Install on an Embedded cluster (legacy)

caution

You are now on a GitGuardian legacy architecture page.

We recommend installing the latest GitGuardian architecture. Please refer to Install on an Embedded cluster for guidance.

For information on the new architecture, as well as determining whether you are using the new or the legacy GitGuardian architecture, explore the New GitGuardian Architecture page.

Introduction

GitGuardian can be installed with an embedded Kubernetes distribution packaged with it and supports deployment on bare metal, private, or public clouds.

This installation uses KOTS, a kubectl plugin and KOTS Admin Console to help manage Kubernetes Off-The-Shelf software.

Requirements

Before starting the installation, ensure to review the system and network requirements, and download your license.

Installation

Embedded cluster

To start the installation, run the following command on your host. This command will run for 10-20 minutes, putting in a screen or a tmux session can prevent an interruption due to a loss of connection.

curl -sSL https://kurl.sh/gitguardian-seal-prod | sudo bash

This will install a single node-managed Kubernetes cluster with everything it needs to run the GitGuardian application.

Once the installation is completed, instructions will appear on how to access the KOTS Admin Console. Use provided IP address on port 8800.

Save this information, especially passwords, they will be useful later.

danger

The second raw storage is required for the KOTS-based installation. Do not install any filesystem on this block device or mount any partition, or you may run into this error:

[FAIL] Block Devices: No available block devices during install

In that case, you must wipe completely that second device, using wipefs or related commands.

For the root storage, these are the core directories requirements from the kURL documentation.

Application

With the embedded Kubernetes cluster now set up, let's move on to installing the GitGuardian application.

1. Access the KOTS Admin Console at https://<ip_address>:8800 and configure TLS. You have the option to upload your TLS certificates or use self-signed ones.

2. Enter the password provided at the end of the cluster installation.

3. Upload the license downloaded on the portal. Refer to the download your license page.

4. Configure the application by completing all the required fields:

   • Application Hostname: Enter the Fully Qualified Domain Name (FQDN) for the GitGuardian application.
   • Admin User Fields: These fields are used to create the first GitGuardian user. You'll need to change the password upon the first login.

   

   Additional configuration options include:

   • Scaling (Advanced): Adjust the number of replicas for each application component. For more details, visit the Scaling page.
   • Prometheus: Activate an exporter for Prometheus.
   • Nginx TLS Certificate: This is for the GitGuardian Application. You can either use auto-generated self-signed certificates or upload your own. These certificates are distinct from the TLS certificates used for the KOTS Admin Console in step 1. For self-signed or private CA certificates, disable SSL verification for the GitHub webhook. Learn more on the Configure TLS certificates page.
   • Custom Certificate Authority: Provide a custom CA if necessary.
   • HTTP(s) Proxy: Refer to the proxy section if needed.
   • Databases/Datastores: Choose between using embedded PostgreSQL/Redis or an external one. For more information, see Configure your database.

5. Check if preflight checks pass.

6. Launch

The first installation of the GitGuardian application requires a few minutes to create all database objects. Once the process is completed, you will be able to log in to the dashboard using the administrator user you defined.

7. Save the Data Encryption Key

caution

GitGuardian encrypts all sensitive information in the database using an encryption key (aka Django Secret Key). In case of disaster recovery, this key will be needed to restore your data.

You should save it and keep it in a secure location. Use the following command to display the key:

kubectl get secrets gitguardian-env-variables  -o jsonpath='{.data.DJANGO_SECRET_KEY}' | base64 -d

Network and storage configuration

Configuring proxy settings

If a proxy is required for outgoing access to the internet, please create a patch.yaml:

apiVersion: "cluster.kurl.sh/v1beta1"
kind: "Installer"
metadata:
  name: "patch"
spec:
  kurl:
    proxyAddress: http://<IP>:<PORT>
    noProxy: false

And run the installer with -installer-spec-file=patch.yaml:

curl -sSL https://kurl.sh/gitguardian-seal-prod | sudo bash -s installer-spec-file=patch.yaml

Managing disk space

The kURL installer will look for the existence of the /var directory as well as all the core directories mentioned in this documentation.

The root disk should not be partitioned. You can read more about the disk space requirements in the kURL documentation.

Note that if your disk is not a SCSI device, you will need to patch the install script following these guidelines:

1. Create a YAML file and add the following parameters (this is an example for a nvme device):

kind: Installer
metadata:
  name: patch
spec:
  rook:
    blockDeviceFilter: nvme1n[0-1]

2. Run the install script with that patch:

curl -sSL https://kurl.sh/gitguardian-seal-prod | sudo bash -s installer-spec-file=[path of the above YAML patch file]

Was this page helpful?