Installing Containerized Wind River Conductor (Helm)

Overview

Use the following step to deploy a Conductor Manager to Kubernetes with a helm chart.

Configure Conductor Helm values

1. Get the wind-river-conductor-24.3.0.tgz chart file from licensed Wind River registry.
2. Create an override-values.yaml as described in “Configuration options of Wind River Conductor-services values.yaml” below and customize the fields as required.
   2.1. To run on a WRCP host, for example, you need to add cephfs to all occurrences of storageClass and mgmtworker.resources.pvc.class in that file.
3. To be able to access Conductor UI and external CLI, configure Ingress service.

Configure Ingress service

Ingress without hostname (Nginx example)

To access Conductor UI and CLI without a hostname, using directly the IP address where it’s installed, use the following:

# override-values.yaml
ingress:
  enabled: true
  ingressClassName: nginx

Ingress with hostname (Nginx example)

To expose Conductor through domain hostname, make sure to have it on network’s DNS server or add it to system’s hosts file.

# override-values.yaml
ingress:
  enabled: true
  host: mydomain-conductor.com
  ingressClassName: nginx

# /etc/hosts Linux example
10.10.100.50  mydomain-conductor.com

Expose Ingress for WRCP Systems (Nginx)

After following previous section, it’s necessary to create a Global Network Policy to allow traffic on HTTP port 80. For HTTPS access, user must setup production-ready certificates and customize Conductor helm values.

Create the following global-networkpolicy.yaml on the WRCP controller host and run kubectl apply -f global-networkpolicy.yaml. This will allow ingress traffic through OAM IP address.

# This rule opens up default HTTP port 80
# To apply use:
# kubectl apply -f global-networkpolicy.yaml
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
  name: gnp-oam-overrides
spec:
  ingress:
  - action: Allow
    destination:
      ports:
      - 80
    protocol: TCP
  order: 500
  selector: has(iftype) && iftype == 'oam'
  types:
  - Ingress

Example of override-values.yaml

# use these values override to run the wind-river-conductor chart

composer_backend:
  image: <registry-link>/composer-backend:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

composer_frontend:
  image: <registry-link>/composer-frontend:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

execution_scheduler:
  image: <registry-link>/execution-scheduler:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

mgmtworker:
  image: <registry-link>/mgmtworker:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []
  resources:
    pvc:
      name: "mgmtworker-pvc"
      size: "10Gi"
      modes:
        - "ReadWriteOnce"
      class: ""

rest_service:
  image: <registry-link>/restservice:latest
  config:
    manager:
      security:
        # When changing these credentials, must set into wrc_endpoint_secret.data.username and .password
        # or make sure to use these anchors
        admin_username: &wrc_admin_user admin
        admin_password: &wrc_admin_pass admin
  curl_image: <registry-link>/alpine/curl:8.5.0
  bind_host: "[::]"
  affinity: {}
  nodeSelector: {}
  tolerations: []

api_service:
  image: <registry-link>/apiservice:latest
  bind_host: "[::]"
  affinity: {}
  nodeSelector: {}
  tolerations: []

stage_backend:
  image: <registry-link>/stage-backend:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

stage_frontend:
  image: <registry-link>/stage-frontend:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

wrc_endpoint_secret:
  # Must match rest_service.config.manager.security.admin_username and .admin_password values or aliases
  data:
    username: *wrc_admin_user
    password: *wrc_admin_pass

system_inventory_manager:
  image: <registry-link>/system-inventory-manager:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

upgrade_group_manager:
  image: <registry-link>/upgrade-group-manager:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

wrc_secret:
  image: <registry-link>/wrc-secret-operator:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []

rest_api_server:
  image: <registry-link>/rest-api-app:latest
  affinity: {}
  nodeSelector: {}
  tolerations: []
  bind_host: "::"
  service:
    name: "rest-api-server"
    type: ClusterIP

nginx:
  image: <registry-link>/nginxinc/nginx-unprivileged:1.25.4
  replicas: 1
  affinity: {}
  nodeSelector: {}
  tolerations: []

seaweedfs:
  master:
    imageOverride: <registry-link>/seaweedfs:3.55
    data:
      storageClass: ""
    ## Must be multi-line string, not map/array type values
    # affinity: ""
    # nodeSelector: ""
    # tolerations: ""
  filer:
    imageOverride: <registry-link>/seaweedfs:3.55
    data:
      storageClass: ""
    ## Must be multi-line string, not map/array type values
    # affinity: ""
    # nodeSelector: ""
    # tolerations: ""
  s3:
    imageOverride: <registry-link>/seaweedfs:3.55
    ## Must be multi-line string, not map/array type values
    # nodeSelector: ""
    # tolerations: ""
  volume:
    imageOverride: <registry-link>/seaweedfs:3.55
    data:
      storageClass: ""
    ## Must be multi-line string, not map/array type values
    # affinity: ""
    # nodeSelector: ""
    # tolerations: ""
  clientImage: <registry-link>/aws-cli:2.13.9

prometheus:
  alertmanager:
    image:
      registry: ""
      repository: <registry-link>/alertmanager
      tag: 0.25.0-debian-11-r62
  server:
    persistence:
      storageClass: ""
      accessModes:
        - ReadWriteOnce
      size: 8Gi
    image:
      registry: ""
      repository: <registry-link>/prometheus
      tag: 2.45.0-debian-11-r0
    thanos:
      image:
        registry: ""
        repository: <registry-link>/thanos
        tag: 0.31.0-scratch-r8
    nodeSelector: {}
    tolerations: []
    affinity: {}
  volumePermissions:
    image:
      registry: ""
      repository: <registry-link>/bitnami-shell
      tag: 11-debian-11-r130

rabbitmq:
  image:
    registry: ""
    repository: <registry-link>/rabbitmq
    tag: 3.12.2-debian-11-r8
  persistence:
    storageClass: ""
    accessModes:
      - ReadWriteOnce
    size: 8Gi
  volumePermissions:
    image:
      registry: ""
      repository: <registry-link>/os-shell
      tag: 11-debian-11-r16
  affinity: {}
  nodeSelector: {}
  tolerations: []

postgresql:
  image:
    registry: ""
    repository: <registry-link>/postgresql
    tag: 15.3.0-debian-11-r17
  primary:
    persistence:
      storageClass: ""
      accessModes:
        - ReadWriteOnce
      size: 8Gi
    affinity: {}
    nodeSelector: {}
    tolerations: []
  readReplicas: # ignored if architecture != "replication"; default is "standalone"
    persistence:
      storageClass: ""
      accessModes:
        - ReadWriteOnce
      size: 8Gi
    affinity: {}
    nodeSelector: {}
    tolerations: []
  volumePermissions:
    image:
      registry: ""
      repository: <registry-link>/bitnami-shell
      tag: 11-debian-11-r130
  metrics:
    image:
      registry: ""
      repository: <registry-link>/postgres-exporter
      tag: 0.13.1-debian-11-r0

kube-state-metrics:
  image:
    registry: ""
    repository: <registry-link>/kube-state-metrics
    tag: 2.9.2-debian-11-r14
  affinity: {}
  nodeSelector: {}
  tolerations: []

ingress:
  enabled: true
  host:
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
  # TLS settings
  tls: false
  secretName: cfy-secret-name

# These files should be provided by a HTTP/File server
resources:
  packages:
    agents:
      manylinux-x86_64-agent.tar.gz: <artifactory-link>/manylinux-x86_64-agent_7.0.0-ga.tar.gz
      manylinux-aarch64-agent.tar.gz: <artifactory-link>/manylinux-aarch64-agent_7.0.0-ga.tar.gz
      cloudify-windows-agent.exe: <artifactory-link>/cloudify-windows-agent_7.0.0-ga.exe

Note When using a non-default username/password, make sure rest_service.config.manager.security.admin_username and .admin_password values match wrc_endpoint_secret.data.username and .password

Install Conductor Helm application

After configuring override-values.yaml file, run the following command to install:

helm install wind-river-conductor -f ./override-values.yaml ./wind-river-conductor-24.3.0.tgz

The installation is complete when all pods are running as shown in the example below.
If the Ingress service is configured correctly, Conductor UI should be available at http://<helm-host-ip>/console

kubectl get pods
NAME                                       READY     STATUS     RESTARTS     AGE
api-service-64d4fb5f54-2ptgs               1/1       Running    0            16m
composer-backend-774467bb95-797dw          1/1       Running    3            16m
composer-frontend-7f7bddc878-8jxdw         1/1       Running    0            16m
execution-scheduler-9cfdbd977-nvvpf        1/1       Running    0            16m
kube-state-metrics-7454f94b6b-nwc2w        1/1       Running    0            16m
mgmtworker-0                               1/1       Running    2            16m
nginx-f7df98d99-2h2pd                      1/1       Running    0            16m
postgresql-0                               2/2       Running    0            16m
prometheus-server-5d47545645-584tf         1/1       Running    0            16m
rabbitmq-0                                 1/1       Running    0            16m
rest-api-server-85c79ccfb6-xvg2c           1/1       Running    0            16m
rest-service-555c864896-gmrs4              1/1       Running    0            16m
seaweedfs-filer-0                          1/1       Running    0            16m
seaweedfs-master-0                         1/1       Running    0            16m
seaweedfs-s3-68b88dd7bd-gpnvg              1/1       Running    0            16m
seaweedfs-volume-0                         1/1       Running    0            16m
stage-backend-d9bdc6567-flcdk              1/1       Running    3            16m
stage-frontend-58d4b575b4-njh2n            1/1       Running    0            16m
system-inventory-manager-7479cc894-8wqwb   1/1       Running    0            16m
upgrade-group-manager-764d4b8598-lhcpt     1/1       Running    0            16m
wrc-secret-operator-7dd5d78b46-xx7bk       1/1       Running    0            16m

Accessing Conductor external CLI

Install the package using Python package manager, optionally on a virtualenv:

# virtualenv Python 3.11
(venv)> pip install --upgrade pip
(venv)> pip install "urllib3<2" cloudify==7.0.3
(venv)> cfy --version
Cloudify CLI 7.0.3

(venv)> cfy profiles use 10.10.100.50 -u admin -p admin
Attempting to connect to 10.10.100.50 through port 80, using http (SSL mode: False)...
Using manager 10.10.100.50 with port 80
Initializing profile 10.10.100.50...
Initialization completed successfully
It is highly recommended to have more than one manager in a Cloudify cluster
Adding cluster node localhost to local profile manager cluster
Adding cluster node rabbitmq to local profile broker cluster
Profile is up to date with 2 nodes

(venv)> cfy profiles list
Listing all profiles...

Profiles:
+----------------+---------------+------------------+----------------+----------+---------+----------+--------------+-----------+---------------+------------------+
|      name      |   manager_ip  | manager_username | manager_tenant | ssh_user | ssh_key | ssh_port | kerberos_env | rest_port | rest_protocol | rest_certificate |
+----------------+---------------+------------------+----------------+----------+---------+----------+--------------+-----------+---------------+------------------+
| *10.10.100.50  | 10.10.100.50  |      admin       |                |          |         |    22    |    False     |     80    |      http     |                  |
+----------------+---------------+------------------+----------------+----------+---------+----------+--------------+-----------+---------------+------------------+

(venv)> cfy status
Retrieving manager services status... [ip=10.10.100.50]

Services:
+--------------------------------+--------+
|            service             | status |
+--------------------------------+--------+
| Webserver                      | Active |
| Management Worker              | Active |
| Manager Rest-Service           | Active |
| Cloudify API                   | Active |
| Cloudify Execution Scheduler   | Active |
| Cloudify Console               | Active |
| PostgreSQL                     | Active |
| RabbitMQ                       | Active |
| Cloudify Composer              | Active |
| Monitoring Service             | Active |
+--------------------------------+--------+

Uninstalling Helm

To uninstall Helm, use the following command:

helm uninstall wind-river-conductor

All pods need to be deleted.

Note:

After uninstalling Helm, PersistentVolumeClaims (PVCs) and PersistentVolumes (PVs) created by Seaweedfs, RabbitMQ, PostgreSQL and WRC MGMTWORKER statefulset will not be deleted.

NAME                                               STATUS    VOLUME                                     CAPACITY   ACCESSMODE     STORAGECLASS   AGE
data-default-seaweedfs-master-0                    Bound     pvc-0056baff-d819-460b-9ac4-bab4bbe2490a   1Gi        RWO            local-path     10m
data-filer-seaweedfs-filer-0                       Bound     pvc-fc612b89-5f47-4105-8b4d-388133cb05b1   1Gi        RWO            local-path     10m
data-postgresql-primary-0                          Bound     pvc-fd7545fa-a662-481c-8f07-7472870322d9   8Gi        RWO            local-path     10m
seaweedfs-master-log-volume-seaweedfs-master-0     Bound     pvc-5f0d868a-bb5f-4a7d-ac2d-e2ec7bc8535d   1Gi        RWO            local-path     10m
data-rabbitmq-0                                    Bound     pvc-bac34ffe-849c-4f01-b074-6d9ad3425952   8Gi        RWO            local-path     10m
data-seaweedfs-volume-0                            Bound     pvc-5dc884fd-eafe-4b25-838e-ca729cb5c31d   10Gi       RWO            local-path     10m
seaweedfs-filer-log-volume-seaweedfs-filer-0       Bound     pvc-9d0ef1f8-5cf9-4211-8add-4ae19b2e0375   1Gi        RWO            local-path     10m
logs-seaweedfs-volume-0                            Bound     pvc-91b9eed0-b113-4604-8d6b-b7783c0e84bf   1Gi        RWO            local-path     10m
data-postgresql-read-0                             Bound     pvc-25557a04-b38d-4215-a3d0-eff18d8e16a0   8Gi        RWO            local-path     10m
mgmtworker-pvc-mgmtworker-0                        Bound     pvc-57f770bd-cead-4c1d-a130-8f2ce9c4560a   10Gi       RWO            local-path     10m
data-rabbitmq-1                                    Bound     pvc-b30c3250-65ca-46a8-99d4-50045edeb80c   8Gi        RWO            local-path     9m52s
mgmtworker-pvc-mgmtworker-1                        Bound     pvc-6350253d-566e-432e-82c4-4fcda5742880   10Gi       RWO            local-path     6m39s 

Bitnami’s charts and the WRC MGMTWorker includes a Statefulset which uses VolumeClaimTemplates to generate new Persistent Volume Claims (PVCs) for each replica created, Helm does not track those PVCs. Therefore, when uninstalling a chart release with these characteristics, the PVCs (and associated Persistent Volumes) are not removed from the cluster. This is a know issue from https://github.com/helm/helm/issues/5156 / https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#persistence-volumes-pvs-retained-from-previous-releases

These PVCs/PVs can be re-used if the Helm deployment is performed again or they can be cleaned up manually as a post-removal step if Conductor is to be removed permanently or a full cleanup is necessary.

To delete these volumes, use: kubectl -n <pvc_namespace> delete pvc <pvc_name>

Using IPv6

When deploying on an IPv6-only cluster, additional settings must be applied to make RabbitMQ compatible. See values-ipv6.yaml for the changed parameters, or use this values file directly when installing the chart. Remember that when using an IPv6 cluster, the ingress controller must support IPv6 as well.

rabbitmq:
  initContainers:
    - name: ipv6-init
      image: "<registry-link>/busybox:1.33.1"
      imagePullPolicy: IfNotPresent
      volumeMounts:
      - name: ipv6-cfg
        mountPath: /ipv6
      command: ['sh', '-c', 'echo "{inet6, true}." > /ipv6/erl_inetrc']
  extraVolumes:
    - name: ipv6-cfg
      emptyDir: {}
  extraVolumeMounts:
    - name: ipv6-cfg
      mountPath: /ipv6
  extraEnvVars:
    - name: RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS
      value: "-kernel inetrc '/ipv6/erl_inetrc' -proto_dist inet6_tcp"
    - name: RABBITMQ_CTL_ERL_ARGS
      value: "-proto_dist inet6_tcp"
  extraConfiguration: |-
    management.ssl.ip         = ::
    management.ssl.port       = 15671
    management.ssl.cacertfile = /opt/bitnami/rabbitmq/certs/ca_certificate.pem
    management.ssl.certfile   = /opt/bitnami/rabbitmq/certs/server_certificate.pem
    management.ssl.keyfile    = /opt/bitnami/rabbitmq/certs/server_key.pem

rest_service:
  bind_host: "[::]"

api_service:
  bind_host: "[::]"

rest_api_server:
  bind_host: "::"

Scaling

There’s several components you might want to scale up:

• RabbitMQ: the RabbitMQ chart provides out-of-the-box clustering, and the amount of replicas can be controlled via the rabbitmq.replicaCount setting.
• PostgreSQL: the PostgreSQL chart allows primary/replica replication (active/passive replication scheme with read replicas). To enable it, set postgresql.architecture to replication. When doing so, point the DB clients at the DB primary by setting db.host to postgresql-primary (read replicas are unused by Conductor).
• Management worker: set mgmtworker.replicas to a number higher than 1, to start multiple mgmtworker instances, allowing better operation concurrency.

For an example of a scaled-up deployment, see the scaled-up-values.yaml example values file.

# this is an example values file showing how to scale up several services

# rabbitmq and mgmtworker can be scaled by just increasing the pod count
rabbitmq:
  replicaCount: 2

mgmtworker:
  replicas: 2

# with the bitnami postgresql chart, using architecture=replication will
# start a primary and a read replica
postgresql:
  architecture: replication
  readReplicas:
    replicaCount: 1

# all the db-using services need to be instructed to connect to the primary
db:
  host: "postgresql-primary"

Configuration options of Wind River Conductor-services values.yaml