Automation Suite on EKS/AKS installation guide

Step 1: Installing the service mesh​

Providing the Istio configuration​

"ingress": {
  "gateway_selector": {
    "istio": "ingressgateway"
  },
  "ingress_gateway_secret": "istio-ingressgateway-certs",
  "namespace": "<istio-system>"
},
"ingress": {
  "gateway_selector": {
    "istio": "ingressgateway"
  },
  "ingress_gateway_secret": "istio-ingressgateway-certs",
  "namespace": "<istio-system>"
},

kubectl -n  get deploy istio-ingressgateway -o jsonpath="{.metadata.labels.istio}"; echokubectl -n  get deploy istio-ingressgateway -o jsonpath="{.metadata.labels.istio}"; echo

Step 2: Configuring Istio and installing the WASM plugin for routing​

Overview​

• Option A: If you cannot provide the permissions that the Automation Suite installer requires, then you must perform this step before the Automation Suite installation.
• Option B: During the Automation Suite installation. This method requires the Kubeconfig file that you use during the Automation Suite installation to have the necessary permissions. To review the permissions, refer to the Granting installation permissions section. If you can provide all the necessary permissions, then skip this step.

Configuration and installation​

1. Create an imagepullsecret in the namespace where you installed the service mesh. To create the imagepullsecret, use your typical workflow or take the following steps:

   assignment

   registry= <registry_url> #provide the registry where the UiPath images are hosted
   username= <user_name> #provide the username which will be used for the authentication
   password= <password> #provide the password which will be used for the authentication
   namespace= <namespace> #namespace where you want to create a secret
   
   kubectl create secret docker-registry uipathpullsecret --namespace=${namespace} \
     --docker-server=${registry} --docker-username=${username} \
     --docker-password=${password} --dry-run=client -o yaml \
     | kubectl apply -f -
   registry= <registry_url> #provide the registry where the UiPath images are hosted
   username= <user_name> #provide the username which will be used for the authentication
   password= <password> #provide the password which will be used for the authentication
   namespace= <namespace> #namespace where you want to create a secret
   
   kubectl create secret docker-registry uipathpullsecret --namespace=${namespace} \
     --docker-server=${registry} --docker-username=${username} \
     --docker-password=${password} --dry-run=client -o yaml \
     | kubectl apply -f -
   

2. Pull the helm chart to a local directory, <uipath-istio-configure>:

   assignment

   helm pull oci://<docker-registry>/helm/istio-configure --version <istio-configure-version> \
   --untar --untardir <uipath-istio-configure>
   helm pull oci://<docker-registry>/helm/istio-configure --version <istio-configure-version> \
   --untar --untardir <uipath-istio-configure>
   

   The following example shows the command after you replace the placeholders with actual values:

   assignment

   helm pull oci://registry.mycompany.com/helm/istio-configure --version 2024.10.0 \
   --untar --untardir uipath-istio-configure
   helm pull oci://registry.mycompany.com/helm/istio-configure --version 2024.10.0 \
   --untar --untardir uipath-istio-configure
   

3. Create a parameter values file to apply during the Helm installation of istio-configure. Use the following sample as a template for the file and the replace the <fqdn>, <cluster_type>, <pullsecret>, <registry>, and <uipath_namespace> placeholders with appropriate values:

   assignment

   fqdn: <fqdn>    #the FQDN of the Automation Suite
   gateway:
     selector:
       istio: ingressgateway
   global:
     cluster_type: <cluster_type>    # REQUIRED. Example: eks, aks, openshift
     kubernetesDistribution: <cluster_type>  # REQUIRED. Example: eks, aks, openshift
     imagePullSecret:
       name: <pullsecret>    #name of pull secret which you had create earlier
   minProtocolVersion: TLSV1_2   #TLS versions
   uipath:
     registry: <registry>    #registry url without the protocol 
   uipathServiceNamespace: <uipath_namespace>   #namespace where the uipath application is deployed
   patchIstioService: false
   wasm:
     image:
       pullSecret: <pullsecret>    #name of pull secret which you had create earlier
       registry: oci://<registry>   #registry url without the protocol
   fqdn: <fqdn>    #the FQDN of the Automation Suite
   gateway:
     selector:
       istio: ingressgateway
   global:
     cluster_type: <cluster_type>    # REQUIRED. Example: eks, aks, openshift
     kubernetesDistribution: <cluster_type>  # REQUIRED. Example: eks, aks, openshift
     imagePullSecret:
       name: <pullsecret>    #name of pull secret which you had create earlier
   minProtocolVersion: TLSV1_2   #TLS versions
   uipath:
     registry: <registry>    #registry url without the protocol 
   uipathServiceNamespace: <uipath_namespace>   #namespace where the uipath application is deployed
   patchIstioService: false
   wasm:
     image:
       pullSecret: <pullsecret>    #name of pull secret which you had create earlier
       registry: oci://<registry>   #registry url without the protocol
   

4. Install istio-configure in the Istio namespace, using Helm. In the following command, replace the <istio_namespace> placeholder with the namespace where Istio is installed, and the <path_to_the_values_yaml> with the location of the YAML file containing the parameter values:

   assignment

   helm upgrade --debug --install --wait custom-istio-configure \
     uipath-istio-configure/istio-configure --version 2024.10.0 \
     --namespace <istio_namespace> -f <path_to_the_values.yaml>
   helm upgrade --debug --install --wait custom-istio-configure \
     uipath-istio-configure/istio-configure --version 2024.10.0 \
     --namespace <istio_namespace> -f <path_to_the_values.yaml>
   

5. If you use a registry that is not signed by a known authority, you must add the WASM_INSECURE_REGISTRIES environment variable to the istio-ingressgateway deployment, so that Istio can pull the image that the WASM plugin uses. To add the environment variable, run the following command:

   assignment

   kubectl -n <istio-system> patch deployment istio-ingressgateway --type json -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": [{"name": "WASM_INSECURE_REGISTRIES", "value": "registry.mycompany.com"}]}]'
   kubectl -n <istio-system> patch deployment istio-ingressgateway --type json -p='[{"op": "add", "path": "/spec/template/spec/containers/0/env", "value": [{"name": "WASM_INSECURE_REGISTRIES", "value": "registry.mycompany.com"}]}]'
   

6. Add istio-configure to the exclude_components section in your input.json file.

7. Create certificate secrets using the name provided in ingress.ingress_gateway_secret within the <istio-system> namespace.