Pre-install checklist¶
This checklist should be used to verify all requirements have been met prior to any installation.
For many of these items, we have provided some commands or commmand templates to run in order to verify the given prequisite, along with a typical output to give you an idea of the kind of information you should be given. Please run each of these commands, modified as appropriate for your environment, and copy the outputs into a document for sending to the Anaconda implementation team so that they may verify that the requirements are ready.
Basic requirements¶
An administration server has been provisioned with appropriate versions of
kubectl
,helm
, and other tools needed to perform installation and administration tasks.Command:
helm version
:The API version of the Kubernetes cluster is between 1.15 and 1.24.
Command:
kubectl version
:All nodes nodes on which Anaconda Enterprise will be installed have sufficient CPU and memory allocations.
Command:
kubectl get nodes -o=jsonpath="{range .items[*]}{.metadata.name}{'\t'}{.status.capacity.cpu}{'\t'}{.status.capacity.memory}{'\n'}{end}"
:
Access control and security¶
The namespace into which Anaconda Enterprise will be installed has been created.
Command:
kubectl describe namespace <NAMESPACE>
:The service account that will be used during the installation process as well as by Anaconda Enterprise itself, has been created.
Command:
kubectl describe sa <SERVICEACCOUNT>
:(Openshift) The Security Context Constraint (SCC) associated with the service account contains all of the necessary permisisons. Note the example below uses the
anyuid
scc, however therestricted
scc can also be used, as long as theuid
range is known.Command:
oc describe scc <SCC_NAME>
:The
ClusterRole
resource associated with the service account has the necessary permissions to facilitate installation and operation.Command:
kubectl describe clusterrole <CR_NAME>
:
Note
The above example is fully permissive. See this example for a more realistic choice.
The numeric UID to use to run Anaconda Enterprise containers has been identified. Furthermore, GID 0 is verified to be permitted by the security context. Please include the UID in your checklist results.
Any tolerations and/or node labels required to permit Anaconda Enterprise to run on its assigned nodes have been identified.
Command (tolerations only):
kubectl get nodes -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.taints[*].key}{"\n"}{end}'
Storage¶
A Persistent Volume Claim (PVC) has been created within the application namespace, referencing a statically provisioned Persistent Volume that meets the storage requirements for the
anaconda-storage
volume.Command:
kubectl describe pvc anaconda-storage
:A Persistent Volume Claim (PVC) has been created within the application namespace, referencing a statically provisioned Persistent Volume that meets the storage requirements for the
anaconda-persistence
volume.Command: ``kubectl describe pvc anaconda-persistence`:
Cluster Sizing / Resources¶
The cluster is sized appropriately (CPU / Memory) for user workload, including consideration for “burst” workloads. Cluster considerations
Resource Profiles have been determined, and created in the “values.yaml” file prior to install. Resource Profile guide
Networking¶
The domain name for the Anaconda Enterprise application has been identified. In the next several bullets, we will use the sample domain
anaconda.example.com
as a stand-in for this choice. Please include this domain name in your checklist output.If a customer-selected ingress controller is to be used, this controller has already been installed, and its master IP address and
ingressClassName
value have been identified. Please include both the IP address ingress class name in your checklist output.The DNS records for both
anaconda.example.com
and*.anaconda.example.com
have been created, pointing to the IP address of the ingress controller.Command:
ping test.anaconda.example.com
:If the ingress controller is to be installed with Anaconda Enterprise, this may not be possible; in this case, it is sufficient to confirm that the networking team is prepared to instantiate these records immediately following installation.
A wildcard SSL secret for
anaconda.example.com
and*.anaconda.example.com
has been created. The public and private keys for the main certificate, as well as the full public certificate chain, are accessible from the administration server. Please share the public certificate chain in your checklist output.If the SSL secret was created using a private CA, the public root certificate has been obtained.
Docker Images¶
If a private Docker registry is to be used, the full set of Docker images have been transferred to this registry.
If a pull secret is required to access the Docker images—whether from the standard Anaconda Enterprise Docker channel or the private registry—the secret has been created in the application namespace.
Command:
kubectl get secret -n <NAMESPACE> <PULL_SECRET_NAME>