Before You Begin

Prerequisites:

Running kubernetes cluster or local minikube installation
Configured and installed kubectl
CloudGen Access Proxy enrollment link

The steps described assume familiarity with kubernetes. The required images are available in the Dockerhub registry under the organization FydeInc.

Helm Chart

The helm chart is available at Artifactory and includes:

Orchestrator
Envoy

Redis (from dandy-developer chart)
HTTP resource (to test access)

Check the Artifactory link or values.yaml file for all the configuration parameters.

Deployment

Create a custom-values.yaml file with the desired values.

Minimum required configuration for a successful deployment:

'orchestrator.enrollmentToken.existingSecret.*’ or ‘orchestrator.enrollmentToken.newSecret’

Minimum required configuration to allow external access:

‘envoy.loadBalancer.enabled’
‘envoy.loadBalancer.annotations’

Add the helm repo and install the chart:

<code sh> 
helm repo add barracuda-cloudgen-access https://barracuda-cloudgen-access.github.io/helm-charts 
helm install my-release barracuda-cloudgen-access/cga-proxy --namespace  my-namespace --values custom-values.yaml 
</code sh>

Optionally, instead of using “helm install”, export the yaml files and deploy using your preferred method:

<code sh> 
helm template barracuda-cloudgen-access/cga-proxy --values custom-values.yaml 
</code sh>

Example

This extended example for a high availability deployment uses AWS NLB and Prometheus service monitors:

<code yaml> 
nameOverride: cga-proxy-my-deploy 
serviceMonitor: true 
priorityClassName: high-priority orchestrator: 
  enrollmentToken: 
    existingSecret: 
      name: cga-orchestrator-secret 
      key: enrollment-token 
  highAvailability: 
    enabled: true 
  resources: 
    limits: 
      cpu: 500m 
      memory: 512Mi 
    requests: 
      cpu: 100m 
      memory: 128Mi envoy:  
  replicaCount: 3 
  loadBalancer: 
    enabled: true 
    annotations: 
      service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: 
        app=cga-proxy,service=envoy-proxy-external,namespace=cga-proxy-my-deploy 
      service.beta.kubernetes.io/aws-load-balancer-type: nlb 
    externalTrafficPolicy: Local 
    port: 443   resources: 
    limits: 
      cpu: 500m 
      memory: 512Mi 
    requests: 
      cpu: 100m 
      memory: 128Mi redis-ha:  
  nameOverride: redis 
  priorityClassName: high-priority 
  redis: 
    resources: 
      requests: 
        cpu: 100m 
        memory: 200Mi 
      limits: 
        cpu: 100m 
        memory: 200Mi 
  sentinel: 
    resources: 
      requests: 
        cpu: 100m 
        memory: 200Mi 
      limits: 
        cpu: 100m 
        memory: 200Mi 
  hardAntiAffinity: true 
  exporter: 
    enabled: true 
    resources: 
      requests: 
        cpu: 100m 
        memory: 200Mi 
      limits: 
        cpu: 100m 
        memory: 200Mi 
    serviceMonitor: 
      enabled: true 
  podDisruptionBudget: 
    minAvailable: 2 
  persistentVolume: 
    enabled: false 
http-test: 
  enabled: true 
</code yaml>