Installation to use

rianbooyer

Hello,

I have an existing k8s cluster that is on site and bare metal. I currently use the awx-operator for our project but as everyone knows it has not had a new release in years.

I have been experimenting with ascender as a replacement but I'm realizing the ascender-installer doesn't even come close to meeting our needs.

I'm running into these issues:

Every time ascender is installed it wipes out the secret key that encrypts the data
- On awx I have the secret key applied in a kustomization file to retain the key each time I bring it down
I have my cluster behind a proxy and after installing ascender I get the error of csrf_trusted_origin not being valid.
- On AWX i have this customized under extra_settings in the crd but have not found any documentation from ascender that shows how this is to be set. currently on my prod cluster we can't login due to this issue.
- your documentation here: https://ascender-automation.org/release_notes/known_issues.html points to the solution for django but not how to apply the fix to ascender itself.
I need to be able to apply some other customizations like i do in awx
- import our CA trust chain so that ldap will work in our environment (bundle_cacert_secret)
- retain the secret key so that it can be applied if we have to recreate the namespace (secret_key_secret)
- need other customizations such as task and web replica controls ingress hostnames, etc.

I have tried to utilize the ascender-install but it seems to be geared towards cloud and other tech that we don't utilize onsite for our awx work. I was able to get it going on a new test cluster with a load balancer but implementing in our production cluster has been a bit of a challenge without the ability to customize things like awx has.

Which installation option would be the best, do you have any actual installation documentation that is current for ascender (the documentation on the basic-install references the old awx images and I would rather not use un-updated images if i'm migrating)

I do see you have a helm installer but would need instructions on how to patch in custom settings.

any help or guidance would be greatly appreciated.

Regards,

cigamit

I am currently on the road, but I will take a look tonight. I know we already have a hidden ldap_cacert_secret setting, that you just point at the ldap cert secret. I can update the documentation and config for that. For the others, I can drop in an extra_settings variable to allow you to add anything additional you need.

Could you also look at the 2 templates and see if there is anything else in there you might be able to use? We already have variables for the replicas and already create ingresses using hostname stated in the config.

ctrliq/ascender-installblob/main/playbooks/roles/ascender_install/templates/ascender-deployment/ascender-deployment-k3s.yml
ctrliq/ascender-installblob/main/playbooks/roles/ascender_install/templates/ascender-deployment/additional-spec.yml

rianbooyer

I did find some ways around these issues. since i am not familiar with git to public repos i put a description in an issue:

ctrliq/ascender-install269

rianbooyer

this one ctrliq/ascender-installblob/main/playbooks/roles/ascender_install/templates/ascender-deployment/ascender-deployment-k3s.yml

Looks like the awx specification under ascender-app, however, how would one apply this during the ascender-install?

rianbooyer

the ldap_cacert_secret will definitely help thanks