Install GKO

The Gluesync Kubernetes Operator (GKO) runs in the namespace of your Gluesync install, next to Core Hub. Recent Kubernetes kits install it for you. With an older kit, install it from its own Helm chart.

Commands on this page use the namespace gluesync-dev and the release name gluesync, the defaults of deploy-local.sh. With those defaults, the kit names its resources gluesync-gluesync-<component>: for example, the Core Hub StatefulSet is gluesync-gluesync-core-hub. Replace the namespace and the gluesync-gluesync prefix with your own.

With the Kubernetes kit

Open values.yaml in the gluesync-kubernetes directory of your kit. If it has an operator section, the kit installs GKO with the platform:

operator:
  enabled: true
  image: "molo17/gluesync-operator"
  tag: "0.1.1"          # set by the kit assembler
  updatePolicy: ui      # ui | gitops
  stability:
    windowSeconds: 20
    maxWaitSeconds: 180
  maintenance:
    disabled: false
    drainTimeoutSeconds: 600

Deploy the kit as usual, see Kubernetes and Helm. Next to Core Hub, the chart then creates:

the GluesyncPlatform custom resource definition and one GluesyncPlatform named gluesync, whose spec.version is the Core Hub version of the kit;
the GKO Deployment gluesync-gluesync-operator, with its ServiceAccount, Role and Service;
a Traefik route on /conductor/api, the path the Core Hub UI calls for updates;
the com.molo17.conductor.type label on Core Hub (core-hub) and on Chronos, Grafana and Prometheus (module).

GKO connects to Core Hub as an external module with the licence of the kit’s gluesync-gluesync-shared Secret, and serves HTTPS with the certificate of the gluesync-gluesync-tls Secret. You do not need a Core Hub API token.

A later helm upgrade of the kit does not undo an update: the chart keeps the image tags and the spec.version that GKO or the UI set. To install the kit without GKO, set operator.enabled=false.

The operator values map to the GluesyncPlatform fields with the same names, see GluesyncPlatform reference.

With GKO’s Helm chart

Use GKO’s own chart when your kit’s values.yaml has no operator section, or when you want to manage GKO separately from the kit. The chart is in the gluesync-operator repository.

Label the Gluesync workloads

Kits without GKO do not label their workloads. Add the labels GKO looks for:

kubectl -n gluesync-dev label statefulset gluesync-gluesync-core-hub com.molo17.conductor.type=core-hub
kubectl -n gluesync-dev label statefulset gluesync-gluesync-chronos com.molo17.conductor.type=module
kubectl -n gluesync-dev label deployment gluesync-gluesync-grafana gluesync-gluesync-prometheus com.molo17.conductor.type=module

Label only the workloads you want GKO to update. Exactly one workload must have com.molo17.conductor.type=core-hub.

Install the chart

Read the Core Hub version that runs now:

kubectl -n gluesync-dev get statefulset gluesync-gluesync-core-hub \
  -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'

Download the chart of the GKO release you want, then install it in the Gluesync namespace:

git clone --depth 1 --branch release-0.1.1 \
  https://gitlab.com/molo17-public/gluesync/gluesync-operator.git

helm upgrade --install gluesync-operator ./gluesync-operator/charts/gluesync-operator \
  --namespace gluesync-dev \
  --set platform.version=<running Core Hub tag> \
  --set platform.coreHub.url=https://gluesync-gluesync-core-hub:1717 \
  --set platform.coreHub.moduleAuth.licenseSecret.name=gluesync-gluesync-shared \
  --set api.tlsSecretName=gluesync-gluesync-tls \
  --set api.ingressRoute.enabled=true \
  --set api.ingressRoute.serversTransport=insecure-transport

platform.version is the tag of the running Core Hub image, for example 2.3.2.1. Starting from that version, GKO has nothing to update until you or the UI ask for a new one.

The main chart values:

Value Default Description

Value	Default	Description
`image.repository`, `image.tag`	`molo17/gluesync-operator`, the chart version	Operator image.
`imagePullSecrets`	`[]`	Pull secrets for the GKO image.
`api.tlsSecretName`	empty	Secret of type `kubernetes.io/tls` for the GKO API on port 1717. Empty serves plain HTTP inside the cluster: then also set `api.ingressRoute.scheme=http`.
`api.ingressRoute.enabled`	`false`	Creates the Traefik route on `/conductor/api` that the Core Hub UI calls.
`api.ingressRoute.serversTransport`	empty	Traefik ServersTransport to reach GKO. The kit’s `insecure-transport` accepts its self-signed certificate.
`platform.create`, `platform.name`	`true`, `gluesync`	Creates the `GluesyncPlatform` with this name.
`platform.coreHub.auth`	`module`	`module` connects to Core Hub with the licence, `token` with a Core Hub API token. See Connect to Core Hub.
`platform.coreHub.moduleAuth.licenseSecret.name`, `.key`	empty, `gs-license.dat`	Secret and key holding the licence. Required with `auth: module`.
`platform.*`		The other `GluesyncPlatform` fields: `version`, `modules`, `releaseChannel`, `updatePolicy`, `offline`, `imageRegistry`, `stability`, `maintenance`, `coreHub.url`, `coreHub.insecureSkipVerify`. See GluesyncPlatform reference.

image.repository, image.tag

molo17/gluesync-operator, the chart version

Operator image.

imagePullSecrets

[]

Pull secrets for the GKO image.

api.tlsSecretName

empty

Secret of type kubernetes.io/tls for the GKO API on port 1717. Empty serves plain HTTP inside the cluster: then also set api.ingressRoute.scheme=http.

api.ingressRoute.enabled

false

Creates the Traefik route on /conductor/api that the Core Hub UI calls.

api.ingressRoute.serversTransport

empty

Traefik ServersTransport to reach GKO. The kit’s insecure-transport accepts its self-signed certificate.

platform.create, platform.name

true, gluesync

Creates the GluesyncPlatform with this name.

platform.coreHub.auth

module

module connects to Core Hub with the licence, token with a Core Hub API token. See Connect to Core Hub.

platform.coreHub.moduleAuth.licenseSecret.name, .key

empty, gs-license.dat

Secret and key holding the licence. Required with auth: module.

platform.*

The other GluesyncPlatform fields: version, modules, releaseChannel, updatePolicy, offline, imageRegistry, stability, maintenance, coreHub.url, coreHub.insecureSkipVerify. See GluesyncPlatform reference.

A kit without GKO sets the image tags from its own values.yaml. After GKO has updated a component, a helm upgrade of that kit puts the old image back, without maintenance mode. Before you run helm upgrade on such a kit, set its image tags to the versions that run now, or move to a kit that includes GKO.

The stability check waits for the pods to be Ready. Kits that include GKO add readiness probes to Core Hub and Chronos; without them, a pod counts as Ready as soon as its container starts, and the check relies on the stability window to catch a crash.

Connect to Core Hub

GKO calls Core Hub’s REST API to read the release channel, list pipelines, and enter and exit maintenance mode. It reaches Core Hub at spec.coreHub.url, or at https://<core hub workload>.<namespace>.svc:1717 when the field is empty.

It can authenticate in two ways:

Licence (recommended): GKO connects to Core Hub as an external module, as Chronos and Conductor do, with the licence of spec.coreHub.moduleAuth.licenseSecretRef. It registers with the tag conductor, so Core Hub lists it as its Conductor module and forwards /conductor/api requests to it. The connection reconnects by itself when Core Hub restarts.
API token: GKO uses a Core Hub API token from the Secret of spec.coreHub.tokenSecretRef. The token must be allowed to list pipelines and to enter and exit maintenance mode. With the chart, set platform.coreHub.auth=token and either platform.coreHub.tokenSecret.value (the chart creates the Secret) or the name of a Secret you manage. A token takes precedence over the licence.

GKO reads only the Secrets named in its GluesyncPlatform: its Role grants get on those Secrets alone.

Check the installation

kubectl -n gluesync-dev get gsp
kubectl -n gluesync-dev get deployment,service -l app.kubernetes.io/name=gluesync-operator

kubectl get gsp shows the running Core Hub version and, after the first check of the version catalog, the latest version on your release channel:

NAME       PHASE             VERSION   DESIRED   AVAILABLE   AGE
gluesync   UpdateAvailable   2.3.2.1   2.3.2.1   2.3.2.2     2m

In the Core Hub UI, the Platform updates button lists the available updates, as it does on Docker. Core Hub reads them through GKO. To start an update, see How an update runs.

Upgrade GKO

Helm installs the custom resource definition from the chart’s crds directory on the first install only. Before you upgrade to an operator release that changes it, apply the new definition:

kubectl apply --server-side -f ./gluesync-operator/charts/gluesync-operator/crds/

Then run the same helm upgrade --install command with the new chart. With the kit, deploy the new kit; its operator.tag selects the GKO version. The upgrade keeps spec.version, spec.modules and spec.requestID of the live GluesyncPlatform.

From GKO 0.2.0, GKO updates itself from Platform updates, see GKO’s own update. To get there from GKO 0.1.x, upgrade once with Helm: a kit from v0.0.296 (chart 0.4.0), or GKO’s chart 0.2.0. GKO 0.2.0 needs no new custom resource definition.

A later helm upgrade keeps the GKO version GKO moved itself to, unless the chart’s GKO tag is a newer version: then Helm upgrades GKO.

Uninstall

helm uninstall gluesync-operator --namespace gluesync-dev

The GluesyncPlatform has the annotation helm.sh/resource-policy: keep, so Helm leaves it, with its history, in the namespace. Delete it, and then the custom resource definition, only when you no longer need them:

kubectl -n gluesync-dev delete gsp gluesync
kubectl delete crd gluesyncplatforms.gluesync.molo17.com

Uninstalling GKO does not change Core Hub or the modules: they keep running on their current images.