Install Astronomer Software in an airgapped environment

By default, the Software installation process requires accessing public repositories to download the following components:

• Docker images from quay.io/astronomer or docker.io
• Astronomer Helm charts from helm.astronomer.io
• Astronomer version information from updates.astronomer.io

If you cannot use public repositories and networks for your installation, you can install Astronomer in an airgapped environment. An airgapped environment is a locked-down environment with no access to or from the public internet.

This guide explains how to configure your system to install Astronomer without access to the public internet by moving Astronomer images to an accessible registry in your airgapped environment. After completing this setup, follow Steps 1 to 8 in the AWS, GCP, or Azure installation guide to finish your installation.

Prerequisites

To complete this setup, you need:

• A VPC.
• Private Kubernetes.
• A PostgreSQL instance accessible from that environment.
• PostgreSQL superuser permissions.
• A VPN (or other means) set up to access, at a minimum, Kubernetes and DNS from inside your VPC.
• A Helm configuration file for Astronomer named values.yaml. You can find sample values.yaml files in the AWS, Azure, GCP standard installation guides.

Step 1: Configure a private Docker registry

Astronomer’s Docker images are hosted on a public registry which isn’t accessible from an airgapped network. Therefore, these images must be hosted on a Docker registry accessible from within your own network. Every major cloud platform provides its own managed Docker registry service that can be used for this step:

• AWS: ECR
• Azure: Azure Container Registry
• GCP: Container Registry

You can also set up your own registry using a dedicated registry service such as JFrog Artifactory. Regardless of which service you use, follow the product documentation to configure a private registry according to your organization’s security requirements.

After you create your registry:

1. Log in to the registry and follow the Kubernetes documentation to produce a /.docker/config.json file.

2. Run the following command to create an image pull secret:

   1
   kubectl create secret generic regcred \
   2
   --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
   3
   --type=kubernetes.io/dockerconfigjson

3. Copy the generated secret for use in Step 3.

Step 2: Fetch images from Astronomer’s Helm template

The images and tags which are required for your Software installation depend on the version of Astronomer you’re installing. To gather a list of exact images and tags required for your Astronomer version:

1. Run the following command to template the Astronomer Helm chart and fetch all of its rendered image tags. Make sure to substitute <your-basedomain> and <your-astronomer-version> with your information.

   $
   helm template --version <your-astronomer-version> astronomer/astronomer --set global.dagOnlyDeployment.enabled=True --set global.loggingSidecar.enabled=True --set global.postgresqlEnabled=True --set global.authSidecar.enabled=True --set global.baseDomain=<your-basedomain> | grep "image: " | sed -e 's/"//g' -e 's/image:[ ]//' -e 's/^ *//g' | sort | uniq

   This command sets all possible Helm values that could impact which images are required for your installation. By fetching all images now, you save time by eliminating the risk of missing an image.

2. Run the following command to determine the Astronomer Airflow Helm chart version:

   $
   helm template astronomer/astronomer --version <your-astronomer-version>|grep 'Static helm' -A4| grep "version: " | sed -e 's/"//g' -e 's/version:[ ]//' -e 's/^ */v/g'

3. Run the following command to template the Astronomer Airflow Helm chart and fetch its rendered image tags:

   $
   helm template --version <your-astronomer-airflow-chart-version> astronomer/airflow --set airflow.postgresql.enabled=false --set airflow.pgbouncer.enabled=true --set airflow.statsd.enabled=true --set airflow.executor=CeleryExecutor | grep "image: " | sed -e 's/"//g' -e 's/image:[ ]//' -e 's/^ *//g' | sort | uniq

   Note: The Astronomer Airflow Helm Chart version begins with the letter v and is versioned separately from Astronomer Software and Airflow.

These commands generate a list of images required for your version of Astronomer. Add these images to a private image registry hosted within your organization’s network. In Step 3, you will specify this private registry in your Astronomer configuration.

Step 3: Add images to your values.yaml file

Regardless of whether you choose to mirror or manually pull/push images to your private registry, the returned images and/or tags must be made accessible within your network.

To make these images accessible to Astronomer, specify your organization’s private registry in the global section of your values.yaml file:

1
global:
2
  privateRegistry:
3
    enabled: true
4
    repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo
5
    # secretName: ~

This configuration automatically pulls most Docker images required in the Astronomer Helm chart. You must also configure the following images individually in a separate section of your values.yaml file:

1
astronomer:
2
  houston:
3
    config:
4
      deployments:
5
        helm:
6
          runtimeImages:
7
            airflow:
8
              repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/astro-runtime
9
            flower:
10
              repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/astro-runtime
11
          airflow:
12
            defaultAirflowRepository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-airflow
13
            defaultRuntimeRepository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/astro-runtime
14
            images:
15
              airflow:
16
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-airflow
17
              statsd:
18
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-statsd-exporter
19
              redis:
20
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-redis
21
              pgbouncer:
22
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-pgbouncer
23
              pgbouncerExporter:
24
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-pgbouncer-exporter
25
              gitSync:
26
                repository: 012345678910.dkr.ecr.us-east-1.amazonaws.com/myrepo/astronomer/ap-git-sync

Step 4: Fetch Airflow Helm charts

There are two Helm charts required for Astronomer:

• The Astronomer Helm chart for the Astronomer Platform
• The Astronomer Airflow Helm chart for Airflow deployments in Astronomer Platform

The Astronomer Helm chart can be downloaded using helm pull and applied locally if desired.

Commander, which is Astronomer’s provisioning component, uses the Astronomer Airflow Helm chart to create Airflow deployments. You have two options to make the Helm chart available to Commander:

• Use the built-in Astronomer Airflow Helm chart in the Commander Docker image.
• Host the Astronomer Airflow Helm chart within your network. Not every cloud provider has a managed Helm registry, so you might want to check out JFrog Artifactory or ChartMuseum.

To use the built-in Astronomer Airflow Helm chart in the Commander Docker image, add the following configuration to your values.yaml file:

1
astronomer:
2
  commander:
3
    airGapped:
4
      enabled: true

To configure a self-hosted Helm chart, add the following configuration to your values.yaml file:

1
# Example URL - replace with your own repository destination
2
global:
3
  helmRepo: "http://artifactory.example.com:32775/artifactory/astro-helm-chart"

Step 5: Fetch Airflow updates

By default, Astronomer checks for Airflow updates once a day at midnight by querying https://updates.astronomer.io/astronomer-runtime, which returns a JSON file with version details. However, this URL is not accessible in an airgapped environment. There are several options for making these updates accessible in an airgapped environment:

• You can download the JSON and host it in a location that’s accessible within your airgapped environment, for example:
  • AWS S3
  • Git
  • Nginx (example below)
• You can disable the update checks (not advised)

This setup assumes that the updates JSON will be manually downloaded and added to your environment. For guidance on how to automate this process, reach out to your Astronomer contact.

Exposing Airflow updates using an Nginx endpoint

The following topic provides an example implementation of hosting the Airflow updates JSON files in your airgapped environment and accessing them via an Nginx endpoint. Depending on your organization’s platform and use cases, your own installation might vary from this setup.

To complete this setup:

1. Host an updates JSON in a Kubernetes configmap by running the following commands:

   $
   $ curl -L https://updates.astronomer.io/astronomer-certified --output astronomer-certified.json
   $
   $ curl -L https://updates.astronomer.io/astronomer-runtime --output astronomer-runtime.json
   $
   $ kubectl create configmap astronomer-certified --from-file=astronomer-certified.json=./astronomer-certified.json -n astronomer
   $
   $ kubectl create configmap astronomer-runtime --from-file=astronomer-runtime.json=./astronomer-runtime.json -n astronomer

2. Add an Nginx deployment and service configuration to a new file named nginx-astronomer-certified.yaml:

   1
   apiVersion: apps/v1
   2
   kind: Deployment
   3
   metadata:
   4
     name: astronomer-releases
   5
     namespace: astronomer
   6
   spec:
   7
     strategy:
   8
       type: Recreate
   9
     selector:
   10
       matchLabels:
   11
         app: astronomer-releases
   12
     template:
   13
       metadata:
   14
         labels:
   15
           app: astronomer-releases
   16
       spec:
   17
         containers:
   18
         - name: astronomer-releases
   19
           image: ap-nginx-es
   20
           resources:
   21
             requests:
   22
               memory: "32Mi"
   23
               cpu: "100m"
   24
             limits:
   25
               memory: "128Mi"
   26
               cpu: "500m"
   27
           ports:
   28
           - containerPort: 8080
   29
           volumeMounts:
   30
           - name: astronomer-certified
   31
             mountPath: /usr/share/nginx/html/astronomer-certified
   32
             subPath: astronomer-certified.json
   33
           - name: astronomer-runtime
   34
             mountPath: /usr/share/nginx/html/astronomer-runtime
   35
             subPath: astronomer-runtime.json
   36
         volumes:
   37
         - name: astronomer-certified
   38
           configMap:
   39
             name: astronomer-certified
   40
         - name: astronomer-runtime
   41
           configMap:
   42
             name: astronomer-runtime
   43
   ---
   44
   apiVersion: v1
   45
   kind: Service
   46
   metadata:
   47
     name: astronomer-releases
   48
     namespace: astronomer
   49
   spec:
   50
     type: ClusterIP
   51
     selector:
   52
       app: astronomer-releases
   53
     ports:
   54
     - port: 80
   55
       targetPort: 8080
   56
   ---
   57
   apiVersion: networking.k8s.io/v1
   58
   kind: NetworkPolicy
   59
   metadata:
   60
     name: astronomer-astronomer-releases-nginx-policy
   61
   spec:
   62
     ingress:
   63
     - from:
   64
       - namespaceSelector: {}
   65
         podSelector: {}
   66
       ports:
   67
       - port: 8080
   68
         protocol: TCP
   69
     podSelector:
   70
       matchLabels:
   71
         app: astronomer-releases
   72
     policyTypes:
   73
     - Ingress

   Note the Docker image in the deployment and ensure that this is also accessible from within your environment.

3. Save this file and apply it to your cluster by running the following command:

   1
   kubectl apply -f nginx-astronomer-releases.yaml

   The updates JSON will be accessible by the service name from pods in the Kubernetes cluster via http://astronomer-releases.astronomer.svc.cluster.local/astronomer-certified.json.

To validate if the updates JSON is accessible you have several options:

• If an image with curl is available in your network, you can run:

  $
  $ kubectl run --rm -it [container name] --image=[image] --restart=Never -- /bin/sh
  $
  $ curl http://astronomer-releases.astronomer.svc.cluster.local/astronomer-certified
  $
  $ curl http://astronomer-releases.astronomer.svc.cluster.local/astronomer-runtime

• If you have curl installed on your client machine:

  $
  $ kubectl proxy
  $
  # In a separate terminal window:
  $
  $ curl http://localhost:8001/api/v1/namespaces/astronomer/services/astronomer-releases/astronomer-certified
  $
  $ curl http://localhost:8001/api/v1/namespaces/astronomer/services/astronomer-releases/astronomer-runtime

• Complete the entire Software installation, then use one of the astro-ui pods which include bash and curl:

  $
  $ kubectl exec -it astronomer-astro-ui-7cfbbb97fd-fv8kl -n=astronomer -- /bin/bash
  $
  $ curl http://astronomer-releases.astronomer.svc.cluster.local/astronomer-certified
  $
  $ curl http://astronomer-releases.astronomer.svc.cluster.local/astronomer-runtime

No matter what option you choose, the commands that you run should return the updates JSON if the service was configured correctly.

Configuring a custom updates JSON URL

After you have made the updates JSON accessible within your premises, you must configure the Helm chart to fetch updates from the custom URL:

1
astronomer:
2
  houston:
3
    updateCheck: # There is a 2nd check for Astronomer platform updates but this is deprecated and not actively used. Therefore disable
4
      enabled: false
5
    updateAirflowCheck: # Configure URL for Airflow updates check
6
      url: http://astronomer-releases.astronomer.svc.cluster.local/astronomer-certified
7
    updateRuntimeCheck: # Configure URL for Airflow updates check
8
      url: http://astronomer-releases.astronomer.svc.cluster.local/astronomer-runtime
9
    config:
10
      deployments:
11
        helm:
12
          airflow:
13
            extraEnv:
14
            - name: AIRFLOW__ASTRONOMER__UPDATE_URL
15
              value: http://astronomer-releases.astronomer.svc.cluster.local/astronomer-runtime

Step 6: Install Astronomer using Helm

Before completing this step, double-check that the following statements are true:

• You made Astronomer’s Docker images, Astronomer Airflow Helm chart, and updates JSON accessible inside your network.
• You completed Steps 1 through 8 in the AWS, GCP, or Azure install guides.

After this check, you can install the Astronomer Helm chart by running the following commands, making sure to replace <your-version> with the version of Astronomer that you want to install:

$
curl -L https://helm.astronomer.io/astronomer-<your-version>.tgz -o astronomer.tgz
$
$
# Alternatively, use helm pull to pull the latest version of Astronomer
$
helm pull astronomer/astronomer
$
$
# ... If necessary, copy to a place where you can access Kubernetes ...
$
helm install astronomer -f values.yaml -n astronomer astronomer.tgz

After these commands finish, continue your installation with Step 10 (Verify pods are up) in the AWS, Azure, or GCP installation guide.