How to deploy Theia Cloud on an existing Kubernetes cluster

[umar-shabbir]

I have access to a namespace within an internal Kubernetes cluster. This means I do not have permission to create a cluster or manage resources at the cluster scope. I want to deploy Theia cloud in the namespace I have access to within this cluster. Can someone give me hints on how to do it?
I was able to deploy Theia using docker image in this Kubernetes namespace and the browser example application worked fine. Now I am trying to do same for Theia Cloud.

I have explored Theia Cloud getting started guides. It contains information on how to deploy using Minikube where it also creates a new cluster.
Another thing I tried was to install the helm charts in my namespace as described here: https://github.com/eclipsesource/theia-cloud/blob/main/documentation/Install.md#install-the-last-release

Do I need to learn Terraform and write Terraform manifests code from scratch for Theia Cloud? In which I do not create a cluster and adjust it to use the existing one. There would be some other things which will change like certificate management. Or is there any simpler way to achieve this?

Any suggestions?

[sgraband]

Hey @umar-shabbir,

Using only the helm charts should be sufficient. You do not need to use terraform. It just automates the installation of helm charts.
What happened when you installed the Theia Cloud helm charts or were are you stuck?

If you have only access to one namespace it should not be a problem, but we would need to check your values. Because like you said, the certificate management might change. For example the question is also whether or not you need to run an ingress in the same namespace or if you can reuse one that is already existing.

If you can provide us more information about what your current problem is we might be able to spot the issue. General Note: Specific questions can always be answered more easily/quickly than broad questions.

Thanks for trying out Theia cloud.

[umar-shabbir]

@sgraband thanks for the reply.

Here are some specific details about this issue:
When I tried to install the cert manager and helm chart on our internal Kubernetes cluster, I got following errors:

1. Cannot list resource "clusterroles" in API group "rbac.authorization.k8s.io" at the cluster scope
2. Cannot list resource "clusterissuers" in API group "cert-manager.io" at the cluster scope

I contacted my IT support for these permissions and got following response:
"We don't provide cluster wide permission to customers. Can you explain more why the App needs needs clusterrole and cluster issuer permissions"

So, do you have any suggestion on how to make Theia cloud work without these permissions at cluster scope?

[sgraband]

Regarding the cluster issuer:
This one is used in order to hand out certificates to the ingress, landing-page and service. Theia Cloud creates a new ClusterIssuer by default with the theia-cloud-base helm chart.
However, you do not have to use (and create) that cluster issuer.
In the theia-cloud helm chart you can set the ingress.clusterIssuer value to the name of the ClusterIssuer you would like to use. This could either be one that it already provided by the cluster or you can try if you can create an Issuer in just your namespace (We do not have any experiences with this).
If you do not want to create the ClusterIssuer from the base chart you can simply make a local copy of the chart and remove the resource from the template folder.

Cluster roles:
These are used to define the capabilities of the operator and the service. So that they cannot alter everything on the cluster. Here again we do not have any experiences with single namespace setups, but you could try to change the ClusterRole kind to a Role then it should only apply to the workspace the helm chart is being created in (which of course should be then your namespace). Maybe this is enough to get your setup to work.

Let us now if this works for you. If this works and you think this is a common use case people will encounter, we will gladly review a contribution to make this configurable in the helm charts.