Configuring SOPs

• Syncing images to a local private registry
  • Prerequisites
  • Configure sync variables
  • Update configuration
  • Next steps
• Using the in-cluster container registry
  • Prerequisites
  • Security considerations
  • Loading images into HMRegistry
  • Configure the HybridControlPlane to use the HMRegistry
  • Switching back to a registry external to HM
• Configuring image discovery
  • Prerequisites
    • Overview
    • Configure image discovery
  • imageDiscovery
  • imagesetDiscoveryContainerRegistryURL
    • imagesetDiscoveryContainerRegistryProvider
  • imagesetDiscoveryAllowInsecureRegistry
    • imagesetDiscoveryAuthenticationType
  • image_discovery_credentials_secret_name
    • Configure registry permissions
  • Generic / on-Premises (RKE2/OpenShift)
  • Azure Container Registry (ACR)
  • AWS Elastic Container Registry (ECR)
  • Additional configuration for package installation
  • Google Artifact Registry (GAR)
  • GitLab Container Registry
    • Configure Kubernetes Secret
• Customizing secrets
  • Customizing GenAI Builder secrets
    • Creating GenAI Builder secrets
  • Customizing Catalog secrets
    • Creating Catalog secret
  • Customizing Migration Portal secrets for secure internal communication
    • Creating Migration Portal secrets using edbctl
      • Overriding existing secrets manually
    • Creating secrets
    • Apply the secrets to your installation
    • Back up the secrets
      • Understanding Migration Portal secrets
    • Migration Portal database account
    • Migration Portal database superuser account
    • Migration Copilot HTTP access from Migration Portal
    • Migration Copilot and Migration Portal database account
    • Monitoring and Migration Copilot
• Implementing TLS certificates
  • Set up a custom x.509 certificate for the Hybrid Manager Portal
    • Generate the certificate
    • Create the yaml file
    • Apply the secret in your Kubernetes cluster
    • Configure HM to use the new certificate
  • Set up a custom cert-manager issuer for the HM Portal
  • Bring your own private certificate authority
• Configuring object storage
  • Provider configurations
    • AWS IAM (EKS and ROSA)
    • AWS static credentials (generic Kubernetes)
    • Azure Blob Storage
    • GCP object storage
    • Other S3-compatible storage
  • Providing a CA bundle
    • Using aws_ca_bundle (raw PEM)
    • Using aws_ca_bundle_base64 (base64-encoded PEM)
  • Configuring per-project object storage
• Deploying Hybrid Manager across multiple data centers
  • Multi-DC for high availability
    • Architecture and roles: Hub and Spoke
      • The primary (The Hub)
      • The secondaries (The Spokes)
      • Data plane & storage
    • Topologies
    • Resilience and failover
    • Network latency in Distributed High Availability (DHA) clusters
    • HM backups and DR for multi-DC environments
    • Current limitations
  • Configuring a Hybrid Manager deployment across multiple data centers
    • Before you start
    • Prerequisites
      • Architecture prerequisites
      • Collect the required information
    • Object storage across locations
      • Key requirement
    • Parameter uniqueness
    • Configure the multi-DC topology
    • Reduced set of components (Spoke clusters only)
    • Hybrid Manager installation
      • Validate wiring
      • Create a Postgres database cluster across different data centers
      • Operational notes
    • Validation (end-to-end)
    • Manual failover
      • Manual failover procedure for databases from the primary location to a secondary location
    • Troubleshooting
    • Appendix B — Quick daily checks
• Enabling Key Management Systems (KMS) for TDE
  • Adding KMS support
    • HashiCorp Vault
    • AWS KMS
    • Azure KMS
    • Google KMS
    • Next steps
  • HashiCorp Vault
    • Installing Vault
    • Configuring Vault and creating a key
    • Assigning the Vault key to a project
  • AWS Key Management Service (KMS)
    • Prerequisites
    • Creating the AWS KMS key
    • Assigning the AWS KMS key to a project
  • Azure Key Vault (Key Management Service)
    • Prerequisites
    • Creating the Azure Key Vault key
    • Granting workload identity access to the key
    • Assigning the Azure Key Vault key to a project
  • Google Cloud Key Management Service (Cloud KMS)
    • Prerequisites
    • Creating the Google Cloud KMS key
    • Assigning the Google Cloud KMS key to a project
  • Deleting a key
• Optimizing service mesh memory
  • Understanding Istio memory requirements
  • Recommended memory limits
  • Configuring Istio memory limits
  • Monitoring Istio memory usage
    • Using Grafana dashboards
    • Check for memory-related issues
• API audit logging
  • What gets audited
  • Disabling API audit logging
  • Re-enabling API audit logging
  • Querying audit logs
    • Viewing audit logs in Grafana
    • Using kubectl
  • Log format
  • Log fields