Skip to content

Commit

Permalink
Merge pull request #57 from steffinstanly/patch-1
Browse files Browse the repository at this point in the history
Fixed typo errors and made few grammatical fixes
  • Loading branch information
niso120b authored Jan 16, 2020
2 parents 4e331a4 + 8472243 commit 07321c6
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions docs/marketplace/gcp/gke/README.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Aqua Container Security Platform (CSP) for GCP Marketplace

This github repo retains the helm charts and kubernets application manifest for Aqua Security's GCP Kubernetes Application Market offering. This readme includes reference documention regarding installation and upgrades while operating within Google Kubernetes Engine.
This Github repo retains the helm charts and Kubernetes application manifest for Aqua Security's GCP Kubernetes Application Market offering. This readme includes reference documentation regarding installation and upgrades while operating within Google Kubernetes Engine.

Installation is simple, as Cloud Native apps should be! There is a minimal pre-requsite to attend to beyond having a GCP account: Aqua recommends running the Container Security Platform in a dedicated namespace. At the time of this writing creating a namespace in GKE requires kubectl. Fortunatly, it's also very easy using the cloud shell. First, authenticate to the cluster, then create a namespace as follows:
Installation is simple, as Cloud Native apps should be! There is a minimum pre-requisite to attend to beyond having a GCP account: Aqua recommends running the Container Security Platform in a dedicated namespace. At the time of this writing creating a namespace in GKE requires kubectl. Fortunately, it's also very easy using the cloud shell. First, authenticate to the cluster, then create a namespace as follows:

```shell
kubectl create namespace aqua-security
Expand All @@ -15,7 +15,7 @@ Now be patient as the deployment takes approximately three minutes.

> **A word about plans**
>
>Aqua has established three Pay-As-You-Go billing plans. These plans are based on kubernetes cluster nodes where the Enforcer will run.
>Aqua has established three Pay-As-You-Go billing plans. These plans are based on Kubernetes cluster nodes where the Enforcer will run.
>The billing service on the Aqus server is defining these nodes for PAYG billing by the quantity of vCPU at the host VM level. See the below chart.
>
>| Aqua Term | vCPU Count |
Expand All @@ -24,15 +24,15 @@ Now be patient as the deployment takes approximately three minutes.
>| Medium Node | 3-7 vCPU |
>| Large Node | 8+ vCPU |
>
>GCP allows a an organization to designate a billing admin. A [billing admin permission](https://cloud.google.com/billing/docs/how-to/billing-access) allows the user to specify the billing plan an entire org may utilize. For example Aqua CSP has three billing sizes, yet the billing admin chose the small plan. The kubernetes admin in this case would not be allowed >to deploy Aqua CSP on a cluster with nodes of 12 vCPU. K8s admins, be advised this functionality exists.
>GCP allows an organization to designate a billing admin. A [billing admin permission](https://cloud.google.com/billing/docs/how-to/billing-access) allows the user to specify the billing plan an entire org may utilize. For example, Aqua CSP has three billing sizes, yet the billing admin chose the small plan. The Kubernetes admin, in this case, would not be allowed >to deploy Aqua CSP on a cluster with nodes of 12 vCPU. K8s admins, be advised this functionality exists.
## Complete Initial Deployment

The marketplace deployer will automatically deploy the Aqua Command Center and accompanying Aqua Enforcers set to audit mode. This process takes approx. three minutes. The following four basic steps are necessary to complete deployment. They are also depicted in the notes side of the GCP deployer panel.

## 1. Backup Auto-Generated Secrets

By default the Aqua postgresql container utilizes a persistant volume (PVC). When removing the application, this PVC is not deleted along with your application in order to save your data.
By default, the Aqua PostgreSQL container utilizes a persistent volume (PVC). When removing the application, this PVC is not deleted along with your application to save your data.
In the case you re-deploy using the same application name and namespace, reloading these secrets will be necessary to access the db files on the reused PVC. It is **very important** to back up the secrets for this purpose.
Please back them up ***now*** and see the [ReDeploying Aqua CSP](#ReDeploying-Aqua-CSP) section.

Expand Down Expand Up @@ -68,7 +68,7 @@ Users that have a license token for GKE Marketplace should enter it to enable th

>*A note about Aqua CSP for GCP Marketplace licenses*
>
>The license issued is specific to the environement. As of this writing an Enterprise license will not enable a deplyment via GCP Marketplace or vice versa.
>The license issued is specific to the environment. As of this writing, an Enterprise license will not enable a deployment via GCP Marketplace or vice versa.
## View logs of the Aqua Command Center

Expand All @@ -82,9 +82,9 @@ kubectl logs -f ${SERVERPOD} --namespace=nameSpace

## ReDeploying Aqua CSP

Sometimes a cluster has to be deleted, migrated, redeployed in a different region, etc for various reasons. Because of these scenerios the Aqua database container uses a Persistant Volume Claim (PVC) in order to safe-guard inadvertant database loss. A [PVC](https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes) is a mechanisim within kubernetes that allows an application to mount a physical disk (PD) as a kubernetes volume. This grants the PD reusability, among other capabilities.
Sometimes a cluster has to be deleted, migrated, redeployed in a different region, etc for various reasons. Because of these scenarios, the Aqua database container uses a Persistent Volume Claim (PVC) to safeguard inadvertent database loss. A [PVC](https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes) is a mechanism within Kubernetes that allows an application to mount a physical disk (PD) as a Kubernetes volume. This grants the PD reusability, among other capabilities.

To redeploy Aqua CSP and reattach the previously utilized PVC, one may choose the same cluster, namespace and app name. Doing so will cause the marketplace launcher to reattach the matching PVC. This does present a challenge however due to the *kubectl apply* that the launcher is running. The *apply* means existing secrets of the same name will be regenerated and overwritten, causing the database connection from the Aqua server and database containers to fail. To allieviate this particular issue, stage the following commands in the cloud console run them 15-30 seconds after starting a redeploy. Doing so will overwrite the secrets with the proper values, and allow the server and gateway pods to reconnect to the database. You may notice this procedure relies on the the kubernetes pod initilization restart timer, and you would be correct! We're merely taking advantage of the kubernetes toolkit vs editing the database with postgres commands.
To redeploy Aqua CSP and reattach the previously utilized PVC, one may choose the same cluster, namespace and app name. Doing so will cause the marketplace launcher to reattach the matching PVC. This does present a challenge however due to the *kubectl apply* that the launcher is running. The *apply* means existing secrets of the same name will be regenerated and overwritten, causing the database connection from the Aqua server and database containers to fail. To alleviate, this particular issue, stage the following commands in the cloud console run them 15-30 seconds after starting a redeploy. Doing so will overwrite the secrets with the proper values, and allow the server and gateway pods to reconnect to the database. You may notice this procedure relies on the Kubernetes pod initialization restart timer, and you would be correct! We're merely taking advantage of the Kubernetes toolkit vs editing the database with Postgres commands.

```bash
kubectl delete -f aquaSecrets.json
Expand All @@ -93,7 +93,7 @@ kubectl create -f aquaSecrets.json

## Uninstalling Aqua CSP

Uninstalling the Aqua CSP and all componants may be performed by the following functions in the GCP Console:
Uninstalling the Aqua CSP and all components may be performed by the following functions in the GCP Console:

1. Delete the Aqua Security app under GKE > Applications
2. Delete the associated PVC under GKE > Storage
Expand Down

0 comments on commit 07321c6

Please sign in to comment.