getting-started-gke.md

Getting Started with Nuclio on Google Kubernetes Engine (GKE)

Follow this step-by-step guide to set up a Nuclio development environment that uses the Google Kubernetes Engine (GKE) and related Google Cloud Platform (GCP) tools.

In this document

• Prerequisites
• Set up a Kubernetes cluster and a local environment
• Install Nuclio
• What's next

Prerequisites

Before starting the set-up procedure, ensure that the following prerequisites are met:

• You have a billable GKE project. For detailed information about GKE, see the GKE documentation.

  Note: For simplicity, this guide uses the GKE project name nuclio-gke. Replace all reference to this name with the name of your GKE project.

• The GCP CLI (gcloud) is installed and configured to work with your GKE project.

• The GCR Docker credentials helper, (docker-credential-gcr) is installed. You can use this gcloud command to install it:

  gcloud components install docker-credential-gcr

• The Google Container Registry (GCR) API is enabled on your project.

• The Nuclio CLI (nuctl) is installed — if you wish to use the CLI to deploy Nuclio functions. To install the CLI, simply download the appropriate CLI version to your installation machine.

Set up a Kubernetes cluster and a local environment

Create a Kubernetes cluster by running the following gcloud command. Feel free to modify the options and parameters:

gcloud container clusters create nuclio --machine-type n1-standard-2 --image-type COS --disk-size 100 --num-nodes 2 --no-enable-legacy-authorization

Get the credentials of the cluster by running the following gcloud command. This command updates the kubeconfig file, which configures access to your cluster:

gcloud container clusters get-credentials nuclio

Assign cluster-admin permissions to your user to allow creation of role-based access control (RBAC) roles, in accordance with the GKE documentation:

Note: The first command, which sets GKE_USER, is just a method for retrieving your registered email address. This command requires jq. If you know your GCP registration email address, you can enter it manually; note that the email address is case sensitive.

GKE_USER=$(gcloud projects get-iam-policy "$(gcloud config list --format 'value(core.project)')" --format json \
           | jq -r '.bindings[] | select(.role == "roles/owner") | .members[]' \
           | awk -F':' '{print $2}')

kubectl create clusterrolebinding cluster-admin-binding --clusterrole cluster-admin --user $GKE_USER

Verify your configuration by running the following kubectl command (see the Kubernetes documentation):

kubectl get pods --all-namespaces

Create a secret for GCR authentication: because Nuclio functions are images that need to be pushed and pulled to/from the registry, you need to create a secret that stores your registry credentials, and mount the secret to the Nuclio dashboard container so that it can be used to authenticate the Docker client with the GCR. Start by getting your service ID.

Note: You can use any private Docker registry:

• To use the Azure Container Registry (ACR), see Getting Started with Nuclio on Azure Container Service (AKS).
• To use the Docker Hub, see Getting Started with Nuclio on Kubernetes.
• For other registries, create a Docker-registry secret named registry-credentials for storing your registry credentials. If the registry URL differs from the URL in the credentials, create a ConfigMap file named nuclio-registry that contains the URL, as demonstrated in the Nuclio installation instructions later in this guide.

Create a service-to-service key that allows GKE to access the GCR: this guide uses the key gcr.io. You can replace this with any of the supported sub domains, such as us.gcr.io if you want to force the US region:

gcloud iam service-accounts keys create credentials.json --iam-account $(gcloud iam service-accounts list --format "value(email)")

Install Nuclio

At this stage you should have a functioning Kubernetes cluster, credentials to a private Docker registry, and a working Kubernetes CLI (kubectl), and you can proceed to install the Nuclio services on the cluster (i.e., deploy Nuclio). For more information about kubectl, see the Kubernetes documentation.

Create a Kubernetes Docker-registry secret from service-key file that you created as part of the Kubernetes cluster setup

And then follow the instructions of How to run nuclio in Production

NOTE: use the below docker registry secret creation command:

kubectl create secret docker-registry registry-credentials \
    --namespace nuclio \
    --docker-username _json_key \
    --docker-password "$(cat credentials.json)" \
    --docker-server gcr.io \
    --docker-email [email protected]

rm credentials.json

Use the command kubectl --namespace nuclio get pods to verify both the controller and dashboard are running.

What's next?

See the following resources to make the best of your new Nuclio environment:

• Deploying Functions
• Invoking Functions by Name with a Kubernetes Ingress
• More function examples
• References
• Best Practices and Common Pitfalls