Verrazzano Enterprise Container Platform – Setup

Docs: Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Verrazzano requires the following:

A Kubernetes cluster and a compatible kubectl.
At least two CPUs, 100GB disk storage, and 16GB RAM available on the Kubernetes worker nodes. This is sufficient to install the development profile of Verrazzano. Depending on the resource requirements of the applications you deploy, this may or may not be sufficient for deploying your applications.

Supported hardware

Verrazzano requires x86-64; other architectures are not supported.

Supported software versions

Verrazzano supports the following software versions.

Kubernetes

You can install Verrazzano on the following Kubernetes versions.

Verrazzano	Kubernetes Versions
1.3	1.21, 1.22, 1.23
1.2	1.19, 1.20, 1.21
1.1	1.19, 1.20, 1.21
1.0	1.18, 1.19, 1.20

For more information, see Kubernetes Release Documentation. For platform specific details, see Verrazzano platform setup.

WebLogic Server

The supported versions of WebLogic Server are dependent on the WebLogic Kubernetes Operator version. See the WebLogic Server versions supported here.

Coherence

The supported versions of Coherence are dependent on the Coherence Operator version. See the Coherence versions supported here.

Helidon

Verrazzano supports all versions of Helidon. For more information, see Helidon and Helidon Commercial Offerings.

Installed components

Verrazzano installs a curated set of open source components. The following table lists each component, its version, and a brief description.

Component	Version	Description
alert-manager	0.24.0	Handles alerts sent by client applications, such as the Prometheus server.
cert-manager	1.7.1	Automates the management and issuance of TLS certificates.
Coherence Operator	3.2.5	Assists with deploying and managing Coherence clusters.
ExternalDNS	0.10.2	Synchronizes exposed Kubernetes Services and ingresses with DNS providers.
Fluentd	1.12.3	Collects logs and sends them to OpenSearch.
Grafana	7.5.11	Tool to help you examine, analyze, and monitor metrics.
Istio	1.13.5	Service mesh that layers transparently onto existing distributed applications.
Jaeger Operator	1.32.0	Distributed tracing system for monitoring and troubleshooting distributed systems.
Keycloak	15.0.2	Provides single sign-on with Identity and Access Management.
Kiali	1.42.0	Management console for the Istio service mesh.
kube-state-metrics	2.4.2	Provides metrics about the state of Kubernetes API objects.
MySQL	8.0.28	Open source relational database management system used by Keycloak.
NGINX Ingress Controller	1.1.1	Traffic management solution for cloud‑native applications in Kubernetes.
Node Exporter	1.3.1	Prometheus exporter for hardware and OS metrics.
OAM Kubernetes Runtime	0.3.0	Plug-in for implementing Open Application Model (OAM) control plane with Kubernetes.
OpenSearch	1.2.3	Provides a distributed, multitenant-capable full-text search engine.
OpenSearch Dashboards	1.2.0	Provides search and data visualization capabilities for data indexed in OpenSearch.
Prometheus	2.34.0	Provides event monitoring and alerting.
Prometheus Adapter	0.9.1	Provides metrics in support of pod autoscaling.
Prometheus Operator	0.55.1	Provides management for Prometheus monitoring tools.
Prometheus Pushgateway	1.4.2	Allows ephemeral and batch jobs to expose their metrics to Prometheus.
Rancher	2.6.6	Manages multiple Kubernetes clusters.
WebLogic Kubernetes Operator	3.4.3	Assists with deploying and managing WebLogic domains.

Docs: Platform Setup

Mon, 01 Jan 0001 00:00:00 +0000

Docs: Install

Mon, 01 Jan 0001 00:00:00 +0000

Docs: Customize Installations

Mon, 01 Jan 0001 00:00:00 +0000

Docs: Uninstall

Mon, 01 Jan 0001 00:00:00 +0000

To delete a Verrazzano installation, delete the Verrazzano custom resource you used to install it into your cluster.

The following example starts a deletion of a Verrazzano installation in the background, and then uses the kubectl logs -f command to tail the Console output of the pod performing the uninstall:

# Get the name of the Verrazzano custom resource
$ MYVZ=$(kubectl  get vz -o jsonpath="{.items[0].metadata.name}")

# Delete the Verrazzano custom resource
$ kubectl delete verrazzano $MYVZ --wait=false
$ kubectl logs -n verrazzano-install \
    -f $(kubectl get pod \
    -n verrazzano-install \
    -l job-name=verrazzano-uninstall-${MYVZ} \
    -o jsonpath="{.items[0].metadata.name}")

Docs: Upgrade

Mon, 01 Jan 0001 00:00:00 +0000

A Verrazzano installation consists of a stack of components, such as cert-manager, where each component has a specific release version that may be different from the overall Verrazzano version. The Verrazzano platform operator knows the versions of each component associated with the Verrazzano version. When you perform the initial Verrazzano installation, the appropriate version of each component is installed by the platform operator. Post installation, it may be necessary to update one or more of the component images or Helm charts. This update is also handled by the platform operator and is called an upgrade. Currently, Verrazzano does only patch-level upgrades, where a helm upgrade command can be issued for the component. Typically, patch-level upgrades simply replace component images with newer versions.

Application and system pod restarts

If Verrazzano has a new version of Istio, then all the pods with Istio proxy sidecars need to be restarted. This is done so that the new version of the proxy sidecar can be injected into the pods. All Verrazzano pods containing Istio proxy sidecars will be restarted. This includes Verrazzano system pods, such as the NGINX Ingress Controller, along with Verrazzano applications. For WebLogic workloads, Verrazzano will shut down every domain, do the upgrade, then start every domain. For all other workloads, Verrazzano will perform a rolling restart when the upgrade is complete. There is no user involvement related to restarting applications; it is done automatically during upgrade.

Upgrade steps

It is important to distinguish between updating the Verrazzano platform operator versus upgrading the Verrazzano installation. The platform operator contains the newer component charts and image versions, so it must be updated prior to upgrading the installation. Updating the platform operator has no effect on an existing installation until you initiate the Verrazzano installation upgrade. Currently, there is no way to roll back either the platform operator update or the Verrazzano installation upgrade.

Upgrading an existing Verrazzano installation is a two-step process:

Update the Verrazzano platform operator to the Verrazzano release version to which you want to upgrade.
Upgrade the Verrazzano installation.

Update the Verrazzano platform operator

In order to upgrade an existing Verrazzano installation, you must first update the Verrazzano platform operator.

Update the Verrazzano platform operator.

NOTE: If you are using a private container registry, then to update the platform operator, follow the instructions at Use a Private Registry.

To update to the latest version:
```
$ kubectl apply -f https://github.com/verrazzano/verrazzano/releases/download/v1.3.8/operator.yaml
```
To update to a specific version, where <version> is the desired version:
```
$ kubectl apply -f https://github.com/verrazzano/verrazzano/releases/download/<version>/operator.yaml
```

Wait for the deployment to complete.

$ kubectl -n verrazzano-install rollout status deployment/verrazzano-platform-operator

# Expected response
deployment "verrazzano-platform-operator" successfully rolled out

Confirm that the operator pod is correctly defined and running.

$ kubectl -n verrazzano-install get pods

# Sample output
NAME                                            READY   STATUS    RESTARTS   AGE
verrazzano-platform-operator-59d5c585fd-lwhsx   1/1     Running   0          114s

Upgrade Verrazzano

To upgrade the Verrazzano installation, you need to change the version of your installed Verrazzano resource to the version supported by the Verrazzano platform operator.

NOTE: You may only change the version field during an upgrade; changes to other fields or component configurations are not supported at this time.

In one simple step, you can upgrade to a specified version of Verrazzano using this command:

$ kubectl patch vz example-verrazzano -p '{"spec":{"version":"v1.3.8"}}' --type=merge

Alternatively, you can upgrade the Verrazzano installation using the following steps:

Update the Verrazzano resource to the desired version.

To upgrade the Verrazzano components, you must update the version field in your Verrazzano resource spec to match the version supported by the platform operator to which you upgraded and apply it to the cluster.

The value of the version field in the resource spec must be a Semantic Versioning value corresponding to a valid Verrazzano release version.

You can update the resource by doing one of the following:

a. Editing the YAML file you used to install Verrazzano and setting the version field to the latest version.

For example, to upgrade to v1.3.8, your YAML file should be edited to add or update the version field:
```
apiVersion: install.verrazzano.io/v1alpha1
kind: Verrazzano
metadata:
  name: example-verrazzano
spec:
  profile: dev
  version: v1.3.8
```
Then apply the resource to the cluster (if you have not edited the resource in-place using kubectl edit):
```
$ kubectl apply -f example-verrazzano.yaml
```
b. Editing the Verrazzano resource directly using kubectl and setting the version field directly, for example:
```
$ kubectl edit verrazzano example-verrazzano
# In the resource editor, add or update the version field to "version: v1.3.8", then save.
```

Wait for the upgrade to complete:

$ kubectl wait \
    --timeout=10m \
    --for=condition=UpgradeComplete verrazzano/example-verrazzano

Verify the upgrade

Check that all the pods in the verrazzano-system namespace are in the Running state. While the upgrade is in progress, you may see some pods terminating and restarting as newer versions of components are applied, for example:

$ kubectl get pods -n verrazzano-system

# Sample output
coherence-operator-866798c99d-r69xt                1/1     Running   1          43m
fluentd-f9fbv                                      2/2     Running   0          38m
fluentd-n79c4                                      2/2     Running   0          38m
fluentd-xslzw                                      2/2     Running   0          38m
oam-kubernetes-runtime-56cdb56c98-wn2mb            1/1     Running   0          43m
verrazzano-application-operator-7c95ddd5b5-7xzmn   1/1     Running   0          42m
verrazzano-authproxy-594d8c8dcd-llmlr              2/2     Running   0          38m
verrazzano-console-74dbf97fdf-zxvvn                2/2     Running   0          38m
verrazzano-monitoring-operator-6fcf8484fd-gfkhs    1/1     Running   0          38m
verrazzano-operator-66c8566f95-8lbs6               1/1     Running   0          38m
vmi-system-es-master-0                             2/2     Running   0          38m
vmi-system-grafana-799d79648d-wsdp4                2/2     Running   0          38m
vmi-system-kiali-574c6dd94d-f49jv                  2/2     Running   0          41m
vmi-system-kibana-77f8d998f4-zzvqr                 2/2     Running   0          38m
vmi-system-prometheus-0-7f89d54fbf-brg6x           3/3     Running   0          36m
weblogic-operator-7b447fdb47-wlw64                 2/2     Running   0          42m

Check that the pods in your application namespaces are ready, for example:

$ kubectl get pods -n todo-list

# Sample output
NAME                     READY   STATUS    RESTARTS   AGE
mysql-67575d8954-d4vkm   2/2     Running   0          39h
tododomain-adminserver   4/4     Running   0          39h

Upgrade failures

In Verrazzano 1.3 and later, upgrade will continue to run until it succeeds or until you delete the Verrazzano CR. In previous versions, upgrade could fail and transition to the UpgradeFailed state. If that happens, and you updated the Verrazzano platform operator to 1.3+, then the Verrazzano CR will transition to UpgradePaused. To continue with the upgrade, you must change the CR version to the current version of the Verrazzano platform operator. The following steps illustrate this scenario:

You install Verrazzano 1.1.2.
You upgrade to 1.2.0 by changing the Verrazzano CR version field to v1.2.0.
- For some reason, the upgrade failed and the Verrazzano CR state transitions to UpgradeFailed.
You update the Verrazzano platform operator to 1.3.0.
- The Verrazzano CR state transitions to UpgradePaused.
You change the Verrazzano CR version field to v1.3.0.
- The Verrazzano CR state transitions to Upgrading and stays in that state until it completes, then it transitions to UpgradeComplete.

To see detailed progress of the upgrade, view the logs with the following command:

$ kubectl logs -n verrazzano-install \
    -f $(kubectl get pod \
    -n verrazzano-install \
    -l app=verrazzano-platform-operator \
    -o jsonpath="{.items[0].metadata.name}") | grep '^{.*}$' \
    | jq -r '."@timestamp" as $timestamp | "\($timestamp) \(.level) \(.message)"'

Docs: Use a Private Registry

Mon, 01 Jan 0001 00:00:00 +0000

Installing Verrazzano using a private Docker-compliant container registry requires the following:

Loading all the required Verrazzano container images into your own registry and repository.
Installing the Verrazzano platform operator with the private registry and repository used to load the images.

To obtain the required Verrazzano images and install from your private registry, you must:

Download the Verrazzano ZIP file:
- Download the Verrazzano ZIP file from the Oracle Software Delivery Cloud for major or minor releases.
  
  a. In your browser, go to the Oracle Software Delivery Cloud and log in with your credentials.
  
  b. In the drop-down menu preceding the search bar, select All Categories.
  
  c. In the search bar, enter Verrazzano Enterprise Container Platform and click Search.
  
  d. Select the REL: Verrazzano Enterprise Container Platform 1.3.0.0.0 link. This will add it to your download queue.
  
  e. At the top of the page, select the Continue link.
  
  f. Review the Download Queue, then click Continue.
  
  g. Accept the license agreement and click Continue.
  
  h. Download the file:
  - To download the ZIP file directly, select the file link in the list.
  - To download the ZIP file using Oracle Download Manager, click Download and run the Oracle Download Manager executable.
- Download the Verrazzano ZIP file from My Oracle Support for cumulative patches.
  
  a. In your browser, go to My Oracle Support and log in with your credentials.
  
  b. Select the Patches & Updates tab.
  
  c. In the Patch Search panel, select the link Product or Family (Advanced).
  
  d. In the search bar for Product is, enter Oracle Verrazzano Enterprise Container Platform.
  
  e. The previous step populates the available releases for Verrazzano in the drop-down menu Release is. Select the desired release(s) and click Search.
  
  f. A new panel with Patch Advanced Search Results will open listing all the patches for the release. Select the link for the desired patch, under the Patch Name.
  
  g. From the page providing details about the patch, click Download.
  
  h. Download the ZIP file by selecting the file link.
Prepare to do the private registry install:
- Unzip the ZIP archive to a desired directory location. There will be two files, a compressed TAR file containing the product files and a checksum file.
- Go to the expanded archive directory.
- (Optional) Validate the checksum and the TAR file match. For example,
```
$ shasum -c  verrazzano_1.3.8.tar.gz.sha256

# Sample output
verrazzano_1.3.8.tar.gz: OK
```
- Expand the TAR file, for example, tar xvf verrazzano_1.3.8.tar.gz.
Load the product images into your private registry and install Verrazzano using the instructions in the README.md file that is packaged with the TAR file.

Configuring access to an insecure private registry

A private Docker registry is called an insecure registry when it is configured for access using a self-signed certificate or over an unencrypted HTTP connection. Depending on the platform, there could be some additional configuration required for installing Verrazzano with an insecure registry.

For example, for the Oracle Cloud Native Environment platform, the insecure registries must be configured in /etc/containers/registries.conf as follows on the worker nodes:

[registries]
   [registries.insecure]
     registries = ["insecure-registry-1:1001/registry1","insecure-registry-2:1001/registry2"]