Air-gapped Edge installation via the Zarf method

Important The Zarf package method is only supported if you have an Air-gapped Collibra Platform and environment.

Prerequisites

On your workstation

  • Your server meets all system requirements.
  • You must have admin level access to the Kubernetes cluster where you want to install your Edge site.
    • If you are installing your Edge site on an OpenShift cluster, you must have the permission to create SecurityContextConstraints and ClusterRoleBinding objects, such as cluster-admin.
  • You have configured the forward proxy, if a forward proxy is required for Edge to connect to Collibra Platform Self-Hosted. Contact your network administrator if this is applicable.

In your CPSH environment

  • You are installing your Edge site on an EKS or OpenShift cluster that has Zarf deployed.
    Note The AWS Load Balancer Controller is not needed.
  • FIPS Mode: Collibra must be installed in FIPS mode for Air-gapped Edge installation to support required cryptographic modules. (See Install CPSH for more information.)
    Important For Air-gapped environments, FIPS mode is mandatory to support required cryptographic algorithms.
  • If you want to deploy in Edge-only mode, you must apply the kubectl apply -f cpsh-priority-classes.yaml and /cpsh-platform-zarf-package/resources/cpsh-priority-classes.yaml priority classes before proceeding.
  • The username and password for a Collibra user that has the following global permissions. This user is used only to create, reinstall, and delete Air-gapped Edge sites. For reference purposes, we will refer to this user as the Air-gapped Edge installation user.
    • Install Edge sites
    • Manage Edge sites
    • Manage connections and capabilities
    • Upload Edge charts
    • View Edge connections and capabilities

Steps

Important You can only have 1 Air-gapped Edge site per Kubernetes cluster.

  1. From the Downloads page, click the latest Collibra Zarf package.
    Note If you do not see Collibra CPSH extended capabilities please reach out to your Collibra account team.
  2. From the Collibra ZARF package page, click and download the Edge Zarf package.
  3. Set up your kubeconfig or kubecontext so that it points to your Kubernetes cluster.
  4. If you don't plan to install Technical lineage Collibra Platform Self-Hosted, apply these priority classes with kubectl apply -f cpsh-priority-classes.yaml and /cpsh-platform-zarf-package/resources/cpsh-priority-classes.yaml:
    Copy
    apiVersion: scheduling.k8s.io/v1
    kind: PriorityClass
    metadata:
      name: platform
    value: 10000000
    description: "Platform supporting services level"
    ---
    apiVersion: scheduling.k8s.io/v1
    kind: PriorityClass
    metadata:
      name: application
    value: 100000
    description: "Application level"
    ---
    apiVersion: scheduling.k8s.io/v1
    kind: PriorityClass
    metadata:
      name: job
    value: 1000
    description: "Job level"
  5. If you are using an Openshift cluster, deploy Security Context Constraints (SCC) which provide Edge service accounts with the required permissions.
    1. Create the SCC file, for example, edge-scc-minimal.yaml, and paste the following information into it:
      Copy
      apiVersion: security.openshift.io/v1
      kind: SecurityContextConstraints
      metadata:
        name: edge-scc-documented
      allowHostDirVolumePlugin: false
      allowHostIPC: false
      allowHostNetwork: false
      allowHostPID: false
      allowHostPorts: false
      allowPrivilegeEscalation: false
      allowPrivilegedContainer: false
      allowedCapabilities: []
      allowedUnsafeSysctls: []
      defaultAddCapabilities: []
      fsGroup:
        type: MustRunAs
      priority: null
      readOnlyRootFilesystem: true
      requiredDropCapabilities: []
      runAsUser:
        type: MustRunAs
        uid: 1000
      seLinuxContext:
        type: MustRunAs
        seLinuxOptions:
          level: "s0"
          role: "system_r"
          type: "container_t"
          user: "system_u"
      seccompProfiles:
        - 'runtime/default'
      supplementalGroups:
        type: MustRunAs
      # who can use it
      users: []
      groups: [system:authenticated]
    2. Create the SCC-role file, for example, edge-scc-role-minimal.yaml, and paste the following information into it:
      Copy
      # File: edge-scc-role-minimal.yaml
      apiVersion: rbac.authorization.k8s.io/v1
      kind: Role
      metadata:
        name: edge-scc-minimal
      rules:
      - apiGroups:
        - security.openshift.io
        resourceNames:
        - edge-scc-minimal
        resources:
        - securitycontextconstraints
        verbs:
        - use
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: edge-scc-minimal
      subjects:
      - kind: Group
        name: system:serviceaccounts
        apiGroup: rbac.authorization.k8s.io
      roleRef:
        kind: Role
        name: edge-scc-minimal
        apiGroup: rbac.authorization.k8s.io
    3. Deploy both the SCC and SCC-role files:
      Copy
      kubectl apply -f edge-scc-minimal.yaml
      kubectl apply -f edge-scc-role-minimal.yaml -n <my-namespace>
  6. Using the Zarf CLI:
    1. Copy and paste the following command in the Zarf CLI:
      Copy
      zarf package deploy <PATH TO ZST PACKAGE> \
          --set PLATFORM_ID=<DGC URL> \
          --set PLATFORM_USER=<DGC ADMIN NAME> \
          --set PLATFORM_PASSWORD=<DGC ADMIN PASSWORD> \
          --set SITE_NAME=<SITE_NAME>
      Note This can be run in interactive mode by just running the first line of the command. When you run the first line of the above command, you will be prompted to enter the information individually.
    2. Enter the relevant details for each installation flag. For example, enter your Collibra Platform Self-Hosted URL for <DGC URL>.
      FlagDescription
      zarf package deploy <PATH TO ZST PACKAGE>The path Edge site Zarf package you downloaded.
      --set PLATFORM_ID=<DGC URL>The URL of your Collibra Platform Self-Hosted.
      --set PLATFORM_USER=<DGC ADMIN NAME> The username of your Collibra admin.
      --set PLATFORM_PASSWORD=<DGC ADMIN PASSWORD>The password of your Collibra admin.
      --set SITE_NAME=<SITE_NAME>The desired name of your Edge site.
      Important 
      • If you don't enter a site name, your Air-gapped Edge site is created with the default name: CPSH-Collibra-Edge.
      • If you plan to have more than 1 Air-gapped Edge site on the same Collibra Platform, ensure that each site has a unique name. If you have multiple Air-gapped Edge sites with the same name on the same Collibra Platform, your sites may fail to deploy.
      --namespace <NAMESPACE>

      Add this flag if you want to use a custom namespace, for example, wen you need to run multiple Air-gapped Edge sites on a single cluster. This flag specifies the Kubernetes namespace where your Air-gapped Edge site will be installed.

      Note By default, the Edge installation packages deploys into a namespace called collibra-edge. If you don't specify a custom namespace, your Air-gapped Edge site will be installed in the collibra-edge namespace.

      --set EDGE_NAMESPACE=<NAMESPACE>

      Required when you use the --namespace flag. This flag sets the internal custom namespace variable used by the Air-gapped Edge site package scripts.

      Important The value here must match the value used with the --namespace flag. Omitting one flag or using different values can cause the Air-gapped Edge site deployment to fail or behave unexpectedly.

      --set OPENSHIFT_ENABLED=trueAdd this flag if you are deploying your Air-gapped Edge site on an OpenShift cluster. This enables the required Security Context Constraints (SCC) and OpenShift-specific configuration for the Edge site pods.
      Copy
      zarf package deploy zarf/edgefolder \
          --set PLATFORM_ID=https://mycollibra.com \
          --set PLATFORM_USER=EdgeUser1 \
          --set PLATFORM_PASSWORD=Pass1234 \
          --set SITE_NAME=EdgeSite1234
    3. Run the command to create the Edge site.
      Your Air-gapped Edge site is created and deployed. It will appear in Edge. A dedicated user account is created in Collibra Platform Self-Hosted that grants the permission to manage your Edge site.
  7. Log in to Edge to add connections and capabilities to your Air-gapped Edge site.

Troubleshooting

If an Air-gapped Edge site fails to install on your Kubernetes cluster, a site is still created in Edge. You can choose to do one of the following:
  • Remove the failed Edge site from your Kubernetes cluster and Edge by running the following command:
    Copy
    zarf package remove ZARF_PACKAGE_FILE/ZARF_PACKAGE_NAME
  • Remove the failed Edge site from your Kubernetes cluster, but keep the Edge site in Edge by running the following command:
    Copy
     ZARF_VAR_KEEP_CPSH_EDGE_SITE=true \
         zarf package remove ZARF_PACKAGE_FILEZARF_PACKAGE_NAME
    When you try to install or reinstall the failed Air-gapped Edge site installation, you can use the same name to reuse the Edge site in Edge.
Note If you installed your Air-gapped Edge site on a custom namespace, zarf package remove doesn't delete the namespace. After removing the package, you need to run the following command to manually delete the namespace:
kubectl delete namespace <NAMESPACE>

What's next