Skip to content

Commit 0fced13

Browse files
vhristev-1vhristev-1
committed
Keep the kubectl command along with rdi-secret.sh script
1 parent b229945 commit 0fced13

File tree

1 file changed

+119
-10
lines changed
  • content/integrate/redis-data-integration/data-pipelines

1 file changed

+119
-10
lines changed

‎content/integrate/redis-data-integration/data-pipelines/deploy.md

Lines changed: 119 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -61,16 +61,16 @@ following command line to set the source database username to `myUserName`:
6161
redis-di set-secret SOURCE_DB_USERNAME myUserName
6262
```
6363

64-
### Set secrets for K8s/Helm deployment
65-
66-
Use the provided `scripts/rdi-secret.sh` shell script to set the specified secrets. The general pattern to use it is:
64+
### Set secrets for K8s/Helm deployment using provided rdi-secret.sh script
65+
66+
To use the `rdi-secret.sh` script, begin by extracting the archive that contains the Helm chart. Once extracted, navigate to the resulting directory and verify that a `scripts` folder is present. Ensure that the `rdi-secret.sh` script is located inside the scripts folder before proceeding. The general pattern to use it is:
6767
```bash
6868
scripts/rdi-secret.sh set <SECRET-KEY> <SECRET-VALUE>
6969
```
7070

7171
The script lets you retrieve a specific secret or list all the secrets that have been set:
7272
```bash
73-
# Set specific secret
73+
# Get specific secret
7474
scripts/rdi-secret.sh set <SECRET-KEY>
7575

7676
# List all secrets
@@ -123,14 +123,14 @@ scripts/rdi-secret.sh get SOURCE_DB_KEY_PASSWORD
123123
The corresponding command lines for target secrets are:
124124

125125
```bash
126-
# Without target TLS
126+
# Without source TLS
127127
scripts/rdi-secret.sh set TARGET_DB_USERNAME yourUsername
128128
scripts/rdi-secret.sh set TARGET_DB_PASSWORD yourPassword
129129
# Verify that the secrets are created/updated
130130
scripts/rdi-secret.sh get TARGET_DB_USERNAME
131131
scripts/rdi-secret.sh get TARGET_DB_PASSWORD
132132

133-
# With target TLS
133+
# With source TLS
134134
scripts/rdi-secret.sh set TARGET_DB_USERNAME yourUsername
135135
scripts/rdi-secret.sh set TARGET_DB_PASSWORD yourPassword
136136
scripts/rdi-secret.sh set TARGET_DB_CACERT /path/to/myca.crt
@@ -139,7 +139,7 @@ scripts/rdi-secret.sh get TARGET_DB_USERNAME
139139
scripts/rdi-secret.sh get TARGET_DB_PASSWORD
140140
scripts/rdi-secret.sh get TARGET_DB_CACERT
141141

142-
# With target mTLS
142+
# With source mTLS
143143
scripts/rdi-secret.sh set TARGET_DB_USERNAME yourUsername
144144
scripts/rdi-secret.sh set TARGET_DB_PASSWORD yourPassword
145145
scripts/rdi-secret.sh set TARGET_DB_CACERT /path/to/myca.crt
@@ -155,6 +155,117 @@ scripts/rdi-secret.sh get TARGET_DB_KEY
155155
scripts/rdi-secret.sh get TARGET_DB_KEY_PASSWORD
156156
```
157157

158+
### Set secrets for K8s/Helm deployment using Kubectl command
159+
160+
In some scenarios, you may prefer to use [`kubectl create secret generic`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_create/kubectl_create_secret_generic/)
161+
to set secrets for a K8s/Helm deployment. The general pattern of the commands is:
162+
163+
```bash
164+
kubectl create secret generic <DB> \
165+
--namespace=rdi \
166+
--from-literal=<SECRET-NAME>=<SECRET-VALUE>
167+
```
168+
169+
Where `<DB>` is either `source-db` for source secrets or `target-db` for target secrets.
170+
171+
If you use TLS or mTLS for either the source or target databases, you also need to create the `source-db-ssl` and/or `target-db-ssl` K8s secrets that contain the certificates used to establish secure connections. The general pattern of the commands is:
172+
173+
```bash
174+
kubectl create secret generic <DB>-ssl \
175+
--namespace=rdi \
176+
--from-file=<FILE-NAME>=<FILE-PATH>
177+
```
178+
179+
When you create these secrets, ensure that all certificates and keys are in `PEM` format. The only exception to this is that for PostgreSQL, the private key in the `source-db-ssl` secret (the `client.key` file) must be in `DER` format. If you have a key in `PEM` format, you must convert it to `DER` before creating the `source-db-ssl` secret using the command:
180+
181+
```bash
182+
openssl pkcs8 -topk8 -inform PEM -outform DER -in /path/to/myclient.key -out /path/to/myclient.pk8 -nocrypt
183+
```
184+
185+
This command assumes that the private key is not encrypted. See the [`openssl` documentation](https://docs.openssl.org/master/) to learn how to convert an encrypted private key.
186+
187+
The specific command lines for source secrets are as follows:
188+
189+
```bash
190+
# Without source TLS
191+
# Create or update source-db secret
192+
kubectl create secret generic source-db --namespace=rdi \
193+
--from-literal=SOURCE_DB_USERNAME=yourUsername \
194+
--from-literal=SOURCE_DB_PASSWORD=yourPassword \
195+
--save-config --dry-run=client -o yaml | kubectl apply -f -
196+
197+
# With source TLS
198+
# Create of update source-db secret
199+
kubectl create secret generic source-db --namespace=rdi \
200+
--from-literal=SOURCE_DB_USERNAME=yourUsername \
201+
--from-literal=SOURCE_DB_PASSWORD=yourPassword \
202+
--from-literal=SOURCE_DB_CACERT=/etc/certificates/source_db/ca.crt \
203+
--save-config --dry-run=client -o yaml | kubectl apply -f -
204+
# Create or update source-db-ssl secret
205+
kubectl create secret generic source-db-ssl --namespace=rdi \
206+
--from-file=ca.crt=/path/to/myca.crt \
207+
--save-config --dry-run=client -o yaml | kubectl apply -f -
208+
209+
# With source mTLS
210+
# Create or update source-db secret
211+
kubectl create secret generic source-db --namespace=rdi \
212+
--from-literal=SOURCE_DB_USERNAME=yourUsername \
213+
--from-literal=SOURCE_DB_PASSWORD=yourPassword \
214+
--from-literal=SOURCE_DB_CACERT=/etc/certificates/source_db/ca.crt \
215+
--from-literal=SOURCE_DB_CERT=/etc/certificates/source_db/client.crt \
216+
--from-literal=SOURCE_DB_KEY=/etc/certificates/source_db/client.key \
217+
--from-literal=SOURCE_DB_KEY_PASSWORD=yourKeyPassword \ # add this only if SOURCE_DB_KEY is password-protected
218+
--save-config --dry-run=client -o yaml | kubectl apply -f -
219+
# Create or update source-db-ssl secret
220+
kubectl create secret generic source-db-ssl --namespace=rdi \
221+
--from-file=ca.crt=/path/to/myca.crt \
222+
--from-file=client.crt=/path/to/myclient.crt \
223+
--from-file=client.key=/path/to/myclient.key \
224+
--save-config --dry-run=client -o yaml | kubectl apply -f -
225+
```
226+
227+
The corresponding command lines for target secrets are:
228+
229+
```bash
230+
# Without target TLS
231+
# Create or update target-db secret
232+
kubectl create secret generic target-db --namespace=rdi \
233+
--from-literal=TARGET_DB_USERNAME=yourUsername \
234+
--from-literal=TARGET_DB_PASSWORD=yourPassword \
235+
--save-config --dry-run=client -o yaml | kubectl apply -f -
236+
237+
# With target TLS
238+
# Create of update target-db secret
239+
kubectl create secret generic target-db --namespace=rdi \
240+
--from-literal=TARGET_DB_USERNAME=yourUsername \
241+
--from-literal=TARGET_DB_PASSWORD=yourPassword \
242+
--from-literal=TARGET_DB_CACERT=/etc/certificates/target_db/ca.crt \
243+
--save-config --dry-run=client -o yaml | kubectl apply -f -
244+
# Create or update target-db-ssl secret
245+
kubectl create secret generic target-db-ssl --namespace=rdi \
246+
--from-file=ca.crt=/path/to/myca.crt \
247+
--save-config --dry-run=client -o yaml | kubectl apply -f -
248+
249+
# With target mTLS
250+
# Create or update target-db secret
251+
kubectl create secret generic target-db --namespace=rdi \
252+
--from-literal=TARGET_DB_USERNAME=yourUsername \
253+
--from-literal=TARGET_DB_PASSWORD=yourPassword \
254+
--from-literal=TARGET_DB_CACERT=/etc/certificates/target_db/ca.crt \
255+
--from-literal=TARGET_DB_CERT=/etc/certificates/target_db/client.crt \
256+
--from-literal=TARGET_DB_KEY=/etc/certificates/target_db/client.key \
257+
--from-literal=TARGET_DB_KEY_PASSWORD=yourKeyPassword \ # add this only if TARGET_DB_KEY is password-protected
258+
--save-config --dry-run=client -o yaml | kubectl apply -f -
259+
# Create or update target-db-ssl secret
260+
kubectl create secret generic target-db-ssl --namespace=rdi \
261+
--from-file=ca.crt=/path/to/myca.crt \
262+
--from-file=client.crt=/path/to/myclient.crt \
263+
--from-file=client.key=/path/to/myclient.key \
264+
--save-config --dry-run=client -o yaml | kubectl apply -f -
265+
```
266+
267+
Note that the certificate paths contained in the secrets `SOURCE_DB_CACERT`, `SOURCE_DB_CERT`, and `SOURCE_DB_KEY` (for the source database) and `TARGET_DB_CACERT`, `TARGET_DB_CERT`, and `TARGET_DB_KEY` (for the target database) are internal to RDI, so you *must* use the values shown in the example above. You should only change the certificate paths when you create the `source-db-ssl` and `target-db-ssl` secrets.
268+
158269
## Deploy a pipeline
159270

160271
When you have created your configuration, including the [jobs]({{< relref "/integrate/redis-data-integration/data-pipelines/data-pipelines#job-files" >}}), they are
@@ -167,6 +278,4 @@ command to deploy a pipeline:
167278

168279
```bash
169280
redis-di deploy --dir <path to pipeline folder>
170-
```
171-
172-
281+
```

0 commit comments

Comments
 (0)