Navigation :

Installing Gloo Edge Enterprise

Review how to install Gloo Edge Enterprise.

Before you begin

Make sure that you prepared your Kubernetes cluster according to the instructions for platform configuration.
Pay attention to provider-specific information in the setup guide. For example, OpenShift requires stricter multi-tenant support, so the setup guide includes an example Helm chart values.yaml file that you must supply while installing Gloo Edge Enterprise.
Get your Gloo Edge Enterprise license key. If you don’t have one already, you may request a trial license key here.
You must provide the license key during the installation process. When you install Gloo Edge, a Kubernetes secret is created to store the license key. Note that each trial license key is typically valid for 30 days. When the license key expires, you can request a new license key by contacting your Account Representative or filling out this form. For more information, see Updating Enterprise Licenses.
Check whether glooctl, the Gloo Edge command line tool (CLI), is installed.
```
glooctl version
```
- If glooctl is not installed, install it.
- If glooctl is installed, update it to the latest version.

Install the Gloo Edge command line tool (CLI)

You can install the Gloo Edge command line, glooctl, to help install, configure, and debug Gloo Edge. Depending on your operating system, you have several installation options.

macOS: You can use the Homebrew package manager.
```
brew install glooctl
```
Most platforms: You can use the following installation script, which requires Python to execute properly.
```
curl -sL https://run.solo.io/gloo/install | sh
export PATH=$HOME/.gloo/bin:$PATH
```

Windows: You can use the following installation script, which requires OpenSSL to execute properly.

(New-Object System.Net.WebClient).DownloadString("https://run.solo.io/gloo/windows/install") | iex
$env:Path += ";$env:userprofile/.gloo/bin/"

Direct download: You can download glooctl directly via the GitHub releases page. After downloading, rename the executable to glooctl and add it to your system’s PATH.

Update glooctl CLI version

If you already installed glooctl, make sure to update glooctl to the same minor version as the version of Gloo Edge that is installed in your cluster. For example, if you’re using Gloo Edge 1.10.0, you should use a 1.10.0 release of glooctl.

You can use the glooctl upgrade command to set the --release that you want to use. You can use this command to upgrade or roll back the glooctl version. For example, you might change versions during an upgrade process, or when you have multiple versions of Gloo Edge across clusters that you manage from the same workstation.

glooctl upgrade --release v1.10.0

Verify the installation or update

You can verify the glooctl CLI is installed and running the appropriate version.

glooctl version

In the output, the Client is your local version. The Server is the version that runs in your cluster, and is undefined if you did not install Gloo Edge yet!

Client: {"version":"1.10.0"}
Server: version undefined, could not find any version of gloo running

Installing Gloo Edge Enterprise on Kubernetes

Review the following steps to install Gloo Edge Enterprise with glooctl or with Helm.

Installing on Kubernetes with `glooctl`

Once your Kubernetes cluster is up and running, run the following command to deploy the Gloo Edge to the gloo-system namespace:

glooctl install gateway enterprise --license-key YOUR_LICENSE_KEY

For OpenShift clusters, make sure to include the --values values.yaml option to point to the Helm chart custom values file that you created.

Special Instructions to Install Gloo Edge Enterprise on Kind

If you followed the cluster setup instructions for Kind here, then you should have exposed custom ports 31500 (for http) and 32500 (https) from your cluster's Docker container to its host machine. The purpose of this is to make it easier to access your service endpoints from your host workstation. Use the following custom installation for Gloo Edge to publish those same ports from the proxy as well.

cat <<EOF | glooctl install gateway enterprise --license-key YOUR_LICENSE_KEY --values -
gloo:
  gatewayProxies:
    gatewayProxy:
      service:
        type: NodePort
        httpPort: 31500
        httpsPort: 32500
        httpNodePort: 31500
        httpsNodePort: 32500
EOF

Creating namespace gloo-system... Done.
Starting Gloo Edge Enterprise installation...

Gloo Edge Enterprise was successfully installed!

Note also that the url to invoke services published via Gloo Edge will be slightly different with Kind-hosted clusters. Much of the Gloo Edge documentation instructs you to use $(glooctl proxy url) as the header for your service url. This will not work with kind. For example, instead of using curl commands like this:

curl $(glooctl proxy url)/all-pets

You will instead route your request to the custom port that you configured above for your docker container to publish. For example:

curl http://localhost:31500/all-pets

Once you’ve installed Gloo Edge, please be sure to verify your installation.

You can run the command with the flag --dry-run to output the Kubernetes manifests (as yaml) that glooctl will apply to the cluster instead of installing them.

Installing on Kubernetes with Helm

This is the recommended method for installing Gloo Edge Enterprise to your production environment as it offers rich customization to the Gloo Edge control plane and the proxies Gloo Edge manages.

As a first step, you have to add the Gloo Edge repository to the list of known chart repositories:

helm repo add glooe https://storage.googleapis.com/gloo-ee-helm

Finally, install Gloo Edge using the following command:

helm install gloo glooe/gloo-ee --namespace gloo-system \
  --create-namespace --set-string license_key=YOUR_LICENSE_KEY

For OpenShift clusters, make sure to include the --values values.yaml option to point to the Helm chart custom values file that you created.

Using Helm 2 is not supported in Gloo Edge.

Once you’ve installed Gloo Edge, please be sure to verify your installation.

Airgap installation

You can install Gloo Edge Enterprise in an air-gapped environment, such as an on-premises datacenter, clusters that run on an intranet or private network only, or other disconnected environments.

Before you begin, make sure that you have the following setup:

A connected device that can pull the required images from the internet.
An air-gapped or disconnected device that you want to install Gloo Edge Enterprise in.
A private image registry such as Sonatype Nexus Repository or JFrog Artifactory that both the connected and disconnected devices can connect to.

To install Gloo Edge Enterprise in an air-gapped environment:

Set the Gloo Edge Enterprise version that you want to use as an environment variable, such as the latest version in the following example.
```
export GLOO_EE_VERSION=1.12.28
```

On the connected device, download the Gloo Edge Enterprise images.

helm template glooe/gloo-ee --version $GLOO_EE_VERSION | yq e '. | .. | select(has("image"))' - | grep image: | sed 's/image: //'

The example output includes the list of images.

quay.io/solo-io/gloo-fed-apiserver:1.12.28
quay.io/solo-io/gloo-federation-console:1.12.28
quay.io/solo-io/gloo-fed-apiserver-envoy:1.12.28
quay.io/solo-io/gloo-fed:1.12.28
quay.io/solo-io/gloo-ee:1.12.28
quay.io/solo-io/discovery-ee:1.12.28
quay.io/solo-io/gloo-ee-envoy-wrapper:1.12.28
"grafana/grafana:8.2.1"
"quay.io/coreos/kube-state-metrics:v1.9.7"
"jimmidyson/configmap-reload:v0.5.0"
"quay.io/prometheus/prometheus:v2.24.0"
docker.io/busybox:1.28
docker.io/redis:6.2.4
quay.io/solo-io/rate-limit-ee:1.12.28
quay.io/solo-io/extauth-ee:1.12.28
quay.io/solo-io/observability-ee:1.12.28
quay.io/solo-io/certgen:1.12.29
quay.io/solo-io/kubectl:1.22.9

Push the images from the connected device to a private registry that the disconnected device can pull from. For instructions and any credentials you must set up to complete this step, consult your registry provider, such as Nexus Repository Manager or JFrog Artifactory.
Optional: You might want to set up your private registry so that you can also pull the Helm charts. For instructions, consult your registry provider, such as Nexus Repository Manager or JFrog Artifactory.
When you install Gloo Edge Enterprise with a custom Helm chart values file, make sure to use the specific images that you downloaded and stored in your private registry in the previous steps.

Customizing your installation with Helm

You can customize the Gloo Edge installation by providing your own Helm chart values file.

For example, you can create a file named value-overrides.yaml with the following content.

global:
  glooRbac:
    # do not create kubernetes rbac resources
    create: false
settings:
  # configure gloo to write generated custom resources to a custom namespace
  writeNamespace: my-custom-namespace

Then, refer to the file during installation to override default values in the Gloo Edge Helm chart.

helm install gloo glooe/gloo-ee --namespace gloo-system \
  -f value-overrides.yaml --create-namespace --set-string license_key=YOUR_LICENSE_KEY

Using Helm 2 is not supported in Gloo Edge.

List of Gloo Edge Helm chart values

The following table describes the most important enterprise-only values that you can override in your custom values file.

For more information, see the following resources:

Gloo Edge Open Source overrides (also available in Enterprise).
Advanced customization guide.
Enterprise Helm chart reference document.

Gloo Edge Open Source Helm values in Enterprise must be prefixed with gloo, unless they are the Gloo Edge settings, such as settings.<rest of helm value>.

Option	Type	Description
grafana.defaultInstallationEnabled	bool	Deploy Grafana in the `gloo-system` namespace. Default is `true`.
prometheus.enabled	bool	Deploy Prometheus in the `gloo-system` namespace. Default is `true`.
rateLimit.enabled	bool	Deploy the rate-limiting server in the `gloo-system` namespace. Default is `true`.
global.extensions.caching.enabled	bool	Deploy the caching server in the `gloo-system` namespace. Default is `false`.
global.extensions.extAuth.enabled	bool	Deploy the ext-auth server in the `gloo-system` namespace. Default is `true`.
global.extensions.extAuth.envoySidecar	bool	Deploy ext-auth in the `gateway-proxy` pod as a sidecar to Envoy. Communicates over a Unix domain socket instead of TCP. Default is `false`.
observability.enabled	bool	Deploy Grafana in the `gloo-system` namespace. Default is `true`.
observability.customGrafana.enabled	bool	Use your own Grafana instance instead of the default Gloo Edge Grafana instance. Default is `false`.
observability.customGrafana.username	string	Authenticate to your custom Grafana instance using this username for basic auth.
observability.customGrafana.password	string	Authenticate to your custom Grafana instance using this password basic auth.
observability.customGrafana.apiKey	string	Authenticate to your custom Grafana instance using this API key.
observability.customGrafana.url	string	The URL for your custom Grafana instance.

Enterprise UI

Gloo Edge Enterprise includes the user interface (UI) by default. Note that when you enable Gloo Federation, the UI does not show any data until you register one or more clusters. If you do not use Gloo Federation, the UI shows the installed Gloo Edge instance automatically without cluster registration.

To disable Gloo Federation, you can set gloo-fed.enabled=false during installation as shown in the following examples.

glooctl install
helm install

echo "gloo-fed:
  enabled: false" > values.yaml
glooctl install gateway enterprise --values values.yaml --license-key=<LICENSE_KEY>

helm install gloo glooe/gloo-ee --namespace gloo-system --set gloo-fed.enabled=false --set license_key=<LICENSE_KEY>

Verify your Installation

Check that the Gloo Edge pods and services have been created. Depending on your install option, you may see some differences from the following example. And if you choose to install Gloo Edge into a different namespace than the default gloo-system, then you will need to query your chosen namespace instead.

kubectl --namespace gloo-system get all

NAME                                                       READY   STATUS    RESTARTS        AGE
pod/caching-service-5d7f867cdc-jgrbb                       1/1     Running   0               5m22s
pod/discovery-755c4f9f45-n5qxp                             1/1     Running   0               5m22s
pod/extauth-7c4c7f5999-m5zmc                               1/1     Running   0               5m22s
pod/gateway-proxy-59bf9f7d5f-7xm2f                         1/1     Running   0               5m22s
pod/gloo-7bb4dcf577-g6mcm                                  1/1     Running   0               5m22s
pod/gloo-fed-7b55f67c5d-m6mdk                              1/1     Running   0               5m22s
pod/gloo-fed-console-7c446775c-mpzq8                       3/3     Running   0               5m22s
pod/glooe-grafana-865bb9cd45-v6f4v                         1/1     Running   0               5m22s
pod/glooe-prometheus-kube-state-metrics-55ffc89cbb-66x2h   1/1     Running   0               5m22s
pod/glooe-prometheus-server-7d5b85764c-2zb4d               2/2     Running   0               5m22s
pod/observability-7f8f5c549c-794pm                         1/1     Running   0               5m22s
pod/rate-limit-74d459bfb6-2pzc6                            1/1     Running   0               5m22s
pod/redis-57fd559c5c-jjrrc                                 1/1     Running   0               5m22s

NAME                                          TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                                AGE
service/caching-service                       ClusterIP      10.76.6.4      <none>           8085/TCP                                               5m22s
service/extauth                               ClusterIP      10.76.9.130    <none>           8083/TCP                                               5m22s
service/gateway-proxy                         LoadBalancer   10.76.5.209    34.150.172.173   80:30451/TCP,443:32528/TCP                             5m22s
service/gloo                                  ClusterIP      10.76.6.206    <none>           9977/TCP,9976/TCP,9988/TCP,9966/TCP,9979/TCP,443/TCP   5m22s
service/gloo-fed-console                      ClusterIP      10.76.8.207    <none>           10101/TCP,8090/TCP,8081/TCP                            5m22s
service/glooe-grafana                         ClusterIP      10.76.3.207    <none>           80/TCP                                                 5m22s
service/glooe-prometheus-kube-state-metrics   ClusterIP      10.76.8.74     <none>           8080/TCP                                               5m22s
service/glooe-prometheus-server               ClusterIP      10.76.3.75     <none>           80/TCP                                                 5m22s
service/rate-limit                            ClusterIP      10.76.8.248    <none>           18081/TCP                                              5m22s
service/redis                                 ClusterIP      10.76.14.247   <none>           6379/TCP                                               5m22s

NAME                                                  READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/caching-service                       1/1     1            1           5m22s
deployment.apps/discovery                             1/1     1            1           5m22s
deployment.apps/extauth                               1/1     1            1           5m22s
deployment.apps/gateway-proxy                         1/1     1            1           5m22s
deployment.apps/gloo                                  1/1     1            1           5m22s
deployment.apps/gloo-fed                              1/1     1            1           5m22s
deployment.apps/gloo-fed-console                      1/1     1            1           5m22s
deployment.apps/glooe-grafana                         1/1     1            1           5m22s
deployment.apps/glooe-prometheus-kube-state-metrics   1/1     1            1           5m22s
deployment.apps/glooe-prometheus-server               1/1     1            1           5m22s
deployment.apps/observability                         1/1     1            1           5m22s
deployment.apps/rate-limit                            1/1     1            1           5m22s
deployment.apps/redis                                 1/1     1            1           5m22s

NAME                                                             DESIRED   CURRENT   READY   AGE
replicaset.apps/caching-service-5d7f867cdc                       1         1         1       5m22s
replicaset.apps/discovery-755c4f9f45                             1         1         1       5m22s
replicaset.apps/extauth-7c4c7f5999                               1         1         1       5m22s
replicaset.apps/gateway-proxy-59bf9f7d5f                         1         1         1       5m22s
replicaset.apps/gloo-7bb4dcf577                                  1         1         1       5m22s
replicaset.apps/gloo-fed-7b55f67c5d                              1         1         1       5m22s
replicaset.apps/gloo-fed-console-7c446775c                       1         1         1       5m22s
replicaset.apps/glooe-grafana-865bb9cd45                         1         1         1       5m22s
replicaset.apps/glooe-prometheus-kube-state-metrics-55ffc89cbb   1         1         1       5m22s
replicaset.apps/glooe-prometheus-server-7d5b85764c               1         1         1       5m22s
replicaset.apps/observability-7f8f5c549c                         1         1         1       5m22s
replicaset.apps/rate-limit-74d459bfb6                            1         1         1       5m22s
replicaset.apps/redis-57fd559c5c                                 1         1         1       5m22s

Looking for opened ports?

You will NOT have any open ports listening on a default install. For Envoy to open the ports and actually listen, you need to have a Route defined in one of the VirtualServices that will be associated with that particular Gateway/Listener. Please see the Hello World tutorial to get started.

NOT opening the listener ports when there are no listeners (routes) is by design with the intention of not over-exposing your cluster by accident (for security). If you feel this behavior is not justified, please let us know.

Uninstall

To uninstall Gloo Edge, you can use the glooctl CLI. If you installed Gloo Edge to a different namespace, include the -n option.

glooctl uninstall -n my-namespace

Make sure that your cluster has no other instances of Gloo Edge running, such as by running kubectl get pods --all-namespaces. If you remove the CRDs while Gloo Edge is still installed, you will experience errors.

glooctl uninstall --all

Next Steps

After you’ve installed Gloo Edge, please check out our User Guides.

As you continue to use Gloo Edge, remember to periodically upgrade your installation, CRDs, and glooctl CLI to get the latest features and security updates.