Helm Charts

​

Prerequisites:

• Access to a DNS record set
• Kubernetes cluster
• Install Kubernetes 1.16+
• Install Helm 3.1.0+
• Temporal Namespace (optional)

​

Overview of the Deployment Process

1. Install kubectl and helm on your local machine
2. Select required subdomains
3. Deploy the Cert-Manager Helm chart
4. Deploy the Multiwoven Helm Chart
5. Deploy additional (required) Nginx Ingress resources
6. Obtain the public IP address associated with your Nginx Ingress Controller
7. Create A records in your DNS record set that resolve to the public IP address of your Nginx Ingress Controller.
8. Wait for cert-manager to issue an invalid staging certificate to your K8s cluster
9. Switch letsencrypt-staging to letsencrypt-prod and upgrade Multiwoven again, this time obtaining a valid TLS certificate

​

Installing Multiwoven via Helm

Below is a shell script that can be used to deploy Multiwoven and its dependencies.

​

Chart Dependencies

​

Cert-Manager

Cert-Manager is used to automatically request, implement and rotate TLS certificates for your deployment. Enabling TLS is required.

​

Nginx-Ingress

Nginx-Ingress resources are added to provide the Multiwoven Ingress Controller with a external IP address.

​

Install Multiwoven

​

Environment Variables:

Generic

1. tls-admin-email-address -> the email address that will receive email notifications about pending automatic TLS certificate rotations

2. api-host -> api.your_domain (ex. api.multiwoven.com)

3. ui-host -> app.your_domain (ex. app.multiwoven.com)

Temporal - Please read the Notes section below

4. temporal-ui-host -> temporal.your_domain (ex. temporal.multiwoven.com)

5. temporalHost -> your Temporal Cloud host name (ex. my.personal.tmprl.cloud)

6. temporalNamespace -> your Temporal Namespace, verify within your Temporal Cloud account (ex. my.personal)

​

Notes:

• Deploying with the default In-cluster Temporal (recommended for Development workloads):
  1. Only temporal-ui-host is required. You should leave multiwovenConfig.temporalHost, temporal.enabled and multiwovenConfig.temporalNamespace commented out. You should also leave the temporal-cloud secret commented out as well.
• Deploying with Temporal Cloud (HIGHLY recommended for Production workloads):
  1. comment out or remove the flag setting multiwovenConfig.temporalUiHost
  2. Uncomment the flags setting multiwovenConfig.temporalHost, temporal.enabled and multiwovenConfig.temporalNamespace. Also uncomment the temporal-cloud secret.
  3. Before running this script, you need to make sure that your Temporal Namespace authentication certificate key and pem files are in the same directory as the script. We recommend renaming these files to temporal.key and temporal.pem for simplicity.
• Notice that for tlsCertIssuer, the value letsencrypt-staging is present. When the intial installation is done and cert-manager has successfully issued an invalid certificate for your 3 subdomains, you will switch this value to letsencrypt-prod to obtain a valid certificate. It is very important that you follow the steps written out here as LetsEncrypt’s production server only allows 5 attempts per week to obtain a valid certificate. This switch should be done LAST after you have verified that everything is already working as expected.

#### Pull and deploy the cert-manager Helm chart
cd charts/multiwoven
echo "installing cert-manager"
helm repo add jetstack https://charts.jetstack.io --force-update
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.14.5 --set installCRDs=true

#### Pull and deploy the Multiwoven Helm chart
echo "installing Multiwoven"
helm repo add multiwoven https://multiwoven.github.io/helm-charts
helm upgrade -i multiwoven multiwoven/multiwoven \
  --set multiwovenConfig.tlsAdminEmail=<tls-admin-email-address> \
  --set multiwovenConfig.tlsCertIssuer=letsencrypt-staging \
  --set multiwovenConfig.apiHost=<api-host> \
  --set multiwovenConfig.uiHost=<ui-host> \
  --set multiwovenWorker.multiwovenWorker.args={./app/temporal/cli/worker} \
  --set multiwovenConfig.temporalUiHost=<temporal-ui-host>
  # --set temporal.enabled=false \
  # --set multiwovenConfig.temporalHost=<temporal-host> \
  # --set multiwovenConfig.temporalNamespace=<temporal-namespace>

# kubectl create secret generic temporal-cloud -n multiwoven \
#     --from-file=temporal-root-cert=./temporal.pem \
#     --from-file=temporal-client-key=./temporal.key

# Install additional required Nginx ingress resources
echo "installing ingress-nginx resources"
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/cloud/deploy.yaml

​

Post Installation Steps

1. Run the following command to find the external IP address of your Ingress Controller. Note that it may take a minute or two for this value to become available post installation.

kubectl get svc -n ingress-nginx

2. Once you have this IP address, go to your DNS record set and use that IP address to create three A records, one for each subdomain. Below are a list of Cloud Service Provider DNS tools but please refer to the documentation of your specific provider if not listed below.

• Adding a new record in Azure DNS Zones
• Adding a new record in AWS Route 53
• Adding a new record in GCP Cloud DNS

3. Run the following command, repeatedly, until an invalid LetsEncrypt staging certificate has been issued for your Ingress Controller.

kubectl describe certificate -n multiwoven mw-tls-cert

When the certificate has been issued, you will see the following output from the command above.

We also encourage you to further verify by navigating to your subdomain, app.your_domain, and check the certificate received by the browser. You should see something similar to the image below:

Once the invalid certificate has been successfully issued, you are ready for the final steps.

4. Edit the shell script above by changing the tlsCertIssuer value from letsencrypt-staging to letsencrypt-prod and run the script again. Do not worry when you see Installation Failed for cert-manager, you are seeing this because it was installed on the intial run.

5. Repeat Post Installation Step 3 until a valid certificate has been issued. Once issued, your deployment is complete and you can navigate to app.your_domain to get started using Mutliwoven!

Happy Helming!

​

Helm Chart Environment Values

​

Multiwoven Helm Configuration

​

General Configuration

• kubernetesClusterDomain: The domain used within the Kubernetes cluster.
  • Default: cluster.local
• kubernetesNamespace: The Kubernetes namespace for deployment.
  • Default: multiwoven

​

Multiwoven Configuration

​

Multiwoven PostgreSQL Configuration

​

Multiwoven Server Configuration

​

Multiwoven Worker Configuration

​

Persistent Volume Claim (PVC)

​

Temporal Configuration

​

Temporal UI Configuration