You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: adoc/SAP-EIC-General.adoc
+126-6Lines changed: 126 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ https://help.sap.com/docs/integration-suite?locale=en-US and search for the "Edg
8
8
9
9
10
10
# tag::disclaimer-production-versions[]
11
-
If you want to use different versions of {slem} or {slm}, {rancher}, {rke}, or {lh}, make sure to check the support matrix for the related solutions you want to use:
11
+
To use different versions of {slem} or {slm}, {rancher}, {rke}, or {lh}, make sure to check the support matrix for the related solutions you want to use:
Scroll to the very bottom and enter your registry FQDN, as shown below:
226
+
227
+
image::SAP-Edge-Registry-Add.png[title=Configure Registry at cluster config,scaledwidth=99%]
228
+
229
+
There's no need to start with http:// or https:// prefix, neither with the /project as a suffix.
230
+
If you are using certificates from an unknown CA, make sure to enable *Skip TLS Verifications*.
231
+
232
+
# end::rancher-registries[]
233
+
234
+
# tag::legacyRestrictedAccess[]
235
+
236
+
[#legacyRestrictedAccess]
237
+
238
+
For Edge Integration Cell versions older than 8.41, you must manually prepare the cluster using the resources attached to **SAP Note 3618713**: https://me.sap.com/notes/3618713.
239
+
240
+
==== Applying the resources from SAP Note
241
+
242
+
1. Access **SAP Note 3618713** and download the `resources.zip` file.
243
+
2. Follow the instructions in the **"Manual Setup Using Attached Resources"** section of the SAP Note to create the namespaces, Custom Resource Definitions (CRDs), and RBAC policies (Roles and RoleBindings) in your cluster.
244
+
3. When the resources are successfully applied, return to this guide to complete the following steps.
245
+
246
+
==== Configuring ImagePullSecrets
247
+
248
+
Create the *imagePullSecret* in all newly created namespaces (except `edge-icell-secrets`). Refer to <<imagePullSecret>> for credential details and apply them to `edgelm`, `istio-gateways`, `edge-icell`, `edge-icell-services`, and `edge-icell-ela`.
249
+
250
+
Alternatively, run the following script to create the *imagePullSecret* in all required namespaces:
The manifests provided by SAP contain the necessary security policies, but they must be explicitly assigned to your restricted user. By associating these policies with your Rancher User ID, {elm} can securely manage the cluster using Rancher's centralized authentication.
270
+
271
+
Ensure you have created the restricted user in Rancher as described in <<createRestrictedUser>>. Then, create a file named `configuring_permissions.sh` and add the following validated script to grant the required permissions to your user:
Make the script executable and run it, replacing `<USER_ID>` with your actual restricted user ID:
312
+
313
+
[source, bash]
314
+
----
315
+
chmod +x configuring_permissions.sh
316
+
./configuring_permissions.sh <USER_ID>
317
+
----
318
+
319
+
[#raLegacyKubeconfig]
320
+
==== Generating and downloading the kubeconfig file
321
+
322
+
The process for downloading the restricted kubeconfig file from the Rancher UI is identical for all {eic} versions.
323
+
324
+
Refer to <<raDownloadKubeconfig>> for the detailed steps and visual guides. When downloaded, you can provide this file to the {elm} UI to finish initializing your Edge Node.
This chapter describes a basic example of how to use {hana} with {eic}.
3
+
It will *NOT* instruct how to set up {hana} or high availability for {hana}.
4
+
5
+
TIP: For more information around high availability, refer to
6
+
link:https://documentation.suse.com/sbp/high-availability/[SUSE's best practices guides]
7
+
8
+
TIP: If you are looking for automated deployments of {hana}, there are Ansible scripts available at https://github.com/sap-linuxlab/ansible.playbooks_for_sap
9
+
10
+
++++
11
+
<?pdfpagebreak?>
12
+
++++
13
+
14
+
== Architecture overview
15
+
16
+
IMPORTANT: HANA is supposed to run in a side-by-side approach with the {eic} Kubernetes cluster. {hana} is not part of that Kubernetes cluster. The picture below shows the side-by-side installation from an architectural point of view.
If you are planning to use a shared {hana} instance for {eic} with other workloads, itis recommended to create a dedicated tenant database, user and schema for {eic}.
24
+
25
+
To create a new tenant database log in to your installed {hana}.
26
+
An example login command looks like:
27
+
28
+
[source, bash]
29
+
----
30
+
hdbsql -i 00 -d SYSTEMDB -u SYSTEM -p <password>
31
+
----
32
+
33
+
When logged in, run the following command to create a new tenant database:
34
+
35
+
[source, sql]
36
+
----
37
+
CREATE DATABASE EICDB SYSTEM USER PASSWORD "SuperSecret123";
38
+
----
39
+
40
+
This will create a new tenant database _EICDB_ and sets the database password to _"SuperSecret123"_
41
+
After creation, you will need to login to the newly created database to create a new user and schema.
42
+
43
+
Similar to the previous log in, the our example uses now the newly created _EICDB_ and the password from the command above:
44
+
45
+
[source, bash]
46
+
----
47
+
hdbsql -i 00 -d EICDB -u SYSTEM -p "SuperSecret123"
48
+
----
49
+
50
+
After now being logged into the dedicated tenant database, you can now create the new user and the schema.
51
+
In the following example we'll create a user named _EICUSER_ with the password _YourPassword123_ and the related schema _EIC_:
52
+
53
+
[source, sql]
54
+
----
55
+
CREATE USER EICUSER PASSWORD "YourPassword123" NO FORCE_FIRST_PASSWORD_CHANGE;
56
+
GRANT DATA ADMIN TO EICUSER;
57
+
CREATE SCHEMA EIC;
58
+
----
59
+
60
+
// GRANT SELECT,INSERT,UPDATE,DELETE ON SCHEMA "EIC" TO "EICUSER";
61
+
62
+
[#gatherHANAdbPort]
63
+
Get the sql port for the newly created tenant database:
64
+
65
+
[source, sql]
66
+
----
67
+
SELECT SQL_PORT FROM SYS.M_SERVICES WHERE SERVICE_NAME='indexserver';
68
+
----
69
+
70
+
[#gatherHANArootCert]
71
+
== Gather the HANA DB root cert
72
+
73
+
The HANA DB root cert is required to deploy {eic} with {hana} as the datastore or database.
74
+
The certificate is stored locally on your HANA node and can be found in the $SECUDIR.
75
+
Typically the name of the certificate is like:
76
+
77
+
[source, text]
78
+
----
79
+
clientpki_<SID>.cer
80
+
----
81
+
82
+
The file is located on the {hana} node and you can access is in the given directory.
83
+
The hdbadm user usually has the SECUDIR variable set so you can easily change into that directory like:
84
+
85
+
[source, bash]
86
+
----
87
+
cd $SECUDIR
88
+
----
89
+
90
+
++++
91
+
<?pdfpagebreak?>
92
+
++++
93
+
94
+
== Enter input
95
+
96
+
When deploying {eic} with HANA, you will be prompted to enter the relevant data.
97
+
98
+
The _HANA DB Node_ requires the URL and port of your {hana} tenant database.
99
+
You can get the port as described in the chapter above <<gatherHANAdbPort>>.
100
+
101
+
The _HANA DB Name_ is the name of the tenant database to use. +
102
+
For the _HANA DB Schema_ you can enter the name of the schema to be used. +
103
+
The _HANA DB Username_ is the name of the user, used to connect to {hana}. +
104
+
The _HANA DB Password_ is the password for the given user.
105
+
106
+
If you followed our example above, the values are:
0 commit comments