Procedure

1. Create a pull secret in the olm namespace using the following command:

   kubectl -n olm create secret docker-registry rhdh-pull-secret \
       --docker-server=registry.redhat.io \
       --docker-username=<user_name> \ 1
       --docker-password=<password> \ 2
       --docker-email=<email> 3

   1

   Enter your username in the command.

   2

   Enter your password in the command.

   3

   Enter your email address in the command.

   The created pull secret is used to pull the Operator images from the Red Hat Ecosystem.

2. Create a CatalogSource resource in the olm namespace that contains the Operators from the Red Hat Ecosystem:

   cat <<EOF | kubectl -n olm apply -f -
   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: redhat-catalog
   spec:
     sourceType: grpc
     image: registry.redhat.io/redhat/redhat-operator-index:v4.17
     secrets:
     - "rhdh-pull-secret"
     displayName: Red Hat Operators
   EOF

3. Wait a few minutes until the Catalog Source is up and run the following command to list the available operators from the Red Hat ecosystem and confirm that the rhdh operator is listed:

   kubectl -n olm get packagemanifests

4. Create the rhdh-operator namespace aimed at containing the Operator:

   kubectl create namespace rhdh-operator

5. Create a pull secret in the rhdh-operator namespace:

   kubectl -n rhdh-operator create secret docker-registry rhdh-pull-secret \
       --docker-server=registry.redhat.io \
       --docker-username=<user_name> \ 1
       --docker-password=<password> \ 2
       --docker-email=<email> 3

   1

   Enter your username in the command.

   2

   Enter your password in the command.

   3

   Enter your email address in the command.

   The created pull secret is used to pull the Developer Hub images from the Red Hat Ecosystem.

6. Create an OperatorGroup resource as follows:

   cat <<EOF | kubectl apply -n rhdh-operator -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: rhdh-operator-group
   EOF

7. Create a Subscription resource:

   cat <<EOF | kubectl apply -n rhdh-operator -f -
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhdh
     namespace: rhdh-operator
   spec:
     channel: fast
     installPlanApproval: Automatic
     name: rhdh
     source: redhat-catalog
     sourceNamespace: olm
     startingCSV: rhdh-operator.v1.4.0
   EOF

8. Verify that the created Operator is running:

   kubectl -n rhdh-operator get pods -w

   If the operator pod shows ImagePullBackOff status, then you might need permissions to pull the image directly within the Operator deployment’s manifest.

   Tip

   You can include the required secret name in the deployment.spec.template.spec.imagePullSecrets list and verify the deployment name using kubectl get deployment -n rhdh-operator command:

   kubectl -n rhdh-operator patch deployment \
       rhdh-operator --patch '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"rhdh-pull-secret"}]}}}}' \
       --type=merge

9. Update the default configuration of the operator to ensure that Developer Hub resources can start correctly using the following steps:

   1. Edit the backstage-default-config ConfigMap in the rhdh-operator namespace using the following command:

      kubectl -n rhdh-operator edit configmap backstage-default-config

   2. Locate the db-statefulset.yaml string and add the fsGroup to its spec.template.spec.securityContext, as shown in the following example:

        db-statefulset.yaml: |
          apiVersion: apps/v1
          kind: StatefulSet
      --- TRUNCATED ---
          spec:
          --- TRUNCATED ---
            restartPolicy: Always
            securityContext:
            # You can assign any random value as fsGroup
              fsGroup: 2000
            serviceAccount: default
            serviceAccountName: default
      --- TRUNCATED ---

   3. Locate the deployment.yaml string and add the fsGroup to its specification, as shown in the following example:

        deployment.yaml: |
          apiVersion: apps/v1
          kind: Deployment
      --- TRUNCATED ---
          spec:
            securityContext:
              # You can assign any random value as fsGroup
              fsGroup: 3000
            automountServiceAccountToken: false
      --- TRUNCATED ---

   4. Locate the service.yaml string and change the type to NodePort as follows:

        service.yaml: |
          apiVersion: v1
          kind: Service
          spec:
           # NodePort is required for the ALB to route to the Service
            type: NodePort
      --- TRUNCATED ---

   5. Save and exit.

      Wait for a few minutes until the changes are automatically applied to the operator pods.

Procedure

1. Create an Image Pull Secret named rhdh-pull-secret using your Red Hat credentials to access images from the protected registry.redhat.io as shown in the following example:

   kubectl -n <your_namespace> create secret docker-registry rhdh-pull-secret \
       --docker-server=registry.redhat.io \
       --docker-username=<redhat_user_name> \
       --docker-password=<redhat_password> \
       --docker-email=<email>

2. Create a ConfigMap named app-config-rhdh containing the Developer Hub configuration using the following template:

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: app-config-rhdh
   data:
     "app-config-rhdh.yaml": |
       app:
         title: Red Hat Developer Hub
         baseUrl: https://<rhdh_dns_name>
       backend:
         auth:
           externalAccess:
               - type: legacy
                 options:
                   subject: legacy-default-config
                   secret: "${BACKEND_SECRET}"
         baseUrl: https://<rhdh_dns_name>
         cors:
           origin: https://<rhdh_dns_name>

3. Create a Secret named my-rhdh-secrets and add a key named BACKEND_SECRET with a Base64-encoded string as value:

   apiVersion: v1
   kind: Secret
   metadata:
     name: my-rhdh-secrets
   stringData:
     # TODO: See https://backstage.io/docs/auth/service-to-service-auth/#setup
     BACKEND_SECRET: "xxx"

   Important

   Ensure that you use a unique value of BACKEND_SECRET for each Developer Hub instance.

   You can use the following command to generate a key:

   node -p 'require("crypto").randomBytes(24).toString("base64")'

4. To enable pulling the PostgreSQL image from the Red Hat Ecosystem Catalog, add the image pull secret in the default service account within the namespace where the Developer Hub instance is being deployed:

   kubectl patch serviceaccount default \
       -p '{"imagePullSecrets": [{"name": "rhdh-pull-secret"}]}' \
       -n <your_namespace>

5. Create a Custom Resource file using the following template:

   apiVersion: rhdh.redhat.com/v1alpha3
   kind: Backstage
   metadata:
    # TODO: this the name of your Developer Hub instance
     name: my-rhdh
   spec:
     application:
       imagePullSecrets:
       - "rhdh-pull-secret"
       route:
         enabled: false
       appConfig:
         configMaps:
           - name: "app-config-rhdh"
       extraEnvs:
         secrets:
           - name: my-rhdh-secrets

6. Create an Ingress resource using the following template, ensuring to customize the names as needed:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     # TODO: this the name of your Developer Hub Ingress
     name: my-rhdh
     annotations:
       alb.ingress.kubernetes.io/scheme: internet-facing
   
       alb.ingress.kubernetes.io/target-type: ip
   
       # TODO: Using an ALB HTTPS Listener requires a certificate for your own domain. Fill in the ARN of your certificate, e.g.:
       alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-xxx:xxxx:certificate/xxxxxx
   
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
   
       alb.ingress.kubernetes.io/ssl-redirect: '443'
   
       # TODO: Set your application domain name.
       external-dns.alpha.kubernetes.io/hostname: <rhdh_dns_name>
   
   spec:
     ingressClassName: alb
     rules:
       # TODO: Set your application domain name.
       - host: <rhdh_dns_name>
         http:
           paths:
           - path: /
             pathType: Prefix
             backend:
               service:
                 # TODO: my-rhdh is the name of your Backstage Custom Resource.
                 # Adjust if you changed it!
                 name: backstage-my-rhdh
                 port:
                   name: http-backend

   In the previous template, replace ` <rhdh_dns_name>` with your Developer Hub domain name and update the value of alb.ingress.kubernetes.io/certificate-arn with your certificate ARN.