In some situations, the Smartfacts server has no access to the internet. In this case, it is not possible to download the needed software and images. This article describes which options we have to install Smartfacts in such scenarios.

Content

Preparations

Server

Please provide a server that meets the following requirements:

CPU:
- x64 / AMD64 processor - ARM based servers will not work
- Minimum: 6 Cores
RAM: minimum 32 GB
Hard disk: minimum 150 GB
Most of the data will be stored under /var/lib/rancher/k3s
Operating System: Linux
All Linux distributions running K3s can be used.
If you are using a Red Hat / CentOS Linux, please perform these preparations:
- It is recommended to turn off firewalld:
  systemctl disable firewalld --now
- If enabled, it is required to disable nm-cloud-setup and reboot the node:
  systemctl disable nm-cloud-setup.service nm-cloud-setup.timer
  reboot
The user performing the installation will need sudo privileges
The server must be connected to the internet

DNS

Please define a domain for Smartfacts. Either add a wildcard entry *.<domain-name> to the DNS or enter the required URLs individually:

smartfacts.<domain-name>
camp.<domain-name>
identity.<domain-name>
genoslc.<domain-name>
oslc.<domain-name>

Certificates

Please prepare certificates for the server which meet the following requirements:

It is an X.509 certificate which is suitable for server authentication
Base64-coded in PEM format
Hostnames
- The certificat must be issued on the hostnames
  - smartfacts.<domain-name>
  - camp.<domain-name>
  - identity.<domain-name>
  - genoslc.<domain-name>
  - oslc.<domain-name>
- Hostnames must also be stored in the "Subject Alternative Name" attribute of the certificate
- All hostnames and subject alternative names must be written in lower case
The certificat must be valid (valid from, valid to)
It is suitable for the provided private key
The private key may not be password protected
The certificate should comprise the complete certificate chain where possible
If this is missing, then an attempt is made to download the missing intermediate and root certificate during installation.

Install the software

Download the software

Download “k3s” and “k3s-airgap-images-amd64.tar.gz” from the “Assets” section of https://github.com/k3s-io/k3s/releases
Download the Helm binaries for Linux amd64 from https://github.com/helm/helm/releases
Copy the contents of the K3s install script at https://get.k3s.io into a new text file called “install.sh”
Download the file https://cp.mid.de/releases/smartfacts-air-gapped/install_airgapped_software.sh

Copy the files to the server

Create a new directory “download” in your home directory
Create a new directory “software” under “download”

Copy all downloaded files to ~/download/software
After copying all files, the file structure should look like this:

download
└── software
    ├── helm-v3.10.3-linux-amd64.tar.gz
    ├── install.sh
    ├── install_airgapped_software.sh
    ├── k3s
    └── k3s-airgap-images-amd64.tar.gz

Execute the installation script

In the directory ~/download/software make the install script executeable and execute it:

chmod u+x install_airgapped_software.sh
./install_airgapped_software.sh

Download the Smartfacts Helm Chart

Log into the Smartfacts Chart Registry using the credentials provided and download the latest chart version that does not contain the postfix “-dev”.
Copy the downloaded helm chart to your home directory on the Smartfacts server
Extract the helm chart using the command
```
tar -xvzf smartfacts-*.tgz
```

Create the deployment configuration

Provide Certificates and Key as Base64 String

The Prerequisite is: The complete certificate chain is available in a file as base64-encoded x509 certificates. The certificates are contained in the file in the correct order (server certificate at the top, root certificate at the bottom). See Section “Certificates” above in this article.

Save the certificate chain as a base64-encoded string:

cat <your certificate chain.crt> | base64 -w0 > chain.crt.base64

Save certificate key as a base64-encoded string:

cat <your certificate key.key> | base64 -w0 > key.base64

Customize Values File

Change to the home directory of your user on the server and create a new text file values.yaml with the following content:

global:
  domain: "<your-domain>"
  instance: "smartfacts-poc"
  registry: "library"
  cert:
    crtFullChain: "<FULL-CHAIN-CERT-BASE64>"
    key: "<CERT-KEY-BASE64>"
  ingress:
    enabled: true
mailservice:
  enabled: false
genoslc:
  enabled: false

Replace the value of the property domain with your domain name
Replace the placeholder of the property crtFullChain with the content of the file chain.crt.base64
Replace the placeholder of the property key with the content of the key.base64 file
Save the file values.yaml

Provide the container images

The Kubernetes environment at the Smartfacts server must have access to the Smartfacts container images.

The recommended way to gain access to the container images is to add the Smartfacts registry https://repo.mid.de to an existing container registry in your organisation that has access to the internet. This registry serves as a proxy registry so that the Smartfacts server can load the images through this proxy registry. Follow the instructions in the section Provide container images with a proxy container registry if you can use a proxy registry.

If it is not possible to use a proxy registry, the container images can be loaded directly into the container service of the Smartfacts server. To do this, follow the instructions in the section Provide container images without a container registry.

Provide container images with a proxy container registry

Provide Container Images with a Proxy Container Registry

Please contact your administrators to add the Smartfacts registry https://repo.mid.de to the proxy registry.

Add login data to the proxy registry

To connect to your proxy registry, you will need to add the proxy registry login information to your values.yaml file.

To do this, replace the placeholder in the following text and insert it into a file called “registrylogin.txt” on the Smartfacts server.

{
  "auths":
  {
    "<proxy registry name>" :
    {
      "username":"<username>",
      "password":"<password>"
    }
  }
}

Replace the placehoder <proxy registry name> with the name of your proxy registry without protocol (e.g. write “repo.yourcompany.com”, not “https://repo.yourcompany.com”)
Replace the value of the fields “username” and “password” with the login data for your proxy registry
Save the file under the name “registrylogin.txt”

convert the login information to a base64-encoded string

cat registrylogin.txt | base64 -w0 > registrylogin.base64

In the file “values.yaml” add a new line below the line beginning with “instance” with the content
```
  repologin: "<content of file registrylogin.base64>"
```
- Replace the placehoder “<content of file registrylogin.txt>“ with the content of the file “registrylogin.base64”
- Make sure that the indentation at the beginning of the line is exactly the same as in the line above
delet the files “registrylogin.txt” and “registrylogin.base64”

Provide container images without a container registry

In this scenario you will download the container images manually and copy it to the server.

Call up the web page for downloading the container images. The link to the web page contains the chart version. It has the following format:
https://cp.mid.de/releases/smartfacts-air-gapped/smartfacts_air_gapped_<HELM_CHART_VERSION>.html
- Make sure to replace the placeholder <HELM_CHART_VERSION> with the version of the helm chart you downloaded. You should now see the download page.

Download all files to your client PC
Create a new directory ~/download/smartfacts on the Smartfacts server
Copy the downloaded files to ~/download/smartfacts on the Smartfacts server
Download the script to load the images from https://cp.mid.de/releases/smartfacts-air-gapped/loadimages.sh and copy it to ~/download/smartfacts on the Smartfacts server

Load the container images into k3s

On the Smartfacts server

Change into the directory ~/download/smartfacts
Make the script “loadimages.sh” executeable and execute it
```
chmod u+x loadimages.sh
./loadimages.sh
```

The script checks wether all files are present and correct. If this is the case, it will load the container images from the files.

You can view the loaded images with the following command.

sudo k3s crictl images

Install Smartfacts

Execute the Installation

In the user's home directory, enter the following command to execute the Installation:

sudo helm upgrade --install --timeout 15m0s smartfacts ./smartfacts -f values.yaml -n smartfacts --create-namespace

Watch Deployment events (in a new Session)

Open a second session on the server and enter the following command:

sudo watch kubectl get deployments -n smartfacts

Enter the following command to show the URLs (please make sure to prefix it with “https://” in your browser):

sudo kubectl get ingress -n smartfacts

Troubleshooting

Display events

If the deployments don`t get healthy, you can display the event messages of the installation:

sudo kubectl get events -n smartfacts

These events show some common error conditions (e.g. Images are not found; insufficient ressources)

Deployment on Kubernetes without Internet Connection