反馈已提交

网络繁忙

K8s Private Cloud Authentication

  • Last update:  2024-03-04
  • Overview

    Version

    FineBI Version
    Functional Change

    6.0.5

    /

    Application Scenario

    Kubernetes (also known as K8s), an open-source container orchestration platform, is widely used for containerized workload management and deployment with multiple clouds and regions. It provides high availability and scalability.

    After deploying FanRuan applications on K8s, you need to register the applications. This document introduces how to perform container private cloud registrations for FanRuan applications deployed on K8s.

    This document (only for reference) takes the Cloud Container Engine (CCE) service of Huawei Cloud as the example environment. For other K8s cloud platforms, you can adjust operation steps accordingly.

    Image Preparation

    Obtaining the Authorized Image

    Send the registration information through the email address specified in the contract to FineReport business personnel (business@fanruan.com). The following table describes the email format.

    After receiving the email and verifying the information, the business personnel will generate an image file named fanruan_license_server.tar of the authentication server and send the file to you by email.

    iconNote:
    Specify the special requirements (if any) in the email.


    Needed Information
    RequirementNote

    Contact

    Contact FanRuan sales personnel in advance to confirm relevant matters and sign the contract.

    /

    Sender

    Use the email address specified in the contract.

    If you use an email address which is not that one specified in the contract, the registration will be rejected.

    Recipient

    business@fanruan.com

    /

    Title

    Official Authorization Document of Company Name's Registration for FineReport

    If you do not indicate the company name in the email, the registration will not be allowed.

    Body

    Basic Information

    Company name: Company Name

    Project name: Project Name

    Contract signing date: YYYY/MM/DD

    /

    Registration Method

    Container Private Cloud Authentication

    /

    Maximum Number of Registrations

    Number of nodes in the cluster project

    If this item is not provided, the default value 1 is used.

    You do not need to provide this item in the standalone mode.

    Uploading the Image

    Upload the authorized image package fanruan_license_server.tar (obtained in section "Authorized Image Obtaining") to an image repository, as shown in the following figure.

    You are advised to save the authorized image and the FanRuan application component image in the same image repository. (You can skip this section if an image repository already exists.)

     1.png

    1.1.png

    Viewing Image Information

    Record the repository address and version of the image (such as swr.cn-north-1.myhuaweicloud.com/fanruan/fanruan_license_server_amd64:1.0.0 in the following figure).

     2.png

    Creating Authorized Applications

    Namespace Selection/Creation

    You can set multiple namespaces in a Kubernetes cluster. Each namespace is a relatively independent virtual space. Resources in different namespaces are also independent.

    You are advised to install authorized applications and FanRuan's to-be-authorized applications in the same namespace (in which no other components are installed) of the same Huawei Cloud cluster, to achieve resource isolation in multiple applications.

    Record the name (such as fanruan-test in the following figure) of the namespace. 

     3.png

    Storage Creation

    Storage in the K8s cluster is an important component for storing business data. You need to first create a static storage, which will be used in the following YAML file.

    Create a static storage in the namespace selected in section "Namespace Selection/Creation."

    Record the PersistentVolumeClaim (PVC) name (such as data-fr-0 in the following figure) of the static storage.

     4.png

    YAML File Modification

    You can download and decompress the YAML file lic_example.zip.

    Modify the following content as needed.

    Configuration Item
    Description

    namespace

    Modify the value of namespace to the namespace name selected in section "Namespace Selection/Creation."

     5.png

    claimName

    Modify the value of claimName to the storage name created in section "Storage Creation."

     6.png

    image

    Modify the value of image to the image information in section "Image Information Viewing." (If image pulling requires a key for authentication, you need to include the key in the value.)

     7.png

    Resource Creation from YAML

    Create an authorized application in the namespace selected in section "Namespace Selection/Creation" through the YAML file in section "YAML File Modification."

     8.png

    Authorization Authentication

    Authentication Submission

    1. Access the address (https://<host>:<Port number>/license/qrcode) of the authorized application to scan the QR code for authentication.

    • Protocol: HTTPS protocol

    • host: domain name fanruan-license-server.namespace (such as fanruan-license-server.fanruan-test), rather than an IP address. namespace is the one selected in section "Namespace Selection/Creation."

    • Port number: 8081

    2. Scan the generated QR code through a mobile browser, enter the returned 6-digit verification code in the system, and click Submit, as shown in the following figure. 

    iconNote:

    1. The QR code is valid for five minutes. Ensure that the registration is completed in the specified time. You need to refresh the QR code manually if the registration takes more than five minutes.

    2. You had better register the project immediately after obtaining the verification code. Do not restart the project until the registration is successful.

    3. If you enter incorrect verification codes for more than five times, the system will be locked for 15 minutes to prevent brute force attacks and high-frequency accesses to the interface.


    9.png 

    Verification and Authorization in the FineBI Project

    Log in to the FineBI system as the admin, choose System Management > Registration Management, and click Register Now, as shown in the following figure.

     10.png

    Set Authentication Method to Private Cloud, set Server Address (https://host:Port number 

    in which host is the domain name and Port number is the listening port number of the authorized application in section "Authentication Submission"), and click Submit, as shown in the following figure.

    iconNote:
    Ensure that the FineBI project can access the authorized application.


     11.png

    The following figure shows the effect of the successful authentication.

    iconNote:

    1. The maximum number of connections represents the maximum number of projects for which you can apply for authorization registrations to the authorization server at the same time.

    2. If the authentication fails, you need to check the firewall setting (to open the corresponding port or disable the firewall).


    12.png

    附件列表


    主题: Deployment and Integration
    • Helpful
    • Not helpful
    • Only read

    feedback

    鼠标选中内容,快速反馈问题

    鼠标选中存在疑惑的内容,即可快速反馈问题,我们将会跟进处理。

    不再提示

    10s后关闭