Update doc for knative deploy on IBMCloudPrivate #660

zxDiscovery · 2018-12-13T09:10:09Z

Fixes #557

Proposed Changes

Add the a new file install/Knative-with-ICP.md
Update the install/README.md

knative-prow-robot · 2018-12-13T09:10:24Z

Hi @zxDiscovery. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

zxDiscovery · 2018-12-13T09:35:12Z

Copy from #618
/cc @averikitsch @samodell @gyliu513

gyliu513 · 2018-12-14T02:38:21Z

install/Knative-with-ICP.md

+
+Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions]((https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)) in the IBM Knowledge Center for install instructions.
+
+### Step 1: Install Docker for your boot node only


I think we do not need step 1 to step 5, just navigate this to IBM Cloud Private KC is good enough.

Also please navigate to IBM Cloud Private CE version, as EE version is not free.

If pointing out to the IBM Cloud Private KC includes only the steps covered here in 1-5, then yes, I agree that simply linking to those steps is ok.

BUT, if the linked page contains a bunch of unnecessary steps or requirements, then its a poor user experience to link out to a separate set of instructions and therefore, its better to include steps 1-5 here.

The IBM Cloud Private KC covered the install step, I Simplify the step and navigate the step to IBM Cloud Private KC.

gyliu513 · 2018-12-14T02:39:32Z

@zxxa When you update a PR, if it is not a significant change, just use command git commit --amend to make sure you are using one commit.

gyliu513 · 2018-12-19T02:25:03Z

install/Knative-with-ICP.md

+```
+
+Update spec.repositories by adding `gcr.io/knative-releases/*`
+```


replace "" to "yaml"

gyliu513 · 2018-12-19T02:26:30Z

install/Knative-with-ICP.md

+ibm-restricted-psp          false                                                                                                                           RunAsAny   MustRunAsNonRoot   MustRunAs   MustRunAs   false            configMap,emptyDir,projected,secret,downwardAPI,persistentVolumeClaim
+```
+
+Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use ``ibm-privileged-psp``.


one "" is good enough for ibm-privileged-psp`

gyliu513

lgtm, thanks @zxDiscovery

@samodell @RichieEscarez can you help if we can get this merged?

samodell · 2018-12-19T18:16:13Z

install/Knative-with-ICP.md

+     - use
+EOF
+```
+The output resembles the following code:


Suggested change

The output resembles the following code:

You will see the following output:

samodell · 2018-12-19T18:17:05Z

install/Knative-with-ICP.md

+EOF
+```
+
+You can use the same mothed add the other knative namespaces to `ibm-privileged-psp` pod security policy.


Suggested change

You can use the same mothed add the other knative namespaces to `ibm-privileged-psp` pod security policy.

Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.

samodell · 2018-12-19T18:18:43Z

install/Knative-with-ICP.md

+
+Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).
+
+## Installing Knative Serving


Is there a reason not to include instructions for installing the other Knative components here? the IKS guide covers instructions for Serving and Build, and ideally we'd like to keep the guides as similar as possible.

https://github.com/knative/docs/blob/master/install/Knative-with-IKS.md

samodell · 2018-12-19T18:21:01Z

install/Knative-with-ICP.md

+```
+
+If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.
+Using the following commend get the image security policy.


Suggested change

Using the following commend get the image security policy.

Enter the following command to view the current image security policy:

samodell · 2018-12-19T18:23:52Z

install/Knative-with-ICP.md

+  | kubectl apply --filename -
+```
+
+If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.


Lines 40 and 41 don't make sense as written -- should this say "If the image-security-enforcement wasn't enabled when you installed..."? Or are you saying that, even if it was already enabled, you need to update it further? Can you clarify?

samodell · 2018-12-19T18:25:32Z

install/Knative-with-ICP.md

+clusterrole "knative-role" created
+```
+
+Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.


Suggested change

Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.

Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.

Suggested change

Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.

Set up cluster role binding for the service account in Knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.

samodell · 2018-12-19T18:27:00Z

install/Knative-with-ICP.md

+  | kubectl apply --filename -
+```
+
+If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.


Suggested change

If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.

If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image.

averikitsch · 2018-12-19T19:01:36Z

install/Knative-with-ICP.md

+
+Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.
+
+1: [Install Docker for your boot node only](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html#prep_boot)


Change to typical ordered list format 1: --> 1.

averikitsch · 2018-12-19T19:05:52Z

install/Knative-with-ICP.md

+If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.
+Using the following commend get the image security policy.
+```
+kubectl get clusterimagepolicies


Add a space or other separation between the command and print out (it's hard to see the difference). Same as below.

averikitsch · 2018-12-19T19:06:27Z

install/Knative-with-ICP.md

+kubectl edit clusterimagepolicies ibmcloud-default-cluster-image-policy
+```
+
+Update spec.repositories by adding "gcr.io/knative-releases/*"


Suggested change

Update spec.repositories by adding "gcr.io/knative-releases/*"

Update `spec.repositories` by adding `"gcr.io/knative-releases/*"`

averikitsch · 2018-12-19T19:07:45Z

install/Knative-with-ICP.md

+
+## Installing Knative Serving
+
+Next, install [Knative Serving](https://github.com/knative/serving):


Can you number these steps or add additional formatting so it's easier to follow?

averikitsch · 2018-12-19T19:09:44Z

install/Knative-with-ICP.md

+  - name: "gcr.io/knative-releases/*"
+```
+
+Put the namespaces `knative-serving`, `knative-build`, `knative-monitoring` and `knative-eventing` into pod security policy `ibm-privileged-psp` as follows.


How/What are you putting? How does this relate to the command below?

averikitsch · 2018-12-19T19:11:06Z

install/Knative-with-ICP.md

+```
+
+Create a cluster role for the pod security policy resource. The resourceNames for this role must be the name of the pod security policy that was created previous. Here we use `ibm-privileged-psp`.
+Create a YAML file for the cluster role.


Add a space between this line and line above.

Suggested change

Create a YAML file for the cluster role.

Create a YAML file for the cluster role with the following command:

samodell

A few last suggestions. Thanks for all the work on this!

samodell · 2018-12-20T17:14:11Z

install/Knative-with-ICP.md

+
+Now you can deploy an app to your newly created Knative cluster.
+
+### Installing Knative Build only


Since this is an option to install Build alone, this should go right after the section on "Installing Knative Serving and Build components," so right at line 43.

samodell · 2018-12-20T17:15:00Z

install/Knative-with-ICP.md

+  | kubectl apply --filename -
+```
+
+You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.


I would add a descriptive heading for these steps around the image security policy, to group all these commands together.

samodell · 2018-12-20T17:16:15Z

install/Knative-with-ICP.md

+  | kubectl apply --filename -
+```
+
+You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.


Suggested change

You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.

You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) to allow the cluster to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.

samodell · 2018-12-26T19:10:36Z

@RichieEscarez for the final stamp of approval later this week.

RichieEscarez

A bunch of editorial suggestions and a general IA question for @samodell (now that that custom install instructions have been merged). Thanks @zxDiscovery !

RichieEscarez · 2018-12-27T17:41:23Z

install/Knative-with-ICP.md

+# Knative Install on IBM Cloud Private
+
+This guide walks you through the installation of the latest version of
+[Knative Serving](https://github.com/knative/serving) using pre-built images and


since the install package is release-lite.yaml, its not just Serving, you get Build too

install/Knative-with-ICP.md

RichieEscarez · 2018-12-27T17:47:08Z

install/Knative-with-ICP.md

+This guide walks you through the installation of the latest version of
+[Knative Serving](https://github.com/knative/serving) using pre-built images and
+demonstrates creating and deploying an image of a sample `hello world` app onto
+the newly created Knative cluster.


Suggested change

the newly created Knative cluster.

the newly created Knative cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private).

See comment below.

RichieEscarez · 2018-12-27T17:50:11Z

install/Knative-with-ICP.md

+
+## Installing Istio
+
+Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).


Two separate links don't make it clear that you want the user to navigate away (and to which link). Lets make the whole sentence a link:

Suggested change

Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).

[Follow the instructions to install and run Istio in IBM Cloud Private](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private).

RichieEscarez · 2018-12-27T18:10:58Z

install/Knative-with-ICP.md

+
+## Before you begin
+
+Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.


It looks like all the steps in the KC topic should be taken?

If that is true, lets clarify/state that, and also provide only a single link because right now with the 6 separate links, we are asking the user to switch back and forth between the same page multiple times.

I think you could also leave in the list but remove the links.

@RichieEscarez Yes, all the steps in the KC topic should be taken. I wrote all the steps in the the previous review versions. But it seems a little redundant. So I simplify it.

I think I just keep the KC topic link here and remove the six separate links. User follow the step from KC link to install the IBM Cloud Private.

Sounds good, please revise to:

Suggested change

Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.

Knative requires a v3.1.1 standard [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster.

Before you can install Knative, you must first complete all the steps that are provided in the

[IBM Cloud Private standard cluster installation instructions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html).

@zxDiscovery , one open item here.

RichieEscarez · 2018-12-27T18:28:28Z

install/Knative-with-ICP.md

+
+1. Check the pod security policy in [IBM Cloud Private](https://www.ibm.com/cloud/private).
+```
+kubectl get psp


Global comment:
Please indent all these code blocks to nest them under the steps

Suggested change

kubectl get psp

kubectl get psp

RichieEscarez · 2018-12-27T18:30:52Z

install/Knative-with-ICP.md

+EOF
+```
+
+Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.


This looks like a separate step.

Also can we list what the "other Knative namespaces" are that need to be added?

Suggested change

Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.

4. Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.

RichieEscarez · 2018-12-27T18:38:29Z

install/Knative-with-ICP.md

+
+Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.
+
+Monitor the Knative components until all of the components show a `STATUS` of


Suggested change

Monitor the Knative components until all of the components show a `STATUS` of

5. Ensure that the installation was successful by running the following commands until both of the Knative components show a `STATUS` of

RichieEscarez · 2018-12-27T18:40:12Z

install/Knative-with-ICP.md

+kubectl get pods --namespace knative-build
+```
+
+Just as with the Istio components, it will take a few seconds for the Knative


The Istio install instructions that are used are the IBM steps and I dont think it refers to the delay.

Suggested change

Just as with the Istio components, it will take a few seconds for the Knative

It might take a few seconds for the Knative

RichieEscarez · 2018-12-27T18:41:43Z

install/Knative-with-ICP.md

+If you'd like to view the available sample apps and deploy one of your choosing,
+head to the [sample apps](../serving/samples/README.md) repo.
+
+> Note: When looking up the IP address to use for accessing your app, you need to look up


The markdown note and codeblock are disconnected here. Maybe just use bold?

Suggested change

> Note: When looking up the IP address to use for accessing your app, you need to look up

*Note*: When looking up the IP address to use for accessing your app, you need to look up

gyliu513 · 2018-12-29T07:31:46Z

install/Knative-with-ICP.md

+1. Enter the following command to view the current image security policy:
+    ```
+    kubectl get clusterimagepolicies
+


gyliu513 · 2018-12-29T07:32:12Z

install/Knative-with-ICP.md

+1. Check the pod security policy in [IBM Cloud Private](https://www.ibm.com/cloud/private).
+    ```
+    kubectl get psp
+


gyliu513 · 2018-12-29T07:32:49Z

install/Knative-with-ICP.md

+
+Delete the cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private):
+
+```shell


How about adding shell for other curl command?

gyliu513 · 2019-01-02T23:27:27Z

@samodell @RichieEscarez @averikitsch do you think this is ready to merge?

RichieEscarez · 2019-01-03T00:30:02Z

@samodell @RichieEscarez @averikitsch do you think this is ready to merge?

still an open item, please see comment above

RichieEscarez

I committed a couple small corrections and added some technical questions/comments that require action.

RichieEscarez · 2019-01-04T18:16:14Z

install/Knative-with-ICP.md

+```
+
+### Update the image security policy
+You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) to allow the cluster to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.


This says "at the time of installation" & "to pull the Knative image", both of which make it sound like this security policy needs to be created before you run the "kubctl apply" commands to install Knative.

Does the whole "Update the image security policy" section need to move up before the "Installing Knative components" steps?

Yes, you are right. The section Update the image security policy and Update pod security policy are all need to move up before the "Installing Knative components" steps. I put this two section after "install IBM Cloud Private"

RichieEscarez · 2019-01-04T18:19:56Z

install/Knative-with-ICP.md

+    ```
+
+### Update pod security policy
+Configure the namespaces `knative-serving`, `knative-build`, `knative-monitoring` and `knative-eventing` into pod security policy `ibm-privileged-psp`. The step as follows:


We have only provided steps to install Serving and Build, not Eventing nor Monitoring. This will be confusing to someone new and they might think they actually get those features too.

They should be removed or otherwise, it should be clarified that those policies are optional for if you choose to install them at a later time.

That said, are there issues/vulnerabilities with setting unnecessary security policies?

The yaml release-lite.yaml include the namespace knative-monitoring, so I keep knative-monitoring and remove the namespace knative-eventing . And I put this section before install knative.

The security policies here is necessary. Knative pod can't run normally if the we don't set the security policies.

RichieEscarez · 2019-01-04T18:21:36Z

install/Knative-with-ICP.md

+Delete the cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private):
+
+```shell
+curl -L https://github.com/knative/serving/releases/download/v0.2.2/release-lite.yaml \


The options for serving.yaml and build.yaml are provided above and are not mentioned here. If users decided to follow one of the alternatives, this command will fail.

Redo the overwritten commit, clarify security policy steps, fix indentation errors

samodell · 2019-01-07T23:14:44Z

/lgtm
/approve

knative-prow-robot · 2019-01-07T23:14:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: averikitsch, RichieEscarez, samodell, zxDiscovery

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [RichieEscarez,averikitsch,samodell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gyliu513 · 2019-01-08T05:15:56Z

Finally, thanks @samodell @RichieEscarez @averikitsch @zxDiscovery

knative-prow-robot requested review from carieshmarie and vaikas December 13, 2018 09:10

knative-prow-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 13, 2018

zxDiscovery mentioned this pull request Dec 13, 2018

Add the doc for install knative on IBMCloudPrivate #618

Closed

gyliu513 reviewed Dec 14, 2018

View reviewed changes

Update doc for knative deploy on IBMCloudPrivate

f029e28

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from 1af89f6 to f029e28 Compare December 17, 2018 05:56

RichieEscarez added the kind/new-docs-needed label Dec 19, 2018

RichieEscarez requested review from averikitsch and samodell December 19, 2018 01:47

RichieEscarez added the needs edits label Dec 19, 2018

RichieEscarez assigned samodell Dec 19, 2018

gyliu513 reviewed Dec 19, 2018

View reviewed changes

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from 9da2fe0 to 2da508f Compare December 19, 2018 05:15

gyliu513 reviewed Dec 19, 2018

View reviewed changes

samodell suggested changes Dec 19, 2018

View reviewed changes

averikitsch suggested changes Dec 19, 2018

View reviewed changes

zxDiscovery force-pushed the IBMCloudPrivate_doc branch 3 times, most recently from 3d6efc1 to 521fe46 Compare December 20, 2018 07:03

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from 85ba53b to cbd4eef Compare December 20, 2018 07:37

averikitsch approved these changes Dec 20, 2018

View reviewed changes

knative-prow-robot added the approved label Dec 20, 2018

samodell suggested changes Dec 20, 2018

View reviewed changes

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from cbd4eef to 7bb99f2 Compare December 26, 2018 07:12

samodell approved these changes Dec 26, 2018

View reviewed changes

samodell removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 26, 2018

RichieEscarez reviewed Dec 27, 2018

View reviewed changes

zxDiscovery force-pushed the IBMCloudPrivate_doc branch 4 times, most recently from 0e59411 to 9e9e84b Compare December 29, 2018 07:22

gyliu513 reviewed Dec 29, 2018

View reviewed changes

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from 9e9e84b to a6c8777 Compare December 29, 2018 07:38

Simplify IBMCloudPrivate Installation Steps

211f1ed

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from a6c8777 to 211f1ed Compare January 3, 2019 02:10

RichieEscarez suggested changes Jan 4, 2019

View reviewed changes

Change configuration order

2f799ae

zxDiscovery force-pushed the IBMCloudPrivate_doc branch from ebe20bf to 2f799ae Compare January 7, 2019 02:53

Re-add lost edits + improvements and fixes

b6453e9

Redo the overwritten commit, clarify security policy steps, fix indentation errors

RichieEscarez approved these changes Jan 7, 2019

View reviewed changes

knative-prow-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 7, 2019

knative-prow-robot merged commit f31d710 into knative:master Jan 7, 2019

zxDiscovery deleted the IBMCloudPrivate_doc branch January 11, 2019 03:11


		Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions]((https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html)) in the IBM Knowledge Center for install instructions.

		### Step 1: Install Docker for your boot node only

	The output resembles the following code:
	You will see the following output:

	You can use the same mothed add the other knative namespaces to `ibm-privileged-psp` pod security policy.
	Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.


		Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).

		## Installing Knative Serving

	Using the following commend get the image security policy.
	Enter the following command to view the current image security policy:

	Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.
	Set up cluster role binding for the service account in knative namespace. By using this role binding, you can set the service accounts in the namespace to use the pod security policy that you created.

	If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the knative image.
	If the `image-security-enforcement` enabled when you install [IBM Cloud Private](https://www.ibm.com/cloud/private). You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image.


		Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.

		1: [Install Docker for your boot node only](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html#prep_boot)

	Update spec.repositories by adding "gcr.io/knative-releases/*"
	Update `spec.repositories` by adding `"gcr.io/knative-releases/*"`


		## Installing Knative Serving

		Next, install [Knative Serving](https://github.com/knative/serving):

	Create a YAML file for the cluster role.
	Create a YAML file for the cluster role with the following command:


		Now you can deploy an app to your newly created Knative cluster.

		### Installing Knative Build only

	You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) allow to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.
	You need to update the [image security policy](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/manage_images/image_security.html) to allow the cluster to pull the Knative image when you enable the `image-security-enforcement` at the time of [IBM Cloud Private](https://www.ibm.com/cloud/private) installation.

	the newly created Knative cluster.
	the newly created Knative cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private).


		## Installing Istio

		Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).

	Follow the [instructions](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private) to install and run Istio in [IBM Cloud Private](https://www.ibm.com/cloud/private).
	[Follow the instructions to install and run Istio in IBM Cloud Private](https://istio.io/docs/setup/kubernetes/quick-start-ibm/#ibm-cloud-private).


		## Before you begin

		Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.

-Knative requires an [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster v3.1.1. See [Installing IBM Cloud Private Cloud Native, Enterprise, and Community editions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html) in the IBM Knowledge Center for install instructions.
+Knative requires a v3.1.1 standard [IBM Cloud Private](https://www.ibm.com/cloud/private) cluster.
+Before you can install Knative, you must first complete all the steps that are provided in the
+[IBM Cloud Private standard cluster installation instructions](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.1/installing/install_containers.html).

	Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.
	4. Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.


		Use the same method to add the other Knative namespaces to the `ibm-privileged-psp` pod security policy.

		Monitor the Knative components until all of the components show a `STATUS` of

Update doc for knative deploy on IBMCloudPrivate #660

Update doc for knative deploy on IBMCloudPrivate #660

Uh oh!

Conversation

zxDiscovery commented Dec 13, 2018

Proposed Changes

Uh oh!

knative-prow-robot commented Dec 13, 2018

Uh oh!

zxDiscovery commented Dec 13, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gyliu513 commented Dec 14, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gyliu513 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

samodell left a comment

zxDiscovery commented Dec 13, 2018 •

edited

Loading

	Monitor the Knative components until all of the components show a `STATUS` of
	5. Ensure that the installation was successful by running the following commands until both of the Knative components show a `STATUS` of

	Just as with the Istio components, it will take a few seconds for the Knative
	It might take a few seconds for the Knative

	> Note: When looking up the IP address to use for accessing your app, you need to look up
	Note: When looking up the IP address to use for accessing your app, you need to look up


		Delete the cluster on [IBM Cloud Private](https://www.ibm.com/cloud/private):

		```shell