Install an Edge site

The default Edge CLI method automatically creates the required cluster level objects, such as namespaces and priority classes, for you. This reduces manual configuration and ensures your Edge site meets the cluster level requirements.

Prerequisites

• You have a global role with the Install Edge sites and the User Administration global permission, for example Edge site administrator.
• You configured the forward proxy, if a forward proxy is required for Edge to connect to Collibra, Datadog, OpenTelemetry and jFrog. Contact your network administrator if this is applicable.
• Your server meets all system requirements.
• You must have admin level access to your the Kubernetes cluster where you want to install your Edge site.

Steps

1. Download the installer:
   1. Open a site.
      1. On the main toolbar, click → Settings.
         The Settings page opens.
      2. In the tab pane, click Edge.
         The Sites tab opens and shows a table with an overview of your sites.
      3. In the site overview, click the name of a site.
         The site page appears.
   2. Click Download in the Installer and properties files section.Click Download Installer.
      An Edge user is created in Collibra.
      Warning  Every time you download an Edge site installer, the previously downloaded Edge site installer becomes outdated. If you use this outdated installer, the Edge site cannot communicate with Collibra.
   3. Depending on your operating system and browser, follow the regular steps for downloading files.
      The installer file is a TGZ archive and contains the files proxy.properties and registries.yaml.

2. Extract the TGZ archive on the external Linux server which will be used to install the Edge site on your managed Kubernetes cluster.

   Copy

   tar -xf <edge-site-id>-installer.tgz

   Note 

   • Keep the installer or the contents of the extracted installer in a secure location on your server. These contents contain various tools that you may need later, for example to troubleshoot issues.
   • Ensure the directory is not mounted as noexec before you run scripts or executable files. If a directory is mounted as noexec, scripts and executable files can't be run within the directory. For example, you won't be able to use the Edge CLI if you mount the directory as noexec.
3. Set the EDGE_INSTALLER_PATH environment variable to the path of the root of the extracted installer.
   Example…

   1. Go to the extracted installer and run pwd.The result should look similar to this:

      /path/to/installer/installer-111e8a59-b842-4f57-970c-32aa72000598

   2. Set the environment variable to the result:

      export EDGE_INSTALLER_PATH=/path/to/installer/installer-111e8a59-b842-4f57-970c-32aa72000598

4. Run the following command to confirm that the Kubeconfig environment variable has been set to a valid kubeconfig:
   Copy

   echo $KUBECONFIG 

5. If you intend to have multiple Edge sites in your Kubernetes cluster, you must give each Edge site a unique namespace.
   How to create a unique namespace…

   1. Copy the following command, replacing <my-namespace> with a unique name for the namespace:
      Copy

      apiVersion: v1
      kind: Namespace
      metadata:
        labels:
          pod-security.kubernetes.io/enforce: baseline
          pod-security.kubernetes.io/enforce-version: v1.27
      name: <my-namespace>

   2. Store this copied yaml into a new file called collibra-edge-ns.yaml.
   3. Create the namespace using kubectl:
      Copy

      kubectl apply -f collibra-edge-ns.yaml <my-namespace>

   Note Throughout the remaining installation steps, add this new namespace to the provided commands.
6. If you are using an Openshift cluster, deploy Security Context Constraints (SCC) which provide Edge service accounts with the required permissions.
   How to create and install security constraints…

   1. Create the SCC file, for example, edge-scc-minimal.yaml, and paste the following information into it:
      Copy

      apiVersion: security.openshift.io/v1
      kind: SecurityContextConstraints
      metadata:
        name: edge-scc-documented
      allowHostDirVolumePlugin: false
      allowHostIPC: false
      allowHostNetwork: false
      allowHostPID: false
      allowHostPorts: false
      allowPrivilegeEscalation: false
      allowPrivilegedContainer: false
      allowedCapabilities: []
      allowedUnsafeSysctls: []
      defaultAddCapabilities: []
      fsGroup:
        type: MustRunAs
      priority: null
      readOnlyRootFilesystem: true
      requiredDropCapabilities: []
      runAsUser:
        type: MustRunAs
        uid: 1000
      seLinuxContext:
        type: MustRunAs
        seLinuxOptions:
          level: "s0"
          role: "system_r"
          type: "container_t"
          user: "system_u"
      seccompProfiles:
        - 'runtime/default'
      supplementalGroups:
        type: MustRunAs
      # who can use it
      users: []
      groups: [system:authenticated]

   2. Create the SCC-role file, for example, edge-scc-role-minimal.yaml, and paste the following information into it:
      Copy

      # File: edge-scc-role-minimal.yaml
      apiVersion: rbac.authorization.k8s.io/v1
      kind: Role
      metadata:
        name: edge-scc-minimal
      rules:
      - apiGroups:
        - security.openshift.io
        resourceNames:
        - edge-scc-minimal
        resources:
        - securitycontextconstraints
        verbs:
        - use
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: edge-scc-minimal
      subjects:
      - kind: Group
        name: system:serviceaccounts
        apiGroup: rbac.authorization.k8s.io
      roleRef:
        kind: Role
        name: edge-scc-minimal
        apiGroup: rbac.authorization.k8s.io

   3. Deploy both the SCC and SCC-role files:
      Copy

      kubectl apply -f edge-scc-minimal.yaml
      kubectl apply -f edge-scc-role-minimal.yaml -n <my-namespace>

7. On the machine connected to Kubernetes, use the Edge CLI to run one of the following installation commands. Add specific flags to the command to configure your setup, such as for a forward proxy. To see a full list of available installation flags, run the edgecli install--help command in the Edge CLI:
   Show me the additional installation flags

   Use these flags to configure your installation for your organization's setup, such as if you use a forward proxy or private registry. To apply a flag, add it to the ./edgecli install command.

   Example 

   ./edgecli install -n edge-namespace
        --is-openshift
        --registry-url https://private-docker.registry.com 
        --registry-user user1 
        --registry-pass pass12

   Flag	Description
   -n <my-namespace>	If you created a custom namespace, add -n <my-namespace> to the command. For example: ./edgecli install -n <my-namespace>
   --proxy	If you are using a forward proxy, add this flag to the installation prerequisite script. Note If your proxy properties are not in the default proxy.properties file in the root of the installer, you must add the file path the installation prerequisite script. For example: --proxy temp/proxy/proxyproperties
   --ca	Add this flag to use a custom certificate, such as for a forward man-in-the-middle proxy. Note If your custom certificate are not in the default ca.pem file in the root of the installer, you must add the file path the installation prerequisite script. For example: --ca temp/certs You can also use this flag to add a custom certificate for data sources. More information Some data sources require a custom certificat to connect to Edge. If a private Certificate Authority signed the certificate, add it to the Edge site truststore. As you may not have a list of all required certificates at the time of installation, we recommend the ./edgecli config ca merge --path command shown in the Edge CLI topic. The process functions as follows: Edge and the data source connect using the data source certificate. Edge communicates the data source metadata to your Collibra Platform using a Collibra certified certificate.
   --is-openshift	Add this flag for OpenShift clusters to deploy Security Context Constraints (SCC). SCC provide the required permissions to the Edge service accounts.
   --disable-otel	Add this flag to disable OpenTelemetry. Your metrics and logs will no longer be sent to Edge.
   Private container image registry	Use these flags if you want to install your Edge site with a private container image registry to store and manage the container images included in an Edge site installation.
   --registry-url <registry-url>	The URL of your registry. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   --registry-user <registry-user>	Your registry account username. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   --registry-pass <registry-pass>	Your registry account password. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   Private Helm registry	Use the following flags if you want to install your Edge site with a private Helm registry, which stores and manage the Helm charts included in an Edge site installation.
   --helm-url <helm-registry-url	The URL of your registry. For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --helm-user <helm-registry-user>	Your registry account username. This may look different depending on your authentication method, for example: Username Token name Service principal ID JSON key For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --helm-registry-pass <helm-pass>	Your registry account password. This may look different depending on your authentication method, for example: Password Token password Service principal secret Path to JSON file For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --user-id <user_id>	Add this flag to run all of your Edge site pods and containers with a specific user ID (UID).
   --group-id <group_id>	Add this flag to run all of your Edge site pods and containers with a specific group ID (GID).
   --unset-run-as-ids	Add this flag for OpenShift clusters to run all of your Edge site pods and containers from random UIDs and GIDs,
   --no-priority-class-install	Warning  Don't skip priority class configuration unless you have an experienced Kubernetes engineer in your organization, as doing so may result in Edge site failures. Add this flag to skip installing priority classes. Running this flag sets all Edge site pods to the default priority (0).
   --use-custom-priority-class	Warning  Don't configure custom priority classes unless you have an experienced Kubernetes engineer in your organization, as doing so may result in Edge site failures. Add this flag and the following --set flags to configure custom priority classes for your Edge site pods: --set global.priorityClassName.platform=<priority>: This flags sets the custom priority class name for Edge platform pods. This should be the highest priority class in Edge. --set global.priorityClassName.application=<priority>: This flag sets the custom priority class name for Edge application pods. This should be the second highest priority class in Edge. --set global.priorityClassName.job=<priority>:This flag sets the custom priority class name for Edge job pods. This should be the third highest priority class in Edge. Show an example --set global.priorityClassName.platform=critical-priority --set global.priorityClassName.application=high-priority --set global.priorityClassName.job=low-priority
   --b <backup-file	Add this flag if you have a backup you want to use to restore an Edge site.

   • With terminal logging, which only saves the output to the Edge terminal:
     Copy

     ./edgecli install -n <my-namespace>

   • With terminal and file logging, which saves the output both to the terminal and a separate file. This file will be saved in the current directory with the naming format: edge-installer-$(date +"%Y-%m-%d_%H-%M-%S").log:
     Copy

     ./edgecli install -n <my-namespace> 2>&1 | tee "edge-installer-$(date +"%Y-%m-%d_%H-%M-%S").log"

   In the Edge site's overview, you see the status of the installation.
8. Run the following command to verify the status of the installation.
   Copy

   kubectl get pods -n collibra-edge

The restrictive Edge CLI method allows you to create the required cluster-level objects like namespaces and priority classes. Use this method if your organization has strict security requirements that prevent Edge from creating these objects automatically.

Prerequisites

• You have a global role with the Install Edge sites and the User Administration global permission, for example Edge site administrator.
• You configured the forward proxy, if a forward proxy is required for Edge to connect to Collibra, Datadog, OpenTelemetry and jFrog. Contact your network administrator if this is applicable.
• Your server meets all system requirements.
• You must have namespace level access to the Kubernetes cluster where you want to install your Edge site.

Steps

1. Download the installer:
   1. Open a site.
      1. On the main toolbar, click → Settings.
         The Settings page opens.
      2. In the tab pane, click Edge.
         The Sites tab opens and shows a table with an overview of your sites.
      3. In the site overview, click the name of a site.
         The site page appears.
   2. Click Download in the Installer and properties files section.Click Download Installer.
      An Edge user is created in Collibra.
      Warning  Every time you download an Edge site installer, the previously downloaded Edge site installer becomes outdated. If you use this outdated installer, the Edge site cannot communicate with Collibra.
   3. Depending on your operating system and browser, follow the regular steps for downloading files.
      The installer file is a TGZ archive and contains the files proxy.properties and registries.yaml.
2. Extract the TGZ archive on the external Linux server which will be used to install the Edge site on your managed Kubernetes cluster.
   Copy

   tar -xf <edge-site-id>-installer.tgz

   Note 

   • Keep the installer or the contents of the extracted installer in a secure location on your server. These contents contain various tools that you may need later, for example to troubleshoot issues.
   • Ensure the directory is not mounted as noexec before you run scripts or executable files. If a directory is mounted as noexec, scripts and executable files can't be run within the directory. For example, you won't be able to use the Edge CLI if you mount the directory as noexec.
3. Set the EDGE_INSTALLER_PATH environment variable to the path of the root of the extracted installer.
   Example…

   1. Go to the extracted installer and run pwd.The result should look similar to this:

      /path/to/installer/installer-111e8a59-b842-4f57-970c-32aa72000598

   2. Set the environment variable to the result:

      export EDGE_INSTALLER_PATH=/path/to/installer/installer-111e8a59-b842-4f57-970c-32aa72000598

4. Run the following command to confirm that the Kubeconfig environment variable has been set to a valid kubeconfig:
   Copy

   echo $KUBECONFIG  

5. Deploy cluster level objects:
   1. Create the namespace for collibra-edge.
      Note Clusters that have more than one Edge site installed must have unique namespaces.
      1. Copy the following command, replacing <my-namespace> with a unique name for the namespace:
         Copy

         apiVersion: v1
         kind: Namespace
         metadata:
           labels:
             pod-security.kubernetes.io/enforce: baseline
             pod-security.kubernetes.io/enforce-version: v1.27
             name: <my-namespace>

      2. Store this copied yaml into a new file called collibra-edge-ns.yaml.
      3. Create the namespace using kubectl:
         Copy

         kubectl apply -f collibra-edge-ns.yaml

      Note Throughout the remaining installation steps, replace <my-namespace> in the provided commands with this new namespace name. Example commands will have edge-namespace as an example namespace name.
   2. For all cluster types, deploy priority classes:
      Copy

      kubectl apply -f resources/custom/priorityclass.yaml

   3. If you are using an Openshift cluster, deploy Security Context Constraints (SCC) which provide Edge service accounts with the required permissions.
      How to create and install security constraints…

      1. Create the SCC file, for example, edge-scc-minimal.yaml, and paste the following information into it:
         Copy

         apiVersion: security.openshift.io/v1
         kind: SecurityContextConstraints
         metadata:
           name: edge-scc-documented
         allowHostDirVolumePlugin: false
         allowHostIPC: false
         allowHostNetwork: false
         allowHostPID: false
         allowHostPorts: false
         allowPrivilegeEscalation: false
         allowPrivilegedContainer: false
         allowedCapabilities: []
         allowedUnsafeSysctls: []
         defaultAddCapabilities: []
         fsGroup:
           type: MustRunAs
         priority: null
         readOnlyRootFilesystem: true
         requiredDropCapabilities: []
         runAsUser:
           type: MustRunAs
           uid: 1000
         seLinuxContext:
           type: MustRunAs
           seLinuxOptions:
             level: "s0"
             role: "system_r"
             type: "container_t"
             user: "system_u"
         seccompProfiles:
           - 'runtime/default'
         supplementalGroups:
           type: MustRunAs
         # who can use it
         users: []
         groups: [system:authenticated]

      2. Create the SCC-role file, for example, edge-scc-role-minimal.yaml, and paste the following information into it:
         Copy

         # File: edge-scc-role-minimal.yaml
         apiVersion: rbac.authorization.k8s.io/v1
         kind: Role
         metadata:
           name: edge-scc-minimal
         rules:
         - apiGroups:
           - security.openshift.io
           resourceNames:
           - edge-scc-minimal
           resources:
           - securitycontextconstraints
           verbs:
           - use
         ---
         apiVersion: rbac.authorization.k8s.io/v1
         kind: RoleBinding
         metadata:
           name: edge-scc-minimal
         subjects:
         - kind: Group
           name: system:serviceaccounts
           apiGroup: rbac.authorization.k8s.io
         roleRef:
           kind: Role
           name: edge-scc-minimal
           apiGroup: rbac.authorization.k8s.io

      3. Deploy both the SCC and SCC-role files:
         Copy

         kubectl apply -f edge-scc-minimal.yaml
         kubectl apply -f edge-scc-role-minimal.yaml -n <my-namespace>

6. On the machine connected to Kubernetes, use the Edge CLI to run one of the following installation commands. Add specific flags to the command to configure your setup, such as for a forward proxy. To see a full list of available installation flags, run the edgecli install--help command in the Edge CLI:
   Show me the additional installation flags

   Use these flags to configure your installation for your organization's setup, such as if you use a forward proxy or private registry. To apply a flag, add it to the ./edgecli install command.

   Example 

   ./edgecli install -n edge-namespace
        --is-openshift
        --registry-url https://private-docker.registry.com 
        --registry-user user1 
        --registry-pass pass12

   Flag	Description
   -n <my-namespace>	If you created a custom namespace, add -n <my-namespace> to the command. For example: ./edgecli install -n <my-namespace>
   --proxy	If you are using a forward proxy, add this flag to the installation prerequisite script. Note If your proxy properties are not in the default proxy.properties file in the root of the installer, you must add the file path the installation prerequisite script. For example: --proxy temp/proxy/proxyproperties
   --ca	Add this flag to use a custom certificate, such as for a forward man-in-the-middle proxy. Note If your custom certificate are not in the default ca.pem file in the root of the installer, you must add the file path the installation prerequisite script. For example: --ca temp/certs You can also use this flag to add a custom certificate for data sources. More information Some data sources require a custom certificat to connect to Edge. If a private Certificate Authority signed the certificate, add it to the Edge site truststore. As you may not have a list of all required certificates at the time of installation, we recommend the ./edgecli config ca merge --path command shown in the Edge CLI topic. The process functions as follows: Edge and the data source connect using the data source certificate. Edge communicates the data source metadata to your Collibra Platform using a Collibra certified certificate.
   --is-openshift	Add this flag for OpenShift clusters to deploy Security Context Constraints (SCC). SCC provide the required permissions to the Edge service accounts.
   --disable-otel	Add this flag to disable OpenTelemetry. Your metrics and logs will no longer be sent to Edge.
   Private container image registry	Use these flags if you want to install your Edge site with a private container image registry to store and manage the container images included in an Edge site installation.
   --registry-url <registry-url>	The URL of your registry. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   --registry-user <registry-user>	Your registry account username. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   --registry-pass <registry-pass>	Your registry account password. For more information about the flags and format required for the supported registries and authentication methods, go to the private container image registry documentation.
   Private Helm registry	Use the following flags if you want to install your Edge site with a private Helm registry, which stores and manage the Helm charts included in an Edge site installation.
   --helm-url <helm-registry-url	The URL of your registry. For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --helm-user <helm-registry-user>	Your registry account username. This may look different depending on your authentication method, for example: Username Token name Service principal ID JSON key For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --helm-registry-pass <helm-pass>	Your registry account password. This may look different depending on your authentication method, for example: Password Token password Service principal secret Path to JSON file For more information about the flags and format required for the supported registries and authentication methods, go to the private Helm registry documentation.
   --user-id <user_id>	Add this flag to run all of your Edge site pods and containers with a specific user ID (UID).
   --group-id <group_id>	Add this flag to run all of your Edge site pods and containers with a specific group ID (GID).
   --unset-run-as-ids	Add this flag for OpenShift clusters to run all of your Edge site pods and containers from random UIDs and GIDs,
   --no-priority-class-install	Warning  Don't skip priority class configuration unless you have an experienced Kubernetes engineer in your organization, as doing so may result in Edge site failures. Add this flag to skip installing priority classes. Running this flag sets all Edge site pods to the default priority (0).
   --use-custom-priority-class	Warning  Don't configure custom priority classes unless you have an experienced Kubernetes engineer in your organization, as doing so may result in Edge site failures. Add this flag and the following --set flags to configure custom priority classes for your Edge site pods: --set global.priorityClassName.platform=<priority>: This flags sets the custom priority class name for Edge platform pods. This should be the highest priority class in Edge. --set global.priorityClassName.application=<priority>: This flag sets the custom priority class name for Edge application pods. This should be the second highest priority class in Edge. --set global.priorityClassName.job=<priority>:This flag sets the custom priority class name for Edge job pods. This should be the third highest priority class in Edge. Show an example --set global.priorityClassName.platform=critical-priority --set global.priorityClassName.application=high-priority --set global.priorityClassName.job=low-priority
   --b <backup-file	Add this flag if you have a backup you want to use to restore an Edge site.

   • With terminal logging, which only saves the output to the Edge terminal:
     Copy

     ./edgecli install -n <my-namespace>

   • With terminal and file logging, which saves the output both to the terminal and a separate file. This file will be saved in the current directory with the naming format: edge-installer-$(date +"%Y-%m-%d_%H-%M-%S").log:
     Copy

     ./edgecli install -n <my-namespace> 2>&1 | tee "edge-installer-$(date +"%Y-%m-%d_%H-%M-%S").log"

   In the Edge site's overview, you see the status of the installation.
7. Run the following command to verify the status of the installation.
   Copy

   kubectl get pods -n <my-namespace>

Warning Collibra Support will not assist with custom Helm or Kubernetes configurations. The following steps are an example, and any assistance for configurations or issues outside of these steps is unsupported. We recommend using the Edge CLI method for managed Kubernetes installations.

A common example of custom Helm configurations is, but not limited to, using an unsupported private repository. For more information, go to our supported private helm registries documentation.