Skip to content

Conversation

@zxDiscovery
Copy link
Contributor

Fixes #557

Proposed Changes

  • Add the a new file install/Knative-with-ICP.md
  • Update the install/README.md

@knative-prow-robot knative-prow-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Dec 3, 2018
@knative-prow-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: zxDiscovery
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: richieescarez

If they are not already assigned, you can assign the PR to them by writing /assign @richieescarez in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow-robot knative-prow-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 3, 2018

This guide walks you through the installation of the latest version of
[Knative Serving](https://github.com/knative/serving) using pre-built images and
demonstrates creating and deploying an image of a sample "hello world" app onto
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/"hello world"/hello world

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


## Before you begin

Knative requires a [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v2.1.0.3 or newer. The install step you can find on the IBM Knowledge Center, [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www-03preprod.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

www-03preprod.ibm.com cannot be accessed externally, please use a released link.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

| kubectl apply --filename -
```

Put the namespaces ``knative-serving``, ``knative-build``, ``knative-monitoring`` and ``knative-eventing`` into pod security policy ``ibm-privileged-psp`` as follows.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one ` is enough.

s/knative-serving/knative-serving

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use ``ibm-privileged-psp``.
Create a YAML file for the cluster role.
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like you use following command:

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: knative-role
rules:
- apiGroups:
  - extensions
  resourceNames:
  - ibm-privileged-psp
  resources:
  - podsecuritypolicies
  verbs:
  - use
EOF

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@samodell What do you think of this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@averikitsch @samodell this is the most popular way for some document related with Kubernetes command, like Istio, federation etc, please refer to https://istio.io/docs/tasks/traffic-management/circuit-breaking/#configuring-the-circuit-breaker for an example. ;-)


Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.
```
vim knative-clusterrolebinding.yaml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto as above

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


Delete the Knative on [IBM Cloud Private](https://www.ibm.com/cloud/private):

```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add shell for "````"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

| sed 's/LoadBalancer/NodePort/' \
| kubectl apply --filename -
```
> Note: If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to see more detail for how to update image-security-enforcement based on knative image location.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The document here should also be 2.1.0.3

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use ``ibm-privileged-psp``.
Create a YAML file for the cluster role.
```shell
cat <<EOF | kubectl apply -f -
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kill the blank space in front of this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.
```shell
cat <<EOF | kubectl apply -f -
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kill the blank space in front of this section.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


## Before you begin

Knative requires a [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v2.1.0.3 or newer. The install step you can find on the IBM Knowledge Center, [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/a/an

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are mentioning cluster v2.1.0.3, but here you are using 3.1.1 document, so here I'd like you mention this example is using 3.1.1 as example.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

| sed 's/LoadBalancer/NodePort/' \
| kubectl apply --filename -
```
> Note: If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The document here should also be 2.1.0.3


## Before you begin

Knative requires a [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v2.1.0.3 or newer. The install step you can find on the IBM Knowledge Center, [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why request cluster v2.1.0.3 or newer?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@gyliu513
Copy link
Contributor

gyliu513 commented Dec 3, 2018

@gyliu513
Copy link
Contributor

gyliu513 commented Dec 4, 2018

@zxDiscovery please rebase as there are some conflict with master.

Also please run prettier --write <your filename> to format your markdown file as we have just merged the PR for whole docs repo at #620

@evankanderson
Copy link
Member

evankanderson commented Dec 4, 2018 via email


Then edit the image security policy.
```
# kubectl edit clusterimagepolicies ibmcloud-default-cluster-image-policy
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove "#" from all commands.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

You can use the following command to look up the value to use for the {IP_ADDRESS} placeholder
used in the samples:
```shell
echo $(ICP cluster ip):$(kubectl get svc knative-ingressgateway --namespace istio-system --output 'jsonpath={.spec.ports[?(@.port==80)].nodePort}')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you break this into two lines for readability?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@gyliu513
Copy link
Contributor

gyliu513 commented Dec 7, 2018

@zxDiscovery after you resolved the comments for the reviewer, please also ack, such as adding Done to the review comments, so that reviewers will know if their comments are addressed or not.


## Cleaning up

Delete the Knative on [IBM Cloud Private](https://www.ibm.com/cloud/private):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Delete the Knative on [IBM Cloud Private](https://www.ibm.com/cloud/private):
Delete the cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private):

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

* [Knative Install on OpenShift](Knative-with-OpenShift.md)
* [Knative Install on Minishift](Knative-with-Minishift.md)
* [Knative Install on Pivotal Container Service](Knative-with-PKS.md)
* [Knative Install on IBM Cloud Private](Knative-with-ICP.md)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This list is in alphabetical order; please insert after IBM Cloud Kubernetes Service.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


## Before you begin

Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. The install step you can find on the IBM Knowledge Center, [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"The install step you can find on the IBM Knowledge Center, Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions"

change to:

"See Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions in the IBM Knowledge Center for install instructions."

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@gyliu513
Copy link
Contributor

gyliu513 commented Dec 10, 2018

@zxDiscovery Some actions need to take:

  1. Rebase, as there are some conflicts for your PR.
  2. Make sure you ACK all reviewer's comments but not only uploading PRs.
  3. Squash all of your commits to one with squash.

@samodell
Copy link
Contributor

/ok-to-test

@knative-prow-robot knative-prow-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 10, 2018
@samodell
Copy link
Contributor

/retest

GuessWhoSamFoo and others added 2 commits December 11, 2018 12:47
Signed-off-by: GuessWhoSamFoo <sfoohei@gmail.com>
Change the image name to match the instructions in README.
@gyliu513
Copy link
Contributor

@zxDiscovery please squash your commits to one commit, you can ask @clyang82 for how to squash commits.

@googlebot
Copy link

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

@zxDiscovery
Copy link
Contributor Author

The local git repository has some problem, I create a new PR to replace the current PR. See #660
So close this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.