Deploying LIM in Kubernetes

This document describes how to configure and use the helm-lim 24.4 Helm chart for complete LIM container orchestration in Kubernetes. You can find the LIM Helm chart at https://hub.docker.com/r/fortifydocker/helm-lim/.

Table of Contents

• Kubernetes Versions
• Tool Prerequisites
• Installation
• Upgrade

Kubernetes Versions

These charts have been tested using the following Kubernetes versions:

• Kubernetes 1.28
• Kubernetes 1.29
• Kubernetes 1.30

Tool Prerequisites

• kubectl v1.28.7
• helm v3.12.2
• yq v4.35.1

OpenText recommends that you use the same tool versions to avoid unpredictable results.

Installation

The following instructions are for example purposes and are based on a default Kubernetes environment running under Linux, using the default namespace. Windows systems may require different syntax for certain commands and other Kubernetes Cluster providers may require additional/different configurations. Your Kubernetes administrator may require the use of specific namespaces and/or other configuration adjustments.

Installation Prerequisites

• A working Kubernetes Cluster
• A PersistentVolumeClaim to use for LIM persistence

Installation Steps

1. Prepare default Admin credentials Secret and values

2. Prepare JWT Secret and value(s)

3. Prepare Server Certificate Secret(s) and value(s)

4. Prepare Signing Certificate Secrets and values

5. Install Release

6. Set up port forwarding

7. Verifying LIM availability and admin login

Prepare default Admin credentials Secret and values

The Helm chart requires a default administrator credentials Secret.

NOTE: The Secret will be named lim-admin-credentials.

• To create the credentials Secret, use the kubectl create secret command, as shown in the following code sample.

  kubectl create secret generic lim-admin-credentials \
   --type=basic-auth \
   --from-literal=username=lim_admin \
   --from-literal=password="$(openssl rand -base64 32| tr -d [:punct:])"

Prepare JWT Secret and value(s)

The Helm chart requires a JSON web token (JWT) Secret.

NOTE: The Secret will be named lim-jwt-security-key.

• To create the JWT Secret, use the kubectl create secret command, as shown in the following code sample.

  kubectl create secret generic lim-jwt-security-key \
   --type=Opaque \
   --from-literal=token="$(openssl rand -base64 32| tr -d [:punct:])"

Prepare Server Certificate Secret(s) and value(s)

Optionally, you can use a PEM (.crt) server certificate. If a certificate is used, then you must create a server certificate Secret for the Helm chart.

To use a PEM server certificate:

1. Use the following command to create the server certificate.

   openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout /tmp/lim-server-key.pem -out /tmp/lim-server-cert.pem -subj "/C=CA/ST=Ontario/L=Waterloo/O=OpenText/OU=IT"   

2. Use the kubectl create secret command, as shown in the following code sample, to create the Secret in Kubernetes.

   kubectl create secret generic lim-server-certificate \
     --type=TLS \
     --from-file=tls.crt=/tmp/lim-server-cert.pem \
     --from-file=tls.key=/tmp/lim-server-key.pem   

3. Use the following commands to delete the certificate file(s).

   rm /tmp/lim-server-key.pem /tmp/lim-server-cert.pem   

Prepare Signing Certificate Secrets and values

The Helm chart requires a signing certificate Secret.

To create the signing certificate Secret:

1. Use the following command to generate LIM signing certificate password.

   LIM_SIGNING_CERT_PWD="$(openssl rand -base64 32)"

2. Use the following command to create the server certificate.

   openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout /tmp/lim-signing-key.pem -out /tmp/lim-signing-cert.pem -subj "/C=CA/ST=Ontario/L=Waterloo/O=OpenText/OU=IT"

3. Use the following command to create a PFX file from the certificate.

   openssl pkcs12 -export -out /tmp/lim-signing-cert.pfx -inkey /tmp/lim-signing-key.pem -in /tmp/lim-signing-cert.pem  -passout "pass:${LIM_SIGNING_CERT_PWD}"   

4. Use the kubectl create secret command, as shown in the following code sample, to create the certificate Secret in Kubernetes.

   kubectl create secret generic lim-signing-certificate \
    --type=Opaque \
    --from-file=tls.pfx=/tmp/lim-signing-cert.pfx

5. Use the kubectl create secret command, as shown in the following code sample, to create the password Secret in Kubernetes.

   kubectl create secret generic lim-signing-certificate-password \
    --type=Opaque \
    --from-literal=pfx.password=$LIM_SIGNING_CERT_PWD

6. Use the following command to delete the certificate file(s).

   rm /tmp/lim-signing-key.pem /tmp/lim-signing-cert.pem /tmp/lim-signing-cert.pfx

7. Use the following command to unset the LIM signing certificate password form the terminal.

   unset LIM_SIGNING_CERT_PWD

Install release

The following command installs the LIM using the recommended defaults. In some cases, you might need to customize these values using the Helm --set parameter or by creating a values.yaml override file and passing it to the command line with the Helm -f flag. For more information about the values you can override, see the Helm Chart Values table.

TIP: To find the available LIM 24.4 helm chart version, go to https://hub.docker.com/r/fortifydocker/helm-lim/tags.

• Use the following command to install the LIM.

  helm install <release-name> oci://registry-1.docker.io/fortifydocker/helm-lim --version <LIM Helm Chart Version> \
   --set defaultAdministrator.credentialsSecretName=lim-admin-credentials \
   --set jwt.securityKeySecretName=lim-jwt-security-key \
   --set serverCertificate.certificateSecretName=lim-server-certificate \
   --set signingCertificate.certificateSecretName=lim-signing-certificate \
   --set signingCertificate.certificatePasswordSecretName=lim-signing-certificate-password \
   --set dataPersistence.existingClaim=<Existing Persistent Volume Claim>

Setting up port forwarding through kubectl

You can use kubectl to forward a local port to a port on the Pod.

To set up port forwarding:

1. Verify that your LIM Pod is running successfuly. It may take a few minutes before your pod gets to a proper 1/1 Running configuration. You can run the command above multiple times or use the flag -w to watch for any changes.

   kubectl get pods

   NOTE: It may take several minutes before your Pod reaches a proper 1/1 Running configuration. You can run the previous command multiple times or use command with the - w option to watch for any changes.

2. Open a new terminal shell.

3. Use the kubectl port-forward command, as shown in the following code sample, to set up port forwarding to access your LIM endpoint.

   kubectl port-forward svc/lim 8080:37562

Verifying LIM availibility and admin login

After setting up port forwarding in kubectl, you should be able to access the LIM user interface in a browser.

To verify that the LIM is running:

• In a browser, navigate to https://localhost:8080.

To verify that you can log in to the LIM using the admin credentials that were passed to the Helm chart:

1. In a browser, navigate to https://localhost:8080/login.

2. Log in with your default admin credentials.

Upgrade

This section explains upgrading of LIM Helm charts to version 24.4.

Upgrade Prerequisites

• A running LIM environment
• kubectl access to LIM environment
• helm access to LIM environment
• Access to the LIM web client
• LIM admin credentials

Upgrading from Version 24.2.0.2

• Upgrade LIM with Helm:

  helm upgrade <Existing Installed LIM Release Name> oci://registry-1.docker.io/fortifydocker/helm-lim --version <LIM Helm Chart Version>  --reuse-values

Upgrading from Version prior to 24.2.0.2

Upgrade Steps:

1. Retrieve Licenses
2. Remove/Release licenses
3. Destroy previous LIM Deployment
4. Update your values.yaml
5. Deploy the current LIM version
6. Register licenses

Retrieve licenses

Before upgrading your LIM in Kubernetes, you must retrieve the license information for the LIM and the product licenses currently associated with the LIM, as well as configuration details for all license pools.

To retrieve your license and pool details:

1. In a browser, access your LIM.
2. Log in with your default admin credentials.
3. Select ADMIN.
4. Note the following items:
   • Your Fortify License and Infrastructure Manager Activation Token.
   • The License Server Description.
   • The Fortify License Server URL.
5. Select PRODUCT LICENSES.
6. Access the Details page for each registered license and note the respective Activation Token.
7. Select LICENSE POOLS.
8. Access the Details page for each license pool and note the respective configuration.

Remove/Release licenses

Before upgrading your LIM in Kubernetes, you must delete the license pools, remove the product licenses, and release the server license for the LIM.

IMPORTANT - You must perform the steps in Retrieve Licenses before proceeding. Otherwise, the actions in this procedure can lock your licenses to a deactivated cluster.

To delete pools and remove and release licenses:

1. In a browser, access your LIM.
2. Log in with your default admin credentials.
3. Select LICENSE POOLS.
4. Click Delete on each of the configured license pools.
5. Select PRODUCT LICENSES.
6. Click Remove on each of the licenses.
7. Select ADMIN.
8. Click Release on the Server License.

Destroy previous LIM Deployment

Before upgrading the LIM, you must destroy the previously deployed version.

IMPORTANT Make sure that your kubectl and Helm contexts are set to the correct cluster before running the following commands.

To destroy the previous LIM:

• Use the Helm delete command, as shown in the following code sample, to delete your LIM deployment:

  helm delete <your_release_name> --namespace <your_namespace>

Update your values.yaml

• Merge your previous values.yaml with the provided values.yaml of the current release using your favorite text editor.

Deploy the current LIM version.

To deploy the LIM

• Use the Helm install command, as shown in the following code sample, to deploy your LIM:

  helm install lim oci://registry-1.docker.io/fortifydocker/helm-lim --version <LIM Helm Chart Version> -f values.yaml

Register licenses

After deploying the new LIM version, you must license the updated LIM, add the product licenses to the new LIM version, and reconfigure the license pools.

To register licenses:

1. In a browser, access your LIM.
2. Log in with your default admin credentials.
3. Select ADMIN.
4. Enter the Fortify License and Infrastructure Manager Activation Token, License Server Description, and Fortify License Server URL values from your previous deployment.
5. Select PRODUCT LICENSES.
6. Click + LICENSE and add each of your licenses from the previous deployment. For more information, see "Working with product licenses" on Fortify License and Infrastructure Manager documentation.

Values

The following values are exposed by the Helm Chart. Unless specified as Required, values should only be overridden as made necessary by your specific environment.

Required

Optional, but recommended

Other Values