Skip to content

Commit e83a1d7

Browse files
enekofbenekofb
committed
added extended capabilities
Signed-off-by: Eneko Fernandez <[email protected]>
1 parent 70cfb74 commit e83a1d7

File tree

1 file changed

+171
-174
lines changed

1 file changed

+171
-174
lines changed

‎website/docs/enterprise/getting-started/install-enterprise-onboard-platform-engineers.mdx‎

Lines changed: 171 additions & 174 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,9 @@ resources will be created.
328328
</TabItem>
329329
</Tabs>
330330

331+
332+
333+
331334
## Access the dashboard
332335

333336
During [getting started](../install-enterprise-getting-started/) you have accessed the dashboard via its non-TLS ClusterIP service
@@ -374,8 +377,176 @@ Other ingress configuration changes can be made via the ingress configuration
374377
... other parameters specific to the ingress type ...
375378
```
376379

380+
## Expand WGE Capabilities
381+
382+
During [getting started](../install-enterprise-getting-started/) you have installed Flux and WGE which allows you to deploy and
383+
view Flux Applications. Expand your environment capabilities by following the section below.
384+
385+
### Enable Write Access to Git
386+
387+
Weave GitOps Enterprise creates pull requests for adding resources. To do this, it needs to be able to write to the Git repository.
388+
Here we provide guidance for GitHub, GitLab, BitBucket Server, and Azure DevOps.
389+
390+
<Tabs groupId="git-provider" default>
391+
<TabItem value="github" label="GitHub">
392+
GitHub requires no additional configuration for OAuth git access
393+
</TabItem>
394+
<TabItem value="gitlab" label="GitLab">
395+
396+
Create a GitLab OAuth application that will request `api` permissions to create pull requests on your behalf.
397+
398+
Follow the [GitLab docs](https://docs.gitlab.com/ee/integration/oauth_provider.html).
399+
400+
The application should have at least these scopes:
401+
402+
- `api`
403+
- `openid`
404+
- `email`
405+
- `profile`
406+
407+
Add callback URLs to the application for each address the UI will be exposed on, e.g.:
408+
409+
- `https://localhost:8000/oauth/gitlab` for port-forwarding and testing
410+
- `https://git.example.com/oauth/gitlab` for production use
411+
412+
Save your application, taking note of the **Client ID** and **Client Secret**. Save
413+
them into the `git-provider-credentials` secret, along with:
414+
415+
- `GIT_HOST_TYPES` to tell WGE that the host is gitlab
416+
- `GITLAB_HOSTNAME` where the OAuth app is hosted
417+
418+
**Replace values** in this snippet and run:
419+
420+
```bash
421+
kubectl create secret generic git-provider-credentials --namespace=flux-system \
422+
--from-literal="GITLAB_CLIENT_ID=13457" \
423+
--from-literal="GITLAB_CLIENT_SECRET=24680" \
424+
--from-literal="GITLAB_HOSTNAME=git.example.com" \
425+
--from-literal="GIT_HOST_TYPES=git.example.com=gitlab"
426+
```
427+
428+
</TabItem>
429+
<TabItem value="bitbucket-server" label="BitBucket Server">
430+
431+
Create a new [incoming application link](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html) from
432+
the BitBucket administration dashboard. You will be asked to enter a unique name and the redirect URL for the external application. The redirect URL
433+
should be set to `$WGE_DASHBOARD_URL/oauth/bitbucketserver`. You will also need to select permissions for the application. The minimum set of
434+
permissions needed for WGE to create pull requests on behalf of users is `Repositories - Write`. An example of configuring these settings is shown below.
435+
436+
<figure>
437+
438+
<img src={oauthBitbucket} width="500"/>
439+
440+
<figcaption>Configuring a new incoming application link</figcaption>
441+
</figure>
442+
443+
444+
Save your application and take note of the **Client ID** and **Client Secret**. Save
445+
them into the `git-provider-credentials` secret, along with:
446+
447+
- `GIT_HOST_TYPES` to tell WGE that the host is bitbucket-server
448+
- `BITBUCKET_SERVER_HOSTNAME` where the OAuth app is hosted
449+
450+
**Replace values** in this snippet and run:
451+
452+
```bash
453+
kubectl create secret generic git-provider-credentials --namespace=flux-system \
454+
--from-literal="BITBUCKET_SERVER_CLIENT_ID=13457" \
455+
--from-literal="BITBUCKET_SERVER_CLIENT_SECRET=24680" \
456+
--from-literal="BITBUCKET_SERVER_HOSTNAME=git.example.com" \
457+
--from-literal="GIT_HOST_TYPES=git.example.com=bitbucket-server"
458+
```
459+
460+
If the secret is already present, use the following command to update it using your default editor:
461+
462+
```bash
463+
kubectl edit secret generic git-provider-credentials --namespace=flux-system
464+
```
465+
466+
:::info
467+
468+
If BitBucket Server is running on the default port (7990), make sure you include the port number in the values of the secret. For example: `GIT_HOST_TYPES=git.example.com:7990=bitbucket-server`
469+
470+
:::
471+
472+
</TabItem>
473+
474+
<TabItem value="azure-devops" label="Azure DevOps">
475+
476+
Navigate to [VisualStudio](https://app.vsaex.visualstudio.com/app/register) and register a new application, as explained in the [docs](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#1-register-your-app). Set the authorization callback URL and select which scopes to grant. Set the callback URL to `$WGE_DASHBOARD_URL/oauth/azuredevops`.
477+
478+
Select the `Code (read and write)` scope from the list. This is necessary so that WGE can create pull requests on behalf of users. An example of configuring these settings is shown below.
479+
480+
<figure>
481+
<img src={oauthAzureDevOps}/>
482+
<figcaption>Creating a new application</figcaption>
483+
</figure>
484+
485+
After creating your application, you will be presented with the application settings. Take note of the `App ID` and `Client Secret` values—you will use them to configure WGE.
377486

487+
<figure>
488+
<img src={oauthAzureDevOpsSuccess}/>
489+
<figcaption>Application settings</figcaption>
490+
</figure>
378491

492+
In your cluster, create a secret named `git-provider-credentials` that contains the `App ID` and `Client Secret` values from the newly created application.
493+
494+
**Replace values** in this snippet and run:
495+
496+
```bash
497+
kubectl create secret generic git-provider-credentials --namespace=flux-system \
498+
--from-literal="AZURE_DEVOPS_CLIENT_ID='App ID value'" \
499+
--from-literal="AZURE_DEVOPS_CLIENT_SECRET='Client Secret value'"
500+
```
501+
502+
WGE is now configured to ask users for authorization the next time a pull request must be created as part of using a template.
503+
Note that each user can view and manage which applications they have authorized by navigating to https://app.vsaex.visualstudio.com/me.
504+
505+
</TabItem>
506+
</Tabs>
507+
508+
### Enable Cluster Management via Cluster API
509+
510+
TBA
511+
512+
### Enable Policy via Weave Policy
513+
514+
To install [Policy Agent](../../policy/intro.mdx) follow any of the following approaches:
515+
516+
<Tabs groupId="policy agent" default>
517+
<TabItem value="cli" label="cli">
518+
519+
You could configure this stage by using the following flags and examples:
520+
521+
```bash
522+
# install Policy Agent alongside Weave GitOps Enterprise
523+
gitops bootstrap --components-extra="policy-agent"
524+
```
525+
526+
For more information about the CLI configurations, check the below sections [here](#cli-configurations)
527+
</TabItem>
528+
<TabItem value="manual" label="manual">
529+
530+
[Policy agent](../../policy/intro.mdx) comes packaged with the WGE chart. To install it, set the following values:
531+
532+
- `values.policy-agent.enabled`: set to true to install the agent with WGE
533+
- `values.policy-agent.config.accountId`: organization name, used as identifier
534+
- `values.policy-agent.config.clusterId`: unique identifier for the cluster
535+
536+
Commit and push all the files
537+
538+
```bash
539+
git add clusters/management/weave-gitops-enterprise.yaml
540+
git commit -m "Deploy Weave GitOps Enterprise"
541+
git push
542+
```
543+
544+
Flux will reconcile the helm-release and WGE will be deployed into the cluster. You can check the `flux-system` namespace to verify all pods are running.
545+
546+
</TabItem>
547+
</Tabs>
548+
549+
### Enable Infrastructure Management via Tf-Controller
379550

380551

381552

@@ -553,12 +724,6 @@ and information as to why they're not.
553724

554725

555726

556-
557-
558-
### Cluster User
559-
560-
561-
562727
### Customise the UI
563728

564729
#### Login
@@ -574,176 +739,8 @@ extraEnvVars:
574739
value: "Login with ACME"
575740
```
576741

577-
### Install Other Components
578-
579-
#### Cluster Management via CAPI
580-
581-
TBA
582-
583-
#### Policy via Weave Policy Agent
584-
585-
To install [Policy Agent](../../policy/intro.mdx) follow any of the following approaches:
586-
587-
<Tabs groupId="policy agent" default>
588-
<TabItem value="cli" label="cli">
589-
590-
You could configure this stage by using the following flags and examples:
591-
592-
```bash
593-
# install Policy Agent alongside Weave GitOps Enterprise
594-
gitops bootstrap --components-extra="policy-agent"
595-
```
596-
597-
For more information about the CLI configurations, check the below sections [here](#cli-configurations)
598-
</TabItem>
599-
<TabItem value="manual" label="manual">
600-
601-
[Policy agent](../../policy/intro.mdx) comes packaged with the WGE chart. To install it, set the following values:
602-
603-
- `values.policy-agent.enabled`: set to true to install the agent with WGE
604-
- `values.policy-agent.config.accountId`: organization name, used as identifier
605-
- `values.policy-agent.config.clusterId`: unique identifier for the cluster
606-
607-
Commit and push all the files
608-
609-
```bash
610-
git add clusters/management/weave-gitops-enterprise.yaml
611-
git commit -m "Deploy Weave GitOps Enterprise"
612-
git push
613-
```
614-
615-
Flux will reconcile the helm-release and WGE will be deployed into the cluster. You can check the `flux-system` namespace to verify all pods are running.
616-
617-
</TabItem>
618-
</Tabs>
619-
620-
#### Infrastructure via Tf-Controller
621-
622-
// TBA
623-
624-
625-
### Configure Write Access to Git
626-
627-
Weave GitOps Enterprise creates pull requests for adding resources. To do this, it needs to be able to write to the Git repository.
628-
Here we provide guidance for GitHub, GitLab, BitBucket Server, and Azure DevOps.
629-
630-
<Tabs groupId="git-provider" default>
631-
<TabItem value="github" label="GitHub">
632-
GitHub requires no additional configuration for OAuth git access
633-
</TabItem>
634-
<TabItem value="gitlab" label="GitLab">
635-
636-
Create a GitLab OAuth application that will request `api` permissions to create pull requests on your behalf.
637-
638-
Follow the [GitLab docs](https://docs.gitlab.com/ee/integration/oauth_provider.html).
639-
640-
The application should have at least these scopes:
641-
642-
- `api`
643-
- `openid`
644-
- `email`
645-
- `profile`
646-
647-
Add callback URLs to the application for each address the UI will be exposed on, e.g.:
648-
649-
- `https://localhost:8000/oauth/gitlab` for port-forwarding and testing
650-
- `https://git.example.com/oauth/gitlab` for production use
651-
652-
Save your application, taking note of the **Client ID** and **Client Secret**. Save
653-
them into the `git-provider-credentials` secret, along with:
654-
655-
- `GIT_HOST_TYPES` to tell WGE that the host is gitlab
656-
- `GITLAB_HOSTNAME` where the OAuth app is hosted
657-
658-
**Replace values** in this snippet and run:
659-
660-
```bash
661-
kubectl create secret generic git-provider-credentials --namespace=flux-system \
662-
--from-literal="GITLAB_CLIENT_ID=13457" \
663-
--from-literal="GITLAB_CLIENT_SECRET=24680" \
664-
--from-literal="GITLAB_HOSTNAME=git.example.com" \
665-
--from-literal="GIT_HOST_TYPES=git.example.com=gitlab"
666-
```
667-
668-
</TabItem>
669-
<TabItem value="bitbucket-server" label="BitBucket Server">
670-
671-
Create a new [incoming application link](https://confluence.atlassian.com/bitbucketserver/configure-an-incoming-link-1108483657.html) from
672-
the BitBucket administration dashboard. You will be asked to enter a unique name and the redirect URL for the external application. The redirect URL
673-
should be set to `$WGE_DASHBOARD_URL/oauth/bitbucketserver`. You will also need to select permissions for the application. The minimum set of
674-
permissions needed for WGE to create pull requests on behalf of users is `Repositories - Write`. An example of configuring these settings is shown below.
675-
676-
<figure>
677-
678-
<img src={oauthBitbucket} width="500"/>
679-
680-
<figcaption>Configuring a new incoming application link</figcaption>
681-
</figure>
682-
683-
684-
Save your application and take note of the **Client ID** and **Client Secret**. Save
685-
them into the `git-provider-credentials` secret, along with:
686-
687-
- `GIT_HOST_TYPES` to tell WGE that the host is bitbucket-server
688-
- `BITBUCKET_SERVER_HOSTNAME` where the OAuth app is hosted
689-
690-
**Replace values** in this snippet and run:
691-
692-
```bash
693-
kubectl create secret generic git-provider-credentials --namespace=flux-system \
694-
--from-literal="BITBUCKET_SERVER_CLIENT_ID=13457" \
695-
--from-literal="BITBUCKET_SERVER_CLIENT_SECRET=24680" \
696-
--from-literal="BITBUCKET_SERVER_HOSTNAME=git.example.com" \
697-
--from-literal="GIT_HOST_TYPES=git.example.com=bitbucket-server"
698-
```
699-
700-
If the secret is already present, use the following command to update it using your default editor:
701742

702-
```bash
703-
kubectl edit secret generic git-provider-credentials --namespace=flux-system
704-
```
705743

706-
:::info
707-
708-
If BitBucket Server is running on the default port (7990), make sure you include the port number in the values of the secret. For example: `GIT_HOST_TYPES=git.example.com:7990=bitbucket-server`
709-
710-
:::
711-
712-
</TabItem>
713-
714-
<TabItem value="azure-devops" label="Azure DevOps">
715-
716-
Navigate to [VisualStudio](https://app.vsaex.visualstudio.com/app/register) and register a new application, as explained in the [docs](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops#1-register-your-app). Set the authorization callback URL and select which scopes to grant. Set the callback URL to `$WGE_DASHBOARD_URL/oauth/azuredevops`.
717-
718-
Select the `Code (read and write)` scope from the list. This is necessary so that WGE can create pull requests on behalf of users. An example of configuring these settings is shown below.
719-
720-
<figure>
721-
<img src={oauthAzureDevOps}/>
722-
<figcaption>Creating a new application</figcaption>
723-
</figure>
724-
725-
After creating your application, you will be presented with the application settings. Take note of the `App ID` and `Client Secret` values—you will use them to configure WGE.
726-
727-
<figure>
728-
<img src={oauthAzureDevOpsSuccess}/>
729-
<figcaption>Application settings</figcaption>
730-
</figure>
731-
732-
In your cluster, create a secret named `git-provider-credentials` that contains the `App ID` and `Client Secret` values from the newly created application.
733-
734-
**Replace values** in this snippet and run:
735-
736-
```bash
737-
kubectl create secret generic git-provider-credentials --namespace=flux-system \
738-
--from-literal="AZURE_DEVOPS_CLIENT_ID='App ID value'" \
739-
--from-literal="AZURE_DEVOPS_CLIENT_SECRET='Client Secret value'"
740-
```
741-
742-
WGE is now configured to ask users for authorization the next time a pull request must be created as part of using a template.
743-
Note that each user can view and manage which applications they have authorized by navigating to https://app.vsaex.visualstudio.com/me.
744-
745-
</TabItem>
746-
</Tabs>
747744

748745

749746
## Next Steps

0 commit comments

Comments
 (0)