Install on IBM Cloud

GitGuardian has been tested on IBM Cloud Kubernetes Service (IKS) on VPC infrastructure, with IBM Cloud Databases for PostgreSQL, IBM Cloud Databases for Redis and IBM Cloud Object Storage for ClickHouse. For Red Hat OpenShift on IBM Cloud, also follow the OpenShift page.

Several points specific to IBM Cloud apply on top of the regular Helm installation.

Kubernetes version

Create the cluster on a supported Kubernetes version. IBM Cloud proposes its most recent version by default, which may be newer than what GitGuardian supports.

Cluster access

Cluster-wide permissions, needed to create the GitGuardian namespace, come with the cluster admin configuration:

ibmcloud ks cluster config --cluster <cluster-name> --admin

Outbound traffic

IBM Cloud blocks all outbound traffic from the worker nodes of VPC clusters by default (outbound traffic protection). Container images and the external services GitGuardian reaches are unreachable until you choose one of the following:

• Disable the protection:

  ibmcloud ks vpc outbound-traffic-protection disable --cluster <cluster-name>

• Keep it and add outbound rules to the kube-<cluster-id> security group for the required destinations. IBM Cloud removes these rules when you run ibmcloud ks security-group reset.

• Keep it and mirror the GitGuardian images into IBM Cloud Container Registry, which is reachable from the cluster over the private network. See Air-gapped installation for the private registry configuration.

IBM Cloud managed databases and object storage are reached over the private network in all cases.

Storage

The default ibmc-vpc-block-10iops-tier storage class is SSD-backed and provides ReadWriteOnce volumes, which suits every volume GitGuardian creates, including the ClickHouse volumes. Do not use IBM Cloud File Storage for ClickHouse.

Ingress and TLS

A Kubernetes Service of type LoadBalancer creates an IBM Cloud VPC load balancer. Install an ingress controller such as ingress-nginx, then register the load balancer hostname with IBM Cloud to obtain a public hostname and a TLS certificate:

ibmcloud ks nlb-dns create vpc-gen2 --cluster <cluster-name> --lb-host <load-balancer-hostname>

IBM Cloud creates a <cluster-name>-<hash>-0001.<region>.containers.appdomain.cloud hostname and stores its certificate in a Secret of the default namespace. Copy that Secret into the GitGuardian namespace and reference it as ingress.tls.existingSecret, or use your own domain and certificate. See Ingress.

Managed services

• PostgreSQL: IBM Cloud Databases for PostgreSQL
• Redis: IBM Cloud Databases for Redis
• ClickHouse object storage: IBM Cloud Object Storage and its backup destination