User's Guide: Deploy the Workflow - Web Interface

Disclaimer: The Fortanix CCM Workflows feature will only be enabled for Customers with an "Enterprise" license.

Deploy the Workflow - UI

After a workflow is approved by all the users, you can execute the application in the workflow using the workflow RUN button that allows users to start the application job and monitor them.

NOTE
  • Currently, the RUN button works only for single job deployments, that is, workflows that only contain a single application will run using the RUN. In future releases of CCM, multiple jobs will be supported.
  • The application execution will be performed on the Azure Kubernetes Service (AKS) runtime environment. In future releases of CCM, other runtime environments will also be supported for the workflow deployment.

Execute the Application on Azure Kubernetes Service

Prerequisites

  • Compute Clusters: A compute cluster is a set of nodes that run containerized applications. Compute clusters are used to run CCM workflows. Refer to Section 18.1.4 for steps to configure a compute cluster in Fortanix CCM and access the cluster.
  • Job specification: A Kubernetes job spec is a YAML file. A skeleton is provided as input to Fortanix CCM with user parameters. This is then updated by Fortanix CCM with relevant environment variables. Please see the example for expected inputs.
    Refer to Section Configure Workflow for steps to configure the Kubernetes job specification.

Create an AKS Cluster

To set up an AKS Cluster refer to the article how to set up an AKS cluster as worker nodes in Fortanix CCM. The article shows you how to:

  • Create a cluster
  • Configure Fortanix Node Agent
  • Use the cluster to deploy applications manually

Obtain the Kubectl Config File

A kubectl YAML file is used to configure the compute cluster. This file stores the following:

  • The client certificates, token, cluster CA certificate. This is the only authentication mechanism for AKS. We do not yet support username/password or other authentication options.
  • The server address.
  • Metadata like cluster name and user name.

The following are the usual steps for Azure Kubernetes Service to obtain a kubectl config file. For more information refer to official documentation from Microsoft.

  1. Log in on the command line.
    az login
  2. Get a list of all the available subscriptions.
    az account list
  3. Select a subscription.
    az account set --subscription subscription-id
  4. Get the AKS credentials.
    az aks get-credentials --name (cluster-name) --resource-group (cluster-resource-group)
    The config is now available in ~/.kube/config folder.
    NOTE
    The credentials can be revoked if needed using the command:az aks rotate-certificates but this will incur a downtime, for more information, check Microsoft Azure Kubernetes Service documentation.

Configure the AKS Compute Cluster in Fortanix CCM

In order to start applications using the RUN button, you must configure the AKS credentials in Fortanix CCM.

NOTE
Only the Azure Kubernetes Service is available at the moment.

To configure the AKS cluster in Fortanix CCM:

  1. Click the Infrastructure tab in the Fortanix CCM left panel and select the Compute Clusters tab.
  2. In the Compute Clusters page, click ADD COMPUTE CLUSTER to configure a new compute cluster. ComputeClusters1.pngFigure 1: Create compute cluster
  3. In the “Add Cluster” form, enter the following details:
    • Name: The AKS cluster name.
    • Type: The runtime environment, that is, Kubernetes.
    • Kubernetes Configuration: The YAML file obtained in Section Obtain the Kubectl File that has the AKS configuration details.
    ComputeClusters2.pngFigure 2: Configure the compute cluster
  4. Click ADD CLUSTER to save the cluster configuration. The cluster is successfully configured. ComputeClusters8.pngFigure 3: Cluster configured

Configure Workflow

To run a workflow application, you need to configure the workflow by following the steps below:

  1. Click the Workflows tab and on the Workflows page, select the Approved workflows tab.
  2. In the list of approved workflows, select a workflow that has a single application since Fortanix CCM 3.5 supports only single job deployments. ComputeClusters3.pngFigure 4: Select approved workflow
  3. In the detailed view of the selected workflow, you will notice a RUN button in the disabled state. The RUN button will be disabled if you have not configured the job specification. To enable the RUN button, configure the Kubernetes job specification using the Configuration ComputeClusters4.pngicon next to the RUN button. ComputeClusters5.pngFigure 5: Configure job spec
  4. In the RUN WORKFLOW window, enter the following details:
    • Deployment Type: The workflow deployment type, that is, Kubernetes (Single Job). Currently, Fortanix CCM supports only a single job deployment.
    • Namespace: The Kubernetes namespace
    • Cluster: The cluster that you configured in Fortanix CCM. Currently, Fortanix CCM supports only the AKS cluster as the runtime environment for deploying the workflow.
    • Deployment Type: The deployment type for the application, that is, Kubernetes.
    • Job Specification: The Kubernetes job specification YAML file that is required by the cluster and the application to run the application job.
    apiVersion: batch/v1
    kind: Job
    metadata:
    name: job-name
    spec:
    backoffLimit: 0
    template:
    spec:
    containers:
    - name: containername
    resources:
    limits:
    kubernetes.azure.com/sgx_epc_mem_in_MiB: 1
    imagePullSecrets:
    - name: dockerhub
    restartPolicy: Never
    NOTE
    • This is a Kubernetes job spec: https://kubernetes.io/docs/concepts/workloads/controllers/job/
    • Fortanix CCM will update it with relevant environment variables.
    • We need to provide imagePullSecrets if the docker image is behind a password-protected docker repository.
    • Fortanix CCM does not push any secrets stored in it, it is the user’s responsibility to configure these in Kubernetes.
    ComputeClusters6.pngFigure 6: Configure job spec ComputeClusters7.pngFigure 7: Configure job spec
  5. Configure secret in Kubernetes.
    • This is a subset of: https://kubernetes.io/docs/concepts/configuration/secret/
    • For any information, please refer to the official documentation above.
      To configure the secret:
    • If you are using a docker hub, generate a token as in this example.
    • If you are using ECR - get a token using the CLI.
    • Using docker server, for docker hub, it is the URL used in this example.
    NOTE
    Tokens usually expire, so the following step needs to be refreshed.
    kubectl delete secret dockerhub
    kubectl create secret docker-registry dockerhub --docker-server=https://index.docker.io/v1/ --docker-username=username --docker-password=password
  6. Click CONFIGURE to configure the Kubernetes job specification.
  7. If the job spec is configured successfully, you will see the RUN button enabled. ComputeClusters9.pngFigure 8: Run enabled

Run the Workflow Application

To run the Workflow application,

  1. Configure the image pull secret.
  2. Click the RUN button in the detailed view of an approved workflow that you enabled in the previous section. ComputeClusters12.pngFigure 9: Run the application
  3. In the RUN WORKFLOW modal window, the Cluster, Job Type, and Job Spec that you configured in the previous section will be selected.
  4. Click RUN to run the workflow. ComputeClusters11.pngFigure 10: Run workflow
  5. You will notice the Running indication at the bottom of the workflow.
    NOTE
    The workflow execution status is not updated live as it must be fetched from the cluster manually. Hence click the Refresh icon to get the latest execution status.
  6. At any point, if there is a need to stop the execution, click STOP. This will re-enable the RUN button.
  7. If the application is executed successfully, you will see the status of the execution under the Execution Log. Click the View detail link to view the log details. ComputeClusters15.pngFigure 11: Running workflow
  8. The EXECUTION LOG modal window shows the detailed logs of the run. You can also download the log using the DOWNLOAD link. ComputeClusters13.pngFigure 12: Log details
    NOTE
    If you try to run a workflow that has more than one application, you will see the following error. The Fortanix CCM 3.5 release only supports running a workflow with a single application. ComputeClusters14.pngFigure 13: Workflow execution not allowed for multiple applications

Comments

Please sign in to leave a comment.

Was this article helpful?
0 out of 0 found this helpful