Products

Each product is a chart you install in its own namespace. This page covers what the platform sets up for it and how you manage its settings.

• Chart: registry.rigfab.com/rft/apps/<product>/charts/<product>
• Namespace: rft-app-<product>
• Database: a CloudNativePG cluster <product>-db, with the credentials in <product>-db-app

Your licence and pull token decide which products and versions you can pull.

What the platform gives each product

When a product installs, the base chart's controller gives it, through its PlatformApp:

• Secret <product>-oidc, its client at your identity provider. See Sign-in.
• Secret <product>-directory, its token for the platform's directory. See User provisioning.
• Generated secrets, such as its session secret, in <product>-generated. They're made once and never shown.
• Copies of your licence and the pull Secret.

To see whether each product has everything:

kubectl get platformapps --all-namespaces

READY is true once everything is in place. MESSAGE says what the controller is waiting for.

What a product needs from you

Each product's page under Product settings lists:

• its settings
• its secret settings
• the services on your network it reaches
• a starter values file

Secret settings

A product's secret settings are its passwords and keys. Give them in one of two ways. The chart refuses both at once.

• Your own Secret (production). Create a Secret in the product's namespace and name it as secrets.existingSecret. The product's page has the kubectl command. To keep the Secret in git or a secret store, create it with External Secrets Operator, SOPS or Sealed Secrets instead.
• The values file (to get started). Type them under secrets in the product's values file. The chart writes them into Secret <product>-env.

A values file with passwords in it tends to end up in git. Helm also keeps a copy of the values you pass in its release record in the cluster.

A required key is missing

Your own Secret needs a key for every secret setting the product's page marks as required. When one is missing, none of the product's pods start, its database migration included:

• kubectl --namespace rft-app-<product> get pods shows CreateContainerConfigError or Init:CreateContainerConfigError.
• kubectl --namespace rft-app-<product> describe pods names the missing key.
• helm install --wait or helm upgrade --wait ends at its timeout.

Add the key and the pods start by themselves.

Change a setting

Change a setting with helm upgrade. It restarts the product's pods.

After you change your own Secret, restart the pods yourself:

kubectl --namespace rft-app-<product> rollout restart deployment

Rotate a secret

To rotate a generated secret, delete it. The controller makes a new one, and the product's pods pick it up when they restart. If the product's settings still hold a value for it, the controller copies that value again instead.

Rotating a session secret signs everyone out.

Add a product later

1. Create its namespace.
2. Run rft login with --pull-secret rft-app-<product>/rigfab-pull.
3. Install it, as Install says.

When a product moves a secret to its generated secrets

Some releases move a secret the product owns, such as its session secret, from its settings to its generated secrets. The release notes say when. The product keeps your value:

1. Upgrade rft-base first.
2. Leave the value in secrets or your own Secret for the product's upgrade. The controller copies it into <product>-generated once.
3. After that the product uses the copy, and you can remove the setting.

Next steps

• Sign-in to register each product at your identity provider.
• User provisioning to connect your directory.
• Upgrade when new releases are listed.