Adding docs for restricted cluster setup for SAP EIC

Author: Suse-KevinKlinger

adoc/SAP-EIC-General.adoc

@@ -7,16 +7,13 @@ https://help.sap.com/docs/integration-suite?locale=en-US and search for the "Edg
 # end::disclaimer-EIC-sizing[]
 
 
-
 # tag::disclaimer-production-versions[]
-IMPORTANT: If you want to use different versions of {slem} or {slm}, {rancher}, {rke}, or {lh}, make sure to check the support matrix for the related solutions you want to use:
+If you want to use different versions of {slem} or {slm}, {rancher}, {rke}, or {lh}, make sure to check the support matrix for the related solutions you want to use:
 https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/ +
 For {redis} and {pg}, make sure to pick versions compatible to {eic}, which can be found at https://me.sap.com/notes/3247839 . +
-Other versions of {metallb} or {cm} can be used, but they may not have been tested. 
 
 # end::disclaimer-production-versions[]
 
-
 # tag::self-signed-certificates[]
 
 [#selfSignedCertificates]

adoc/SAP-EIC-Harvester-main-docinfo.xml

@@ -67,6 +67,16 @@
             <orgname>SUSE</orgname>
         </affiliation>
     </author>
+    <author>
+        <personname>
+            <firstname>Felipe</firstname>
+            <surname>Vieira</surname>
+        </personname>
+        <affiliation>
+            <jobtitle>SAP Solution Software Engineer</jobtitle>
+            <orgname>SUSE</orgname>
+        </affiliation>
+    </author>
 </authorgroup>
 
 <cover role="logos">

adoc/SAP-EIC-Harvester-main.adoc

@@ -57,9 +57,17 @@ The support matrix below outlines the versions of the software we will be using
 |{cm} | {cm_version}
 |{pg} | {pg_version}
 |{redis} | {redis_version}
+|{istio} | {istio_version}
+|{kiali} | {kiali_version}
+|{prometheus} | {prometheus_version}
+|{grafana} | {grafana_version}
 |===
 
+[IMPORTANT]
+====
 include::SAP-EIC-General.adoc[tags=disclaimer-production-versions]
+Other versions of {cm} can be used, but they may not have been tested. 
+====
 
 ++++
 <?pdfpagebreak?>
@@ -241,7 +249,7 @@ in a Kubernetes cluster in the following chapter.
 
 == Installing the mandatory databases
 
-In the following chapter, we provide an example for setting up {metallb}, {redis} and {pg}.
+In the following chapter, we provide an example for setting up {redis} and {pg}.
 
 NOTE: Keep in mind that the descriptions and instructions provided may differ from the 
 deployment requirements for your specific infrastructure and use cases.
@@ -270,6 +278,40 @@ https://me.sap.com/notes/3247839 are met.
 
 include::SAP-EIC-PostgreSQL.adoc[leveloffset=2]
 
+++++
+<?pdfpagebreak?>
+++++
+
+== Restricted Access for {eic}
+
+This section provides instructions for configuring Restricted Access feature for {eic}.
+
+NOTE: Keep in mind that the descriptions and instructions provided may differ from the 
+deployment requirements for your specific infrastructure and use cases.
+
+[#serviceMesh]
+=== Configuring the {istio} Service Mesh
+
+This section guides you through configuring the {istio} Service Mesh for the Restricted Access feature on {eic}.
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=istio-installation, leveloffset=+2]
+
+=== Configuring the Monitoring
+
+This section covers the deployment of key monitoring and observability tools
+that integrate with the Istio Service Mesh configured previously in <<serviceMesh>>.
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-prometheus-installation, leveloffset=+2]
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-grafana-installation, leveloffset=+2]
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-kiali-installation, leveloffset=+2]
+
+++++
+<?pdfpagebreak?>
+++++
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=shared-cluster-configuration, leveloffset=+1]
 
 ++++
 <?pdfpagebreak?>

adoc/SAP-EIC-ImagePullSecrets.adoc

@@ -5,6 +5,8 @@
 To make the resources available for deployment, you need to create an imagePullSecret.
 In this guide, we use the name _application-collection_ for it.
 
+NOTE: For details on authenticating with the {rac}, refer to the https://docs.apps.rancher.io/get-started/first-steps/#distribution-platform[{rac}].
+
 # end::application-collection[]
 
 # tag::create-kubectl[]
@@ -32,16 +34,26 @@ The related secret can then be used for the components:
 * xref:SAP-EIC-Metallb.adoc#metalIPS[MetalLB]
 * xref:SAP-EIC-Redis.adoc#redisIPS[Redis]
 * xref:SAP-EIC-PostgreSQL.adoc#pgIPS[PostgreSQL]
+* Istio (<<istioIPS>>)
+* Kiali (<<kialiIPS>>)
+* Prometheus (<<prometheusIPS>>)
+* Grafana (<<grafanaIPS>>)
+* {eic} with Restricted Cluster option (<<elmIPS>>)
 
 # end::eic-links[]
 
 # tag::eic-harvester-links[]
 
 The related secret can then be used for the components:
 
-* Cert-Manager <<rancherIPS>>
-* Redis <<redisIPS>>
-* PostgreSQL <<pgIPS>>
+* Cert-Manager (<<rancherIPS>>)
+* Redis (<<redisIPS>>)
+* PostgreSQL (<<pgIPS>>)
+* Istio (<<istioIPS>>)
+* Kiali (<<kialiIPS>>)
+* Prometheus (<<prometheusIPS>>)
+* Grafana (<<grafanaIPS>>)
+* {eic} with Restricted Cluster option (<<elmIPS>>)
 
 # end::eic-harvester-links[]
 

adoc/SAP-EIC-LoginRegistryApplicationCollection.adoc

@@ -19,19 +19,27 @@ end::general-login[]
 
 The login process is needed for the following application installations:
 
-* Cert-Manager <<rancherLIR>>
-* MetalLB <<metalLIR>>
-* Redis <<redisLIR>>
-* PostgreSQL <<pgLIR>>
+* Cert-Manager (<<rancherLIR>>)
+* MetalLB (<<metalLIR>>)
+* Redis (<<redisLIR>>)
+* PostgreSQL (<<pgLIR>>)
+* Istio (<<istioLIR>>)
+* Kiali (<<kialiLIR>>)
+* Prometheus (<<prometheusLIR>>)
+* Grafana (<<grafanaLIR>>)
 
 # end::eic-reference[]
 
 # tag::eic-harvester-reference[]
 
 The login process is needed for the following application installations:
 
-* Cert-Manager <<rancherLIR>>
-* Redis <<redisLIR>>
-* PostgreSQL <<pgLIR>>
+* Cert-Manager (<<rancherLIR>>)
+* Redis (<<redisLIR>>)
+* PostgreSQL (<<pgLIR>>)
+* Istio (<<istioLIR>>)
+* Kiali (<<kialiLIR>>)
+* Prometheus (<<prometheusLIR>>)
+* Grafana (<<grafanaLIR>>)
 
 # end::eic-harvester-reference[]

adoc/SAP-EIC-Main-docinfo.xml

@@ -64,6 +64,16 @@
             <orgname>SUSE</orgname>
         </affiliation>
     </author>
+    <author>
+        <personname>
+            <firstname>Felipe</firstname>
+            <surname>Vieira</surname>
+        </personname>
+        <affiliation>
+            <jobtitle>SAP Solution Software Engineer</jobtitle>
+            <orgname>SUSE</orgname>
+        </affiliation>
+    </author>
 </authorgroup>
 
 <cover role="logos">

adoc/SAP-EIC-Main.adoc

@@ -42,9 +42,17 @@ The support matrix below shows which versions of the given software we will use
 |{metallb} | {metallb_version} 
 |{pg} | {pg_version}
 |{redis} | {redis_version}
+|{istio} | {istio_version}
+|{kiali} | {kiali_version}
+|{prometheus} | {prometheus_version}
+|{grafana} | {grafana_version}
 |===
 
+[IMPORTANT]
+====
 include::SAP-EIC-General.adoc[tags=disclaimer-production-versions]
+Other versions of {metallb} or {cm} can be used, but they may not have been tested. 
+====
 
 ++++
 <?pdfpagebreak?>
@@ -148,7 +156,8 @@ include::SAP-Rancher-RKE2-Installation.adoc[tags=!install-rke2-harvester]
 <?pdfpagebreak?>
 ++++
 
-
+:context-eic-main:
+[#preparingStorage]
 == Preparing storage
 
 To make storage available for Kubernetes workloads, prepare the storage solution you want to use.
@@ -237,6 +246,41 @@ include::SAP-EIC-PostgreSQL.adoc[leveloffset=2]
 <?pdfpagebreak?>
 ++++
 
+== Restricted Access for {eic}
+
+This section provides instructions for configuring Restricted Access feature for {eic}.
+
+NOTE: Keep in mind that the descriptions and instructions provided may differ from the 
+deployment requirements for your specific infrastructure and use cases.
+
+[#serviceMesh]
+=== Configuring the {istio} Service Mesh
+
+This section guides you through configuring the {istio} Service Mesh for the Restricted Access feature on {eic}.
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=istio-installation, leveloffset=+2]
+
+=== Configuring the Monitoring
+
+This section covers the deployment of key monitoring and observability tools
+that integrate with the Istio Service Mesh configured previously in <<serviceMesh>>.
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-prometheus-installation, leveloffset=+2]
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-grafana-installation, leveloffset=+2]
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=monitoring-kiali-installation, leveloffset=+2]
+
+++++
+<?pdfpagebreak?>
+++++
+
+include::SAP-EIC-SharedCluster-main.adoc[tags=shared-cluster-configuration, leveloffset=+1]
+
+++++
+<?pdfpagebreak?>
+++++
+
 == Installing {eic}
 
 // include::SAP-EIC.adoc[]

adoc/SAP-EIC-Metallb.adoc

@@ -36,17 +36,18 @@ Create a _values.yaml_ file with the following configuration:
 
 [source,yaml]
 ----
-imagePullSecrets:
-  - name: application-collection
+global:
+  imagePullSecrets:
+    - name: application-collection
 ----
 
 Then install the metallb application.
-[source, bash]
+[source, bash, subs="attributes"]
 ----
 helm install metallb oci://dp.apps.rancher.io/charts/metallb \
 -f values.yaml \
 --namespace=metallb \
---version 0.14.7
+--version {metallb_chart_version}
 ----
 
 

adoc/SAP-EIC-PostgreSQL.adoc

@@ -89,7 +89,7 @@ podSecurityContext:
 To install the application, run:
 [source, bash, subs="attributes"]
 ----
-helm install {pg_app_name} oci://dp.apps.rancher.io/charts/{pg_app_name} -f values.yaml --namespace={pg_app_name}
+helm install {pg_app_name} oci://dp.apps.rancher.io/charts/{pg_app_name} -f values.yaml --namespace={pg_app_name} --version {pg_chart_version}
 ----
 
 

adoc/SAP-EIC-Redis.adoc

@@ -77,10 +77,16 @@ tls:
   caCertFilename: "root.pem"
 ----
 
+ifdef::context-eic-main[]
+NOTE: The `storageClassName` in the `values.yaml` file should be adjusted to match the storage class you intend to use.
+For more details on configuring storage, refer to <<preparingStorage>>.
+endif::[]
+
 To install the application, run:
 [source, bash, subs="attributes"]
 ----
 helm install {app_name} oci://dp.apps.rancher.io/charts/{app_name} \
 -f values.yaml \
---namespace={app_name}
+--namespace={app_name} \
+--version {redis_chart_version}
 ----