Automating Calico Enterprise - DEMO

Table of Contents

• Welcome!
• Overview
• Before You Begin
• Demo
  • 1. Check Lab Pre-requisites
  • 2. Deploy Gitea and ArgoCD
  • 3. Explore the Repository
  • 4. Deploy Calico Enterprise via ArgoCD
  • 5. How ArgoCD Consumes Charts in Gitea
  • 6. There's a Problem!

Welcome!

Welcome to the Day-2 Operations Automation Workshop.

This workshop builds on your Kubernetes and container expertise, equipping you to confidently manage and operate environments at scale. By the end of this session, you’ll be able to deploy and manage Calico Enterprise in an automated, GitOps-driven fashion.

We hope you enjoyed the presentation! You can download the slides here.

---

Overview

In this demo, you will:

1. Deploy Gitea locally and migrate a GitHub repository containing all the ArgoCD applications needed for deploying Calico Enterprise.
2. Set up ArgoCD to connect it to your cluster and the local Gitea repository.
3. Deploy an app-of-apps ArgoCD application to orchestrate the deployment of Calico Enterprise onto your local cluster.
4. Troubleshoot an issue

---

Before You Begin

Prerequisites

• Calico OSS must already be installed on your cluster. We will verify this in the first chapter.

• We will be running a script to deploy Gitea and ArgoCD. It is very important that you pass your lab name as an argument when running the script. Failure to do so or using an incorrect lab name will cause the demo to fail.

About Gitea

Gitea is a lightweight, self-hosted Git service ideal for local deployments. It offers an intuitive interface for managing repositories, code review, and collaboration. Learn more in the official documentation.

About ArgoCD

ArgoCD is a declarative, GitOps-based continuous delivery tool for Kubernetes. It ensures your cluster state matches the desired configuration stored in Git. Learn more in the official documentation.

---

Demo

1. Check Lab Pre-requisites

1.1 Verify Calico OSS Installation

ArgoCD requires a functioning CNI for intra-cluster communication. In this lab, Calico OSS has been deployed to address this requirement.

Confirm Calico OSS is running with:

kubectl get tigerastatus

Expected output:

NAME      AVAILABLE   PROGRESSING   DEGRADED   SINCE
calico    True        False         False      21s
ippools   True        False         False      46s

1.2 Verify Your Lab Name

The lab name will be provided by your instructor. Alternatively, you can find it in the address bar of your browser:

For example, the lab name in the image is student1.

2. Deploy Gitea and ArgoCD

Use the gitea-argo-setup.sh script located in your lab environment. Provide your lab name as an argument:

chmod +x /home/tigera/gitea-argo-setup.sh
/home/tigera/gitea-argo-setup.sh labname

What the Script Does:

1. Deploys Gitea and ArgoCD via Helm using your lab name for configuration.
2. Configures Git global settings (e.g., user.email and user.name).
3. Pauses to allow you to:
   • Log in to the local Gitea URL.
   • Pull down the GitHub repository containing the ArgoCD applications.
4. Clones the Gitea repository locally to the /home/tigera/day2-gitops-workshop directory and makes the following updates:
   • Adjusts ArgoCD applications to point to the local Gitea repository.
   • Updates the Tigera Manager UI Ingress resource with your lab name.
   • Copies the license.yaml file for Calico Enterprise into the Gitea repository.
5. Configures ArgoCD:
   • Downloads and sets up the ArgoCD CLI.
   • Logs in to ArgoCD and adds the local Gitea repository and cluster.
   • Outputs the ArgoCD URL, username, and password for monitoring deployment progress.

To login to ArgoCD you can use the below information:

ARGOCD_PASSWORD=$(kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
CLUSTERNAME=$(kubectl cluster-info | grep control | awk -F "//" '{print $2}' | awk -F "." '{print $1}')
echo "ArgoCD URL: https://argocd.${CLUSTERNAME}.training.tigera.ca"
echo "ArgoCD Username: admin"
echo "ArgoCD Password: ${ARGOCD_PASSWORD}"

3. Explore the Repository

Take some time to examine the Gitea repository.

Here’s an overview of its structure:

3.1 charts Directory

Contains Helm charts for the ArgoCD applications:

• Sealed Secrets: Deploys the sealed-secrets controller.
• Calico Enterprise: Deploys the Tigera operator.
• Calico Enterprise Configs: Contains additional team-specific configurations (e.g., ingress).
• Base Policies: Contains Calico Tiers and Policies to secure the cluster from birth

3.2 argo-apps Directory

Contains ArgoCD applications that point to the Helm charts in the charts directory:

• sealed-secrets-app -> charts/sealed-secrets
• calico-enterprise-app -> charts/calico-enterprise
• calico-configs-app -> charts/calico-configs
• base-policies-app -> charts/base-policies

3.3 kickstart-apps Directory

Contains the app-of-apps ArgoCD application. This application ensures all ArgoCD applications representing a full deployment are in sync.

This git repository has also been cloned locally into /home/tigera/day2-gitops-workshop and any configuration done should be done locally and not in the gitea repo

4. Deploy Calico Enterprise via ArgoCD

We will now add Calico Entreprise as an app in ArgoCD and deploy it. Run the following command to deploy Calico Enterprise:

argocd app create -f /home/tigera/day2-gitops-workshop/kickstart-apps/dev-team-1/calico-enterprise-standalone-deploy.yaml --grpc-web

5. How ArgoCD Consumes Charts in Gitea

ArgoCD uses a GitOps workflow to deploy applications from the Gitea repository, following these steps:

1. Infrastructure Setup:

   • A sealed-secret master certificate was pre-generated during infrastructure provisioning. This certificate was used to encrypt the Tigera pull-secret, and was then deployed, as a secret (called mycustomkeys), into the sealed-secrets namespace.
   • This master secret enables the sealed-secrets deployment to decrypt sensitive information stored as encrypted secrets in the Gitea repository (e.g., the Tigera pull-secret).

2. Sealed Secrets Deployment:

   • ArgoCD deploys the sealed-secrets Helm chart first.
   • The sealed-secrets deployment uses the master certificate to decrypt the encrypted Tigera pull-secret stored in the Gitea repository.

3. Calico Enterprise Deployment:

   • ArgoCD deploys the Calico Enterprise Helm chart along with supporting resources such as:
     • A storage class.
     • A service account.
     • The decrypted Tigera pull-secret.

4. Additional Configurations:

   • ArgoCD deploys any additional Calico-specific configurations, such as ingress definitions and license keys, based on the team’s requirements.

5. Base Tiers and Policies:

   • ArgoCD deploys pre-defined base network tiers and policies, ensuring the cluster is secure from the outset.

This workflow ensures that all components of Calico Enterprise are deployed securely and in the correct order, leveraging the declarative and automated approach provided by ArgoCD.

If you want to keep track of how Calico Enterprise is progressing, you can watch this in the ArgoCD UI or alternatively, you can run the below command in the cluster:

watch -d kubectl get tigerastatus

It should take roughly 6 to 10 minutes to complete the deployment

6. There's a Problem!

Calico Enterprise looks to be deploying OK, but there is a problem with one of the applications that is always out of sync.

See if you can figure it out and correct it.

Note: Please do not edit the Gitea repo directly; instead, change your local Git repo at /home/tigera/day2-gitops-workshop/.

Solution

1. In ArgoCD, click on the base-policies app. You will notice it is either constantly syncing or has errored, depending on how much time has passed.

   

2. Clicking into it reveals the error similar to: one or more objects failed to apply, reason: resource does not exist: Tier(platformxxxxxxxx) with error: tiers.crd.projectcalico.org "platformxxxxxxxx" not foundl.

   

3. This indicates an issue with the cluster-dns-allow-all policy.

4. Click on the platform.cluster-dns-allow-all GlobalNetworkPolicy in ArgoCD to investigate further.

   

5. It will show as OutOfSync.

   

To fix this:

# Navigate to the file and open it for editing
vi /home/tigera/day2-gitops-workshop/charts/base-policies/templates/02-policies.yaml

# Find the incorrect tier name and update it from "platformxxxxxxxx" to "platform"
# Save the changes

# Commit the changes to Git
cd /home/tigera/day2-gitops-workshop

git add charts/base-policies/templates/02-policies.yaml
git commit -m "Fixed the DNS policy"
git push

Finally, return to ArgoCD and click the Refresh button in the base-policies app to apply the corrected configuration.

You may also have to re-sync if the application sync has since failed. Or if the application is still syncing, click the 'Syncing' icon and choose 'Terminate'

Congratulations! You have completed Day-2 Operations - Automation Workshop'!