Skip to content

Commit f4b5907

Browse files
david-yuclaudemicheleRP
authored
docs (k8s): Add Operator Console CRD deployment docs (#1629)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: micheleRP <michele@redpanda.com>
1 parent 4230c3f commit f4b5907

1 file changed

Lines changed: 284 additions & 7 deletions

File tree

‎modules/deploy/pages/console/kubernetes/deploy.adoc‎

Lines changed: 284 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
= Deploy Redpanda Console on Kubernetes
2-
:description: Deploy Redpanda Console on Kubernetes using Helm charts or YAML manifests.
2+
:description: Deploy Redpanda Console on Kubernetes using the Redpanda Operator, Helm charts, or YAML manifests.
33
:env-kubernetes: true
4+
:page-topic-type: how-to
5+
:personas: platform_operator
6+
:learning-objective-1: Deploy Redpanda Console on Kubernetes using the Redpanda Operator, Helm charts, or YAML manifests
7+
:learning-objective-2: Configure TLS and SASL authentication for Redpanda Console
8+
:learning-objective-3: Verify and scale a Redpanda Console deployment
49

5-
This page shows you how to deploy Redpanda Console as a standalone service on Kubernetes using Helm charts or YAML manifests.
10+
This page shows you how to deploy Redpanda Console as a standalone service on Kubernetes using the Redpanda Operator (Console custom resource), Helm charts, or YAML manifests.
611

712
[NOTE]
813
====
@@ -15,6 +20,11 @@ Use this standalone deployment guide only when you need to:
1520
* Deploy multiple Redpanda Console instances for different environments.
1621
====
1722

23+
After reading this page, you will be able to:
24+
25+
* [ ] {learning-objective-1}
26+
* [ ] {learning-objective-2}
27+
* [ ] {learning-objective-3}
1828
1929
== Prerequisites
2030

@@ -23,6 +33,77 @@ Use this standalone deployment guide only when you need to:
2333

2434
== Install Redpanda Console
2535

36+
Choose your deployment method.
37+
38+
[tabs]
39+
======
40+
Operator::
41+
+
42+
--
43+
44+
The Redpanda Operator provides a `Console` custom resource (CR) that lets you deploy and manage Redpanda Console declaratively. The operator handles the lifecycle of the Console deployment, including creating the underlying Deployment, Service, and ConfigMap resources.
45+
46+
. Create a Console custom resource:
47+
+
48+
[,yaml]
49+
.`console.yaml`
50+
----
51+
apiVersion: cluster.redpanda.com/v1alpha2
52+
kind: Console
53+
metadata:
54+
name: redpanda-console
55+
namespace: redpanda
56+
spec:
57+
cluster:
58+
clusterRef: <1>
59+
name: redpanda
60+
replicaCount: 2 <2>
61+
resources: <3>
62+
requests:
63+
cpu: 100m
64+
memory: 512Mi
65+
limits:
66+
cpu: 4000m
67+
memory: 2Gi
68+
service: <4>
69+
type: LoadBalancer
70+
port: 8080
71+
ingress: <5>
72+
enabled: true
73+
annotations:
74+
cert-manager.io/cluster-issuer: letsencrypt-prod
75+
className: nginx
76+
hosts:
77+
- host: console.example.com
78+
paths:
79+
- path: /
80+
pathType: Prefix
81+
tls:
82+
- secretName: console-tls
83+
hosts:
84+
- console.example.com
85+
----
86+
+
87+
<1> Reference to your Redpanda cluster CR. The operator automatically configures broker addresses, TLS, and authentication based on the referenced cluster. If your Redpanda cluster is not managed by the operator, use `staticConfiguration` instead of `clusterRef`. See the TLS section for `staticConfiguration` examples.
88+
<2> For production, run at least two replicas for high availability and rolling upgrades.
89+
<3> Adjust resource requests and limits based on your expected workload and available node resources.
90+
<4> Use `LoadBalancer` for cloud environments or when you want Redpanda Console to be accessible from outside the cluster. Use `ClusterIP` for internal-only access.
91+
<5> Enable and configure Ingress if you want to expose Redpanda Console using a domain name and use TLS/HTTPS. Make sure your cluster has an Ingress controller installed.
92+
93+
. Apply the Console CR:
94+
+
95+
[,bash]
96+
----
97+
kubectl apply -f console.yaml --namespace redpanda
98+
----
99+
100+
The operator reconciles the Console CR and creates the necessary Deployment, Service, and ConfigMap resources.
101+
102+
--
103+
Helm::
104+
+
105+
--
106+
26107
. Create a values file:
27108
+
28109
The values file is where you configure how Redpanda Console connects to your Redpanda or Kafka cluster. You must specify the broker addresses in the `config.kafka.brokers` section.
@@ -105,9 +186,73 @@ helm install redpanda-console redpanda/console \
105186
--values console-values.yaml
106187
----
107188
189+
--
190+
======
191+
108192
=== Connect to Redpanda clusters with TLS
109193

110-
If your Redpanda cluster uses TLS encryption (the default for Helm deployments), you must configure Redpanda Console to connect securely:
194+
If your Redpanda cluster uses TLS encryption (the default for Helm deployments), you must configure Redpanda Console to connect securely.
195+
196+
[tabs]
197+
======
198+
Operator::
199+
+
200+
--
201+
202+
When you use `clusterRef` to reference a Redpanda cluster managed by the operator, TLS is configured automatically. No additional steps are required.
203+
204+
If you use `staticConfiguration` to connect to an external cluster with TLS:
205+
206+
. Extract the CA certificate:
207+
+
208+
[,bash]
209+
----
210+
kubectl get secret redpanda-default-root-certificate -n redpanda -o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
211+
----
212+
213+
. Create a secret with the CA certificate:
214+
+
215+
[,bash]
216+
----
217+
kubectl create secret generic redpanda-console-tls --from-file=ca.crt=ca.crt -n redpanda
218+
----
219+
220+
. Configure the Console CR:
221+
+
222+
[,yaml]
223+
----
224+
apiVersion: cluster.redpanda.com/v1alpha2
225+
kind: Console
226+
metadata:
227+
name: redpanda-console
228+
namespace: redpanda
229+
spec:
230+
cluster:
231+
staticConfiguration:
232+
kafka:
233+
brokers:
234+
- redpanda-0.redpanda.redpanda.svc.cluster.local:9093
235+
tls:
236+
caCertSecretRef:
237+
name: redpanda-console-tls
238+
key: ca.crt
239+
secretMounts:
240+
- name: redpanda-console-tls
241+
secretName: redpanda-console-tls
242+
path: /etc/console/secrets
243+
----
244+
245+
. Apply the updated Console CR:
246+
+
247+
[,bash]
248+
----
249+
kubectl apply -f console.yaml --namespace redpanda
250+
----
251+
252+
--
253+
Helm::
254+
+
255+
--
111256
112257
. Run the following command to extract the CA certificate from the Redpanda Helm deployment:
113258
+
@@ -150,8 +295,10 @@ helm upgrade --install redpanda-console redpanda/console \
150295
--values console-values.yaml
151296
----
152297
153-
Redpanda Console will now connect securely to your Redpanda cluster using TLS. For production, set `insecureSkipTlsVerify: false` and use a trusted CA.
298+
Redpanda Console now connects securely to your Redpanda cluster using TLS. For production, set `insecureSkipTlsVerify: false` and use a trusted CA.
154299
300+
--
301+
======
155302

156303
== Deploy Redpanda Console as standalone service with YAML manifests
157304

@@ -274,11 +421,11 @@ kubectl apply -f console-service.yaml
274421

275422
== Configuration
276423

277-
Make sure to configure the following settings in your values file or ConfigMap:
424+
Make sure to configure the following settings in your Console CR, values file, or ConfigMap:
278425

279426
=== Connect to Redpanda
280427

281-
Configure the connection to your Redpanda cluster by setting the broker addresses in your values file or ConfigMap.
428+
Configure the connection to your Redpanda cluster by setting the broker addresses in your Console CR or values file.
282429

283430
See xref:console:config/connect-to-redpanda.adoc[].
284431

@@ -290,6 +437,70 @@ For production deployments, configure:
290437
* **SASL authentication**: Configure SASL if Redpanda uses authentication
291438
* **RBAC**: Set up role-based access control
292439

440+
Configure authentication based on your deployment method.
441+
442+
[tabs]
443+
======
444+
Operator::
445+
+
446+
--
447+
448+
When you use `clusterRef`, the operator automatically inherits SASL and TLS settings from the referenced Redpanda cluster. No additional Console configuration is needed.
449+
450+
To configure SASL manually with `staticConfiguration`:
451+
452+
[,yaml]
453+
----
454+
apiVersion: cluster.redpanda.com/v1alpha2
455+
kind: Console
456+
metadata:
457+
name: redpanda-console
458+
namespace: redpanda
459+
spec:
460+
cluster:
461+
staticConfiguration:
462+
kafka:
463+
brokers:
464+
- redpanda-0.redpanda.redpanda.svc.cluster.local:9092
465+
sasl:
466+
enabled: true
467+
mechanism: SCRAM-SHA-256
468+
secret:
469+
kafka:
470+
saslPassword: <console-password>
471+
----
472+
473+
You can also reference an existing Kubernetes Secret for credentials:
474+
475+
[,yaml]
476+
----
477+
apiVersion: cluster.redpanda.com/v1alpha2
478+
kind: Console
479+
metadata:
480+
name: redpanda-console
481+
namespace: redpanda
482+
spec:
483+
cluster:
484+
staticConfiguration:
485+
kafka:
486+
brokers:
487+
- redpanda-0.redpanda.redpanda.svc.cluster.local:9092
488+
sasl:
489+
enabled: true
490+
mechanism: SCRAM-SHA-256
491+
username: console-user
492+
passwordFilepath: /etc/console/secrets/password
493+
secretMounts:
494+
- name: kafka-credentials
495+
secretName: console-kafka-credentials
496+
path: /etc/console/secrets
497+
----
498+
499+
--
500+
Helm::
501+
+
502+
--
503+
293504
Example with SASL authentication:
294505
295506
[,yaml]
@@ -305,10 +516,36 @@ config:
305516
password: console-password
306517
----
307518
519+
--
520+
======
521+
308522
See xref:console:config/security/index.adoc[].
309523

310524
== Verify deployment
311525

526+
Use the following steps to confirm that Redpanda Console is running and accessible.
527+
528+
[tabs]
529+
======
530+
Operator::
531+
+
532+
--
533+
534+
. Check the Console CR status:
535+
+
536+
[,bash]
537+
----
538+
kubectl get console -n redpanda
539+
----
540+
+
541+
The output shows the replica status of your Console deployment:
542+
+
543+
[,bash,role="no-copy"]
544+
----
545+
NAME REPLICAS UPDATED READY AVAILABLE
546+
redpanda-console 2 2 2 2
547+
----
548+
312549
. Check pod status:
313550
+
314551
[,bash]
@@ -339,7 +576,47 @@ kubectl get svc -n redpanda redpanda-console -o jsonpath='{.status.loadBalancer.
339576
kubectl port-forward -n redpanda svc/redpanda-console 8080:8080
340577
----
341578
342-
Then open http://localhost:8080 in your browser.
579+
Open http://localhost:8080 in your browser.
580+
581+
--
582+
Helm::
583+
+
584+
--
585+
586+
. Check pod status:
587+
+
588+
[,bash]
589+
----
590+
kubectl get pods -n redpanda -l app.kubernetes.io/name=console
591+
----
592+
593+
. Check service status:
594+
+
595+
[,bash]
596+
----
597+
kubectl get svc -n redpanda redpanda-console
598+
----
599+
600+
. Access the Redpanda Console:
601+
+
602+
.. If using LoadBalancer:
603+
+
604+
[,bash]
605+
----
606+
kubectl get svc -n redpanda redpanda-console -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
607+
----
608+
609+
.. If using port-forward for testing:
610+
+
611+
[,bash]
612+
----
613+
kubectl port-forward -n redpanda svc/redpanda-console 8080:8080
614+
----
615+
616+
Open http://localhost:8080 in your browser.
617+
618+
--
619+
======
343620

344621
== Scaling
345622

0 commit comments

Comments
 (0)