Installing Hybrid Manager

Installing Hybrid Manager

This section contains everything you need to install and configure Hybrid Manager (HM).

• ** Installation guide ** — The six-phase guide covering architecture planning through post-installation configuration. Start here for new installations.

• ** Step 3: Task Configuration ** — Detailed SOPs for advanced configuration topics: TLS, IdPs, KMS for TDE, multi-DC, image sync, and more.

• ** Migrate from bootstrap to operator ** — For existing bootstrap installations migrating to the operator method.

• ** Troubleshooting Langflow in Hybrid Manager ** — Guidance for diagnosing and resolving installation issues.

• step-by-step guide
  • Overview
  • Phase 1: Planning your architecture
  • Phase 2: Gathering your system requirements
  • Phase 3: Deploying your Kubernetes cluster
  • Phase 4: Preparing your environment
  • Phase 5: Installing Hybrid Manager
  • Phase 6: Exploring your post-installation options
  • Configuring HM
    • Planning your architecture
      • Overview
        • Prerequisites
        • Outcomes
      • Architectural discovery
        • Locality: Where will HM live?
        • Disaster recovery (hot/cold)
        • Activeness (Active/Passive vs. Active/Active)
        • Lifecycle operations
      • Supported platforms
        • Diagram legend reference
      • HM Control Plane vs. Data Plane
        • Protocol and ingress
        • Lifecycle isolation
        • Availability and disaster recovery
      • Deployment architectures
        • Internal architecture: HM Control Plane
        • Architectural dependencies
        • HM Control Plane + Data Plane
        • HM fully featured deployment
      • Multi-location topologies in EDB Hybrid Manager
        • Control Plane: star topology
        • Data Plane: optional mesh topology
        • Relationship between the two topologies
      • Choosing an installation scenario
        • Values needed for the configuration
        • Configuration details
        • Impact on configuration file
      • Next phase
    • Gathering your system requirements
      • Overview
        • Prerequisites
        • Outcomes
      • Connection to architecture
      • Deployment readiness checklist
      • 1. Management workstation (Bastion host)
        • General requirements
        • Required tooling inventory
      • 2. Kubernetes platform verification
        • Configuration dependencies
      • 3. Compute (Node requirements)
        • Node roles summary
        • 3.1 Control plane nodes
        • 3.2 Data plane nodes
        • 3.3 AI model nodes
        • Node abstractions
        • Node allocatable resources requirements
      • 4. Local networking
        • Local network requirements
        • Container Network Interface (CNI)
      • 5. Ingress
        • 5.1 Load balancer controller
        • 5.1.2 NodePort alternative
        • 5.2 DNS
        • Internal cluster DNS & NTP
        • Configuration dependencies
        • DNS configuration strategy
        • 5.3 Certificate management
        • Decision matrix
        • Configuration dependencies by strategy
      • 6. Block storage (Database & logs)
        • Control plane requirements
        • Data plane requirements (Postgres)
        • Notable considerations
        • Configuration dependencies
        • 6.1 Volume snapshots
        • 6.2 Excluding storage from Hybrid Manager discovery
      • 7. Object storage
        • General requirements
        • Authentication strategies
        • Configuration dependencies
        • Configuration file
      • 8. Container registry
        • Choosing a registry approach
        • Preparation
      • 9. Identity provider (IdP)
      • 10. Key management service (KMS)
        • Configuration dependencies
        • Configuration file
      • Impact on configuration
        • Requirements inventory guide
        • General & platform
        • Networking & ingress
        • Storage & registry
        • Security & identity
        • Certificates (Choose one strategy)
        • Example configuration
      • Next phase
    • Deploying your Kubernetes cluster
      • Overview
        • Prerequisites:
        • Outcomes
        • Start the provisioning process
      • Set up your management workstation
        • Install core tooling
        • Verify connectivity
        • Block storage configuration
        • Ingress
      • Post-deployment validation
        • Verify API Access
        • Verify Storage Capability
        • Verify Identity (Cloud Only)
      • Next phase
    • Preparing your environment
      • Overview
        • Prerequisites
        • Outcomes
        • Phase 4 guide
      • Creating secrets
        • Create image pull secret
        • Create component secrets
        • Create object storage secret
      • Implementing TLS
      • Configuring advanced features
        • Configuring multi-location architecture
        • Implementing KMS for TDE
      • Completing environmental preparation
        • Name your backup folder
        • Add required component configuration
      • Finalizing the cluster configuration
        • Create the HybridControlPlane Custom Resource
      • Validating the configuration file, secrets, LoadBalancer, and cluster readiness
        • Validate configuration syntax
        • Validate secrets
        • Validate LoadBalancer
        • Run diagnostic tooling
      • Next phase
    • Install Hybrid Manager
      • Overview
        • Prerequisites
        • Outcomes
      • Install Hybrid Manager
        • Understanding the HybridControlPlane Custom Resource
        • Key benefits of the operator approach
        • Verify final configuration
        • Example HybridControlPlane manifest
        • Install the EDB Postgres AI Operator
        • Add the EDB Helm repository
        • Create namespace
        • Install the operator helm chart
        • Verify operator installation
        • Manual Helm fallback
        • Create the HybridControlPlane resource
        • Prepare your HM manifest
        • Apply the HM resource
        • Monitor installation progress
        • Check HM status
        • Use kubectl to monitor
        • Check component deployment
        • Check postflight
        • Managing the HybridControlPlane
        • Updating configuration
        • Checking operator logs
        • Upgrading HM version
      • Verify portal access
      • Next phase
    • Exploring your post-installation options
      • Overview
        • Prerequisites
        • Outcomes
        • Configuring identity providers (IdP)
      • Unlock AI capabilities: Complete GenAI Builder setup
      • Set up notifications (Observability)
      • Monitor external databases (Observability)
      • Enable Migration Co-pilot
        • Next steps
• Configuring SOPs
  • Syncing images to a local private registry
    • Prerequisites
    • Configure sync variables
    • Update configuration
    • Next steps
  • Using the in-cluster container registry
    • Prerequisites
    • Security considerations
    • Loading images into HMRegistry
    • Configure the HybridControlPlane to use the HMRegistry
    • Switching back to a registry external to HM
  • Configuring image discovery
    • Prerequisites
      • Overview
      • Configure image discovery
    • imageDiscovery
    • imagesetDiscoveryContainerRegistryURL
      • imagesetDiscoveryContainerRegistryProvider
    • imagesetDiscoveryAllowInsecureRegistry
      • imagesetDiscoveryAuthenticationType
    • image_discovery_credentials_secret_name
      • Configure registry permissions
    • Generic / on-Premises (RKE2/OpenShift)
    • Azure Container Registry (ACR)
    • AWS Elastic Container Registry (ECR)
    • Additional configuration for package installation
    • Google Artifact Registry (GAR)
    • GitLab Container Registry
      • Configure Kubernetes Secret
  • Customizing secrets
    • Customizing GenAI Builder secrets
      • Creating GenAI Builder secrets
    • Customizing Catalog secrets
      • Creating Catalog secret
    • Customizing Migration Portal secrets for secure internal communication
      • Creating Migration Portal secrets using edbctl
        • Overriding existing secrets manually
      • Creating secrets
      • Apply the secrets to your installation
      • Back up the secrets
        • Understanding Migration Portal secrets
      • Migration Portal database account
      • Migration Portal database superuser account
      • Migration Copilot HTTP access from Migration Portal
      • Migration Copilot and Migration Portal database account
      • Monitoring and Migration Copilot
  • Implementing TLS certificates
    • Set up a custom x.509 certificate for the Hybrid Manager Portal
      • Generate the certificate
      • Create the yaml file
      • Apply the secret in your Kubernetes cluster
      • Configure HM to use the new certificate
    • Set up a custom cert-manager issuer for the HM Portal
    • Bring your own private certificate authority
  • Configuring object storage
    • Provider configurations
      • AWS IAM (EKS and ROSA)
      • AWS static credentials (generic Kubernetes)
      • Azure Blob Storage
      • GCP object storage
      • Other S3-compatible storage
    • Providing a CA bundle
      • Using aws_ca_bundle (raw PEM)
      • Using aws_ca_bundle_base64 (base64-encoded PEM)
    • Configuring per-project object storage
  • Deploying Hybrid Manager across multiple data centers
    • Multi-DC for high availability
      • Architecture and roles: Hub and Spoke
        • The primary (The Hub)
        • The secondaries (The Spokes)
        • Data plane & storage
      • Topologies
      • Resilience and failover
      • Network latency in Distributed High Availability (DHA) clusters
      • HM backups and DR for multi-DC environments
      • Current limitations
    • Configuring a Hybrid Manager deployment across multiple data centers
      • Before you start
      • Prerequisites
        • Architecture prerequisites
        • Collect the required information
      • Object storage across locations
        • Key requirement
      • Parameter uniqueness
      • Configure the multi-DC topology
      • Reduced set of components (Spoke clusters only)
      • Hybrid Manager installation
        • Validate wiring
        • Create a Postgres database cluster across different data centers
        • Operational notes
      • Validation (end-to-end)
      • Manual failover
        • Manual failover procedure for databases from the primary location to a secondary location
      • Troubleshooting
      • Appendix B — Quick daily checks
  • Enabling Key Management Systems (KMS) for TDE
    • Adding KMS support
      • HashiCorp Vault
      • AWS KMS
      • Azure KMS
      • Google KMS
      • Next steps
    • HashiCorp Vault
      • Installing Vault
      • Configuring Vault and creating a key
      • Assigning the Vault key to a project
    • AWS Key Management Service (KMS)
      • Prerequisites
      • Creating the AWS KMS key
      • Assigning the AWS KMS key to a project
    • Azure Key Vault (Key Management Service)
      • Prerequisites
      • Creating the Azure Key Vault key
      • Granting workload identity access to the key
      • Assigning the Azure Key Vault key to a project
    • Google Cloud Key Management Service (Cloud KMS)
      • Prerequisites
      • Creating the Google Cloud KMS key
      • Assigning the Google Cloud KMS key to a project
    • Deleting a key
  • Optimizing service mesh memory
    • Understanding Istio memory requirements
    • Recommended memory limits
    • Configuring Istio memory limits
    • Monitoring Istio memory usage
      • Using Grafana dashboards
      • Check for memory-related issues
  • API audit logging
    • What gets audited
    • Disabling API audit logging
    • Re-enabling API audit logging
    • Querying audit logs
      • Viewing audit logs in Grafana
      • Using kubectl
    • Log format
    • Log fields
• Migrating from bootstrap to operator installation
  • Overview
  • Understanding the migration challenge
    • The Helm ownership conflict
    • Why this happens
    • The CRD deletion problem
  • Prepare the migration with edbctl
    • Run the conversion
  • Manual fallback for edbctl less than 1.7.0
    • Configuration mapping reference
    • Convert using the migration script
    • Helm ownership transfer (manual)
    • How it works
    • Prerequisites
    • Step 1: Delete bootstrap deployments
    • Step 2: Transfer Helm ownership - ServiceAccount
    • Step 3: Transfer Helm ownership - CRDs
    • Step 4: Transfer Helm ownership - ClusterRoles
    • Step 5: Transfer Helm ownership - ClusterRoleBindings
    • Step 6: Transfer Helm ownership - Roles
    • Step 7: Transfer Helm ownership - RoleBindings
    • Step 8: Transfer Helm ownership - Services
    • Step 9: Transfer Helm ownership - Webhook Configurations
    • Step 10: Verify ownership transfer
  • Support
  • Next steps
• Troubleshooting Hybrid Manager installations
  • Understanding Preflight checks
    • Prerequisites
    • Outcomes
    • Checking the preflight status
    • Understanding the states
    • Troubleshooting preflight failures
      • Installation appears stuck
      • Secret not found
      • Validation rule failures
      • Requirements not being checked
  • Monitoring with Postflight checks
    • Prerequisites
    • Outcomes
    • What postflight checks do
    • Checking the postflight status
      • Quick overview
      • Detailed results
    • Troubleshooting unhealthy checks
      • Pods check is failing
      • Databases check is failing
      • Velero backup check is failing
      • Nodes check is failing
      • Certificates check is failing
    • Configuring the check interval