PrivateEdition/Current/TenantPEGuide/Deploy - Revision history

WikiSysop at 18:15, September 30, 2022

2022-09-30T18:15:57Z

WikiSysop at 18:00, September 30, 2022

2022-09-30T18:00:49Z

Corinneh: Published

2022-03-21T17:39:00Z

Published

Corinneh: Published

2022-02-07T18:59:21Z

Published

Ed.jamer@genesys.com: Text replacement - "Genesys Engage [cC]loud" to "Genesys Multicloud CX"

2021-11-09T20:29:58Z

Text replacement - "Genesys Engage [cC]loud" to "Genesys Multicloud CX"

Corinne.hicks@genesys.com: Published

2021-11-01T18:01:36Z

Published

Show changes

Corinne.hicks@genesys.com: Published

2021-06-30T20:38:32Z

Published

New page

{{Article
|Standalone=No
|DisplayName=Deploy the Tenant Service
|Context=Learn how to deploy the Tenant Service.
|ComingSoon=No
|Section={{Section
|alignment=Vertical
|structuredtext={{NoteFormat|Make sure to review {{Link-SomewhereInThisVersion|topic=Planning}} for the full list of prerequisites required to deploy the Tenant Service.|}}
For solution-level deployment information, see {{SuiteLevelLink|openshift}}.
|Status=No
}}{{Section
|sectionHeading=Deployment scenarios
|anchor=Scenarios
|alignment=Vertical
|structuredtext=More than one deployment scenario is supported, including single region, redundant and multi-region deployment, and multi-tenant deployment.

===Single region/location/cluster===
You deploy Tenant resources in a single Azure Kubernetes Service (AKS) cluster within the same or separate namespace (project) with the Voice platform. If shared resources are being deployed across all tenants, they must also be added to the same target namespace.

Before proceeding with the Tenant(s) deployment at a location, the following features are required:

* POD Monitor for all tenant pods
* FluentBit logging framework

The deployment must include the '''tenant-monitor''' module execution at a location, as described in {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=locationspecificdeploy|display text=tenant-monitor}}.

====Single tenant====

=====Basic deployment=====
Single-node deployment requires a single override file and one "tenant" module to deploy, with reference implementation described at {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=servicespecificdeploy|display text=Single service at one location}}.

Mandatory parameters for basic installation are:

*tenant uuid (v4)
*tenant nickname (becomes a Helm release name)
*all {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=backend|display text=backend parameters}} (along with all secrets that may be required based on these parameters)

To increase the number of nodes, adjust the '''node count''' parameter. For more information, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}.

=====Upgrade=====
The upgrade can be performed by re-running deployment with the same mandatory parameters and adjusted version of tenant image(s) and Helm charts. The upgrade is performed automatically, one node at a time (if '''node count''' is > 1). The update of the tenant configuration may happen automatically upon upgrade of the primary node. Genesys recommends performing a backup of the backend database for a Tenant Service before upgrading.

====Multiple tenants at one location====

=====Basic deployment=====
Additional tenants can be deployed at the same location with following guidelines:

*Each Tenant Service must have a unique tenant uuid, shortid, and nickname.
*Each Tenant Service is deployed or upgraded and adjusted independently.
|Status=No
}}{{Section
|alignment=Vertical
|structuredtext====Multiple regions/locations/clusters===

====Basic deployment====
In multi-regional/multi-location deployments, one region/location is considered "master" (from a tenant perspective) and includes the database backend with write capabilities. Other regions/locations have replicas of the database backend in read-only mode. A Tenant Service at each location may be deployed to have one of its nodes running as master (write access to provisioning data via config API) or have all its nodes running only as replicas (read access to configuration).

Multi-regional deployments have to be done according to these steps (with pre-requisites already satisfied at each region/location):

*If required, deploy the '''tenant-monitor''' module at a location planned as a master tenant node.
*Complete basic deployment of a Tenant Service in the master region, including specification of DR parameters for master, as per {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}.
*Complete deployment of the database backend with replica of master database at location(s) where replica tenant nodes are expected to run, including provisioning of access keys/secrets to access local replica.
*If required, deploy the '''tenant-monitor''' module at location(s) , where replicas are expected to run.
*Complete basic tenant deployment for additional region(s) and specify DR parameters for a master region (see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}).

The same customization scenarios discussed for tenant nodes can be applied for each location independently.

====Upgrade====
Can be performed by re-running deployment with the same mandatory parameters and adjusted version of tenant image(s) and helm charts for every location. Update of tenant configuration may happen automatically upon upgrade of master node in master region. It is recommended to perform back up of the backend database for a Tenant Service before upgrading the master region.
|Status=No
}}{{Section
|sectionHeading=Deploy the service
|anchor=DeployService
|alignment=Vertical
|structuredtext=This section provides reference commands with key parameters that are required to complete each deployment step.
===Prerequisite===
Before proceeding with the Tenant Service deployment, ensure you have completed procedures in the {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=ConfigSecurity|display text=Configure security}} section of this guide.
{{AnchorDiv|locationspecificdeploy}}

===Location-specific deployment steps===
====tenant-monitor====
Monitoring/logging shared configuration and infrastructure deployment:<source lang="text">
helm upgrade --install --force --wait --timeout 600s -n voice tenant-monitor https://<jfrog artifactory/helm location>/tenant-monitor-$TENANT_MANIFEST_VERSION.tgz --username "$JFROG_USER" --password "$JFROG_PASSWORD"
</source>To enable fluent bit logging and Prometheus monitoring, the following overrides can be used with tenant-monitor:<source lang="text">
prometheus:
podMonitor:
create: "true"

fluent:
enable: "true"
</source>Enable Persistent Volume Claim to store tenant logs, then the following overrides can be used with tenant-monitor (logStorageClass must be provided by the infrastructure team):<source lang="text">
tenant:
logging:
volume:
enabled: "true"
createSC: "false"
createpvClaim: "true"
logClaim: "tenant-logs-pvc"
logClaimSize: "5Gi"
logStorageClass: "azure-files"
Storageprovisioner: "TBD OC provosioner"
parameters: {}
</source>
{{AnchorDiv|servicespecificdeploy}}

===Service-specific deployment steps===
====Single service at one location====
A single-service deployment can be implemented with these sample parameters in '''tenant-node-values.yaml''':<source lang="text">
tenantid: 9350e2fc-a1dd-4c65-8d40-1f75a2e080dd

replicaCount: 1
pgdb:
dbhost: "/opt/genesys/dbserver/dbserver"
dbuser: "/opt/genesys/dbuser/dbuser"
dbname: "/opt/genesys/dbname/dbname"
pgpwdSecretName: "/opt/genesys/dbpassword/dbpassword"
usesecret: "true"

pullSecrets: mycred

image:
registry: <docker-repo>
tag: <version of tenant service>

initcontianer:
registry: <docker-repo>
tag: <version of tenant service>

addonpulseinitcontainer:
registry: <docker-repo>
tag: <version of tenant service>
enable: "true"
pulsemode: "setup"

rcsinitcontianer:
enable: "true"
registry: <docker-repo>
tag: <version of roles service batch image>

resources:
limits:
cpu: "2"
memory: 4Gi
requests:
cpu: "1"
memory: 1Gi

containerSecurityContext:
readOnlyRootFilesystem: false
runAsNonRoot: true
runAsUser: 500
runAsGroup: 500

service:
type: ClusterIP

tenant:
serviceuser: "default"
serviceuserpwd: "<random-password-string>"
consul:
acl:
usetoken: "true"
token: "/opt/genesys/consul-shared-secret/consul-consul-voice-token"

volumes: |
- name: fluent-logs
emptyDir: {}
- name: tenants-fluent-bit-config
configMap:
name: tenants-fluent-bit-config
- name: consul-shared-secret
secret:
secretName: consul-voice-token
- name: dbserver
secret:
secretName: dbserver
- name: dbname
secret:
secretName: dbname
- name: dbuser
secret:
secretName: dbuser
- name: dbpassword
secret:
secretName: dbpassword
- name: redis-config-secret
secret:
defaultMode: 420
secretName: redis-config-token
- name: kafka-secrets
secret:
defaultMode: 420
secretName: kafka-secrets-token
- name: redis-tenant-secret
secret:
defaultMode: 420
secretName: redis-tenant-token

volumeMounts: |
- name: fluent-logs
mountPath: "/opt/genesys/logs/JSON"
- name: consul-shared-secret
readOnly: true
mountPath: "/opt/genesys/consul-shared-secret"
- name: dbserver
readOnly: true
mountPath: "/opt/genesys/dbserver"
- name: dbname
readOnly: true
mountPath: "/opt/genesys/dbname"
- name: dbuser
readOnly: true
mountPath: "/opt/genesys/dbuser"
- name: dbpassword
readOnly: true
mountPath: "/opt/genesys/dbpassword"
- name: redis-config-secret
readOnly: true
mountPath: "/opt/genesys/redis-config-secret"
- name: redis-tenant-secret
readOnly: true
mountPath: "/opt/genesys/redis-tenant-secret"
- name: kafka-secrets
readOnly: true
mountPath: "/opt/genesys/kafka-secrets"

initVolumeMounts: |
- name: consul-shared-secret
readOnly: true
mountPath: "/opt/genesys/consul-shared-secret"
- name: dbserver
readOnly: true
mountPath: "/opt/genesys/dbserver"
- name: dbname
readOnly: true
mountPath: "/opt/genesys/dbname"
- name: dbuser
readOnly: true
mountPath: "/opt/genesys/dbuser"
- name: dbpassword
readOnly: true
mountPath: "/opt/genesys/dbpassword"

gws:
enabled: "false"

redis:
enabled: "true"
port: 6379
isCluster: true
usesecret: "true"
usesecretenv: "false"
redisCacheSecretName: "/opt/genesys/redis-config-secret/redis-config-state"
redisTenantSecretName: "/opt/genesys/redis-tenant-secret/redis-tenant-stream"

kafka:
enabled: "true"
usesecret: "true"
usesecretenv: "false"
kafkaSecretName: "/opt/genesys/kafka-secrets/kafka-secrets"

serviceAccount:
create: true
</source>In addition, use the following deployment command:<source lang="text">
helm upgrade --install --force --wait --timeout 600s -n voice -f ./tenant-node-values.yaml tenant<shortid> https://<jfrog artifactory/helm location>/tenant-<helm version>.tgz --username "$JFROG_USER" --password "$JFROG_PASSWORD"
</source>Above deployment will create a Tenant with the password of the service account set up explicitly and without enabling GWS integration. See {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=SamplesReferences|display text=Samples and references}} for values that allow you to reset the Tenant password upon deployment using a pre-generated value from the secret and to enable automated GWS integration.
|Status=No
}}{{Section
|sectionHeading=Deploy in OpenShift
|anchor=DeployinOpenshift
|alignment=Vertical
|structuredtext={{Notices|Notice=PEComingSoon}}
|Status=No
}}{{Section
|sectionHeading=Samples and references
|anchor=SamplesReferences
|alignment=Vertical
|structuredtext=Enabling a service admin password (the secret should be created as described in the {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=servicespecificsecrets|display text=Service account password}} section):
<source lang="text">
...
tenant:
serviceuser: "default"
svcpwdSecretName: "/opt/genesys/service-user-account/svcpassword"
...
volumes: |
- name: service-user-account
secret:
secretName: svcuseraccount
...
volumeMounts: |
- name: service-user-account
readOnly: true
mountPath: "/opt/genesys/service-user-account"
....
initVolumeMounts: |
- name: service-user-account
readOnly: true
mountPath: "/opt/genesys/service-user-account"
....
</source>
Enabling GWS integration (the secret should be created as described in the {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=servicespecificsecrets|display text=Genesys Authentication backend secrets}} section):
<source lang="text">
...
gws:
enabled: "true"
usesecret: "true"
gwsuserSecretName: "/opt/genesys/gauth-client-id/clientid"
gwspwdSecretName: "/opt/genesys/gauth-client-token/clientsecret"

tenant:
...
volumes: |
- name: gauth-client-id
secret:
secretName: gauthclientid
- name: gauth-client-token
secret:
secretName: gauthclientsecret
....

volumeMounts: |
- name: gauth-client-id
readOnly: true
mountPath: "/opt/genesys/gauth-client-id/clientid"
- name: gauth-client-token
readOnly: true
mountPath: "/opt/genesys/gauth-client-token/clientsecret"
....
initVolumeMounts: |
- name: gauth-client-id
readOnly: true
mountPath: "/opt/genesys/gauth-client-id/clientid"
- name: gauth-client-token
readOnly: true
mountPath: "/opt/genesys/gauth-client-token/clientsecret"
....
</source>
Mount Persistent Volume Claim to store Tenant logs, then add the following override values in '''tenant-node-values.yaml''':
<source lang="text">
.....

tenant:
...
volumes: |
...

- name: log
persistentVolumeClaim:
claimName: tenant-logs-pvc

...

volumeMounts: |
.....

- mountPath: /opt/genesys/logs/volume
name: log
- mountPath: /logs
name: log

......

initVolumeMounts: |
........

- mountPath: /opt/genesys/logs/volume
name: log
- mountPath: /logs
name: log

.....
</source>
|Status=No
}}{{Section
|sectionHeading=Validate the deployment
|anchor=Validate
|alignment=Vertical
|structuredtext={{Notices|Notice=PEComingSoon}}
|Status=No
}}
|PEPageType=45d1441f-dc69-4a17-bd47-af5d811ce167
}}

@@ Line 1: / Line 1: @@
-{{Article
+{{ArticlePEServiceDeploy
-|Standalone=No
+|ServiceId=c4749716-a442-4050-ab1a-ca34e082b5c0
-|DisplayName=Deploy the Tenant Service
+|IncludeAssumptions=Yes
 |Section={{Section
 |alignment=Vertical
-|structuredtext={{NoteFormat|Make sure to review {{Link-SomewhereInThisVersion|topic=Planning}} for the full list of prerequisites required to deploy the Tenant Service.|}}
+|structuredtext=For an overview of solution-level deployment, see {{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|topic=GetStarted|display text=Deployment tasks summary}}.
 |Status=No
 }}{{Section
@@ Line 13: / Line 10: @@
 |anchor=Scenarios
 |alignment=Vertical
-|structuredtext=More than one deployment scenario is supported, including single region, redundant, and multi-region deployment as well as multi-Tenant deployment.
+|structuredtext=More than one deployment scenario is supported for Tenant Service, including single region, redundant, and multi-region deployment as well as multi-Tenant deployment.
 ===Single region/location/cluster===
@@ Line 29: / Line 26: @@
 ====Single Tenant: Basic deployment====
 Single-node deployment requires a single override file and one "tenant" module to deploy, with reference implementation described at {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=servicespecificdeploy|display text=Single service at one location}}.
 To increase the number of nodes, adjust the '''node count''' parameter. For more information, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}.
 ====Upgrade====
-An upgrade can be performed by re-running deployment with the same mandatory parameters and adjusted version of Tenant image(s) and Helm charts. The upgrade is performed automatically, one node at a time (if '''node count''' is > 1). The update of the Tenant configuration may happen automatically when the primary node is upgraded. Genesys recommends performing a backup of the backend database for a Tenant Service before upgrading.
+For information about upgrading Tenant Service, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Upgrade|display text=Upgrade, rollback, or uninstall the Tenant Service}}.
 ====Multiple Tenants at one location: Basic deployment====
@@ Line 56: / Line 47: @@
 *If required, deploy the '''tenant-monitor''' module at a location planned as a Master Tenant node.
 *Complete the basic deployment of a Tenant Service in the Master region, including specification of DR parameters for the Master, as per {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}.
-*Complete the deployment of the database backend with replica of the Master database at location(s) where the replica Tenant nodes are expected to run, including provisioning of access keys/secrets to access the local replica.
+*Complete the deployment of the database backend with a replica of the Master database at the location(s) where the replica Tenant nodes are expected to run, including provisioning of access keys/secrets to access the local replica.
 *If required, deploy the '''tenant-monitor''' module at location(s) where replicas are expected to run.
 *Complete the basic Tenant deployment for additional region(s) and specify DR parameters for the Master region (see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=scalabilityparams|display text=Scalability and redundancy parameters}}).
@@ Line 63: / Line 54: @@
 ====Upgrade====
-An upgrade can be performed by re-running the deployment with the same mandatory parameters and adjusted version of the Tenant image(s) and Helm charts for every location. Update of the tenant configuration may happen automatically when the Master node in the Master region is upgraded. Genesys recommends performing a backup of the backend database for a Tenant Service before you upgrade the Master region.
+For information about upgrading Tenant Service, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Upgrade|display text=Upgrade, rollback, or uninstall the Tenant Service}}.
 |Status=No
 }}{{Section
@@ Line 72: / Line 63: @@
 On this page, the '''tenant-values.yaml''' file refers to the '''values.yaml''' file in the Tenant Helm chart. Likewise, the '''tenant-monitor-values.yaml''' file refers to the '''values.yaml''' file in the Tenant Monitor Helm chart.
-===Prerequisite===
+{{AnchorDiv|initdeployprereqs}}
 Before proceeding with the Tenant Service deployment, ensure you have completed procedures in the {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=ConfigSecurity|display text=Configure security}} section of this guide.
 {{AnchorDiv|locationspecificdeploy}}
@@ Line 173: / Line 174: @@
          logClaimSize: "5Gi"
          accessModes: "ReadWriteOnce"
-         logStorageClass: "<storage class>"   #Replace the storage class that's relevant to the Openshift Cluster
+         logStorageClass: "<storage class>"   #Replace the storage class with a relevant storage class for the cluster type
      mounts:
@@ Line 283: / Line 284: @@
 </source>
-In addition, use the following deployment command:
+In addition, use the following deployment command: <!--The command was updated as requested in CPE-2912.-->
 <source lang="text">

@@ Line 7: / Line 7: @@
 |alignment=Vertical
 |structuredtext={{NoteFormat|Make sure to review {{Link-SomewhereInThisVersion|topic=Planning}} for the full list of prerequisites required to deploy the Tenant Service.|}}
-<!-- <div style="background-color: aliceblue; font-style: italic;">Include a link to the "suite-level" documentation that describes the particular cloud platform - for the initial Genesys Multicloud CX private edition release, this is OpenShift: {{SuiteLevelLink|openshift}}
+<!--For solution-level deployment information, see {{SuiteLevelLink|openshift}}.-->
 |Status=No
 }}{{Section
@@ Line 135: / Line 123: @@
 ===Service-specific deployment steps: Single service at one location===
-A PostgreSQL database must be available for the Tenant Service before you begin the service deployment. For additional information about the database requirements, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Planning|anchor=ThirdParty|display text=Third-party prerequisites}}. In addition, after the PostgreSQL database is deployed and before you deploy the Tenant Service, you must configure secrets that contain values for certain PostgreSQL database parameters. To configure the secrets, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=servicespecificsecrets|display text=Service-specific secrets}}.
+A PostgreSQL database must be available for the Tenant Service before you begin the service deployment. For more information about the database requirements, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Planning|anchor=ThirdParty|display text=Third-party prerequisites}}. In addition, after the PostgreSQL database is deployed and before you deploy the Tenant Service, you must configure secrets that contain values for certain PostgreSQL database parameters. To configure the secrets, see {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Configure|anchor=servicespecificsecrets|display text=Service-specific secrets}}.
 Use the following template if you are deploying with the tenant Helm chart. A single-service deployment can be implemented with the following sample parameters in the '''tenant-values.yaml''' file:

@@ Line 28: / Line 28: @@
 ===Single region/location/cluster===
-You deploy Tenant resources in a single Kubernetes cluster within the same or separate namespace (project) with the Voice platform. If shared resources are being deployed across all tenants, they must also be added to the same target namespace.
+You deploy Tenant resources in a single Kubernetes cluster within the same or separate namespace (project) with the Voice platform. If shared resources are being deployed across all Tenants, they must also be added to the same target namespace.
 If you plan to use Prometheus monitoring or Fluent Bit logging framework for Tenant, you must execute the '''tenant-monitor''' module, as described in {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=locationspecificdeploy|display text=tenant-monitor}}. The module enables the following features:
@@ Line 38: / Line 42: @@
 Single-node deployment requires a single override file and one "tenant" module to deploy, with reference implementation described at {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=servicespecificdeploy|display text=Single service at one location}}.
-Mandatory parameters for basic installation are:
+{{AnchorDiv|mandatoryparams}}Mandatory parameters for basic installation are:
 *tenant uuid (v4)
@@ Line 131: / Line 135: @@
 ===Service-specific deployment steps: Single service at one location===
 Use the following template if you are deploying with the tenant Helm chart. A single-service deployment can be implemented with the following sample parameters in the '''tenant-values.yaml''' file:
@@ Line 168: / Line 174: @@
      dbhost: "/opt/genesys/dbserver/dbserver"
      dbuser: "/opt/genesys/dbuser/dbuser"
-     dbname: "/opt/genesys/dbnamet102/dbname"
+     dbname: "/opt/genesys/dbname/dbname"
    securityContext:
      fsGroup: 0
@@ Line 199: / Line 205: @@
            secret:
              secretName: dbserver
-         - name: dbnamet102
+         - name: dbname
            secret:
              secretName: dbname
@@ Line 212: / Line 218: @@
            readOnly: true
            mountPath: "/opt/genesys/dbserver"
-         - name: dbnamet102
+         - name: dbname
            readOnly: true
            mountPath: "/opt/genesys/dbname"
@@ Line 289: / Line 295: @@
 </source>
-In addition, use the following deployment command:<source lang="text">
+In addition, use the following deployment command:
-helm upgrade --install --force --wait --timeout 600s -n voice -f ./tenant-node-values.yaml tenant<shortid> https://<jfrog artifactory/helm location>/tenant-<helm version>.tgz --username "$JFROG_USER" --password "$JFROG_PASSWORD"
-</source>The preceding deployment will create a Tenant with the password of the service account set up explicitly and without enabling GWS integration. See {{Link-SomewhereInThisVersion|manual=TenantPEGuide|topic=Deploy|anchor=enablegws|display text=Samples and references}} for values that allow you to reset the Tenant password upon deployment using a pre-generated value from the secret and to enable automated GWS integration.
+<source lang="text">
 |Status=No
 }}{{Section
@@ Line 361: / Line 373: @@
        jsonLog:
          - name: fluent-logs
            emptyDir: {}
        stdoutUrsLog: