DPF Operator Installation

Cert-manager is a powerful and extensible X.509 certificate controller for Kubernetes workloads. It will obtain certificates from a variety of Issuers, both popular public Issuers as well as private Issuers. It will ensure the certificates are valid and up-to-date and will attempt to renew certificates at a configured time before expiry.

In this deployment, it's a prerequisite used to provide certificates for webhooks used by DPF and its dependencies.

1. Install Cert-manager using helm.

   1. The following values will be used for the helm chart installation:

      manifests/02-dpf-operator-installation/helm-values/cert-manager.yml

      Collapse Source

      Copy

      Copied!

                  
      
                  
      startupapicheck:
        enabled: false
      crds:
        enabled: true
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/master
                    operator: Exists
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Exists
      tolerations:
        - operator: Exists
          effect: NoSchedule
          key: node-role.kubernetes.io/control-plane
        - operator: Exists
          effect: NoSchedule
          key: node-role.kubernetes.io/master
      cainjector:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/master
                      operator: Exists
                - matchExpressions:
                    - key: node-role.kubernetes.io/control-plane
                      operator: Exists
        tolerations:
          - operator: Exists
            effect: NoSchedule
            key: node-role.kubernetes.io/control-plane
          - operator: Exists
            effect: NoSchedule
            key: node-role.kubernetes.io/master
      webhook:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/master
                      operator: Exists
                - matchExpressions:
                    - key: node-role.kubernetes.io/control-plane
                      operator: Exists
        tolerations:
          - operator: Exists
            effect: NoSchedule
            key: node-role.kubernetes.io/control-plane
          - operator: Exists
            effect: NoSchedule
            key: node-role.kubernetes.io/master
              

   2. Run the following commands:

      Jump Node Console

      Collapse Source

      Copy

      Copied!

                  
      
                  
      $ helm repo add jetstack https://charts.jetstack.io --force-update
      $ helm upgrade --install --create-namespace --namespace cert-manager cert-manager jetstack/cert-manager --version v1.16.1 -f ./manifests/02-dpf-operator-installation/helm-values/cert-manager.yml
       
      Release "cert-manager" does not exist. Installing it now.
      NAME: cert-manager
      LAST DEPLOYED: Tue May 20 12:59:30 2025
      NAMESPACE: cert-manager
      STATUS: deployed
      REVISION: 1
      TEST SUITE: None
      NOTES:
      cert-manager v1.16.1 has been deployed successfully!
              

2. Verify that all the pods in cert-manager namespace are in ready state:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ kubectl wait --for=condition=ready --namespace cert-manager pods --all
   pod/cert-manager-6ffdf6c5f8-7k7zz condition met
   pod/cert-manager-cainjector-66b8577665-fgcqg condition met
   pod/cert-manager-webhook-5cb94cb7b6-9rk9m condition met
           

1. Download local-path-provisioner helm chart to your current working directory and create a NS for it:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ curl https://codeload.github.com/rancher/local-path-provisioner/tar.gz/v0.0.30 | tar -xz --strip=3 local-path-provisioner-0.0.30/deploy/chart/local-path-provisioner/
   $ kubectl create ns local-path-provisioner
           

2. The following values will be used for the installation:

   manifests/02-dpf-operator-installation/helm-values/local-path-provisioner.yml

   Collapse Source

   Copy

   Copied!

               
   
               
   tolerations:
     - operator: Exists
       effect: NoSchedule
       key: node-role.kubernetes.io/control-plane
     - operator: Exists
       effect: NoSchedule
       key: node-role.kubernetes.io/master
           

   Run the following command:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ helm install -n local-path-provisioner local-path-provisioner ./local-path-provisioner --version 0.0.30 -f ./manifests/02-dpf-operator-installation/helm-values/local-path-provisioner.yml
    
   NAME: local-path-provisioner
   LAST DEPLOYED: Tue May 20 13:01:40 2025
   NAMESPACE: local-path-provisioner
   STATUS: deployed
   REVISION: 1
   TEST SUITE: None
   NOTES:
   ...
           

3. Ensure that the pod in local-path-provisioner namespace is in ready state:

   Jump Node Console

   Collapse Source

   Copy

   Copied!

               
   
               
   $ kubectl wait --for=condition=ready --namespace local-path-provisioner pods --all
   pod/local-path-provisioner-75f649c47c-fbccd condition met
           

• Create the NS for the operator:

  Jump Node Console

  Collapse Source

  Copy

  Copied!

              
  
              
  $ kubectl create ns dpf-operator-system
          

• The following YAML file defines storage (for the BFB image) that is required by the DPF operator.

  manifests/02-dpf-operator-installation/nfs-storage-for-bfb-dpf-ga.yaml

  Collapse Source

  Copy

  Copied!

              
  
              
  ---
  apiVersion: v1
  kind: PersistentVolume
  metadata:
    name: bfb-pv
  spec:
    capacity:
      storage: 10Gi
    volumeMode: Filesystem
    accessModes:
      - ReadWriteMany
    nfs:
      path: /mnt/dpf_share/bfb
      server: $NFS_SERVER_IP
    persistentVolumeReclaimPolicy: Delete
  ---
  apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: bfb-pvc
    namespace: dpf-operator-system
  spec:
    accessModes:
    - ReadWriteMany
    resources:
      requests:
        storage: 10Gi
    volumeMode: Filesystem
    storageClassName: ""
          

• Run the following command to substitute the environment variables using envsubst and apply the yaml file:

  Jump Node Console

  Collapse Source

  Copy

  Copied!

              
  
              
  $ cat manifests/02-dpf-operator-installation/*.yaml | envsubst | kubectl apply -f -