3.9 - Kubernetes Deployment

SSL certificates

Three files are necessary:

• chain-n.pem

• cert.pem

• key.pem

Domains:

• SSL for the Processmaker application domain, for example https://workflow.organization-name.net

• Rancher: https://rancher.organization-domain.net Example: {{organization}}-rancher.organization-domain.net

• STM app: https://organization-name-stm.organization-domain.net

Records on DNS

The domains need to be pointed to the Kubernetes Ingress. This Ingress load balancer will be identified once the cluster is created.

VPC requirements

Make sure frontend subnets are not assigning Public IP's by default.

AWS Resources

VPC with any main CIDR example: 10.0.0.0/16

Internet gateway attached

Create a NAT gateway

Subnets:

DMZ-A, DMZ-B

nodeGroup-A, nodeGroup-B,

Backend-A, Backend-B

Route tables

DMZ route table:

Subnets association:

DMZ-A, DMZ-B

Create a NAT Gateway:

Inside DMZ -A subnet

Attach an EIP address

Nodes-k8s Route_table:

Subnets association:

nodeGroup-A, nodeGroup-B

Backend route table:

Default config, no extra route needed.

Subnet association:

Backend-A, Backend-B

Security Groups

DMZ security group:

allow port 22 for administration from Main office administration network.

Allow port 80 from anywhere

Allow port 443 from anywhere

Node group security group:

allow port 22 from DMZ

Allow port 80 from DMZ

Backend Security Group

allow port 3306 from k8s cluster node group,

We can specify the internal IP's of the nodesGroup subnets created before.

EKS Cluster

Create an IAM role:

organization-name-eks-iam-role

Attach the next policies:

AmazonEKSClusterPolicy

AmazonEKSVPCResourceController

Create the Cluster

Set a name

Version 1.29

VPC

Subnets nodegroup-a,b

Security group DMZ

Other values by default.

Node Group

Create an IAM role:

organization-name-node-group-iam-role

First Attach the next policies:

AmazonEKSWorkerNodePolicy

AmazonEKS_CNI_Policy

AmazonEC2ContainerRegistryReadOnly

Create the node group

Set a name

Select a role: organization-name-node-group-iam-role

Create a node group for the EKS cluster with at least 3 nodes.

AMI version: AMI Linux 2 compatible with EKS version 1.29

Capacity On Demand

Instance type m5.large

Disk size 100 GB

Node group calling 3 nodes

subnets nodeGroup subnets

Enable configure remote access:

Create or select a key: organization-name-nodegroup-kp.pem

Allow the security group traffic from DMZ security Group.

Add a second EBS into the existing node group

Step 1: Based on the original lunch template create a new version with the desired changes, in this case with the second EBS disk. The size can be 500GB to start. (As mentioned before the size depends on the amount of data that will be stored in the EBS volumes.)

Append the next lines to the user data in the launch template.

This will allow to have the second disk mounted.

Step 2: Create a new lunch template based on the original but using the latest version that involves the new changes. Note: Do not use the role node option, just do not pick any role.

Step 3: Create a new node group using the new template.

Step 4: Wait for the new node group to come up and then delete the old node group one by one.

Create an RDS aurora server

Create a subnet group

Use the backend subnet

Use the backend security group

Make sure the nodegroup security group has access to the RDS server.

EC2 instances

Create two NAT servers for administration:

NAT-A, NAT-B

Security Group DMZ

Subnet DMZ

Create one ec2 server inside the nodegroup subnet:

This server should be able to connect to the EKS cluster.