Install Zero-Code on a cluster

Connect a Kubernetes cluster to your project with the command the console gives you, check that every node is covered, and upgrade or remove the install.

One Helm release puts Zero-Code on a cluster. It installs an operator, and the operator runs one node agent on every node.

A new install runs in monitor mode: it records what happens and denies nothing. Use this guide to connect a cluster for the first time, and later to upgrade or remove the install.

Before you begin

You need:

• A plan that includes Zero-Code.
• The read:kubernetes permission in your project. AuthFI permissions decide who can see a cluster in the console, not Kubernetes RBAC.
• helm and kubectl, with access to the cluster.

The cluster must meet these requirements.

Check that it works

Open Zero-Code > Kubernetes. The cluster appears in the list when its first node checks in.

Select the cluster's row to open it. Its Workloads and Services tabs fill in as the node agent discovers them.

You can also check from the cluster. List the install's AgentRuntime, the custom resource that describes it.

kubectl -n authfi-system get agentrt

NAME                READY   DESIRED   DEGRADED   ENTITLED
authfi-ebpf-agent   3       3         0          true

When READY equals DESIRED, a node agent is running on every node.

What the install creates

Everything is created in one namespace.

The cluster's credential belongs to this cluster alone. Secret values never leave the cluster.

The node agent runs privileged, on the host's network, because it loads programs into the node's kernel. Nothing is added to your own pods, and none of them is restarted.

Change the install's settings

The AgentRuntime is the one object that describes the install. The Helm chart writes it for you.

apiVersion: authfi.io/v1
kind: AgentRuntime
metadata:
  name: authfi-ebpf-agent
  namespace: authfi-system
spec:
  issuerUrl: https://acme.authfi.io
  credentialsSecret: authfi-ebpf-agent-credentials
  mode: observe

To change a setting, set it through Helm values. Do not edit the object.

For what mode changes on the nodes, see Monitor mode and enforce mode.

Upgrade Zero-Code

Run helm upgrade on the release you installed, with the new chart version.

Node agents are replaced one node at a time. Rules already in force stay in force while a node agent restarts.

Remove Zero-Code

helm uninstall "$RELEASE"

$RELEASE is the release name in the command you ran to install.

Uninstalling hands every node back. On each node, before the release is gone:

1. Enforcement is switched off.
2. Every rule is cleared.
3. Every program is unloaded from the kernel.
4. Traffic redirection is removed.

The uninstall finishes only when every node has confirmed. If a node cannot be reached, the uninstall stops and names that node, so a node is never left enforcing rules nobody can change. For a node that is gone for good, set the annotation authfi.io/skip-decommission: "true" on the AgentRuntime to finish without it.

To hand back one service and keep the install, see Hand a service back.

Next steps