TAP On GKE (1.0.0) : Part 2 – Install TAP with supply chain testing and scanning

TAP on GKE

Eknath - 14 January 202226 January 2022

Reading Time: 4 mins

In this post, I will be demonstrating the steps to install Tanzu Application Platform packages from the Tanzu Application Platform package repository. Before you install the packages, ensure you have prepared the setup as mentioned in post.

Contents

Add TAP package repository

# Set up environment variables for use during the installation.

export INSTALL_REGISTRY_USERNAME=TANZU-NET-USER
export INSTALL_REGISTRY_PASSWORD=TANZU-NET-PASSWORD
export INSTALL_REGISTRY_HOSTNAME=registry.tanzu.vmware.com

# Create a namespace called tap-install for deploying any component packages by running:

$  kubectl create ns tap-install

#Create a registry secret by running:

$  tanzu secret registry add tap-registry --username ${INSTALL_REGISTRY_USERNAME} --password ${INSTALL_REGISTRY_PASSWORD} --server ${INSTALL_REGISTRY_HOSTNAME} --export-to-all-namespaces --yes --namespace tap-install

# Add Tanzu Application Platform package repository to the cluster by running:

$  tanzu package repository add tanzu-tap-repository --url registry.tanzu.vmware.com/tanzu-application-platform/tap-packages:1.0.0 --namespace tap-install

# Get the status of the Tanzu Application Platform package repository, and ensure the status updates to Reconcile succeeded by running:

$  tanzu package repository get tanzu-tap-repository --namespace tap-install
- Retrieving repository tanzu-tap-repository...
NAME:          tanzu-tap-repository
VERSION:       16710
REPOSITORY:    registry.tanzu.vmware.com/tanzu-application-platform/tap-packages
TAG:           1.0.0
STATUS:        Reconcile succeeded
REASON:

#List the available packages by running:

$  tanzu package available list --namespace tap-install

Install Tanzu Application Platform profile

Tanzu Application Platform can be installed through pre-defined profiles or through individual packages. TAP contains the following two profiles. In this demo, I will cover full profile with ootb supply chain with testing and scanning, gcr.io for image repo, service_type Load Balancer.

- - Full
  - Light

Note: refer to doc for more details

full Profile Syntax

profile: full
ceip_policy_disclosed: true # Installation fails if this is set to 'false'
buildservice:
  kp_default_repository: "KP-DEFAULT-REPO"
  kp_default_repository_username: "KP-DEFAULT-REPO-USERNAME"
  kp_default_repository_password: "KP-DEFAULT-REPO-PASSWORD"
  tanzunet_username: "TANZUNET-USERNAME"
  tanzunet_password: "TANZUNET-PASSWORD"
  descriptor_name: "DESCRIPTOR-NAME"
  enable_automatic_dependency_updates: true
supply_chain: basic

ootb_supply_chain_basic:
  registry:
    server: "SERVER-NAME"
    repository: "REPO-NAME"
  gitops:
    ssh_secret: ""

learningcenter:
  ingressDomain: "DOMAIN-NAME"

tap_gui:
  service_type: ClusterIP
  ingressEnabled: "true"
  ingressDomain: "INGRESS-DOMAIN"
  app_config:
    app:
      baseUrl: http://tap-gui.INGRESS-DOMAIN
    catalog:
      locations:
        - type: url
          target: https://GIT-CATALOG-URL/catalog-info.yaml
    backend:
      baseUrl: http://tap-gui.INGRESS-DOMAIN
      cors:
        origin: http://tap-gui.INGRESS-DOMAIN

metadata_store:
  app_service_type: LoadBalancer # (optional) Defaults to LoadBalancer. Change to NodePort for distributions that don't support LoadBalancer

grype:
  namespace: "MY-DEV-NAMESPACE" # (optional) Defaults to default namespace.
  targetImagePullSecret: "TARGET-REGISTRY-CREDENTIALS-SECRET"

KP-DEFAULT-REPO is a writable repository in your registry. Tanzu Build Service dependencies are written to this location. Examples:
- Harbor has the form kp_default_repository: "my-harbor.io/my-project/build-service"
- Dockerhub has the form kp_default_repository: "my-dockerhub-user/build-service" or kp_default_repository: "index.docker.io/my-user/build-service"
- Google Cloud Registry has the form kp_default_repository: "gcr.io/my-project/build-service"
KP-DEFAULT-REPO-USERNAME is the username that can write to KP-DEFAULT-REPO. You should be able to docker push to this location with this credential.
- For Google Cloud Registry, use kp_default_repository_username: _json_key
KP-DEFAULT-REPO-PASSWORD is the password for the user that can write to KP-DEFAULT-REPO. You can docker push to this location with this credential.
- For Google Cloud Registry, use the contents of the service account JSON key.
DESCRIPTOR-NAME is the name of the descriptor to import automatically. Current available options at time of release:
- tap-1.0.0-full contains all dependencies, and is for production use.
- tap-1.0.0-lite smaller footprint used for speeding up installs. Requires Internet access on the cluster.
SERVER-NAME is the hostname of the registry server. Examples:
- Harbor has the form server: "my-harbor.io"
- Dockerhub has the form server: "index.docker.io"
- Google Cloud Registry has the form server: "gcr.io"
REPO-NAME is where workload images are stored in the registry. Images are written to SERVER-NAME/REPO-NAME/workload-name. Examples:
- Harbor has the form repository: "my-project/supply-chain"
- Dockerhub has the form repository: "my-dockerhub-user"
- Google Cloud Registry has the form repository: "my-project/supply-chain"
DOMAIN-NAME has a value such as learningcenter.example.com.
INGRESS-DOMAIN is the subdomain for the host name that you point at the tanzu-shared-ingress service’s External IP address.
GIT-CATALOG-URL is the path to the catalog-info.yaml catalog definition file from either the included Blank catalog (provided as an additional download named “Blank Tanzu Application Platform GUI Catalog”) or a Backstage-compliant catalog that you’ve already built and posted on the Git infrastucture you specified in the Integration section.
MY-DEV-NAMESPACE is the namespace where you want the ScanTemplates to be deployed to. This is the namespace where the scanning feature is going to run.
TARGET-REGISTRY-CREDENTIALS-SECRET is the name of the secret that contains the credentials to pull an image from the registry for scanning. If built images are pushed to the same registry as the Tanzu Application Platform images, this can reuse the tap-registry secret.

Note: Using the tap-values.yaml configuration, buildservice.enable_automatic_dependency_updates: false can be used to pause the automatic update of Build Service dependencies.

Since we are using Google Cloud Registry in this demo, I have a simple script to parse the credentials. Replace the necessary values before executing.

# where <key>.json is the file downloaded from GCP console

service_account_key="$(cat <key>.json)"
cat <<EOF > tap-values.yaml
profile: full
ceip_policy_disclosed: true # Installation fails if this is set to 'false'
buildservice:
  kp_default_repository: "gcr.io/eknath-se/build-service" # Replace the project id with yours. In my case eknath-se is the project ID
  kp_default_repository_username: _json_key
  kp_default_repository_password: '$(echo $service_account_key)'
  tanzunet_username: "<Tanzu network user name>" # Provide the Tanzu network user name
  tanzunet_password: "<Tanzu network password>" # Provide the Tanzu network password
  descriptor_name: "tap-1.0.0-full"
  enable_automatic_dependency_updates: true
supply_chain: testing_scanning
ootb_supply_chain_testing_scanning:
  registry:
    server: "gcr.io"
    repository: "eknath-se/build-service" # Replace the project id with yours. In my case eknath-se is the project ID
  gitops:
    ssh_secret: ""
  cluster_builder: default
  service_account: default

learningcenter:
  ingressDomain: "<domain name>" # Provide a Domain Name

metadata_store:
  app_service_type: LoadBalancer # (optional) Defaults to LoadBalancer. Change to NodePort for distributions that don't support LoadBalancer
grype:
  namespace: "tap-install" # (optional) Defaults to default namespace.
  targetImagePullSecret: "registry-credentials"
contour:
  envoy:
    service:
      type: LoadBalancer
tap_gui:
  service_type: LoadBalancer # NodePort for distributions that don't support LoadBalancer
  app_config:
    app:
      baseUrl: http://<ip>:7000 
    integrations:
      github: # Other integrations available see NOTE below
        - host: github.com
          token: <github token> # Create a token in github 
    catalog:
      locations:
        - type: url
          target: https://github.com/sample-accelerators/tanzu-java-web-app/blob/main/catalog/catalog-info.yaml
    backend:
      baseUrl: http://<ip>:7000
      cors:
        origin: http://<ip>:7000
EOF

# Install the package by running:

tanzu package install tap -p tap.tanzu.vmware.com -v 1.0.0 --values-file tap-values.yml -n tap-install

# Verify the package install by running:

tanzu package installed get tap -n tap-install

#Verify that all the necessary packages in the profile are installed by running:

tanzu package installed list -n tap-install
/ Retrieving installed packages...
  NAME                                PACKAGE-NAME                                         PACKAGE-VERSION  STATUS
  accelerator                         accelerator.apps.tanzu.vmware.com                    1.0.0            Reconcile succeeded
  api-portal                          api-portal.tanzu.vmware.com                          1.0.8            Reconcile succeeded
  appliveview                         run.appliveview.tanzu.vmware.com                     1.0.1            Reconcile succeeded
  appliveview-conventions             build.appliveview.tanzu.vmware.com                   1.0.1            Reconcile succeeded
  buildservice                        buildservice.tanzu.vmware.com                        1.4.2            Reconcile succeeded
  cartographer                        cartographer.tanzu.vmware.com                        0.1.0            Reconcile succeeded
  cert-manager                        cert-manager.tanzu.vmware.com                        1.5.3+tap.1      Reconcile succeeded
  cnrs                                cnrs.tanzu.vmware.com                                1.1.0            Reconcile succeeded
  contour                             contour.tanzu.vmware.com                             1.18.2+tap.1     Reconcile succeeded
  conventions-controller              controller.conventions.apps.tanzu.vmware.com         0.5.0            Reconcile succeeded
  developer-conventions               developer-conventions.tanzu.vmware.com               0.5.0-build.1    Reconcile succeeded
  fluxcd-source-controller            fluxcd.source.controller.tanzu.vmware.com            0.16.0           Reconcile succeeded
  grype                               grype.scanning.apps.tanzu.vmware.com                 1.0.0            Reconcile succeeded
  image-policy-webhook                image-policy-webhook.signing.apps.tanzu.vmware.com   1.0.0            Reconcile succeeded
  learningcenter                      learningcenter.tanzu.vmware.com                      0.1.0            Reconcile succeeded
  learningcenter-workshops            workshops.learningcenter.tanzu.vmware.com            0.1.0            Reconcile succeeded
  metadata-store                      metadata-store.apps.tanzu.vmware.com                 1.0.1            Reconcile succeeded
  ootb-delivery-basic                 ootb-delivery-basic.tanzu.vmware.com                 0.5.1            Reconcile succeeded
  ootb-supply-chain-testing-scanning  ootb-supply-chain-testing-scanning.tanzu.vmware.com  0.5.1            Reconcile succeeded
  ootb-templates                      ootb-templates.tanzu.vmware.com                      0.5.1            Reconcile succeeded
  scanning                            scanning.apps.tanzu.vmware.com                       1.0.0            Reconcile succeeded
  service-bindings                    service-bindings.labs.vmware.com                     0.6.0            Reconcile succeeded
  services-toolkit                    services-toolkit.tanzu.vmware.com                    0.5.0            Reconcile succeeded
  source-controller                   controller.source.apps.tanzu.vmware.com              0.2.0            Reconcile succeeded
  spring-boot-conventions             spring-boot-conventions.tanzu.vmware.com             0.3.0            Reconcile succeeded
  tap                                 tap.tanzu.vmware.com                                 1.0.0            Reconcile succeeded
  tap-gui                             tap-gui.tanzu.vmware.com                             1.0.1            Reconcile succeeded
  tap-telemetry                       tap-telemetry.tanzu.vmware.com                       0.1.2            Reconcile succeeded
  tekton-pipelines                    tekton.tanzu.vmware.com                              0.30.0           Reconcile succeeded

Configure TAP GUI

On your Git repository of choice, extract the Blank Software Catalog from VMware Tanzu Network. You link to that catalog-info.yaml file when you configure your catalog later. In this demo I am using an existing catalog-info.yaml file from my repo
Collect the External IP of LoadBalancer by running and update tap-values.yaml file

$ kubectl get svc -n tap-gui
NAME     TYPE           CLUSTER-IP    EXTERNAL-IP      PORT(S)          AGE
server   LoadBalancer   10.32.2.211   35.200.246.183   7000:31577/TCP   91m

Add the following section to tap-values.yml by using the following template, and replace all placeholders with your relevant values.

Syntax for new lines to be added

tap_gui:
  service_type: LoadBalancer
  # Existing tap-values.yml above  
  app_config:
    app:
      baseUrl: http://EXTERNAL-IP:7000
    integrations:
      github: # Other integrations available see NOTE below
        - host: github.com
          token: GITHUB-TOKEN
    catalog:
      locations:
        - type: url
          target: https://GIT-CATALOG-URL/catalog-info.yaml
    backend:
        baseUrl: http://EXTERNAL-IP:7000
        cors:
          origin: http://EXTERNAL-IP:7000

Updated yaml file should be similar to below:

profile: full
ceip_policy_disclosed: true # Installation fails if this is set to 'false'
buildservice:
  kp_default_repository: "gcr.io/eknath-se/build-service" # Replace the project id with yours. In my case eknath-se is the project ID
  kp_default_repository_username: _json_key
  kp_default_repository_password: '<redacted>'  # This will be the key.json file in one line
  tanzunet_username: "<Tanzu network user name>" # Provide the Tanzu network user name
  tanzunet_password: "<Tanzu network password>" # Provide the Tanzu network password
  descriptor_name: "tap-1.0.0-full"
  enable_automatic_dependency_updates: true
supply_chain: testing_scanning
ootb_supply_chain_testing_scanning:
  registry:
    server: "gcr.io"
    repository: "eknath-se/build-service" # Replace the project id with yours. In my case eknath-se is the project ID
  gitops:
    ssh_secret: ""
  cluster_builder: default
  service_account: default

learningcenter:
  ingressDomain: "captainvirtualization.in"  #Domain name

metadata_store:
  app_service_type: LoadBalancer # (optional) Defaults to LoadBalancer. Change to NodePort for distributions that don't support LoadBalancer
grype:
  namespace: "tap-install" # (optional) Defaults to default namespace.
  targetImagePullSecret: "registry-credentials"  # will create this credentials in few next few mins
contour:
  envoy:
    service:
      type: LoadBalancer
tap_gui:
  service_type: LoadBalancer
  app_config:
    app:
      baseUrl: http://35.200.246.183:7000  ### Load balancer External IP collected in previous step
    integrations:
      github: # Other integrations available see NOTE below
        - host: github.com
          token: ghp_t7a7WxC4SMaY8AyUv46IAOk  ### To be collected from git portal
    catalog:
      locations:
        - type: url
          target: https://github.com/sample-accelerators/tanzu-java-web-app/blob/main/catalog/catalog-info.yaml  ## Replace with yours
    backend:
      baseUrl: http://35.200.246.183:7000  ### Load balancer External IP collected in previous step
      cors:
        origin: http://35.200.246.183:7000  ### Load balancer External IP collected in previous step

Update the package profile:

$. tanzu package installed update tap --package-name tap.tanzu.vmware.com --version 1.0.0 -n tap-install -f tap-values-gke.yaml
| Updating installed package 'tap'
/ Getting package install for 'tap'
| Getting package metadata for 'tap.tanzu.vmware.com'
| Updating secret 'tap-tap-install-values'
| Updating package install for 'tap'
- Waiting for 'PackageInstall' reconciliation for 'tap'

Updated installed package 'tap' in namespace 'tap-install'

Access the external IP collected earlier with port 7000 to access the TAP GUI. Ex: http://EXTERNAL-IP:7000