Spinnaker Chart

Spinnaker is an open source, multi-cloud continuous delivery platform.

Chart Details

This chart will provision a fully functional and fully featured Spinnaker installation that can deploy and manage applications in the cluster that it is deployed to.

Redis and Minio are used as the stores for Spinnaker state.

For more information on Spinnaker and its capabilities, see it's documentation.

Setup Instructions

Prerequisites

Kubernetes cluster 1.20 or later with at least 4 cores and 16 GB memory.
Helm 3 is setup on the client system with 3.10.3 or later.

Helm Chart supports two modes of Installations

Non-Gitops Method: This is the normal mode of Spinnaker Halyard, wherein all the configuration is inside Halyard
Gitops Method: The Spinnaker configuration is stored in a git-repo, and the halyard syncs with the repo. While it involves an extra setup, during changes/upgrades, we can see exactly what is changing as all changes, include spinnaker configuration can be routed via git-PRs.

Use below command to check if helm is installed or not
```
helm version
```
If helm is not setup, follow https://helm.sh/docs/intro/install/ to install helm.

Installing with Non-Gitops Method

Add spinnaker helm repo to your local machine
```
helm repo add spinnaker https://opsmx.github.io/spinnaker-helm/
```
Note: If spinnaker helm repo is already added, do a repo update before installing the chart
```
helm repo update
```
Use below command to create the namespace
```
kubectl create namespace opsmx-oss
```
Use below command to install the helm chart using Non-Gitops Method:
```
helm install oss-spin spinnaker/spinnaker -n opsmx-oss --timeout 600s
```
Tip: For more information of changing the default values file please check

Accessing Spinnaker after installation

Check the status of the pods by executing this command:
```
kubectl -n opsmx-oss get po
```
Once all pods show "Running" or "Completed" status and Use port-forward command to access the Spinnaker:
```
kubectl -n opsmx-oss port-forward svc/spin-deck 9000  ## Keep running, it shows messages such as "Forwarding from 127.0.0.1:9000 -> 9000
```
Now, open your browser and navigate to http://localhost:9000

Alternatively, you can route traffic via Ingress/LB to the spin-deck and spin-gate services. Details are here.

Gitops Method

In this method all the halyard configuration will be centralised in Git Repository.
- Create an empty repo(called as "gitops-halyard") branch "main" as default, and clone to the local-machine.
- Clone the repo
```
git clone https://github.com/OpsMx/standard-gitops-halyard.git
```
- Copy contents of the standard-gitops-halyard repo to the gitops-halyard repo
```
cp -r standard-gitops-halyard/* gitops-halyard # Replace "gitops-halyard" with your repo-name
```
- cd to the newley created repo
```
cd gitops-halyard
```
```
 git add -A; git commit -m"Upgrade related changes";git push
```
Use minimal-values.yaml inside charts/spinnaker folder Ex: https://github.com/OpsMx/spinnaker-helm/blob/1.30.1/charts/spinnaker/minimal-values.yaml
Update the gitorg, gitrepo, gituser, dynaaccrepo, gittoken and save the minimal-values.yaml
Use below command to install oss in gitops method.
```
helm install oss-spin spinnaker/spinnaker -f minimal-values.yaml --timeout 600s -n opsmx-oss
```
Note: Make sure the same release name is used during installation.

Securing Secret Credentails in the Halyard Git repo (Optional)

Note: Secrets in Halyard are plain-text, storing them as-is in Git repository is a security concern. We can replace all the Secrets/passwords in halyard config with a placeholder before committing them to the Git repository. During the halyard pod startup, these secrets are evaluated to their original value through an init container.

Create one or more K8s secrets in the same namespace where Spinnaker is running, with your credentials.

kubectl -n opsmx-oss create secret generic <SecretName> --from-literal=<SecretKey>=<SecretValue> --from-file=myk8saccount-kube.config #File name becomes SecretKey

Or, Use below yaml file (hal-secrets.yml) to create the secret

apiVersion: v1
kind: Secret
metadata:
name: hal-secrets
stringData:
prodjenkinspwd: jenkinspassword
gitopstoken: gittoken
myk8saccount-kube.config: <kubeconfig-content>
type: Opaque

kubectl -n opsmx-oss apply -f hal-secrets.yml

Edit the hal config file (e.g: gitops-halyard/config) and update every password/confidential text as per the format here.
- For passwords, the placeholder is
```
encrypted:<K8s-SecretName>:<SecretKey>
```
- For kubeconfig and other confidential files, the placeholder is
```
encryptedFile:<K8s-SecretName>:<SecretKey>
```
Note: The K8s-SecretName and SecretKey should be matching the secret created.
A sample of the Hal config - before GitOps and after GitOps
- Before GitOps - Sample:
```
github:
  enabled: true
  accounts: 
  - name: githubdemo_account
    username: "GITUSERNAME"
    token: "5cb4371fxxxxxxxxx5"
```
- After GitOps - Sample:
```
github:
  enabled: true
  accounts: 
  - name: githubdemo_account
    username: "john"
    token: "encrypted:hal-secrets:gitopstoken"
```
Note: After creating the secrets and updating the hal config file, you are now ready to commit the files to your remote git repository. Go ahead and complete it. Any changes you make in Halyard should be manually committed to Git repository; otherwise with every Halyard restart the changes will be gone and git repo content is the source of the truth for Gitops Halyard repo.

Support

Limited support is available on Spinnaker Slack (spinnakerteam.slack.com).

Channel: opsmx

License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

OpsMx / spinnaker-helm

readme