Configuring Hybrid Manager

• Syncing images to a local private registry
  • Prerequisites
  • Configure sync variables
  • Sync platform images
  • Sync Operator image
  • Update configuration
  • Next steps
• Configuring image discovery
  • Prerequisites
    • Overview
    • Configure Helm Chart
  • imageDiscovery
  • imagesetDiscoveryContainerRegistryURL
    • imagesetDiscoveryAllowInsecureRegistry
    • imagesetDiscoveryAuthenticationType
  • image_discovery_credentials_secret_name
    • Configure registry permissions
  • Generic / on-Premises (RKE2/OpenShift)
  • AWS Elastic Container Registry (ECR)
  • Google Artifact Registry (GAR)
    • Configure Kubernetes Secret
• Implementing TLS certificates
  • Set up a custom x.509 certificate for the Hybrid Manager Portal
    • Generate the certificate
    • Create the yaml file
    • Apply the secret in your Kubernetes cluster
    • Edit the Helm chart
    • Update the Helm chart
  • Set up a custom cert-manager issuer for the HM Portal
  • Bring your own private certificate authority
• Enabling GenAI Builder
  • Creating a secret for GenAI Builder
  • Configuring DataLake object storage for GenAI builder
  • Configuring CORS
  • Backing up the Fernet key
• Enabling data catalogs
  • Creating a secret with the key
  • Backing up the confounding key
• Customizing Migration Portal secrets for secure internal communication
  • Understanding Migration Portal secrets
    • Migration Portal database account
    • Migration Portal database superuser account
    • Migration Copilot HTTP access from Migration Portal
    • Migration Copilot and Migration Portal database account
    • Monitoring and Migration Copilot
  • Overriding the default secrets
    • Creating secrets
    • Apply the secrets to your installation
    • Back up the secrets
• Configuring multiple data centers for Hybrid Manager
  • Overview
    • Why run Hybrid Manager (HM) across multiple data centers?
    • RTO/RPO at a glance
    • RPO (data loss window):
    • What this guide helps you do
    • Current limitations
    • Architecture at a glance
    • Who is this for?
  • Prerequisites
    • Architecture prereqs
    • Discover and set necessary environment variables
  • Object storage across locations
    • Key requirement
    • EKS (IRSA) trust policy
  • Setup options
    • Option A — Quick start (master script)
    • Option B — Manual setup (advanced/customizable)
    • Retrieve the necessary scripts
    • Run the scripts to setup multi-DC
  • SPIRE federation details (what/why/how)
  • Beacon configuration (Primary & Secondary)
    • Primary: allow Secondary trust domain
    • Secondary: point agent to Primary Beacon
    • Federate Agent (Beacon) SPIFFE IDs (required)
  • Telemetry federation (optional)
    • Thanos (metrics)
    • Fluent Bit/Loki (logs)
    • Prereqs recap
    • Discover important values (run against each cluster where noted):
    • Export environment variables you’ll reuse:
    • Multi-DC Beacon Helm install (Primary)
    • Multi-DC Beacon Helm install (Secondary)
    • Beacon ClusterSPIFFEID federation (both directions)
    • Validate wiring
    • Create the cross-DC Postgres topology
    • Typical flow
    • Operational notes
  • Validation (end-to-end)
  • Manual failover runbook
    • Manual failover procedure from Primary to Secondary
    • Operator tips
  • Troubleshooting
  • Appendix A — SPIRE federation via CLI (optional)
  • Appendix B — Quick daily checks
• Configuring your own identity provider
  • Configuring LDAP
    • Creating an Okta user for LDAP integration
    • Configuring Dex to connect to Okta via LDAP connector
    • Parameters
    • Applying Dex configuration
    • Assign new owner and disable native user
  • Configuring SAML
    • Creating a SAML application
    • Configuring Dex to connect to Okta via SAML connector
    • Parameters
    • Applying Dex configuration
    • Assigning new owner and disabling native user
• Enabling Key Management Systems (KMS) for TDE
  • Adding KMS support
    • HashiCorp Vault
    • AWS KMS
    • Google KMS
    • Next steps
  • HashiCorp Vault
    • Installing Vault
    • Configuring Vault and creating a key
    • Assigning the Vault key to a project
  • AWS Key Management Service (KMS)
    • Prerequisites
    • Creating the AWS KMS key
    • Assigning the AWS KMS key to a project
  • Google Cloud Key Management Service (Cloud KMS)
    • Prerequisites
    • Creating the Google Cloud KMS key
    • Assigning the Google Cloud KMS key to a project
  • Deleting a key