1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-01-20 18:52:16 +00:00
kyverno/documentation/installation.md

73 lines
3.5 KiB
Markdown
Raw Normal View History

2019-05-21 15:50:36 -07:00
<small>*[documentation](/README.md#documentation) / Installation*</small>
2019-05-21 14:44:04 -07:00
2019-05-20 20:43:38 -07:00
# Installation
2019-05-21 16:09:05 -07:00
To install Kyverno in your cluster run the following command on a host with kubectl access:
2019-05-20 20:43:38 -07:00
2019-05-21 16:09:05 -07:00
````sh
kubectl create -f https://github.com/nirmata/kyverno/raw/master/definitions/install.yaml
````
2019-05-20 20:43:38 -07:00
2019-05-21 16:09:05 -07:00
To check the Kyverno controller status, run the command:
2019-05-20 20:43:38 -07:00
2019-05-21 16:09:05 -07:00
````sh
kubectl get pods -n kyverno
````
2019-05-21 14:44:04 -07:00
2019-05-21 16:09:05 -07:00
If the Kyverno controller is not running, you can check its status and logs for errors:
2019-05-21 14:44:04 -07:00
2019-05-21 16:09:05 -07:00
````sh
kubectl describe pod <kyverno-pod-name> -n kyverno
````
2019-05-20 20:43:38 -07:00
2019-05-21 16:09:05 -07:00
````sh
kubectl logs <kyverno-pod-name> -n kyverno
````
2019-05-20 20:43:38 -07:00
2019-05-21 14:44:04 -07:00
# Installing in a Development Environment
2019-05-20 20:43:38 -07:00
2019-05-22 20:26:53 -07:00
To build and run Kyverno in a development environment see: https://github.com/nirmata/kyverno/wiki/Building
2019-05-20 20:43:38 -07:00
To check if the controller is working, find it in the list of kyverno pods:
2019-05-20 20:43:38 -07:00
`kubectl get pods -n kyverno`
2019-05-20 20:43:38 -07:00
2019-05-21 14:44:04 -07:00
# Try Kyverno without a Kubernetes cluster
2019-05-20 20:43:38 -07:00
2019-05-21 16:09:05 -07:00
The [Kyverno CLI](documentation/testing-policies-cli.md) allows you to write and test policies without installing Kyverno in a Kubernetes cluster.
2019-05-20 20:43:38 -07:00
# Pre-Requisites
2019-05-28 19:50:40 -07:00
Kyverno installs an admission webhook that requires a CA-signed certificate and key to setup TLS communication with the kube-apiserver. In-cluster mode, there are 2 ways to configure the admission webhook TLS configuration:
* Kyverno generates certificate and key pair for user, and a signed certificate is issued against the certificate signing request generated by Kyverno. This setup requires a 'certificate signer' configured in the cluster. The kube-controller-manager provides a default implementation of a signer which can be used to issue certificates. To verify if it is enabled, check if the command args `--cluster-signing-cert-file` and `--cluster-signing-key-file` are passed to the controller manager with paths to your CA's key-pair.
* Use self-signed certificates.
2019-05-28 18:27:56 -07:00
2019-05-28 19:50:40 -07:00
## Use self-signed certificates
To create a root CA, generate signed certificate and key using openssl:
1. `openssl genrsa -out rootCA.key 4096`
2. `openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt -subj "/C=US/ST=test/L=test /O=test /OU=PIB/CN=*.kyverno.svc/emailAddress=test@test.com”`
3. `openssl genrsa -out webhook.key 4096`
4. `openssl req -new -key webhook.key -out webhook.csr -subj "/C=US/ST=test /L=test /O=test /OU=PIB/CN=kyverno-svc.kyverno.svc/emailAddress=test@test.com"`
5. `openssl x509 -req -in webhook.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out webhook.crt -days 1024 -sha256`
2019-05-28 19:50:40 -07:00
the following files are generated and are used to create kubernetes secrets:
- rootCA.crt
- webhooks.crt
- webhooks.key
To create the required secrets:
1. `kubectl create ns kyverno`
2. `kubectl -n kyverno create secret tls tls.kyverno --cert=webhook.crt --key=webhook.key `
3. `kubectl -n kyverno create secret generic tls-ca --from-file=rootCA.crt`
Secret | Data | Content
------------ | ------------- | -------------
`tls.ca` | rootCA.crt | root CA used to sign the certificate
`tls.kyverno` | tls.key & tls.crt | key and signed certificate
2019-05-28 19:50:40 -07:00
Kyverno uses secrets created above to define the TLS configuration for the webserver hook and specify the CA bundle used to validate the webhook's server certificate in the admission webhook configurations.
2019-05-28 19:50:40 -07:00
To deploy the Kyverno project, run `kubectl create -f definitions/install.yaml`. You can ignore the error 'namespaces "kyverno" already exists', which occurs as we previously created the namespace while creating the secrets.
---
2019-05-21 16:09:05 -07:00
<small>*Read Next >> [Writing Policies](/documentation/writing-policies.md)*</small>