# Cloud Specific Details

## Prerequisites

### Provision Enabling Systems

For quick deployment, mainly for development and testing purposes, you may wish to use cloud marketplaces, managed providers or Rierino playbooks for enabling systems:

{% tabs %}
{% tab title="AWS" %}
{% embed url="<https://aws.amazon.com/marketplace/pp/B01M1EBY7B>" %}
MongoDB
{% endembed %}

For this MongoDB package, configuration updates and restart details can be found from the vendor [site](https://docs.bitnami.com/aws/infrastructure/mean/administration/change-reset-password/).

{% embed url="<https://aws.amazon.com/marketplace/pp/B01K0IWPVI>" %}
Kafka
{% endembed %}

{% embed url="<https://aws.amazon.com/marketplace/pp/prodview-5bryl7uliw4eu>" %}
Keycloak
{% endembed %}

{% hint style="info" %}
If you will be using Keycloak with http for development / testing purposes, you may need to open up the port on local firewall (e.g. sudo ufw allow 8080/tcp) and set "Require SSL" option to false on master realm.
{% endhint %}

{% embed url="<https://aws.amazon.com/marketplace/pp/prodview-ykiljbiw3x2jq>" %}
Elasticsearch
{% endembed %}
{% endtab %}

{% tab title="GCP" %}
{% embed url="<https://console.cloud.google.com/marketplace/product/click-to-deploy-images/mongodb>" %}
MongoDB
{% endembed %}

{% embed url="<https://console.cloud.google.com/marketplace/product/bitnami-launchpad/kafka-cluster>" %}
Kafka
{% endembed %}

{% embed url="<https://console.cloud.google.com/marketplace/product/google/keycloak18>" %}
Keycloak
{% endembed %}
{% endtab %}

{% tab title="Managed Service" %}
{% embed url="<https://www.mongodb.com/atlas/database>" %}
MongoDB
{% endembed %}

{% embed url="<https://www.confluent.io/confluent-cloud/>" %}
Kafka
{% endembed %}

{% embed url="<https://www.cloud-iam.com/>" %}
Keycloak
{% endembed %}
{% endtab %}

{% tab title="Rierino Playbook" %}
{% embed url="<https://github.com/rierino-open/deployment/blob/main/ansible/playbooks/data/mongodb-install.yml>" %}
MongoDB
{% endembed %}

{% embed url="<https://github.com/rierino-open/deployment/blob/main/ansible/playbooks/data/kafka-install.yml>" %}
Kafka
{% endembed %}

{% embed url="<https://github.com/rierino-open/deployment/blob/main/ansible/playbooks/service/keycloak-install.yml>" %}
Keycloak
{% endembed %}
{% endtab %}
{% endtabs %}

### Set-up Initial Deployment Host

Ansible playbooks require access to VM inventory as well as kubernetes cluster from initial deployment host, which requires installation of certain collections and tools:

{% tabs %}
{% tab title="AWS" %}
{% embed url="<https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html>" %}
AWS CLI Installation
{% endembed %}

```sh
ansible-galaxy collection install amazon.aws community.aws
```

Set-up environment variables used by Ansible and AWS tools:

```sh
export KUBECONFIG=[kubeconfig file path]
export K8S_AUTH_KUBECONFIG=[same as KUBECONFIG]
export AWS_REGION=[AWS deployment region]
export AWS_ACCESS_KEY_ID=[AWS access key id]
export AWS_SECRET_KEY=[AWS secret key]
export AWS_SECRET_ACCESS_KEY=[same as AWS_SECRET_KEY]
```

{% hint style="info" %}
If you are using WSL for initial deployment and receive error on valid AWS credentials, your instance's time may be out of sync with Amazon servers.&#x20;

You may use a command such as *sudo hwclock -s* for synchronization.&#x20;
{% endhint %}

{% hint style="warning" %}
As a best practice, it is recommended not to use AWS account root user credentials for these environment variables which are used during deployment.&#x20;
{% endhint %}
{% endtab %}

{% tab title="GCP" %}

{% embed url="<https://cloud.google.com/sdk/docs/downloads-interactive>" %}
gcloud Installation
{% endembed %}

```sh
pip install google-auth
ansible-galaxy collection install google.cloud
gcloud components install gke-gcloud-auth-plugin
```

Set-up environment variables used by Ansible and GCP tools:

```sh
export KUBECONFIG=[kubeconfig file path]
export K8S_AUTH_KUBECONFIG=[same as KUBECONFIG]
export GCP_PROJECT=[GCP deployment project]
export GCP_REGION=[GCP deployment region]
export GOOGLE_APPLICATION_CREDENTIALS=[GCP service account json file path]
```

For authentication, service account file is used with GCP, which is passed as a parameter.&#x20;

{% hint style="info" %}
If you are using WSL for initial deployment and receive error on valid GCP credentials, your instance's time may be out of sync with Google servers.&#x20;

You may use a command such as *sudo date -s "$(wget -qSO- --max-redirect=0 google.com 2>&1 | grep Date: | cut -d' ' -f5-8)Z"* for synchronization.
{% endhint %}
{% endtab %}
{% endtabs %}

### Provision a Kubernetes Cluster

{% tabs %}
{% tab title="AWS" %}
{% hint style="warning" %}
Note that for AWS installations, you may need to manually update kubeconfig file contents output from "terraform apply" step, setting authentication apiVersion to "v1beta1" if you are receiving "invalid apiVersion client.authentication.k8s.io/v1alpha1"error.&#x20;

This is due to a compatibility bug between AWS CLI and recent helm/kubectl versions.
{% endhint %}

It is possible to deploy Rierino platform on any AWS region that has EKS and ELB availability. For the latest list of regions supported for these services, please refer to [AWS availability listing](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/).
{% endtab %}

{% tab title="GCP" %}
For GCP deployments on a new project, you will beed to enable "Compute Engine API" and "Kubernetes Engine API" for the project first.

{% embed url="<https://console.cloud.google.com/marketplace/details/google/compute.googleapis.com>" %}
Compute Engine API
{% endembed %}

{% embed url="<https://console.cloud.google.com/marketplace/details/google/container.googleapis.com>" %}
Kubernetes Engine API
{% endembed %}
{% endtab %}
{% endtabs %}

#### AWS

### Configure Network Connectivity

{% tabs %}
{% tab title="AWS" %}
You can use security groups for configuring connectivity between kubernetes cluster and enabling systems (such as one group allowing ingress from all sources within the group and another granting access to static admin IPs).

{% embed url="<https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html>" %}
Amazon Security Groups
{% endembed %}

You can issue SSL certificates using ACM for your domain.

{% embed url="<https://aws.amazon.com/certificate-manager/>" %}
AWS Certificate Manager
{% endembed %}

You can reserve static IPs to assign them to external facing load balancers.

{% embed url="<https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html>" %}
Amazon Elastic IPs
{% endembed %}

You can map your static IPs to DNS records.

{% embed url="<https://aws.amazon.com/route53/>" %}
Amazon Route 53
{% endembed %}
{% endtab %}

{% tab title="GCP" %}
You can use tags and configure firewall rules to allow them as source / target for configuring connectivity between kubernetes cluster and enabling systems, in addition to static admin IPs.

{% embed url="<https://cloud.google.com/vpc/docs/using-firewalls>" %}
Google Cloud Firewall Rules
{% endembed %}

You can issue SSL certificates using Google Cloud Certificate Manager for your domain.

{% embed url="<https://cloud.google.com/certificate-manager/docs>" %}
Google Cloud Certificate Manager
{% endembed %}

You can reserve static IPs to assign them to external facing load balancers.

{% embed url="<https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address>" %}
Google Static Public IP
{% endembed %}

You can map your static IPs to DNS records.

{% embed url="<https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip#configuring_your_domain_name_records>" %}
{% endtab %}
{% endtabs %}

## Deployments

### Load Balancer Variables

{% tabs %}
{% tab title="AWS" %}
For ansible-playbook deployments including external facing load balancers (admin gateway and admin UI), include the following variables for static IP and certificate assignments:

| Variable      | Definition                                                                   | Default |
| ------------- | ---------------------------------------------------------------------------- | ------- |
| awsACMARN     | ARN for ACM certificate (if certificate is used)                             | -       |
| awsLBSubnets  | List of subnets on which static IPs shall be assigned (if static ip is used) | -       |
| {% endtab %}  |                                                                              |         |
| {% endtabs %} |                                                                              |         |