Deploy cluster services for NBS 7

This phase performs the deployments and configuration in your Kubernetes cluster that the NBS 7 microservices depend on. You first enable Linkerd for the namespace that the microservices deploy into, then deploy the core Kubernetes services, and then set up Keycloak for authentication.

The kubectl commands in this phase require the cluster connection you configured in Connect to Kubernetes cluster.

Enable Linkerd for the default namespace

Linkerd provides mutual TLS (mTLS) between the NBS 7 microservices, all of which are deployed to the default Kubernetes namespace. Complete these steps to enable Linkerd for that namespace:

  1. Annotate the default namespace:

    kubectl annotate namespace default "linkerd.io/inject=enabled"

    The output should be namespace/default annotated.

  2. Verify that the annotation is in place:

    kubectl get namespace default -o=jsonpath='{.metadata.annotations}'

    The output should include "linkerd.io/inject":"enabled".

  3. If this is an update rather than a new installation, that is, if you already completed steps in the Deploy NBS 7 microservices section for this environment, restart the pods in the default namespace so that each pod gets a Linkerd sidecar container:

    kubectl get pods -n default -o custom-columns=":metadata.name" | xargs kubectl delete pod -n default

    Restarted pods show 2/2 in the READY column of kubectl get pods output.

Next steps

Complete the core services page next, then set up Keycloak using the page that matches your environment:

  1. Deploy core services: Get the NEDSS-Helm charts, then install the core Kubernetes services that NBS 7 depends on, including the Traefik ingress controller, cert-manager, and the Cluster Autoscaler.
  2. Set up Keycloak for authentication using one of the following:
    • Deploy and configure Keycloak: Install the NBS-provided Keycloak, create the NBS service and user realms, configure service clients, and retrieve client secrets. Use this page if you do not already run Keycloak.
    • Use an existing Keycloak: Configure a Keycloak your organization already runs to authenticate NBS 7 users, including the OIDC client, claim mapping, and NBS 6 user alignment. Use this page if you already operate Keycloak.