Amazon EKS

Prerequisites

An AWS account with permissions to create EKS, ECR, and networking resources.

A MongoDB Atlas subscription.

Two domain names: a regular one such as example.com, and a wildcard subdomain for proxy support such as *.proxy.example.com.

TLS certificates for those domains.

An identity provider, such as Okta, if you intend to use SAML.

An ingress controller, or a decision about which one to use. SecurSpaces cannot serve traffic without one, and only NetScaler CPX is deployed by the chart. See Ingress.

For sizing and supported versions, see System requirements.

Install the following tools:

Create an EKS cluster

Configure the AWS CLI with your credentials:

aws configure
<!--NeedCopy-->

Enter your AWS access key ID, secret access key, default region, and output format when prompted.

The reference sizing for around 500 developers is two m7i.2xlarge service nodes (8 vCPU, 32 GiB) and an autoscaling workspace pool of m7i.4xlarge (16 vCPU, 64 GiB). See Sizing.

Create the cluster:

eksctl create cluster \
  --name $MY_EKS_CLUSTER_NAME \
  --region $AWS_REGION \
  --nodegroup-name standard-nodes \
  --node-type m7i.2xlarge \
  --nodes 2 \
  --nodes-min 2 \
  --nodes-max 4 \
  --managed
<!--NeedCopy-->

Add a node group for workspaces, with autoscaling. Workspaces are the elastic part of the deployment, so give this group room to grow:

eksctl create nodegroup \
  --cluster $MY_EKS_CLUSTER_NAME \
  --region $AWS_REGION \
  --name workspace-nodes \
  --node-type m7i.4xlarge \
  --nodes 2 \
  --nodes-min 2 \
  --nodes-max 10 \
  --managed
<!--NeedCopy-->

Verify the connection:

kubectl get nodes
<!--NeedCopy-->

Create an Amazon ECR registry

SecurSpaces pulls its service images and your workspace images from a registry you control. The installer pushes them there in the next stage.

Create a repository for the platform images:

aws ecr create-repository \
  --repository-name strong-network \
  --image-scanning-configuration scanOnPush=true
<!--NeedCopy-->

Create a repository for workspace images:

aws ecr create-repository \
  --repository-name ws-images \
  --image-scanning-configuration scanOnPush=true
<!--NeedCopy-->

Authenticate Docker to the registry:

aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com
<!--NeedCopy-->

For a multi-region deployment, set up cross-region replication:

aws ecr put-replication-configuration \
  --replication-configuration '{"rules":[{"destinations":[{"region":"us-west-2","registryId":"$AWS_ACCOUNT_ID"}]}]}'
<!--NeedCopy-->

Create a MongoDB database

SecurSpaces stores its platform state in MongoDB. For what it holds and how large to expect it to grow, see The SecurSpaces database.

In MongoDB Atlas, open the database page and select Create.

Creating a MongoDB Service

Configure the deployment and select Create Deployment:

Select AWS as the cloud provider.
Choose the same region as the EKS cluster.
Select the M10 tier with autoscaling.

Creating a MongoDB Service

On the Database Access page, add a user.

Creating a MongoDB Service

On the Network Access page, allow your EKS cluster to reach the database. Add the CIDR blocks for the cluster VPC, or peer the VPC with Atlas, which is the more secure option.

Creating a MongoDB Service

You can also run MongoDB inside the cluster instead of using Atlas. See Configure an external database.

Prerequisites

Create an EKS cluster

Create an Amazon ECR registry

Create a MongoDB database

Next step

In this article

Amazon EKS

Prerequisites

Create an EKS cluster

Create an Amazon ECR registry

Create a MongoDB database

Next step

Related information

In this article