Helm Chart Installation
## **Helm Chart for Kubernetes**
{% hint style="danger" %}
This cloud or local installation method is considered an **advanced install option**.
{% endhint %}
You can **install** MOTAR in a high availability fashion and optionally configure MOTAR components for **advanced deployments**. (Production, multi-node Kubernetes cluster deployments.)
This Helm chart installs MOTAR with all of its dependencies in a Kubernetes cluster. Our Helm chart also employs non-MOTAR supporting charts, such as:
* A custom Minio chart branched from the Minio public chart.
* The Bitnami PostgreSQL chart.
* The ingress-nginx kubernetes chart.
* The nats public chart.
### Prerequisites
* [ ] Kubernetes 1.23+
* [ ] Helm 3.8.0+
* [ ] PV provisioner support in the underlying infrastructure
* [ ] ReadWriteMany volumes for deployment scaling
The MOTAR Helm chart supports deployments in Kubernetes clusters hosted in nearly any cloud provider, local server, and self-hosted cloud. As such many of the values are left to be filled in by the installing individual.
The default **values.yaml** should provide information sufficient to help you prepare the installation for your circumstance, if you find anything confusing or not intuitive please reach out [contact-us](https://docs.motar.com/support/contact-us "mention").
Below we will provide some general **recommended values**, and then some recommended values based on deployment type.
You will be providing the values to the deployment which overrides the default where the values are set.
{% hint style="info" %}
If MOTAR is already installed, proceed to Section X to upgrade MOTAR with Helm.
{% endhint %}
{% hint style="warning" %}
If using the Dynepic provided helm chart and images, you will need to authenticate with the Dynepic registry to pull the Helm chart and provide a Secret in the cluster which contains the dockerconfigjson to pull the images. See the section for **imagePullSecret** below.
{% endhint %}
### Step 1 - Configuration
* **Create** a values file values.yaml in a known directory
* Replace: your\_directory with your details
```sh
touch /your_directory/your_value.yaml
```
* **Add** Installation Values to values.yaml
```sh
nano /your_directory/your_value.yaml
```
* **Add** the following values to your values.yaml. Update and change any values that contain ‘you’ or ‘your’.
* Then, **save** the file with CTRL-X (if using nano).
Sample **values.yaml** (Single Node Using Nodeport)
{% code overflow="wrap" %}
```yaml
global:
motarImageRegistry: harbor.dynepic.net
domainName: your_domain.com
initialAdminEmail: you@email.com
environment: development
mailConfig:
reportTargets:
- you@email.com
securityTargets:
- you@email.com
s3Config:
source: minio
url: api-minio.your_domain.com
motar:
ingress:
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using certmanager clusterIssuer
nginx.ingress.kubernetes.io/cors-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,clientid
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
tls:
enabled: true
tlsSecret: "webapps-cert" # Substitute with your tlsSecret
serviceAccount:
create: true
name: motar
minio:
ingress:
enabled: true
className: nginx
hostname: api-minio.your_domain.com
annotations:
apiVersion: networking.k8s.io/v1
className: nginx
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
nginx.ingress.kubernetes.io/proxy-body-size: "0"
tls:
enabled: true
tlsSecret: "api-minio-cert" # Substitute with your tlsSecret
consoleIngress:
enabled: true
className: "nginx"
annotations:
apiVersion: networking.k8s.io/v1
className: nginx
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
nginx.ingress.kubernetes.io/proxy-body-size: "0"
hosts:
- console-minio.your_domain.com
tls:
enabled: true
tlsSecret: "console-minio-cert" # Substitute with your tlsSecret
storageClass:
enabled: true
provisioner: driver.longhorn.io
parameters:
fsType: ext4
numberOfReplicas: "1"
staleReplicaTimeout: "30"
ingress-nginx:
enabled: true
controller:
service:
type: "NodePort"
nodePorts:
http: 31080
https: 31443
minio:
auth:
existingSecret: "motar-s3-auth"
rootUserSecretKey: "rootUser"
rootPasswordSecretKey: "rootPassword"
postgresql:
sslDisabled: true
auth:
existingSecret: "motar-pg-auth"
secretKeys:
adminPasswordKey: "postgres-password"
motarPasswordKey: "motar-password"
```
{% endcode %}
Sample **values.yaml** (AWS EKS)
global:
motarImageRegistry: harbor.dynepic.net
domainName: your_domain.com
initialAdminEmail: you@email.com
environment: development
mailConfig:
reportTargets:
- you@email.com
securityTargets:
- you@email.com
s3Config:
source: minio
url: api-minio.your_domain.com
motar:
ingress:
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using certmanager clusterIssuer
nginx.ingress.kubernetes.io/cors-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,clientid
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
tls:
enabled: true
tlsSecret: "webapps-cert" # Substitute with your tlsSecret
serviceAccount:
create: true
name: motar
minio:
ingress:
enabled: true
className: nginx
hostname: api-minio.your_domain.com
annotations:
apiVersion: networking.k8s.io/v1
className: nginx
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
nginx.ingress.kubernetes.io/proxy-body-size: "0"
tls:
enabled: true
tlsSecret: "api-minio-cert" # Substitute with your tlsSecret
consoleIngress:
enabled: true
className: "nginx"
annotations:
apiVersion: networking.k8s.io/v1
className: nginx
cert-manager.io/cluster-issuer: letsencrypt-cluster-issuer # If using CertManager/ClusterIssuer
nginx.ingress.kubernetes.io/proxy-body-size: "0"
hosts:
- console-minio.your_domain.com
tls:
enabled: true
tlsSecret: "console-minio-cert" # Substitute with your tlsSecret
storageClass:
enabled: true
provisioner: kubernetes.io/aws-ebs
parameters:
fsType: ext4
type: gp3
ingress-nginx:
enabled: true
controller:
config:
use-proxy-protocol: false
service:
type: LoadBalancer
external:
enabled: false
internal:
externalTrafficPolicy: Local
enabled: true
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: false
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: true
service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
minio:
auth:
existingSecret: "motar-s3-auth"
rootUserSecretKey: "rootUser"
rootPasswordSecretKey: "rootPassword"
postgresql:
sslDisabled: true
auth:
existingSecret: "motar-pg-auth"
secretKeys:
adminPasswordKey: "postgres-password"
motarPasswordKey: "motar-password"
### Step 2 - Prepare the namespace
* Create the namespace
```sh
kubectl create ns motar
```
* **Apply** the secrets for the s3 storage solution and postgres solution you intend to use
* *This can be **external s3** using your own solution or utilizing our **internal minio chart** either case requires secrets applied for the rootUser and rootPassword*
* You can apply directly from a created **yaml** file like so:
```sh
kubectl apply -f mysecrets.yaml -n motar`
```
Example YAML:
```yaml
apiVersion: v1
data:
rootPassword: base64enc_value
rootUser: base64enc_value
kind: Secret
metadata:
labels:
app.kubernetes.io/part-of: motar
name: motar-s3-auth
type: Opaque
```
Example Literals:
{% code overflow="wrap" %}
```sh
kubectl -n motar create secret generic --from-literal=motar-password=supersecret --from-literal=postgres-password=topsecret motar-pg-auth
kubectl -n motar create secret generic --from-literal=rootUser=minioUser --from-literal=rootPassword=topsecretPassword motar-s3-auth
```
{% endcode %}
{% hint style="info" %}
If you would like to apply a **tls certificate** for use on your ingress, this is the point you should do so as well if note using **CertManager**)
{% endhint %}
### Step 3 - Deploy the Chart
* Assuming you have created the value file as appropriate from above or for your specific use case the following list of commands should be sufficient to get you from start to finish.
{% code overflow="wrap" %}
```sh
kubectl create ns motar
helm install motar --version 3.1.0 oci://harbor.dynepic.net/helmrelease/motar -f your_values.yaml -n motar
```
{% endcode %}
### Step 4 - Access the Site
* At this step, if you correctly **configured** your networking to allow DNS routing to the hosting device , everything is up and running you should be able to access the [https://admin.motarghost.com.](https://admin.motarghost.com)
You have completed HELM setup and may continue to Step [#id-3-access-your-motar-instance](https://docs.motar.com/commercial-use-installation-and-setup-tutorial#id-3-access-your-motar-instance "mention")
## NodePort
{% hint style="warning" %}
If using a NodePort configuration for your ingress controller you will need to ensure you have the networking appropriately set such that traffic goes to the correct port within your deployed environment. Here is a sample way of setting this all up using an nginx-reverse proxy.
{% endhint %}
* **Install** the required services.
```bash
bash
sudo apt update
sudo apt install nginx
sudo apt install libnginx-mod-stream
sudo vim /etc/nginx/nginx.conf
```
* **Include** the proxy passthrough.
* Append outside the http block \`include /etc/nginx/passthrough.conf;\` It should look something like this:
```bash
http {
# default configuration
}
include /etc/nginx/passthrough.conf;
```
* **Declare** the proxy passthrough.
* Now we need to create the /etc/nginx/passthrough.conf and we need to ensure the ports match the NodePort used in the value file. It will look something like:
```bash
stream {
server {
listen 80;
proxy_pass 127.0.0.1:31080;
}
server {
listen 443;
proxy_pass 127.0.0.1:31443;
}
}
```
* **Forward** http to https with reverse proxy
{% hint style="info" %}
If you would like to ensure all http traffic to your domain name is transferred to https you will further which to do the following.
{% endhint %}
* Add the appropriate 301 to the sites-available.
````bash
`sudo vim /etc/nginx/sites-available/your.domain`
```
server {
if ($host ~ ^[^.]+\.your\.domain$) {
return 301 https://$host$request_uri;
}
listen 80;
}
```
````
* Remove the default nginx site.
```bash
sudo rm /etc/nginx/sites-enab...
```
### **Troubleshooting FAQ (As Needed)**
* If you are getting ‘bad address at line \[any number] of /etc/dnsmasq.conf’ this could be from not having set a HOST\_IP in the .env file. Please open your .env and add in your HOST\_IP.
{% code title="Example Error:" %}
```sh
dnsmasq | dnsmasq: bad address at line 680 of /etc/dnsmasq.conf
```
{% endcode %}