Important

For the production environment, a separate X-Road Security Server must be deployed on separate infrastructure (physical or virtual), with its own IP address and DNS name, different from those of the test environment.

Please do not use the test environment's Security Server, or its IP address or DNS name, for production. The Security Servers of the test and production environments, and their corresponding network identifiers, must be kept separate.

Alongside the transition to the production environment, the test infrastructure must be maintained and continue to operate for testing purposes.

Kubernetes deployment using Helm Chart

To deploy the Security Server using the Helm chart, clone the X-Road-Helm Git repository and go to the helm/security-server folder.

In that folder, we need to edit the values.yaml file of the chart to:

1. Set the Security Server version to 7.8.2.

image:
  ...
  repository: "docker.registry.del.am/xroad-security-server-sidecar"
  primaryTag: "7.8.2-primary-am"
  secondaryTag: "7.8.2-secondary-am"

Production instance only

For production deployments, also point the chart to the ADEL production registry and use the production image tags:

image:
  ...
  repository: "docker.registry.del.am/xroad-security-server-sidecar"
  primaryTag: "7.8.2-primary-am"
  secondaryTag: "7.8.2-secondary-am"

This is only required for production deployments. For the test instance, leave the default repository and use the tags shown above.

2. Set the Security Server PIN and create the first admin user (from the Kubernetes Secret).

envSecretName: ${XROAD-USER-SECRET}

Where XROAD-USER-SECRET is a pre-created Kubernetes Secret that must contain the following keys: - XROAD_TOKEN_PIN - XROAD_ADMIN_USER - XROAD_ADMIN_PASSWORD

The XROAD_TOKEN_PIN must be a passphrase with upper and lower case letters, symbols, and numbers (minimum length is 10).

3. Provide the database secret with the superuser password (from the Kubernetes Secret).

dbHost: "your-db-hostname"
dbSecretName: {XROAD-DB-SECRET}

Where XROAD-DB-SECRET is a pre-created Kubernetes Secret that must contain the password key with the postgres user’s password as the value.

4. Provide the SSH keys so the secondary pods can synchronize their configuration from the primary pod.

sshSecretName: ${XROAD-SSH-SECRET}

Where XROAD-SSH-SECRET is a pre-created Kubernetes Secret that must contain the following keys:

• private-key
• public-key

5. Apply Helm chart

At the end, adjust the PVC volume sizes and service type if necessary. The defaults are:

serviceType: NodePort
...
etcVolumeSize: 100Mi
libVolumeSize: 1000Mi

And deploy to the cluster using the following command:

helm install security-server -n ${NAMESPACE} -f helm/security-server/values.yaml helm/security-server 

Where NAMESPACE is the Kubernetes namespace to deploy the Security Server into.

Once deployed, follow the instructions in the X-Road Security Server Configuration Guide to continue the installation.