Prerequisites to Install Calibo Accelerate Orchestrator Agent on Google Kubernetes Engine (GKE) Cluster by Using mTLS

Create or identify a dedicated GKE cluster for deploying the Calibo Accelerate Orchestrator Agent.

Ensure that the cluster meets the following minimum requirements:

• Use a GKE version currently supported by Google Cloud

• Minimum 2 nodes (minimum 8 GiB RAM and 2 vCPUs per node)

• Install the Google Cloud CLI and authenticate it with an account that has access to the required Google Cloud project.

• Configure kubectl to access the cluster.

• Ensure that you have sufficient Kubernetes RBAC permissions to create namespaces, service accounts, secrets, roles, role bindings, services, and ingress resources.

• Enable Workload Identity Federation for GKE.

• For information about supported versions, see the GKE release schedule.

Create a dedicated Google Cloud service account (GSA) for the Calibo Accelerate Orchestrator Agent.

Use the same service account name that you specify for the <SERVICE_ACCOUNT_NAME> placeholder in the Helm installation command.

Install NGINX or Traefik Ingress Controller.

NGINX Ingress Controller Requirements

• Version 1.3.0 or later.

  For information about how to install the Ingress-Nginx Controller, see Ingress-Nginx Controller Installation Guide.

Traefik Ingress Controller Requirements

• Install Traefik Proxy (v3.7.1 or later or latest stable version)

• Helm is installed and configured.

• kubectl is configured to access the GKE cluster.

• The required Kubernetes RBAC permissions are available.

• Ensure required RBAC permissions and IngressClass configuration are defined

• If using advanced routing, install Traefik CRDs (Custom Resource Definitions)

For installation instructions, see Traefik Kubernetes Ingress Controller Documentation.

Ensure that Google Secret Manager is available in the same Google Cloud project as the Google Kubernetes Engine (GKE) cluster used for deploying the Calibo Accelerate Orchestrator Agent.

In Google Secret Manager, create a secret specifically for the API key and set the secret value to the following JSON string (the entire JSON string should be entered as the value of the secret):

{"apiKey":""}

Note the Secret name, as you must provide this value when running the Orchestrator Agent installation command.

The Orchestrator Agent uses this secret to store and periodically update its API key. This key is used to authenticate the agent during registration with the Calibo Accelerate platform.

Note the Secret name, as you must provide this value when running the Orchestrator Agent installation command. The Orchestrator Agent uses this secret to store and periodically update its API key. This key is used to authenticate the agent during registration with the Calibo Accelerate platform.

Best Practice:

Store the Orchestrator Agent API key in a dedicated secret that is separate from secrets containing tool credentials.

The Orchestrator Agent requires:

• Read access to secrets containing tool credentials.

• Read access and permission to add versions to the API key secret.

Separating these secrets prevents the agent from receiving write access to tool-credential secrets.

Grant the Google Cloud service account used by the Calibo Accelerate Orchestrator Agent permission to access the required secrets in Google Secret Manager.

The service account must have permission to:

• Read the tool secrets stored in Google Secret Manager.

• Read and update the Orchestrator Agent API key secret (apiKey) created in the earlier section.

• Add new versions to the API key secret when the key is generated or rotated.

Grant the following IAM roles to the Google Cloud service account.

Before running the commands, replace the following placeholder values with your Google Cloud configuration details:

Run the following commands.

Grant the Secret Manager Secret Accessor role:

gcloud projects add-iam-policy-binding "<GOOGLE_CLOUD_PROJECT>" \
--member="serviceAccount:<GOOGLE_SERVICE_ACCOUNT_NAME>@<GOOGLE_CLOUD_PROJECT>.iam.gserviceaccount.com" \ 
--role="roles/secretmanager.secretAccessor"

This role allows the Orchestrator Agent to access the values stored in Google Secret Manager.

Grant the Secret Manager Secret Version Manager role:

gcloud projects add-iam-policy-binding "<GOOGLE_CLOUD_PROJECT>" \ 
--member="serviceAccount:<GOOGLE_SERVICE_ACCOUNT_NAME>@<GOOGLE_CLOUD_PROJECT>.iam.gserviceaccount.com" \
--role="roles/secretmanager.secretVersionManager"

This role allows the Orchestrator Agent to create and manage versions of the dedicated API key secret.

Allow inbound and outbound connectivity on port 443 to the Google Kubernetes Engine (GKE) cluster dedicated to the Orchestrator Agent.

This connectivity is required to download the Orchestrator Agent images and to establish a secure connection between the agent and the Calibo Accelerate platform.

The following commands help you generate a self-signed Certificate Authority (CA) certificate, server certificate, and client certificate. You can also use your trusted root CA to generate these certificates.

1. Create a CA certificate by running the following command in your command-line interface. Replace Test Cert Authority with the name of your trusted certificate authority. The -days parameter indicates the validity period of the certificate. By default, it is set to 365. You can modify this value. After the specified period, the certificate will expire and you must regenerate the self-signed CA certificate.

   Copy

   openssl req -x509 -sha256 -newkey rsa:4096 -keyout ca.key -out ca.crt -days 365 -nodes -subj '/CN=Test Cert Authority'

 

2. Create a server certificate for your domain by using the CA certificate that you created in step 1. To create the server certificate, run the following command in your command-line interface. Replace <your_domain_name> with your domain name. The -days parameter indicates the validity period of the certificate. By default, it is set to 365. You can modify this value. After the specified period, the server certificate will expire and you must regenerate it.

   Copy

   openssl req -new -newkey rsa:4096 -keyout server.key -out server.csr -nodes -subj '/CN= <your_domain_name> ' && openssl x509 -req -sha256 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

 

3. Create a client certificate by using the CA certificate that you created in step 1. To create a client certificate, run the following command in your command line interface. The -days parameter indicates the validity period of the certificate. By default, it is set to 365. You can modify this value. After the specified period, the certificate will expire and you must regenerate the certificate and upload it to the Calibo Accelerate platform by editing the agent details.

   Copy

   openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr -nodes -subj '/CN=Lazsa' && openssl x509 -req -sha256 -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 02 -out client.crt

 

4. Convert the client certificate to PKCS#12 format by running the following command. Remember the password that you add to create the certificate in PKCS#12 format. You must provide this password when you upload the client certificate during agent installation.

   Copy

   openssl pkcs12 -export -out client.p12 -inkey client.key -in client.crt