Kubernetes インストールガイド

kubectl create ns authlete

helm registry login -u <ORG_ID> -p <TOKEN> artifacts.authlete.com

# 安定版の最新バージョンは 2.1.6
helm pull oci://artifacts.authlete.com/authlete-platform-chart --version 2.1.6 --untar
cd authlete-platform-chart

# レジストリ認証用のシークレットを作成
kubectl create secret docker-registry authlete-registry \
-n authlete \
--docker-server=artifacts.authlete.com \
--docker-username=<ORG_ID> \
--docker-password=<TOKEN>

# デフォルトの ServiceAccount にこのシークレットを設定
kubectl patch serviceaccount default \
-n authlete \
-p '{"imagePullSecrets": [{"name": "authlete-registry"}]}'

# Authlete レジストリにログイン
docker login artifacts.authlete.com -u <ORG_ID> -p <TOKEN>

# イメージを取得
docker pull artifacts.authlete.com/<image>:<tag>

# タグを付けて自社レジストリにプッシュ
docker tag artifacts.authlete.com/<image>:<tag> registry.mycompany.com/<image>:<tag>
docker push registry.mycompany.com/<image>:<tag>

# 対象レジストリのベースを設定
TARGET_REGISTRY="ghcr.io/your-org-name"

# イメージコピーコマンド
crane cp artifacts.authlete.com/server:3.0.32 $TARGET_REGISTRY/server:3.0.33
crane cp artifacts.authlete.com/server-db-schema:v3.0.32 $TARGET_REGISTRY/server-db-schema:v3.0.33
crane cp artifacts.authlete.com/idp:1.0.27 $TARGET_REGISTRY/idp:1.0.28
crane cp artifacts.authlete.com/idp-db-schema:v1.0.27 $TARGET_REGISTRY/idp-db-schema:v1.0.28
crane cp artifacts.authlete.com/console:1.0.22 $TARGET_REGISTRY/console:1.0.23
crane cp artifacts.authlete.com/nginx:1.29.8 $TARGET_REGISTRY/nginx:1.29.8
crane cp artifacts.authlete.com/authlete-bootstrapper:1.1.0 $TARGET_REGISTRY/authlete-bootstrapper:1.2.1
crane cp artifacts.authlete.com/token-migrator:1.3 $TARGET_REGISTRY/token-migrator:1.3
crane cp artifacts.authlete.com/authlete-ops:0.1.0 $TARGET_REGISTRY/authlete-ops:0.1.0

global:
  id: "authlete-platform"
  repo: "registry.your-company.com"  # 必須: 自社のコンテナレジストリ

  # 必須: これらのドメインは利用者からアクセス可能である必要があります
  api: "api.your-domain.com"     # API サーバー
  idp: "login.your-domain.com"   # IDP サーバー
  console: "console.your-domain.com"  # 管理コンソール

kubectl create secret tls proxy-certs \
  --cert=./tls.crt \
  --key=./tls.key \
  -n authlete

cache:
  api:
    enabled: true
    provider: standalone
    auth:
      enabled: false
    connection:
      tls: true
      host: redis
      port: 6379
  idp:
    enabled: true
    provider: standalone
    auth:
      enabled: false
    connection:
      tls: true
      host: redis
      port: 6379

database:
  idp:  # IdP サーバーのデータベース
    name: idp
    type: mysql # mysql|postgres (defaults to mysql if unset)
    host: localhost
    connectionParams:
      allowPublicKeyRetrieval: true
      sslMode: verify-ca # ここで sslMode を設定
  api: # API サーバーのデータベース
    name: authlete
    type: mysql # mysql|postgres (defaults to mysql if unset)
    host: localhost
    connectionParams:
      allowPublicKeyRetrieval: true
      sslMode: verify-ca # ここで sslMode を設定

apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
  name: custom-ca-bundle
spec:
  sources:
  - useDefaultCAs: true

  # A manually specified PEM-encoded cert, included directly into the Bundle
  - inLine: |
      -----BEGIN CERTIFICATE-----
      MIIC5zCCAc+gAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
      ...
      ... contents of proxy's CA certificate ...
      -----END CERTIFICATE-----
  - inLine: |
      -----BEGIN CERTIFICATE-----
      ... contents of mysql's CA certificate ...
      -----END CERTIFICATE-----
  target:
    # All ConfigMaps will include a PEM-formatted bundle, here named "root-certs.pem"
    # and in this case we also request binary formatted bundles in PKCS#12 format,
    # here named "bundle.p12".
    configMap:
      key: "ca-bundle.crt"
    additionalFormats:
      pkcs12:
        key: "ca-bundle.p12"
    namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: "authlete" # Deployment namespace

kubectl create -f bundle-creation.yaml -n authlete

# Input/output directories
SRC="/certs"                                         # crt ファイルを配置する場所
DST="/usr/local/share/ca-certificates/custom"        # update-ca-certificates が監視するディレクトリ
OUT="/bundle"                                        # バンドルの出力先

# 出力ディレクトリをクリーンアップ
rm -f $OUT/*

# 出力ディレクトリを作成
mkdir -p "$DST"

# 必要なパッケージをインストール (Java の truststore 生成に ca-certificates-java が必要)
apt-get -y update
apt-cache madison ca-certificates
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends openssl default-jre-headless ca-certificates-java "ca-certificates=20230311+deb12u1"

# 1) 追加証明書の配置 (*.pem / *.crt を .crt として配置)
cp -v ${SRC}/* ${DST}/
# .pem も .crt として扱うため拡張子を統一したい場合は以下を有効化
# for f in "$DST"/*.pem; do mv -v "$f" "${f%.pem}.crt"; done

# 2) システム & Java truststore を更新
update-ca-certificates -f

# 3) 出力 (PEM と PKCS12)
cp -v /etc/ssl/certs/ca-certificates.crt "$OUT/ca-bundle.crt"
keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore $OUT/ca-bundle.p12 -deststoretype PKCS12 -srcstorepass changeit -deststorepass changeit

docker run --rm --user root -v "$PWD/certs:/certs:ro" -v "$PWD/out:/bundle" -v "$PWD/gen-bundles.sh:/usr/local/bin/gen-bundles.sh:ro" --entrypoint bash docker.io/library/debian:12-slim -c "sh /usr/local/bin/gen-bundles.sh"

kubectl create cm custom-ca-bundle --from-file=ca-bundle.p12 --from-file=ca-bundle.crt

  tls:
    caBundle:
      enabled: true # これを有効にする
      type: ConfigMap
      name: custom-ca-bundle
      trustStore:
        password: "changeit"

database:
  idp:  # IdP サーバーのデータベース
    user: authlete      # DB ユーザー
    password: !raw ***** # ユーザーパスワード
  api: # API サーバーのデータベース
    user: authlete
    password: !raw ******

idp:
  auth:
    adminUser:
      email: "admin@authlete.com"
      password: !raw ******
  encryptionSecret: ********

cache:
  api:
    enabled: true
    provider: standalone
    auth:
      enabled: false
    connection:
      tls: false
      host: redis
      port: 6379
  idp:
    enabled: true
    provider: standalone
    auth:
      enabled: false
    connection:
      tls: false
      host: redis
      port: 6379

cache:
  api:
    provider: cluster
  idp:
    provider: cluster

ops:
  cleanup:
    enabled: true
    schedule: "0 3 * * *"
    timezone: "Etc/UTC"

hsm:
  enabled: true
  provider: "google"
  google:
    projectId: "<replace-me>"         # required - e.g. "authlete-project-1"
    location: "<replace-me>"          # required - e.g. "us-west1-c"
  aws:
    region: ""

hsm:
  enabled: true
  provider: "aws"
  google:
    projectId: ""
    location: ""
  aws:
    region: "<replace-me>"          # required - e.g. "ap-northeast-1"

{
  "database": {
    "idp": {
      "user": "root",
      "password": "<placeholder-idp-db-password>"
    },
    "api": {
      "user": "root",
      "password": "<placeholder-api-db-password>"
    }
  },
  "idp": {
    "adminUser": {
      "email": "admin@authlete.com",
      "password": "mypassword"
    },
    "encryptionSecret": "<placeholder-random-secret>"
  },
  "api": {
    "shutdownToken": "<placeholder-api-shutdown-token>"
  }
}

{
  "database": {
    "idp": {
      "user": "root",
      "password": "<placeholder-idp-db-password>"
    },
    "api": {
      "user": "root",
      "password": "<placeholder-api-db-password>"
    }
  },
  "idp": {
    "adminUser": {
      "email": "admin@authlete.com",
      "password": "mypassword"
    },
    "encryptionSecret": "<placeholder-random-secret>"
  },
  "api": {
    "shutdownToken": "<placeholder-api-shutdown-token>"
  },
  "cache": {
    "api": {
      "auth": {
        "user": "default",
        "password": "<placeholder-api-cache-password>"
      }
    },
    "idp": {
      "auth": {
        "user": "default",
        "password": "<placeholder-idp-cache-password>"
      }
    }
  }
}

<ClusterSecretStore-name>をクラスターのClusterSecretStore名に置き換えてください。

kubectl apply -f - <<EOF
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: authlete-secret
  namespace: authlete
spec:
  refreshInterval: 30s
  secretStoreRef:
    kind: ClusterSecretStore
    name: <ClusterSecretStore-name>
  target:
    name: authlete-credentials
    creationPolicy: Owner
  data:
  # IDP Database
  - secretKey: authlete-idp-db-user
    remoteRef:
      key: authlete-secret
      property: database.idp.user
  - secretKey: authlete-idp-db-password
    remoteRef:
      key: authlete-secret
      property: database.idp.password
  # Cache Authが有効になっている場合
  - secretKey: authlete-api-memcache-auth-user
    remoteRef:
      key: authlete-secret
      property: cache.api.auth.user
  - secretKey: authlete-api-memcache-auth-password
    remoteRef:
      key: authlete-secret
      property: cache.api.auth.password
  - secretKey: authlete-idp-memcache-auth-user
    remoteRef:
      key: authlete-secret
      property: cache.idp.auth.user
  - secretKey: authlete-idp-memcache-auth-password
    remoteRef:
      key: authlete-secret
      property: cache.idp.auth.password
  # API Database
  - secretKey: authlete-api-db-user
    remoteRef:
      key: authlete-secret
      property: database.api.user
  - secretKey: authlete-api-db-password
    remoteRef:
      key: authlete-secret
      property: database.api.password
  # API Graceful Shutdown トークン
  # API Pod の preStop ライフサイクルフックが /api/lifecycle/shutdown を
  # 呼び出す際の Bearer 認証トークンです。32文字程度のランダム英数字を
  # 任意で生成し、外部シークレットマネージャーへ登録してください。
  - secretKey: authlete-api-shutdown-token
    remoteRef:
      key: authlete-secret
      property: api.shutdownToken
  # IDP Admin
  - secretKey: authlete-idp-admin-email
    remoteRef:
      key: authlete-secret
      property: idp.adminUser.email
  - secretKey: authlete-idp-admin-password
    remoteRef:
      key: authlete-secret
      property: idp.adminUser.password
  - secretKey: authlete-idp-encryption-secret
    remoteRef:
      key: authlete-secret
      property: idp.encryptionSecret
EOF

# 外部シークレットマネージャー上に証明書を保存する場合、JSONキーは下記のものと一致しているかご確認ください:
- `tls.crt` for the certificate chain
- `tls.key` for the private key

# 使用例:
{
  "tls.crt": "-----BEGIN CERTIFICATE-----\nMIIE...server-cert-data...==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIF...intermediate-cert...==\n-----END CERTIFICATE-----",
  "tls.key": "-----BEGIN PRIVATE KEY-----\nMIIE...private-key-data...==\n-----END PRIVATE KEY-----"
}

# TLS証明書の外部シークレットマネージャーへの移行は任意です。
# 移行しない場合は、「インストール手順 → 設定フェーズ → TLS証明書の設定のセクションに従ってTLS証明書を設定してください。

kubectl apply -f - <<EOF
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: authlete-proxy-secret
  namespace: authlete
spec:
  refreshInterval: 30s
  secretStoreRef:
  # <ClusterSecretStore-name>をクラスターのClusterSecretStore名に置き換えてください。
    kind: ClusterSecretStore
    name: <ClusterSecretStore-name>
  target:
    name: proxy-certs
    creationPolicy: Owner
  data:
  # TLS Certificates
  - secretKey: tls.crt
    remoteRef:
      key: authlete-proxy-secret
      property: tls.crt
  - secretKey: tls.key
    remoteRef:
      key: authlete-proxy-secret
      property: tls.key
EOF

global:
  externalSecrets:
    enabled: true  # ESMを有効化する場合は'true' | デフォルト値は'false'

global:
  apiAffinity: true

ops:
  cleanup:
    enabled: false

  configs:
    mapHashBucketSize: 128 # ここを調整
    serverNamesHashBucketSize: 128 # ここを調整

hooks:
  serviceAccount: ""
  idpDbSchemaUpgrade:
    enabled: true # 無効化可能
  serverDbSchemaUpgrade:
    enabled: true # 無効化可能

helm install authlete-platform . -n authlete -f secret-values.yaml

helm install authlete-platform . -n authlete

# Podのステータス確認
kubectl get pods -n authlete

NAME                       READY   STATUS    RESTARTS   AGE
api-6b78f87847-xxxxx       2/2     Running   0          2m
proxy-6c99bdc94b-xxxxx     1/1     Running   0          2m

helm upgrade authlete-platform . -n authlete -f secret-values.yaml

helm upgrade authlete-platform . -n authlete

# 新しい Pod のステータス確認
kubectl get pods -n authlete

NAME                       READY   STATUS    RESTARTS   AGE
console-6b78f87847-xxxxx   1/1     Running   0          2m
idp-6c99bdc94b-xxxxx       2/2     Running   0          2m

# GCP 固有のコマンド
# 静的 IP アドレスを予約
gcloud compute addresses create authlete-ip --region=us-central1

# 予約済み IP アドレスを取得
gcloud compute addresses describe authlete-ip --region=us-central1

apiVersion: v1
kind: Service
metadata:
  labels:
    app: proxy
  name: proxy-lb
spec:
  externalTrafficPolicy: Local
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: proxy
  sessionAffinity: None
  type: LoadBalancer
  loadBalancerIP: #external_static_ip  # ここに予約済みの静的 IP を入力

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-eip-allocations: eipalloc-xxxxxxxxxxxxxxxxx  # Replace with your EIP allocation ID
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-subnets: subnet-xxxxxxxxx  # Replace with your subnet ID
    service.beta.kubernetes.io/aws-load-balancer-type: external
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
  labels:
    app: proxy
  name: proxy-lb
spec:
  externalTrafficPolicy: Local
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8443
  selector:
    app: proxy
  sessionAffinity: None
  type: LoadBalancer

kubectl apply -f proxy-lb-service.yaml -n authlete

kubectl get service proxy-lb -n authlete

NAME       TYPE           CLUSTER-IP      EXTERNAL-IP          PORT(S)         AGE
proxy-lb   LoadBalancer   10.x.x.x        YOUR_STATIC_IP       443:32xxx/TCP   1m

# API サーバー
api.your-domain.com.     IN  A     YOUR_STATIC_IP

# IDP サーバー
login.your-domain.com.   IN  A     YOUR_STATIC_IP

# 管理コンソール
console.your-domain.com. IN  A     YOUR_STATIC_IP

# DNS 設定のテスト
dig +short api.your-domain.com
dig +short login.your-domain.com
dig +short console.your-domain.com

# HTTPS エンドポイントのテスト
curl -I https://api.your-domain.com/api/info

tokenmigrator:
  clientSecret: ""            # クライアントシークレット
  serviceApiKey: ""           # Authlete v3.0サービスID
  serviceToken: ""            # Authlete v3.0サービスアクセストークン

tokenmigrator:
  database:
    user: root                # 移行元（v2.3）データベースのユーザー名
    password: !raw example**  # 移行元（v2.3）データベースのパスワード

{
  "database": {
    "idp": {
      "user": "root",
      "password": "<placeholder-idp-db-password>"
    },
    "api": {
      "user": "root",
      "password": "<placeholder-api-db-password>"
    }
  },
  "idp": {
    "adminUser": {
      "email": "admin@authlete.com",
      "password": "mypassword"
    },
    "encryptionSecret": "<placeholder-random-secret>"
  },
  "tokenmigrator": {
    "datasource-username": "<placeholder-source-database-user>",
    "datasource-password": "<placeholder-source-database-password>",
    "client-secret": "<placeholder-client-secret>",
    "service-api-key": "<placeholder-service-id>",
    "service-token": "<placeholder-service-token>"
  }
}

kubectl apply -f - <<EOF
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: authlete-secret
  namespace: authlete
spec:
  refreshInterval: 30s
  secretStoreRef:
  # クラスターのClusterSecretStore名に置き換えてください
    kind: ClusterSecretStore
    name: <ClusterSecretStore-name>
  target:
    name: authlete-credentials
    creationPolicy: Owner
  data:
  # IDPデータベース
  - secretKey: authlete-idp-db-user
    remoteRef:
      key: authlete-secret
      property: database.idp.user
  - secretKey: authlete-idp-db-password
    remoteRef:
      key: authlete-secret
      property: database.idp.password
  # APIデータベース
  - secretKey: authlete-api-db-user
    remoteRef:
      key: authlete-secret
      property: database.api.user
  - secretKey: authlete-api-db-password
    remoteRef:
      key: authlete-secret
      property: database.api.password
  # IDP管理者
  - secretKey: authlete-idp-admin-email
    remoteRef:
      key: authlete-secret
      property: idp.adminUser.email
  - secretKey: authlete-idp-admin-password
    remoteRef:
      key: authlete-secret
      property: idp.adminUser.password
  - secretKey: authlete-idp-encryption-secret
    remoteRef:
      key: authlete-secret
      property: idp.encryptionSecret
  # トークン移行ツールのシークレット
  - secretKey: authlete-client-secret
    remoteRef:
      key: authlete-secret
      property: tokenmigrator.client-secret
  - secretKey: authlete-service-api-key
    remoteRef:
      key: authlete-secret
      property: tokenmigrator.service-api-key
  - secretKey: authlete-service-token
    remoteRef:
      key: authlete-secret
      property: tokenmigrator.service-token
  - secretKey: authlete-source-datasource-username
    remoteRef:
      key: authlete-secret
      property: tokenmigrator.datasource-username
  - secretKey: authlete-source-datasource-password
    remoteRef:
      key: authlete-secret
      property: tokenmigrator.datasource-password

tokenmigrator:
  enabled: true
  mode: dryrun # dryrun（検証・書き込みなし） | sync（実移行）