sdk" rm -rf ${TEMP_DIR} mkdir -p ${TEMP_DIR} mkdir -p ${SCRIPT_DIR}/libs -curl -L https://github.com/oracle/oci-java-sdk/releases/download/v${SDK_VERSION}/oci-java-sdk.zip -o ${TEMP_DIR}/oci-java-sdk.zip -unzip ${TEMP_DIR}/oci-java-sdk.zip -d ${TEMP_DIR} +echo "Downloading oci-java-sdk version v${SDK_VERSION} and the dependent libraries..." +curl -sSL https://github.com/oracle/oci-java-sdk/releases/download/v${SDK_VERSION}/oci-java-sdk.zip -o ${TEMP_DIR}/oci-java-sdk.zip +unzip -qq ${TEMP_DIR}/oci-java-sdk.zip -d ${TEMP_DIR} cp ${TEMP_DIR}/lib/oci-java-sdk-full-1.3.1.jar ${SCRIPT_DIR}/libs/ cp ${TEMP_DIR}/third-party/lib/*.jar ${SCRIPT_DIR}/libs/ rm -rf ${TEMP_DIR} +echo "oci-java-sdk and the dependent libraries are downloaded to ${SCRIPT_DIR}/libs directory"