Install and upgrade in Kubernetes

The instructions below cover the required steps to install and upgrade the Airlock Microgateway Operator in Kubernetes.

 
Notice

The data plane sidecar mode has been deprecated as of Microgateway 4.8 (see Deprecated features). To simplify installation and upgrade procedures, this guide only documents the sidecarless data plane mode.

If you still need to install or operate the deprecated sidecar mode for an existing deployment, follow the instructions in Microgateway 4.7 Installation and uninstallation and use the following versions:

  • Gateway API version: v1.4.0
  • Microgateway version: 4.8.0

Prerequisites

Install

Deploy cert-manager

The cert-manager is required to create the certificates for the Microgateway validating webhook endpoint. Run the command below to install the cert-manager:

 
Terminal box
helm install cert-manager \
  oci://quay.io/jetstack/charts/cert-manager \
  --version 'v1.19.1' \
  -n cert-manager \
  --wait \
  --create-namespace \
  --set crds.enabled=true

For more details, consider the official cert-manager Helm installation instructions.

Deploy Kubernetes Gateway API CRDs

Airlock Microgateway requires the Kubernetes Gateway API CRDs. To use incubating features, install the experimental channel. Otherwise the standard channel.

Standard channel:

 
Terminal box
kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml

Experimental channel:

 
Terminal box
kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/experimental-install.yaml
 
Info

More details, including release notes and upgrade information, can be found in the official Kubernetes Gateway API installation documentation.

Deploy Airlock Microgateway license

  1. Create the airlock-microgateway-system namespace.
  2.  
    Terminal box
    kubectl create namespace airlock-microgateway-system
  3. Store the license in the Microgateway Operator namespace, in a Kubernetes secret with the name airlock-microgateway-license and the key microgateway-license.txt. Use the following command:
  4.  
    Terminal box
    kubectl create secret generic airlock-microgateway-license \
  -n airlock-microgateway-system \
  --from-file=microgateway-license.txt=<path-to-your-local-microgateway-license.txt>
 
Notice

For more details about license monitoring, consider the article Configuring and monitoring licenses.

Deploy Airlock Microgateway Operator

  1. CRDs are included via the standard Helm 3 mechanism, i.e. Helm will handle initial installation but not upgrades

  2.  
    Terminal box
    helm install airlock-microgateway \
  oci://quay.io/airlockcharts/microgateway \
  --version 4.8.0 \
  -n airlock-microgateway-system \
  --wait \
  --set operator.sidecarGateway.enabled=false \
  --set operator.gatewayAPI.enabled=true
  3. The logs should show the message Thank you for installing Airlock Microgateway​. ... including further information on successful installation.

Upgrade

The following upgrade instructions aim to upgrade running deployments to a newer version of Airlock Microgateway without interruption of service.

 
Notice
  • The upgrade instructions may not apply to breaking release upgrades of Airlock Microgateway. Refer to the release notes published on GitHub.
  • Do not add the --reuse-values flag to the helm upgrade command when upgrading to a different version of Airlock Microgateway/Helm charts. The flag would prevent updating some required settings and changes.

For further information, refer to the official CRD Management Guide of the Gateway API.

  1. Update the CRDs. This will not break your current installation if not noted otherwise in the release notes of the new Microgateway version.
  2.  
    Terminal box
    kubectl apply -k https://github.com/airlock/microgateway/deploy/charts/airlock-microgateway/crds/?ref=4.8.0 \
  --server-side \
  --force-conflicts
  3. Upgrade the Microgateway Operator.
  4.  
    Terminal box
    helm upgrade airlock-microgateway \
  oci://quay.io/airlockcharts/microgateway \
  --version '4.8.0' \
  -n airlock-microgateway-system
  5. You can verify the current Pod status by checking the version label.
  6. Run the corresponding command, depending on which Kubernetes Gateway API channel you have installed.

  7. Standard channel:

  8.  
    Terminal box
    kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml

  9. Experimental channel:

  10.  
    Terminal box
    kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/experimental-install.yaml

  11. To upgrade the CRDs of the Gateway API, follow the instructions in the section Upgrading to a new version of the official CRD Management Guide of the Gateway API.

  12.  
    Notice

    Following an upgrade, if CRDs are added or removed, restart the Microgateway Operator to ensure that the updated CRDs are processed.