Installing on a Kubernetes cluster

You can install the IBM® Security Guardium® Key Lifecycle Manager container on a Kubernetes cluster. You can use the provided Helm charts for the installation.

Complete the following steps on the system on which you installed Helm:

1. Extract the k8s-helm.zip file.
2. In the directory where you extracted the files, navigate to k8s-helm > sklm directory.
   If you plan to install the PostgreSQL database separately, delete the database directory.
3. Open the values.yaml file and modify the parameter values in the file as per your requirement.
   The file has information about the mandatory parameters to be updated and description of all the parameters.
4. Navigate to k8s-helm directory and run the following command:

   helm install name sklm

   where, name is the release name, which you can use in the helm delete command. For example, sklm.

5. Verify the installation by running the following commands:

   helm list
   kubectl get pods
   kubectl get pv
   kubectl get pvc

   Sample response:

   helm list
   NAME            NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                           APP VERSION
   sklm            default         3               2020-11-07 21:32:32.063018197 -0800 PST deployed        sklm-0.1.0                      4.1
   
   kubectl get pods
   NAME                                                     READY   STATUS    RESTARTS   AGE
   postgressqldb-7fd84488fc-abcdc                           1/1     Running   0          2d18h
   sklmapp-56768dddc5-al5a2                                 1/1     Running   0          2d1h
   
   kubectl get pv
   NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                       STORAGECLASS   REASON   AGE
   pvc-8c45fb02-0f13-4aab-830f-4e82fe1bfba0   25Gi       RWX            Delete           Bound    default/postgressqldb-pvc   nfs-client              2d18h
   pvc-c2b9fa6b-dc6e-43f9-9489-939d64a22aa3   15Gi       RWX            Delete           Bound    default/sklmapp-pvc         nfs-client              2d18h
   12:53
   NAME                STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
   postgressqldb-pvc   Bound    pvc-8c45fb02-0f13-4aab-830f-4e82fe1bfba0   25Gi       RWX            nfs-client     2d18h
   sklmapp-pvc         Bound    pvc-c2b9fa6b-dc6e-43f9-9489-939d64a22aa3   15Gi       RWX            nfs-client     2d18h

6. Launch the IBM Security Guardium Key Lifecycle Manager graphical user interface.

   https://master_server_IP_address:port/ibm/SKLM/login.jsp

   Where, master_server_IP_address is the IP address of the master server on the Kubernetes cluster, and port is the port number that IBM Security Guardium Key Lifecycle Manager server listens on for requests.

7. On the Configuration page that appears, click the License Agreements link to review the license terms, and then select the I accept the terms in the License Agreements check box.
8. Click Activate License.
9. Upload the IBM Security Guardium Key Lifecycle Manager license activation file and activate the license.
10. Click Login.
11. Log in to the IBM Security Guardium Key Lifecycle Manager graphical user interface with the Administrator user credentials (sklmadmin).
12. Optional: Configure Kubernetes to call the Health Status REST Service.
    Health checks are a simple way to determine whether a server-side application is working properly. Kubernetes requires two types of health checks: readiness probe and liveness probe. These probes are implemented by performing an HTTPS invocation by using the REST interface.

    For more information about configuring liveness and readiness probes, see the Kubernetes documentation.