diff --git a/docs/admin/deployment/gcp/infrastructure-deployment/bastion-host-access.md b/docs/admin/deployment/gcp/infrastructure-deployment/bastion-host-access.md new file mode 100644 index 00000000..4241f22d --- /dev/null +++ b/docs/admin/deployment/gcp/infrastructure-deployment/bastion-host-access.md @@ -0,0 +1,158 @@ +--- +id: infrastructure-bastion-host-access +title: Bastion Host Access Configuration +sidebar_label: Bastion Host Access (Optional) +sidebar_position: 3 +pagination_prev: admin/deployment/gcp/infrastructure-deployment/infrastructure-manual-deployment +pagination_next: admin/deployment/gcp/components-deployment/components-deployment-overview +--- + +# Bastion Host Access Configuration + +:::warning Private Cluster Only +This section is only required if you deployed a **completely private GKE cluster** with private DNS. For public clusters or clusters with authorized networks configured, you can access the GKE API and CodeMie application directly from your workstation. +::: + +The Bastion Host is a secure jump server that provides access to your private GKE cluster and applications running inside the VPC. This VM enables both command-line management (SSH) and browser-based access (RDP) to internal resources. + +### Connection Methods Overview + +| Connection Type | Use Case | Access Method | +| --------------- | ------------------------------------------------------------- | --------------------- | +| **SSH** | Deploy and manage Kubernetes workloads using kubectl and Helm | Terminal/SSH client | +| **RDP** | Access web UIs exposed via private DNS (Kibana, Keycloak) | Remote Desktop client | + +### Option 1: SSH Connection for Cluster Management + +Use SSH to connect to the Bastion Host for deploying and managing Kubernetes resources. + +1. Retrieve the SSH command from Terraform outputs and connect: + +```bash +# Get the SSH connection command +terraform output bastion_ssh_command + +# Example output: +# gcloud compute ssh bastion-vm --project=your-project --zone=europe-west3-a + +# Use this command to connect +gcloud compute ssh bastion-vm --project=your-project --zone=europe-west3-a +``` + +:::tip IAM Permissions +Ensure your user account is listed in `bastion_members` variable from Phase 2 configuration. Only authorized users can SSH into the Bastion Host. +::: + +#### Step 2: Set user password (Required for RDP) + +After connecting via SSH, set a password for the `ubuntu` user for later RDP access: + +```bash +# Set password for the ubuntu user (you'll be prompted to enter it twice) +sudo passwd ubuntu +``` + +:::info Save Your Password +The `ubuntu` user password you set here will be used to login via RDP. Make sure to remember it or store it securely. +::: + +3. Fetch GKE cluster credentials to enable kubectl commands: + +```bash +# Get the kubectl configuration command +terraform output get_kubectl_credentials_for_private_cluster + +# Example output: +# gcloud container clusters get-credentials your-cluster-name --region=europe-west3 --project=your-project + +# Run the command to configure kubectl +gcloud container clusters get-credentials your-cluster-name --region=europe-west3 --project=your-project +``` + +4. Transfer the Helm charts repository to the Bastion Host. + +:::warning VPN Required for gitbud.epam.com +`gitbud.epam.com` is only accessible through VPN and is not reachable from the Bastion Host directly. Clone the repository on your local machine first, then transfer it using `gcloud scp`. +::: + +On your **local machine** (with VPN active): + +```bash +git clone https://gitbud.epam.com/epm-cdme/codemie-helm-charts.git +``` + +Then transfer the cloned directory to the Bastion Host: + +```bash +gcloud compute scp --recurse ./codemie-helm-charts bastion-vm:~/ \ + --project=your-project --zone=europe-west3-a +``` + +On the **Bastion Host**, navigate to the transferred directory: + +```bash +cd ~/codemie-helm-charts +``` + +You're now ready to proceed with [Components Deployment](../components-deployment/index.md). + +### Option 2: RDP Connection for Web UI Access + +Use RDP to access application web interfaces that are only available via private DNS (such as Kibana, Keycloak Admin Console). + +:::tip When to Use RDP +RDP is useful when you need to access web-based administrative interfaces that aren't exposed publicly. For kubectl/Helm operations, SSH access is sufficient. +::: + +1. Retrieve the RDP forwarding command from Terraform outputs and start the IAP tunnel: + +```bash +# Get the RDP forwarding command +terraform output bastion_rdp_command + +# Example output: +# gcloud compute start-iap-tunnel bastion-vm 3389 --local-host-port=localhost:3389 --zone=europe-west3-a --project=your-project +``` + +Run the command to create an IAP tunnel that forwards RDP traffic (keep this terminal open): + +```bash +gcloud compute start-iap-tunnel bastion-vm 3389 \ + --local-host-port=localhost:3389 \ + --zone=europe-west3-a \ + --project=your-project +``` + +2. Open your Remote Desktop client and connect: + +| Setting | Value | +| ------------ | -------------------------- | +| **Computer** | `localhost:3389` | +| **Username** | `ubuntu` | +| **Password** | Password set in SSH Step 2 | + +### Tips for Using the Bastion Host + +#### Pasting Commands into Terminal + +Use the correct keyboard shortcut for pasting in Linux terminal: + +``` +Shift + Ctrl + V +``` + +(Regular `Ctrl + V` won't work in most Linux terminal applications) + +#### File Transfer to/from Bastion + +Transfer files between your local machine and Bastion using `gcloud scp`: + +```bash +# Upload file to Bastion +gcloud compute scp local-file.txt bastion-vm:~/remote-file.txt \ + --project=your-project --zone=europe-west3-a + +# Download file from Bastion +gcloud compute scp bastion-vm:~/remote-file.txt ./local-file.txt \ + --project=your-project --zone=europe-west3-a +``` diff --git a/docs/admin/deployment/gcp/infrastructure-deployment/manual-deployment.md b/docs/admin/deployment/gcp/infrastructure-deployment/manual-deployment.md index ccc1d314..51243294 100644 --- a/docs/admin/deployment/gcp/infrastructure-deployment/manual-deployment.md +++ b/docs/admin/deployment/gcp/infrastructure-deployment/manual-deployment.md @@ -4,7 +4,7 @@ title: Manual Infrastructure Deployment sidebar_label: Manual Deployment sidebar_position: 2 pagination_prev: admin/deployment/gcp/infrastructure-deployment/infrastructure-deployment-overview -pagination_next: admin/deployment/gcp/components-deployment/components-deployment-overview +pagination_next: admin/deployment/gcp/infrastructure-deployment/infrastructure-bastion-host-access --- import Tabs from '@theme/Tabs'; @@ -202,6 +202,11 @@ create_private_dns_zone = false # Set to true if using private DNS keycloak_db_config = { enabled = true } langfuse_db_config = { enabled = false } litellm_db_config = { enabled = false } + +# Optional: Dedicated Cloud Memorystore Redis Instance +# Set enabled = true to provision a Memorystore Redis instance for caching. +# Supported fields: enabled, tier (BASIC|STANDARD_HA), memory_size_gb, redis_version. +codemie_cache_config = { enabled = false } ``` :::info Configuration References @@ -250,144 +255,16 @@ gcloud sql instances list --project= - Keycloak Cloud SQL details (`keycloak_pg_host`, `keycloak_pg_database`, `keycloak_pg_user`, `keycloak_pg_secret_name`) — present when `keycloak_db_config.enabled = true` - LiteLLM Cloud SQL details (`litellm_pg_host`, `litellm_pg_database`, `litellm_pg_user`, `litellm_pg_secret_name`) — present when `litellm_db_config.enabled = true` - Langfuse Cloud SQL details (`langfuse_pg_host`, `langfuse_pg_database`, `langfuse_pg_user`, `langfuse_pg_secret_name`) — present when `langfuse_db_config.enabled = true` +- Cache details (`codemie_cache_address`, `codemie_cache_secret`) — present when `codemie_cache_config.enabled = true` - Service account information :::tip Infrastructure Ready The GCP infrastructure deployment is now complete. You can proceed to configure cluster access or continue with components deployment. ::: -## Bastion Host Access Configuration (Optional) - -:::warning Private Cluster Only -This section is only required if you deployed a **completely private GKE cluster** with private DNS. For public clusters or clusters with authorized networks configured, you can access the GKE API and CodeMie application directly from your workstation. -::: - -The Bastion Host is a secure jump server that provides access to your private GKE cluster and applications running inside the VPC. This VM enables both command-line management (SSH) and browser-based access (RDP) to internal resources. - -### Connection Methods Overview - -| Connection Type | Use Case | Access Method | -| --------------- | ------------------------------------------------------------- | --------------------- | -| **SSH** | Deploy and manage Kubernetes workloads using kubectl and Helm | Terminal/SSH client | -| **RDP** | Access web UIs exposed via private DNS (Kibana, Keycloak) | Remote Desktop client | - -### Option 1: SSH Connection for Cluster Management - -Use SSH to connect to the Bastion Host for deploying and managing Kubernetes resources. - -1. Retrieve the SSH command from Terraform outputs and connect: - -```bash -# Get the SSH connection command -terraform output bastion_ssh_command - -# Example output: -# gcloud compute ssh bastion-vm --project=your-project --zone=europe-west3-a - -# Use this command to connect -gcloud compute ssh bastion-vm --project=your-project --zone=europe-west3-a -``` - -:::tip IAM Permissions -Ensure your user account is listed in `bastion_members` variable from Phase 2 configuration. Only authorized users can SSH into the Bastion Host. -::: - -#### Step 2: Set user password (Required for RDP) - -After connecting via SSH, set a password for the `ubuntu` user for later RDP access: - -```bash -# Set password for the ubuntu user (you'll be prompted to enter it twice) -sudo passwd ubuntu -``` - -:::info Save Your Password -The `ubuntu` user password you set here will be used to login via RDP. Make sure to remember it or store it securely. -::: - -3. Fetch GKE cluster credentials to enable kubectl commands: - -```bash -# Get the kubectl configuration command -terraform output get_kubectl_credentials_for_private_cluster - -# Example output: -# gcloud container clusters get-credentials your-cluster-name --region=europe-west3 --project=your-project - -# Run the command to configure kubectl -gcloud container clusters get-credentials your-cluster-name --region=europe-west3 --project=your-project -``` - -4. Clone the Helm charts repository needed for component deployment: - -```bash -git clone https://gitbud.epam.com/epm-cdme/codemie-helm-charts.git -cd codemie-helm-charts -``` - -You're now ready to proceed with [Components Deployment](../components-deployment/index.md). - -### Option 2: RDP Connection for Web UI Access - -Use RDP to access application web interfaces that are only available via private DNS (such as Kibana, Keycloak Admin Console). - -:::tip When to Use RDP -RDP is useful when you need to access web-based administrative interfaces that aren't exposed publicly. For kubectl/Helm operations, SSH access is sufficient. -::: - -1. Retrieve the RDP forwarding command from Terraform outputs and start the IAP tunnel: - -```bash -# Get the RDP forwarding command -terraform output bastion_rdp_command - -# Example output: -# gcloud compute start-iap-tunnel bastion-vm 3389 --local-host-port=localhost:3389 --zone=europe-west3-a --project=your-project -``` - -Run the command to create an IAP tunnel that forwards RDP traffic (keep this terminal open): - -```bash -gcloud compute start-iap-tunnel bastion-vm 3389 \ - --local-host-port=localhost:3389 \ - --zone=europe-west3-a \ - --project=your-project -``` - -2. Open your Remote Desktop client and connect: - -| Setting | Value | -| ------------ | -------------------------- | -| **Computer** | `localhost:3389` | -| **Username** | `ubuntu` | -| **Password** | Password set in SSH Step 2 | - -### Tips for Using the Bastion Host - -#### Pasting Commands into Terminal - -Use the correct keyboard shortcut for pasting in Linux terminal: - -``` -Shift + Ctrl + V -``` - -(Regular `Ctrl + V` won't work in most Linux terminal applications) - -#### File Transfer to/from Bastion - -Transfer files between your local machine and Bastion using `gcloud scp`: - -```bash -# Upload file to Bastion -gcloud compute scp local-file.txt bastion-vm:~/remote-file.txt \ - --project=your-project --zone=europe-west3-a - -# Download file from Bastion -gcloud compute scp bastion-vm:~/remote-file.txt ./local-file.txt \ - --project=your-project --zone=europe-west3-a -``` - ## Next Steps -After successful infrastructure deployment, proceed to [Components Deployment](../components-deployment/index.md) to install AI/Run CodeMie application components. +After successful infrastructure deployment: + +- **Private GKE cluster with private DNS** — proceed to [Bastion Host Access Configuration](./bastion-host-access.md) to set up secure access before deploying components. +- **Public cluster or authorized networks** — proceed directly to [Components Deployment](../components-deployment/index.md). diff --git a/docs/admin/deployment/gcp/infrastructure-deployment/scripted-deployment.md b/docs/admin/deployment/gcp/infrastructure-deployment/scripted-deployment.md index 3b4bc283..a56e271a 100644 --- a/docs/admin/deployment/gcp/infrastructure-deployment/scripted-deployment.md +++ b/docs/admin/deployment/gcp/infrastructure-deployment/scripted-deployment.md @@ -91,6 +91,11 @@ TF_VAR_extra_authorized_networks='[]' TF_VAR_keycloak_db_config='{"enabled":true}' TF_VAR_langfuse_db_config='{"enabled":false}' TF_VAR_litellm_db_config='{"enabled":false}' + +# Optional: Dedicated Cloud Memorystore Redis Instance Configuration +# Set enabled=true to provision a Memorystore Redis instance for caching. +# Supported fields: enabled, tier (BASIC|STANDARD_HA), memory_size_gb, redis_version. +TF_VAR_codemie_cache_config='{"enabled":false}' ``` :::info Complete Variable List @@ -165,6 +170,10 @@ LANGFUSE_POSTGRES_DATABASE_USER=langfuse_admin LANGFUSE_POSTGRES_DATABASE_INSTANCE=codemie-langfuse-postgresql LANGFUSE_POSTGRES_DATABASE_SECRET=codemieLangfusePGDB LANGFUSE_POSTGRES_DATABASE_PASSWORD=generated-password + +# Cache (present when codemie_cache_config.enabled=true) +CODEMIE_CACHE_ADDRESS= +CODEMIE_CACHE_SECRET=generated-auth-string ``` :::tip Save These Outputs @@ -184,6 +193,9 @@ gcloud container clusters list --project= # Check Cloud SQL instance gcloud sql instances list --project= +# Check Memorystore Redis instance (if enabled) +gcloud redis instances list --project= --region= + # Verify GCS state bucket gcloud storage buckets list | grep terraform ``` @@ -198,6 +210,7 @@ less logs/codemie_gcp_deployment_YYYY-MM-DD-HHMMSS.log ## Next Steps -After successful infrastructure deployment and validation, proceed to: +After successful infrastructure deployment and validation: -**[Components Deployment](../components-deployment/index.md)** - Deploy AI/Run CodeMie application components to your GKE cluster +- **Private GKE cluster with private DNS** — proceed to [Bastion Host Access Configuration](./bastion-host-access.md) to set up secure access before deploying components. +- **Public cluster or authorized networks** — proceed directly to [Components Deployment](../components-deployment/index.md). diff --git a/sidebars.ts b/sidebars.ts index a9a4a1c6..466cdf18 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -527,6 +527,7 @@ const sidebars: SidebarsConfig = { items: [ 'admin/deployment/gcp/infrastructure-deployment/infrastructure-scripted-deployment', 'admin/deployment/gcp/infrastructure-deployment/infrastructure-manual-deployment', + 'admin/deployment/gcp/infrastructure-deployment/infrastructure-bastion-host-access', ], }, {