Installing Hybrid Manager on AWS EKS using the Hybrid Manager Operator

Installing Hybrid Manager on AWS EKS using the Hybrid Manager Operator#

You can install the Hybrid Manager on Amazon EKS using the Hybrid Manager Operator. This is a Helm chart that deploys the Hybrid Manager platform on your EKS cluster. The operator is responsible for managing the lifecycle of the Hybrid Manager platform, including installing, upgrading, and uninstalling the platform.

Important

Complete the Prerequisites for AI Factory on Hybrid Manager before you start this part of the installation process. It will step through the process of creating an EKS cluster, installing the necessary components, and configuring the environment ready for the Hybrid Manager Operator.

Set the version to install#

The version of the EDB Hybrid Manager platform is set by the environment variable EDB_PLATFORM_VERSION. This should be set to the version of the platform you wish to install. For example, to install version v1.2.0, you would set the environment variable as follows:

export EDB_PLATFORM_VERSION="v1.2.0"

Set your token#

This installation process requires that you save your EDB subscription token as an environment variable. You can obtain it by going to your EDB Account Profile . (Log in if prompted to.) There you will find an entry for Repos 2.0 token:

Repo Token

Repo Token#

Take this value and set it as an environment variable:

export EDB_SUBSCRIPTION_TOKEN="your-token"

Obtain the bootstrap kit#

Hybrid Manager is installed using a bootstrap kit. This kit is a collection of scripts and charts that are used to install the EDB Hybrid Manager platform.

  • :ref;`eks-install-operator.sh <eks-install-operator.sh>` - This script installs the Hybrid Manager Operator on your EKS cluster.

  • :ref;`eks-install-secrets.sh <eks-install-secrets.sh>` - This script installs the secrets required for the installation process.

  • :ref;`prepare-op.sh <prepare-op.sh>` - This script prepares the values file for the installation process.

  • :ref;`default-env.sh <default-env.sh>` - This file contains the default environment variables for the installation process.

  • :ref;`hm-default.yaml <hm-default.yaml>` - This file contains the default values for a configuration.

Copy all files to a directory on your local machine and cd into that directory.

Install the Hybrid Manager Operator#

To install the Hybrid Manager Operator, run the eks-install-operator.sh script. (As you already set the token as an environment variable, you can pipe it into the script). You will also need to set the environment variable OPERATOR_VERSION to the version of the operator you wish to install, for example v1.2.0 . This will typically be the same version as the EDB Hybrid Manager platform you are installing, so you can set it as follows:

export OPERATOR_VERSION=$EDB_PLATFORM_VERSION

Then you can run the script to install the operator:

echo $EDB_SUBSCRIPTION_TOKEN | $SHELL eks-install-operator.sh

Install secrets#

The install process requires a number of secrets to be installed in the Kubernetes cluster. These secrets are used to authenticate with the EDB Download Repository and to store the credentials for the EDB Software Deployment platform.

to install the secrets required for the bootstrap process, run the install-secrets.sh script. (As you already set the token as an environment variable, you can pipe it into the script.)

echo $EDB_SUBSCRIPTION_TOKEN | $SHELL eks-install-secrets.sh

Enter the password for pgai-platform@docker.enterprisedb.com
namespace/edbpgai-bootstrap created
namespace/upm-replicator created
secret/edb-cred created
secret/edb-cred created
secret/edb-cred annotated
namespace/upm-griptape created
secret/fernet-secret created
namespace/upm-lakekeeper created
secret/pg-confounding-key created
PG_CONFOUNDING_KEY is 01234567890123456789ABCDEFG - store safely

This process creates secrets needed for Hybrid Manager to run. You can find out more about these secrets in:

  • **

A secret for Griptape and configures DeltaLake object storage (optional for GenAI Builder)**

  • **

A secret for Catalog (optional for using Catalog)**

  • See also **

custom secrets for Migration Portal (optional to secure internal

communications with Migration Portal)**

Prepare the values file#

The bootstrap process requires a number of values to be set in the Helm chart. These values are stored in a file called values.yaml . You can create this file by running the prepare.sh script, which uses variables from the default-env.sh file. Edit the default-env.sh file to set the values you require.

This is the default default-env.sh file:

#  exports for EKS

export EDB_PLATFORM_VERSION="v1.2.0"
export CONTAINER_REGISTRY_URI="docker.enterprisedb.com/pgai-platform"
export IMAGESET_REGISTRY_URI=$CONTAINER_REGISTRY_URI
export IMAGESET_AUTHTYPE="token"
export PORTAL_DOMAIN_NAME="portal.foo.network"
export TRANSPORTER_RW_SERVICE_DOMAIN_NAME="transporter.foo.network"
export BEACON_SERVICE_DOMAIN_NAME="beacon.foo.network"
export AUTHENTICATION_EMAIL="owner@mycompany.com"
export AUTHENTICATION_USER="owner@mycompany.com"
export LOCATION_NAME="default-location"
export STORAGE_CLASS="gp2"
export TRANSPORTER_FIPS_ENABLED=false

#  Set a password hash for the user or pass a password to have it hashed for you.

#  If you pass a password, you will need to remove it from your history.

#  You can hash a password using the following command:

#  echo -n "password" | htpasswd -BinC 10 admin | cut -d: -f2

#

#  export AUTHENTICATION_PASSWORD="password"

#  If setting AUTHENTICATION_PASSWORD_HASH, ensure it is single quoted to prevent variable expansion (e.g. $2y$10$...).

export AUTHENTICATION_PASSWORD_HASH=$2y$10$vKOAXfLHbeV1OQxMpxlLdOIwnX.JAN.ZrD9ZU//ocrNQwhQIMtXhy

Here is a brief guide to the variables in the default-env.sh file.

Variable

Description

CONTAINER_REGISTRY_URI

The URI of the container registry to use. This is set to the EDB Download Repository.

IMAGESET_REGISTRY_URI

The URI of the image set registry. This is set to the EDB Download Repository.

IMAGESET_AUTHTYPE

The authentication type for the image set registry. Set to token as we are using a token to authenticate with the EDB Download Repository.

PORTAL_DOMAIN_NAME

The domain will serve as the public URL for accessing the HM Console. See recommendation below.

TRANSPORTER_RW_SERVICE_DOMAIN_NAME

The domain name for the Data Migration Service (internally transporter). See recommendation below.

BEACON_SERVICE_DOMAIN_NAME

The domain name for the beacon service.

AUTHENTICATION_EMAIL

The email address of the user to create.

AUTHENTICATION_USER

The username of the user to create.

AUTHENTICATION_PASSWORD

The password of the user to create. This can be set as plain text or as a hash with AUTHENTICATION_PASSWORD_HASH.

AUTHENTICATION_PASSWORD_HASH

The hash of the password to create.

LOCATION_NAME

The location name for the Agent, formerly known as Beacon Agent.

STORAGE_CLASS

The storage class to use for the installation. This is set to gp2 for EBS volumes on AWS.

TRANSPORTER_FIPS_ENABLED

Whether to enable FIPS mode for the Transporter service.

!!!note Recommendations for PORTAL_DOMAIN_NAME and TRANSPORTER_RW_SERVICE_DOMAIN_NAME

For consistency and ease of management, derive your TRANSPORTER_RW_SERVICE_DOMAIN_NAME from your PORTAL_DOMAIN_NAME. The most common approach is to replace the portal subdomain with dms .

The following table illustrates this relationship using a variety of examples based on the top-level domain examplecompany.com .

PORTAL_DOMAIN_NAME

TRANSPORTER_RW_SERVICE_DOMAIN_NAME

portal.examplecompany.com

dms.examplecompany.com

portal-dev.examplecompany.com

dms-dev.examplecompany.com

portal.hm001.examplecompany.com

dms.hm001.examplecompany.com

portal-hm-us-east-001.examplecompany.com

dms-hm-us-east-001.examplecompany.com

Run the prepare-op.sh script to create the values.yaml file.

$SHELL prepare-op.sh

This create a values.yaml file with the values set in the default-env.sh file.

You need to create two values for the bootstrap process. These are the AES_256_KEY and the AUTHENTICATION_PASSWORD_HASH. You can create these values with the following commands:

export AES_256_KEY=$(openssl rand -base64 32)

If you have a password to hash, you can do so with the following command:

export AUTHENTICATION_PASSWORD_HASH=$(echo -n $AUTHENTICATION_PASSWORD | htpasswd -BinC 10 admin | cut -d: -f2)

You now need to edit values.yaml file and set the values required for your installation. Find the appropriate key in the values.yaml file and set the values as follows. Replace $<name> entries with the value you have set the environment variables of the same name to.

  1. Set spec.componentsParameters.upm-istio-gateway.cookie_aeskey to $AES_256_KEY.

  2. Set spec.imageRegistry to $CONTAINER_REGISTRY_URI.

  3. Set spec.globalParameters.portal_domain_name to $PORTAL_DOMAIN_NAME.

  4. Set spec.componentsParameters.transporter-rw-service.domain_name to $TRANSPORTER_RW_SERVICE_DOMAIN_NAME.

  5. Set parameters.transporter-dp-agent.rw_service_url to https:// followed by $TRANSPORTER_RW_SERVICE_DOMAIN_NAME followed by /transporter . Following the first of the previously provided examples, this would be https://dms.examplecompany.com/transporter .

  6. Set spec.componentsParameters.upm-beacon.server_host to $BEACON_SERVICE_DOMAIN_NAME.

  7. Set spec.pgai.portal.authentication.staticPasswords[0].email to $AUTHENTICATION_EMAIL.

  8. Set spec.pgai.portal.authentication.staticPasswords[0].hash to $AUTHENTICATION_PASSWORD_HASH.

  9. Set spec.pgai.portal.authentication.staticPasswords[0].username to $AUTHENTICATION_USER.

  10. Set spec.pgai.portal.authentication.staticPasswords[0].userID “c5998173-a605-449a-a9a5-4a9c33e26df”.

  11. Set spec.beaconAgent.location to $LOCATION_NAME

  12. Set spec.globalParameters.storage_class to $STORAGE_CLASS.

  13. Set spec.componentsParameters.transporter-data-operator.fips_enabled to $TRANSPORTER_FIPS_ENABLED. (Ensure the boolean value is quoted as it is handled as a string.)

The hm-values.yaml file should now contain the values required for the installation process.

Install the Hybrid Manager platform#

The next step is to apply the values file which you created in the previous step to the Hybrid Manager Operator. This will trigger the installation of the Hybrid Manager platform on your EKS cluster.

kubectl apply -f ./hm-values.yaml

You can check the status of the installation by running:

kubectl get hybridcontrolplanes.edbpgai.edb.com

When complete, the output should look similar to this:

NAME      PHASE
edbpgai   deployed

If not deploying, run:

kubectl get hybridcontrolplanes.edbpgai.edb.com -o yaml

For more information on the status of the installation, you can check the logs of the Hybrid Manager Operator:

Configure host name resolution#

Obtain the IP address of your ingress gateway. Run:

kubectl -n istio-system get service istio-ingressgateway -o jsonpath={.status.loadBalancer.ingress[0].hostname} | strings | nslookup

This command returns output like:

Server:         192.168.111.1
Address:        192.168.111.1#53

Non-authoritative answer:
Name:   k8s-istiosys-istioing-b3dc9b4f3c-81dc5c45b1d5f6d2.elb.us-east-1.amazonaws.com
Address: 52.70.180.102

You now need to configure your DNS service or your /etc/hosts file to point the domains specified in default-env.sh to the IP address you obtained from the command above. Those domains are in PORTAL_DOMAIN_NAME , TRANSPORTER_RW_SERVICE_DOMAIN_NAME , and BEACON_SERVICE_DOMAIN_NAME . In the example above, they are set to portal.examplecompany.com , dms.examplecompany.com , and beacon.examplecompany.com respectively.

Configure DNS#

In your DNS configuration, create a CNAME record for each of these domains that points to the IP address you obtained. So for our example, you would create the following records in your DNS zone file for examplecompany.com :

cluster IN A 52.70.180.102
portal      IN CNAME cluster.examplecompany.com
transporter IN CNAME cluster.examplecompany.com
beacon      IN CNAME cluster.examplecompany.com

This is a simplified example. The actual configuration will depend on your DNS provider and how you manage your DNS records.

Configure /etc/hosts (if no DNS service)#

If you don’t have a DNS service configured, consider adding the IP address to your local /etc/hosts file. This addition allows you to access Hybrid Manager Console using the domain name you set in the default-env.sh file.

You can then add IP address to your /etc/hosts file like this:

echo "52.70.180.102 portal.examplecompany.com dms.examplecompany.com beacon.examplecompany.com" | sudo tee -a /etc/hosts

Substitute the IP address with the value you obtained earlier. This is a temporary solution and should not be used in production environments. We recommend that you use a proper DNS service for production deployments. The settings in the /etc/hosts file works only on the machine where you set them.

Next steps#

You can now verify the installation by connecting to the HM Console .

Contents