Deploy Flow
In this tutorial, you’ll deploy a Flow application using Hazelcast Platform Operator for Kubernetes.
See Flow for more detailed information.
Prerequisites
-
Flow requires the Management Center application to run and be configured properly. The Management Center application should be configured to use FLow.
...
repository: docker.io/hazelcast/management-center-flow (1)
version: 5.6.0
...
hazelcastClusters:
- address: flow (2)
name: flow (3)
jvm:
args:
- "-Dhazelcast.mc.flow.addresses=http://233.252.0.158" (4)
- "-Dhazelcast.mc.internal.flowAddresses=http://flow:9021" (5)
...| 1 | Management Center Flow image and version |
| 2 | The service name of the Flow application. The same as the Flow Custom Resource (CR) name. |
| 3 | Hazelcast cluster name. Should always be flow. |
| 4 | Flow Ingress public address. |
| 5 | The internal address of Flow in the format of http://<service-name>:9021. The service name is the same as the Flow CR name.
|
kubectl create secret generic flow-db-secret \
--from-literal=database=flow \
--from-literal=username=flow \
--from-literal=password="strong-password"In the created secret username and password are required, whereas database field is optional and will default to flow if not provided.
Run Flow
To run Flow on Kubernetes using Hazelcast Platform Operator you need to create a Flow CR.
apiVersion: hazelcast.com/v1alpha1
kind: Flow
metadata:
labels:
app.kubernetes.io/name: hazelcast-platform-operator
name: flow
spec:
size: 3
licenseKeySecretName: hazelcast-license-key
externalConnectivity:
ingress:
hostname: ""
ingressClassName: nginx
path: "/"
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/enable-opentelemetry: "true"
database:
host: "flow-database"
secretName: flow-db-secret
env:
- name: OPTIONS
value: |
--flow.analytics.persistRemoteCallResponses=true
--flow.stream-server.enabled=false
--flow.analytics.persistResults=false
--flow.toggles.dashboard-enabled=true
--flow.config.custom.managementCenterUrl=http://233.252.0.158/mcAdditional flow configuration can be achieved by providing additional parameters using the OPTIONS environment variable. See Configure Flow for detailed information.
Parameters managed by the Hazelcast Platform Operator are not allowed in OPTIONS. E.g., the Database configuration can only be done via spec.database in the Flow CR.
|
Configure OpenID support
You can enable OpenID support with Management Center deployment on Flow. To configure OpenID, provide the required parameters to the OPTIONS environment variable.
See Security recommendations to discover all available options.
...
- name: OPTIONS
value: |
--flow.security.openIdp.enabled=true
--flow.security.openIdp.jwks-uri=http://233.252.0.158/mc/oauth2/jwks
--flow.security.openIdp.issuerUrl=http://233.252.0.158/mc
--flow.security.openIdp.clientId=flow-client
--flow.security.openIdp.require-https=false
--flow.security.openIdp.roles.format=path
--flow.security.openIdp.roles.path=roles
--flow.security.openIdp.refreshTokensDisabled=true
--flow.security.openIdp.executorRoleClientId=application-client
--flow.security.openIdp.executorRoleClientSecret=${MC_APPLICATION_CLIENT_SECRET}
--flow.security.openIdp.executorRoleTokenUrl=http://233.252.0.158/mc/oauth2/token
--flow.security.openIdp.executorRoleAuthenticationType=ClientSecretBasic
- name: FLOW_SECURITY_OPENIDP_EXECUTORROLESCOPES
value: "openid email profile flow:Admin"
- name: FLOW_SECURITY_OPENIDP_SCOPE
value: "openid email profile"
...