Installation & Deployment¶

Warning

この方法では、Ericom社がワールドワイドでリリースしている全バージョンが選択可能です。日本では独自にサポート可能なバージョンを限定してリリースしています。そのため、setup.sh および ver-change.sh によって選択可能なバージョン以外のものをインストールして利用しないように願いいたします。

Shield can be installed in 2 main methods:

Using the Installation Scripts (can be used for Ubuntu and CentOS)
Using the OVA file (for CentOS)

Shield components are deployed on Linux machines using Rancher. Rancher is a well-known software platform that enables easy deployment and management of Docker and Kubernetes products in production environments.

First step is to create the Kubernetes cluster (using Rancher) and once the cluster is ready - deploy Shield on it.

The recommendation is to set up a dedicated Linux machine which will be used for cluster deployment and management. This machine will be referred to as the Rancher Server machine. This machine will also include the Kubectl & Helm on it (see below). The Rancher Server can be a separated machine or on one of the Master machines (running etcd & Control Plane).

For High Availability deployments, 3 Master (cluster management) machines are required.

The process detailed below is dedicated to installing using the Installation Scripts. When installing using the OVA, some steps can be skipped (due to the components that are included in the OVA). For detailed instructions on installing using the OVA go here.

Note

The process detailed below includes steps performed both on the Linux machine(s) and on the Rancher user interface (using a browser).

The steps describe where it takes place (either in Rancher or Linux).

Prepare The Linux Machines¶

Each Linux machine that takes part in the Shield cluster must be prepared before creating the cluster. Please follow these steps and perform them on each machine separately:

Note

When using Ubuntu 16.04 for a Kubernetes system, some steps are needed for Kubernetes to run successfully. For more details, go here.

Configure OS settings:

curl -s -o configure-sysctl-values.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/configure-sysctl-values.sh
chmod +x configure-sysctl-values.sh
sudo ./configure-sysctl-values.sh

Install Docker:

curl -s -o install-docker.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/install-docker.sh
chmod +x install-docker.sh
./install-docker.sh

Add current user to the docker group:

sudo usermod -aG docker "$USER"

Logout and login again.

Verify that Docker is installed properly:

docker version

All the machines should be synchronized. Configure the NTP (Network Time Protocol) and the timezone on the machine.

Repeat these steps for each machine in the system.

Create The Cluster¶

Once all Shield machines are ready, select a machine to be the Rancher Server to init Rancher and form the cluster.

Note

For High Availability - Shield cluster must include 3 Master (cluster management) machines

Deploy Rancher¶

On the Linux Rancher Server machine, create a dedicated folder and run Rancher:

mkdir ~/ericomshield
curl -s -o run-rancher.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/run-rancher.sh
chmod +x run-rancher.sh
./run-rancher.sh

Init Rancher - Open a browser and go to https://RancherServerIPAddress:8443 (using the Rancher Server IP address).

Set the administrator password (as desired) and click Continue

Click Save URL.

Form A Cluster & Add Nodes¶

In Rancher, click the Add Cluster option (on the right).

Fill in the Cluster Name.

Expand the Cluster Options and on the Network Provider select the Flannel option. Click Next.

Select the required check boxes. For a Cluster Management node (Master machine), select all check boxes. For Worker node, select the Worker check box. E.g.,:

Copy the command on the bottom (using the Copy to Clipboard option in the right).

Run the copied command on EACH Linux machine to join it to the cluster. Make sure the copied command matches the node to join (Master/Worker). Follow the node joining by clicking on Nodes in the cluster menu.

Wait until the process is finished. After the node is joined to the cluster, a green message appears at the bottom of the page. Repeat this process per each node until the cluster is complete. Click Done.

Set Node Labels¶

According to the planned deployment, set the node labels for each machine:

In Rancher, select Nodes and for each node you wish to edit, select the Edit option from the menu on the right

In the Edit Node dialog, expand the Labels section and add the desired labels to the node. For each label, set the value accept. The possible labels are:

Labels can be added manually, one by one, or using copy/paste for one or more lines of the following labels:

shield-role/management=accept
shield-role/proxy=accept
shield-role/elk=accept
shield-role/farm-services=accept
shield-role/remote-browsers=accept

Press Save. The updated labels now appear on the node details:

The new Kubernetes cluster is now up and ready.

Cluster Management¶

Kubectl¶

Kubectl is used for running commands on Kubernetes clusters. For more details, see here.

Install Kubectl on the Linux Rancher Server machine. Run these commands:

curl -s -o install-kubectl.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/install-kubectl.sh
chmod +x install-kubectl.sh
./install-kubectl.sh

Update Kubeconfig¶

In Rancher, go to Cluster and select Kubeconfig File

Scroll down and select the Copy to Clipboard option. This will copy the content of the Kubeconfig file to the Clipboard.

On the Linux Rancher Server machine, create a directory named ~/.kube (mkdir ~/.kube) then create a new file named ~/.kube/config. Paste the clipboard content to the file.

Check that kubectl is configured properly (client and server):

kubectl version

The expected outcome is similar to:

Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:44:30Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.5", GitCommit:"2166946f41b36dea2c4626f90a77706f426cdea2", GitTreeState:"clean", BuildDate:"2019-03-25T15:19:22Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}

Helm¶

Helm is an application manager, used to run applications on Kubernetes (e.g., Shield). Install Helm on the Linux Rancher Server machine.

To install Helm, run these commands:

curl -s -o install-helm.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/install-helm.sh
chmod +x install-helm.sh
./install-helm.sh

Shield Repository¶

Note

Shield repository requires a valid password. Contact Ericom Shield Professional Services to get a valid password.

To add Shield repository to the Linux Rancher Server machine, run these commands:

curl -s -o add-shield-repo.sh  https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/add-shield-repo.sh
chmod +x add-shield-repo.sh
./add-shield-repo.sh -p PASSWORD

Verify that your repository is properly configured. Run:

helm search shield

The expected outcome is similar to:

Note

If migrating from a legacy system, stop at this point and go to step 6 here.

Deploy Shield¶

Note

When installing Shield using OVA, deploy-shield.sh is already included. Simply run it (without downloading it locally)

Once the cluster is prepared and all the nodes in it include the required labels, Shield can be deployed. Run these commands to deploy Shield:

curl -s -o deploy-shield.sh https://raw.githubusercontent.com/EricomSoftwareLtd/Shield/Rel-19.07.1/Kube/scripts/deploy-shield.sh
chmod +x deploy-shield.sh
./deploy-shield.sh

Move Shield-Services To Default Project¶

After Shield is deployed, the different namespaces (components) should be moved to be under the Default project, for easy display and access.

Under the cluster, there 4 namespaces: Management, Proxy, ELK & Farm Services. These correspond with the Shield-Management, Shield-Proxy, Shield-Log and Farm Services components respectively. The Browsers component is a logical component, not represented by a namespace. This is because the browsers are created and managed by the Farm Services.

In Rancher, click on the Cluster. Then click on Projects/Namespaces. Select all Shield namespaces and click on the Move option on top. Select Default and confirm. The Shield components are now displayed under the Default project.

Now, click on the cluster and select Default under the cluster name

Verify System Status¶

In Rancher, check under Workloads if the system is up and running. For more information see here.

Backup¶

Set up the backup path and storage account. For more details go here.

Add Nodes To Existing Cluster¶

When there is a need to add new nodes to an existing Shield cluster that is already in production, follow these steps:

Make sure to prepare the node(s) as required (detailed here)

Joined node(s) to the existing cluster using the copied commaned from Rancher (as explained above). Make sure the copied command matches the node to join (Master/Worker)

Once the new nodes are added, set the labels (detailed here).

The cluster is now updated with the new nodes.