Skip to main content

Install Pomerium Enterprise in Kubernetes with Kustomize

This document covers installing Pomerium Enterprise into your existing Kubernetes cluster. It's designed to work with an existing cluster running Pomerium, as described in Pomerium Kustomize. Follow that document before continuing here.

The assumption is that Pomerium is installed into the pomerium namespace, and Enterprise would be installed into the pomerium-enterprise namespace.

Prepare Core​

The below command will expose the Pomerium Core Databroker gRPC interface.

kubectl apply -k github.com/pomerium/documentation/k8s/core\?ref=0-20-0

Deploy Enterprise Console​

kubectl apply -k github.com/pomerium/documentation/k8s/console\?ref=0-20-0

The Enterprise Console needs to be configured before it becomes fully operational.

Create Cloudsmith Directory Secret​

kubectl create secret docker-registry pomerium-enterprise-docker \
    --namespace pomerium-enterprise \
    --docker-server=docker.cloudsmith.io \
    --docker-username=pomerium/enterprise \
    --docker-password="your password provided by Pomerium Sales"

Configure Enterprise Console​

Create a config directory, and fill in the configuration parameters for the following template files:

kustomization.yaml
resources:
  - config.yaml
  - ingress-console.yaml
  - secret.yaml
namespace: pomerium-enterprise

See Environment Variables for Config and Secret keys description.

config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: enterprise
data:
  # should match authenticate service URL from Pomerium Settings CRD
  authenticate_service_url: https://authenticate.domain.com/
  # audience should correspond to the name in the ingress you created for the console
  # without the protocol part
  audience: console.domain.com
  # administrators is a comma separated list of emails that would be granted admin privileges
  # only use it for bootstrapping, and grant explicit permissions via the UI to the Global namespace
  administrators: me@domain.com
  # databroker service URL allows Console to communicate to Pomerium Core
  databroker_service_url: http://pomerium-databroker.pomerium.svc.cluster.local:5443
  # external Prometheus service URL, to enable metrics.
  # see https://www.pomerium.com/docs/deploying/k8s/install#metrics
  # prometheus_url: ""
secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: enterprise
type: Opaque
stringData:
  database_url: postgres://user:password@host/database
  database_encryption_key: ""
  license_key: ""
  # shared_secret must match a base64 encrypted key from the Pomerium Core secret - i.e.
  # kubectl get secret bootstrap -n pomerium -o jsonpath="{.data.shared_secret}"
  shared_secret: ""

Create Ingress for Console.

ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pomerium-console
  annotations:
    cert-manager.io/cluster-issuer: your-cluster-issuer
    external-dns.alpha.kubernetes.io/hostname: "console.domain.com"
    # the below two annotations are required
    ingress.pomerium.io/pass_identity_headers: "true"
    ingress.pomerium.io/allow_any_authenticated_user: "true"
spec:
  ingressClassName: pomerium
  tls:
    - secretName: console-domain-com
      hosts:
        - console.domain.com
  rules:
    - host: "console.domain.com"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: pomerium-console
                port:
                  name: app

kubectl apply -k ./config