Install the platform

Install the base chart once per cluster, then each product you're licensed for, with Helm.

Before you begin

A cluster that meets the requirements.
From the RigFabTech portal: your site ID, a pull token and your licence file, rigfab.license.
A base domain, such as rft.example.com, and access to its DNS.

No internet access on the cluster? Follow Install without internet access instead.

Install rft

curl -fsSL https://get.rigfab.com/install.sh | sudo sh

The script installs the signed rft command as /usr/local/bin/rft. To check it, run rft version.

For a release candidate, set RFT_CHANNEL=beta. For an exact version, set RFT_VERSION=<VERSION>. To check the download yourself, see Verify the download yourself.

Create the namespaces

Create rft-system and one rft-app-<PRODUCT> namespace for each product you install, and label them:

kubectl create namespace rft-system
kubectl create namespace rft-app-<PRODUCT>
kubectl label namespace rft-system rft-app-<PRODUCT> pod-security.kubernetes.io/enforce=restricted

The label makes Kubernetes refuse any pod that doesn't meet the restricted Pod Security Standard. Every pod of the platform meets it. See Pod Security.

Check the cluster

rft check

Fix every row that says fail, then run rft check again.

rft login --username <SITE_ID> --password-stdin --pull-secret rft-system/rigfab-pull --pull-secret rft-app-<PRODUCT>/rigfab-pull < pull-token.txt

rft login checks your site ID and pull token and runs helm registry login registry.rigfab.com with them. It also writes the image pull Secret rigfab-pull into each namespace you name with --pull-secret, so each product's pods can pull their images on the first try.

When you rotate the token, write rft-system/rigfab-pull again. The base chart's controller updates the products' copies.

Write your site's values

Save your site's shared values as site.yaml. Every helm install and helm upgrade takes it.

global:
  imagePullSecrets:
    - name: rigfab-pull
  rigfab:
    domain: rft.example.com
    ingress:
      className: traefik
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt
signIn:
  issuer: <ISSUER>

signIn.issuer is your identity provider's issuer. Check it with rft check --issuer <ISSUER>, and see Sign-in.
Values that several products share go here once, such as your company's name (global.rigfab.site.companyName) or where your E2 database is (global.rigfab.site.e2). Each product's page says which ones it reads.
To show your logo in the products, set global.rigfab.site.logo to a base64-encoded PNG of at most 64 KiB. base64 -w0 logo.png prints it. After you change it, upgrade each product that shows it.

The values reference lists every value. Leave out a value you don't set: name: with nothing after it removes the chart's default instead of using it.

Then dry-run the base chart with these values against your cluster's admission policies:

rft check --chart oci://registry.rigfab.com/rft/apps/rft-base/charts/rft-base --version <VERSION> --values site.yaml

It changes nothing. The base chart refuses a name under global.rigfab it doesn't know, such as a misspelt one. A product skips such a name, so it can read a site.yaml written for newer releases than its own. Run this check again after every change to site.yaml.

Write each product's values

Give each product a values file of its own, <PRODUCT>.yaml:

Open the product's page under Product settings.
Download its starter file and save it as <PRODUCT>.yaml.
Replace each <PLACEHOLDER>.

A product whose page says it has no settings needs no file. Leave -f <PRODUCT>.yaml out of its commands.

A product's passwords and keys are its secret settings. Give them in one of two ways, never both:

Create a Secret in the product's namespace with the command on the product's page, or with a tool such as External Secrets Operator, SOPS or Sealed Secrets. In <PRODUCT>.yaml, give only the Secret's name:

secrets:
  existingSecret: <PRODUCT>-settings

Keep your values files

Keep site.yaml and each <PRODUCT>.yaml together, in a private git repository or another place that's backed up. Every upgrade passes the same files again. A repository is recommended, not required. With secret settings in a Secret of your own, the files hold no passwords.

If you lose a file, Helm prints the values a release was installed with. For a product, that's site.yaml and its own file merged into one:

helm get values <RELEASE> --namespace <NAMESPACE> --output yaml

Install the charts

Install the base chart first, then each product, at the versions the portal lists for your site:

helm install rft-base oci://registry.rigfab.com/rft/apps/rft-base/charts/rft-base --version <VERSION> --namespace rft-system -f site.yaml --wait --timeout 15m

helm install <PRODUCT> oci://registry.rigfab.com/rft/apps/<PRODUCT>/charts/<PRODUCT> --version <VERSION> --namespace rft-app-<PRODUCT> -f site.yaml -f <PRODUCT>.yaml --wait --timeout 15m

Keep the release name rft-base: the products find the licence agent by it. A product doesn't install until the base chart's PlatformApp definition exists, and --wait on the base chart makes sure it does.

When values are missing or have moved, a product's install stops with one message that lists each of them under "Move these" and "Set these". A value of only spaces counts as missing.

To dry-run a product before you install it, once the base chart is in:

rft check --chart oci://registry.rigfab.com/rft/apps/<PRODUCT>/charts/<PRODUCT> --version <VERSION> --release <PRODUCT> --namespace rft-app-<PRODUCT> --values site.yaml --values <PRODUCT>.yaml

It changes nothing. A missing or misspelt setting stops it with a message that names the setting. It doesn't look inside a Secret of your own.

To start a product with the data of a PostgreSQL database you already run, set up its import before you install it. See Import a database.

Install your licence

rft license install rigfab.license

Until the licence is installed, every product is read-only. See Licence.

Create the DNS records

Point these names at your ingress or Gateway:

<product>.<domain> for each product
scim.<domain>
s3.<domain>

Register the products at your identity provider

Give each product its client at your provider, as Sign-in describes. A product's PlatformApp lists the redirect URIs to register. It turns ready once its client is in place.

Next steps

Connect user provisioning so people and groups reach every product.
Upgrade when the portal lists new releases.
If something doesn't start, see Troubleshooting.

Verify the download yourself

To read the install script before you run it:

curl -fsSL -o install.sh https://get.rigfab.com/install.sh
less install.sh
sudo sh install.sh

To check the rft command by hand instead, save the release key as rft-release.pub, then run these commands. For a release candidate, use beta in place of stable.

version="$(curl -fsSL https://get.rigfab.com/rft/channels/stable)"
name="rft-$version-linux-amd64"
for file in "$name" "$name.sha256" "$name.sha256.sig"; do curl -fsSLO "https://get.rigfab.com/rft/$version/$file"; done
openssl dgst -sha256 -verify rft-release.pub -signature "$name.sha256.sig" "$name.sha256"
sha256sum -c "$name.sha256"
sudo install -m 0755 "$name" /usr/local/bin/rft

The openssl check prints Verified OK, and the sha256sum check ends with OK.

Release key

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE01q4Zhoo8dHhoXbKnRD56oLN/8ae
MGpADAsymo1w6eervihVyIgSzd908IdTZ0uyjbE3I+hAnjQACq9s3tJ1gA==
-----END PUBLIC KEY-----