Initial commit: add .gitignore and README
This commit is contained in:
defiQUG
292
INFRASTRUCTURE_DEPLOYMENT_GUIDE.md
Normal file
292
INFRASTRUCTURE_DEPLOYMENT_GUIDE.md
Normal file
@@ -0,0 +1,292 @@
|
||||
# Infrastructure Deployment Guide
|
||||
|
||||
**Date**: 2025-01-27
|
||||
**Purpose**: Complete guide for deploying shared infrastructure
|
||||
**Status**: Complete
|
||||
|
||||
---
|
||||
|
||||
## Overview
|
||||
|
||||
This guide provides step-by-step instructions for deploying all shared infrastructure components.
|
||||
|
||||
---
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes cluster access
|
||||
- kubectl configured
|
||||
- Helm installed
|
||||
- Terraform installed (for infrastructure as code)
|
||||
- Appropriate permissions
|
||||
|
||||
---
|
||||
|
||||
## Deployment Order
|
||||
|
||||
### 1. Monitoring Stack
|
||||
|
||||
#### Prometheus/Grafana
|
||||
|
||||
```bash
|
||||
cd infrastructure/monitoring/prometheus
|
||||
./install.sh
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- Grafana: `kubectl port-forward -n monitoring svc/prometheus-grafana 3000:80`
|
||||
- Prometheus: `kubectl port-forward -n monitoring svc/prometheus-kube-prom-prometheus 9090:9090`
|
||||
|
||||
#### Loki Logging
|
||||
|
||||
```bash
|
||||
cd infrastructure/monitoring/loki
|
||||
./install.sh
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- Grafana: `kubectl port-forward -n monitoring svc/loki-grafana 3000:80`
|
||||
|
||||
#### Alerting Rules
|
||||
|
||||
```bash
|
||||
kubectl apply -f infrastructure/monitoring/alerts/prometheus-rules.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. API Gateway
|
||||
|
||||
```bash
|
||||
cd infrastructure/api-gateway/kong
|
||||
./install.sh
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- Admin API: `kubectl port-forward -n api-gateway svc/kong-proxy 8001:8001`
|
||||
- Proxy: `kubectl port-forward -n api-gateway svc/kong-proxy 8000:80`
|
||||
|
||||
**Configuration**:
|
||||
- Update `kong.yaml` with your services
|
||||
- Apply: `kubectl create configmap kong-config --from-file=kong.yaml=kong.yaml -n api-gateway --dry-run=client -o yaml | kubectl apply -f -`
|
||||
|
||||
---
|
||||
|
||||
### 3. Kubernetes Shared Cluster
|
||||
|
||||
```bash
|
||||
cd infrastructure/kubernetes/shared-cluster
|
||||
./setup.sh
|
||||
```
|
||||
|
||||
**Components**:
|
||||
- Namespace isolation
|
||||
- Ingress controller
|
||||
- Network policies
|
||||
- RBAC configuration
|
||||
|
||||
---
|
||||
|
||||
### 4. Event Bus (NATS)
|
||||
|
||||
```bash
|
||||
cd infrastructure/event-bus/nats
|
||||
./install.sh
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- Monitoring: `kubectl port-forward -n event-bus svc/nats 8222:8222`
|
||||
- Then visit: http://localhost:8222
|
||||
|
||||
**Configuration**:
|
||||
- Update `nats.yaml` with your cluster configuration
|
||||
- Apply ConfigMap: `kubectl create configmap nats-config --from-file=nats.conf=nats.yaml -n event-bus --dry-run=client -o yaml | kubectl apply -f -`
|
||||
|
||||
---
|
||||
|
||||
### 5. Identity Provider (Keycloak)
|
||||
|
||||
```bash
|
||||
kubectl apply -f infrastructure/identity/keycloak/k8s-deployment.yaml
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- Keycloak: `kubectl port-forward -n identity svc/keycloak 8080:80`
|
||||
- Admin console: http://localhost:8080
|
||||
- Default credentials: admin / (from secret)
|
||||
|
||||
**Setup**:
|
||||
1. Access admin console
|
||||
2. Create realm
|
||||
3. Configure clients
|
||||
4. Set up users and roles
|
||||
|
||||
---
|
||||
|
||||
### 6. Data Storage (MinIO)
|
||||
|
||||
```bash
|
||||
kubectl apply -f infrastructure/data-storage/minio/k8s-deployment.yaml
|
||||
```
|
||||
|
||||
**Access**:
|
||||
- API: `kubectl port-forward -n data-storage svc/minio 9000:9000`
|
||||
- Console: `kubectl port-forward -n data-storage svc/minio-console 9001:9001`
|
||||
- Default credentials: minioadmin / (from secret)
|
||||
|
||||
**Setup**:
|
||||
1. Access console
|
||||
2. Create buckets
|
||||
3. Configure access policies
|
||||
4. Set up lifecycle rules
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
### Check All Services
|
||||
|
||||
```bash
|
||||
# Check namespaces
|
||||
kubectl get namespaces | grep -E "monitoring|api-gateway|event-bus|identity|data-storage"
|
||||
|
||||
# Check pods
|
||||
kubectl get pods --all-namespaces | grep -E "prometheus|grafana|loki|kong|nats|keycloak|minio"
|
||||
|
||||
# Check services
|
||||
kubectl get svc --all-namespaces | grep -E "prometheus|grafana|loki|kong|nats|keycloak|minio"
|
||||
```
|
||||
|
||||
### Test Connectivity
|
||||
|
||||
```bash
|
||||
# Test Prometheus
|
||||
curl http://localhost:9090/-/healthy
|
||||
|
||||
# Test Grafana
|
||||
curl http://localhost:3000/api/health
|
||||
|
||||
# Test Kong
|
||||
curl http://localhost:8001/
|
||||
|
||||
# Test NATS
|
||||
curl http://localhost:8222/varz
|
||||
|
||||
# Test Keycloak
|
||||
curl http://localhost:8080/health
|
||||
|
||||
# Test MinIO
|
||||
curl http://localhost:9000/minio/health/live
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Configuration
|
||||
|
||||
### Environment Variables
|
||||
|
||||
Set these in your deployment:
|
||||
|
||||
```bash
|
||||
# Keycloak
|
||||
export KEYCLOAK_ADMIN_PASSWORD="your-password"
|
||||
|
||||
# MinIO
|
||||
export MINIO_ROOT_USER="your-user"
|
||||
export MINIO_ROOT_PASSWORD="your-password"
|
||||
|
||||
# NATS
|
||||
export NATS_API_PASSWORD="your-password"
|
||||
export NATS_SERVICE_PASSWORD="your-password"
|
||||
```
|
||||
|
||||
### Secrets Management
|
||||
|
||||
Update secrets before deployment:
|
||||
|
||||
```bash
|
||||
# Keycloak admin secret
|
||||
kubectl create secret generic keycloak-admin-secret \
|
||||
--from-literal=password=your-password \
|
||||
-n identity \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
# MinIO secret
|
||||
kubectl create secret generic minio-secret \
|
||||
--from-literal=MINIO_ROOT_USER=your-user \
|
||||
--from-literal=MINIO_ROOT_PASSWORD=your-password \
|
||||
-n data-storage \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Pods Not Starting
|
||||
|
||||
**Check**:
|
||||
- Resource quotas
|
||||
- Storage classes
|
||||
- Image pull secrets
|
||||
- Service account permissions
|
||||
|
||||
### Services Not Accessible
|
||||
|
||||
**Check**:
|
||||
- Service endpoints
|
||||
- Network policies
|
||||
- Ingress configuration
|
||||
- Firewall rules
|
||||
|
||||
### Configuration Issues
|
||||
|
||||
**Check**:
|
||||
- ConfigMaps
|
||||
- Secrets
|
||||
- Environment variables
|
||||
- Volume mounts
|
||||
|
||||
---
|
||||
|
||||
## Best Practices
|
||||
|
||||
### Security
|
||||
- Change all default passwords
|
||||
- Use secrets management
|
||||
- Enable TLS/SSL
|
||||
- Configure network policies
|
||||
- Set up RBAC
|
||||
|
||||
### Monitoring
|
||||
- Set up alerts
|
||||
- Configure dashboards
|
||||
- Monitor resource usage
|
||||
- Track performance metrics
|
||||
|
||||
### Backup
|
||||
- Backup configurations
|
||||
- Backup data volumes
|
||||
- Test restore procedures
|
||||
- Document backup schedule
|
||||
|
||||
---
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Updates
|
||||
- Regular security updates
|
||||
- Monitor for new versions
|
||||
- Test in dev/staging first
|
||||
- Document changes
|
||||
|
||||
### Scaling
|
||||
- Monitor resource usage
|
||||
- Adjust replicas as needed
|
||||
- Scale storage as needed
|
||||
- Optimize configurations
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-01-27
|
||||
|
||||
Reference in New Issue
Block a user