Introduction

The Modern Kubernetes Dashboard by Devtron provides a unified interface for managing and observing all Kubernetes resources across your clusters. It simplifies resource management by offering visualizations, RBAC controls, multi-cluster support, thus making it intuitive for you to view and manage your microservices.

Key Offerings

Discover how Devtron’s Modern Kubernetes Dashboard simplifies operations by managing all your clusters with the Resource Browser. Visualize Helm releases and ArgoCD/FluxCD apps easily, with fine-tuned RBAC controls and OCI registry support. The intuitive interface removes the complexity of Kubernetes, so you can focus on delivering great software and services.

Resource Browser

View and manage the resource kinds available across all your clusters.

Helm Release Management

Easily view, manage, and deploy your Helm releases.

Argo CD App Listing

Visualize your Argo CD apps across all your clusters on a single pane.

Flux CD App Listing

Visualize your Flux CD apps across all your clusters on a single pane.

Fine-Grained Access Control

User management with Single Sign-On (SSO) and Role-Based Access Control (RBAC) for enhanced security.

OCI Registry Support

Support to add your OCI registry for uploading and downloading helm charts.

For your advanced and challenging use-cases, Devtron offers enterprise-grade features too:

• Resource Watcher: Trigger webhook to notify about any intercepting changes to your resources.

• Advanced CEL Filtering: Filter Kubernetes resources with advanced CEL-based queries.

• Cluster & Helm Apps Catalog: Manage and browse the data of clusters and Helm apps using Catalog Framework.

• Simplified Kubeconfig Sharing: Get Kubeconfig file for gaining cluster access through your local machine.

• Fine-grained Access Control: Supports time-based access control for user management.

• Pod Restart Snapshot: View snapshots of Pod states for troubleshooting.

• Cluster Access via SSH & Proxy: Securely access clusters through SSH or proxy.

Search a Resource

You can use the searchbox to browse the resources.

Moreover, you can use filters that allow you to quickly filter your workload as per labels, field selectors, or CEL expression as shown below.

Resource Kinds

Resource kinds displayed upfront for you to manage:

• Nodes

• Events

• Namespaces

Further resources in the cluster are grouped under the following categories:

• Namespace

• Workloads

• Config & Storage

• Networking

• RBAC

• Administration

• Other Resources

• Custom Resource

Edit a Manifest

You can edit the manifest of a Kubernetes object. This can be for fixing errors, scaling resources, or changing configuration. Moreover, you can edit a manifest using YAML or GUI, as per your convenience.

Edit using YAML

View Events

You can monitor activities like creation, deletion, updation, scaling, or errors in the resources involved. Refer Events to learn more.

For events with warnings, you can take the assistance of AI. Clicking the Explain button will help you identify the root cause of the issue along with suggestions to fix those.

Delete a Resource

You can delete an unwanted resource if it is orphaned and no longer required by your applications.

Create a Resource

You can create one or more Kubernetes objects in your cluster using YAML. In case you wish to create multiple objects, separate each resource definition by three dashes (---).

Once you select a cluster in Resource Browser, click + Create Resource, and add the resource definition.

In the below example, we have created a simple pod named nginx:

Here's one more example that shows the required fields and object specifications for a Kubernetes Deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels: 
     app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
       app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
       - name: nginx
         image: nginx:1.14.2
         ports:
         - containerPort: 80

You can use the checkbox to select the resources/workloads you wish to delete or restart.

Bulk Delete

Bulk Restart

1. Add Helm Repo

Add the Devtron Helm repository to pull the necessary charts

helm repo add devtron https://helm.devtron.ai

2. Update Helm Repo

Update the Helm repo to ensure you are using the latest version.

helm repo update devtron

3. Install Dashboard

For EKS, AKS, GKE Users

helm install devtron devtron/devtron-operator \
--create-namespace --namespace devtroncd

For Minikube, MicroK8s, Kind, K3s Users

Click the relevant tab given below to get the command:

helm install devtron devtron/devtron-operator \
--create-namespace --namespace devtroncd \
--set components.devtron.service.type=NodePort 

kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml

helm install devtron devtron/devtron-operator \
--create-namespace --namespace devtroncd \
--set components.devtron.service.type=NodePort

For Cloud VM Users (AWS EC2, Azure VM, GCP VM)

It is recommended to use Cloud VM with 2vCPU+, 4GB+ free memory, 20GB+ storage, Compute Optimized VM type, and Ubuntu Flavoured OS.

First, create a MicroK8s Cluster:

sudo snap install microk8s --classic --channel=1.22
sudo usermod -a -G microk8s $USER
sudo chown -f -R $USER ~/.kube
newgrp microk8s
microk8s enable dns storage helm3
echo "alias kubectl='microk8s kubectl '" >> .bashrc
echo "alias helm='microk8s helm3 '" >> .bashrc
source .bashrc

Then use these commands after setting up MicroK8s:

helm install devtron devtron/devtron-operator \
--create-namespace --namespace devtroncd \
--set components.devtron.service.type=NodePort 

4. Get Dashboard URL

For EKS, AKS, GKE Users

Run the following command to get the dashboard URL:

kubectl get svc -n devtroncd devtron-service -o jsonpath='{.status.loadBalancer.ingress}'

Assuming you have an EKS cluster, you might get a similar message as shown below:

[test2@server ~]$ kubectl get svc -n devtroncd devtron-service -o jsonpath='{.status.loadBalancer.ingress}'
[map[hostname:aaff16e9760594a92afa0140dbfd99f7-305259315.us-east-1.elb.amazonaws.com]]

here, hostname aaff16e9760594a92afa0140dbfd99f7-305259315.us-east-1.elb.amazonaws.com is the Loadbalancer URL at which you can access the Devtron dashboard.

For Minikube, MicroK8s, Kind, K3s Users

minikube service devtron-service --namespace devtroncd

kubectl -n devtroncd port-forward service/devtron-service 8000:80

For Cloud VM Users (AWS EC2, Azure VM, GCP VM)

Get devtron-service port number using the following command:

kubectl get svc -n devtroncd devtron-service -o jsonpath='{.spec.ports[0].nodePort}'

The dashboard URL will be: http://<HOST_IP>:<nodeport>/dashboard

5. Get Admin Login credentials

By default, the username will be admin. Run the below command to get the admin password.

kubectl -n devtroncd get secret devtron-secret \
-o jsonpath='{.data.ADMIN_PASSWORD}' | base64 -d

Introduction

The Devtron Resource Browser provides you a central interface to view and manage all your Kubernetes objects across clusters. It helps you perform key actions like viewing logs, editing live manifests, and even creating/deleting resources directly from the user interface. This is especially useful for troubleshooting purposes as it supports multi-cluster too.

First, the Resource Browser shows you a list of clusters added to your Devtron setup. By default, it displays a cluster named 'default_cluster' after the initial setup is successful.

In the image above, you can see a visual display of the health status for all clusters connected to Devtron. If any node within a cluster encounters an issue and is not ready, it will be highlighted in red, allowing you to quickly address the problem.

If you are a superadmin, you can connect more clusters by clicking the Add Cluster button located at the top of the browser. This will take you to the Clusters page within Global Configurations.

You may click a cluster to view and manage all its resources as shown below.

Resource Utilization

This shows the combined CPU and memory consumption of all running pods in the cluster.

Errors in Cluster

This shows errors in the cluster. If no error is present in the cluster, Resource Browser will not display this section.

Readme

You can also include additional information about your cluster using the Markdown editor.

Whenever you upgrade your Kubernetes version, the API versions change and your workloads/resources may not be compatible with those API versions. Therefore, the resources need to be upgraded first. This could mean changing the API version of the resources itself or changing their outdated spec.

The Check Compatibility feature within Resource Browser scans your cluster and automatically identifies all such resources/workloads that need manual intervention before proceeding with an actual cluster upgrade.

Walkthrough

You can see the list of nodes available in your cluster. Typically you have several nodes in a cluster; in a learning or resource-limited environment, you might have only one node.

The components on a typical node include the kubelet, a container runtime, and the kube-proxy.

If you have multiple nodes, you can search a node by name or label in the search bar. The search result will display the following information about the node. To display a parameter of a node, use Columns on the right side, select the parameter to display from the drop-down list, and click Apply.

Clicking on a node shows you a number of details such as:

• CPU Usage and Memory Usage of Node

• CPU Usage and Memory Usage of Each Pod

• Number of Pods in the Node

• List of Pods

• Age of Pods

• Labels, Annotations, and Taints

• Node IP

Further using the Devtron UI, you will be able to:

• Debug a Node

• Cordon a Node

• Drain a Node

• Taint a Node

• Edit a Node Config

• Delete a Node

Debug a Node

You can debug a node via Cluster Terminal by selecting your namespace and image from the list that has all CLI utilities like kubectl, helm, netshoot etc. or can use a custom image, which is publicly available.

• Click Debug.
• Debug a node by selecting the terminal shell, i.e., bash or sh.

Cordon a Node

Cordoning a node means making the node unschedulable. After cordoning a node, new pods cannot be scheduled on this node.

• Click Cordon.
• A confirmation dialog box will appear, click Cordon Node to proceed.

The status of the node shows SchedulingDisabled with Unschedulable parameter set as true.

Similarly, you can uncordon a node by clicking Uncordon. After a node is uncordoned, new pods can be scheduled on the node.

Drain a Node

Before performing maintenance on a node, draining a node evicts all of your pods safely from a node. Safe evictions allow the pod’s containers to gracefully terminate and honour the PodDisruptionBudgets you have specified (if relevant).

After the node is drained, all pods (including those managed by DaemonSets) in the node will be automatically drained to other nodes in the cluster, and the drained node will be set to cordoned status.

• Click Drain.
• A confirmation dialog box will appear, click Drain Node to proceed.

You can also select from the following conditions before draining a node:

Taint a Node

Taints are key:value pairs associated with effect. After you add taints to nodes, you can set tolerations on a pod to allow the pod to be scheduled to nodes with certain taints. When you taint a node, it will repel all the pods except those that have a toleration for that taint. A node can have one or many taints associated with it.

Note: Make sure to check taint validations before you add a taint.

• Click Edit taints.
• Enter the key:value pairs and select the taint effect from the drop-down list.
• Click Save.

You can also add more taints using + Add taint button, or delete the existing taint by using the delete icon.

Edit a Node Config

This allows you to directly edit any node. It will open the editor which contains all the configuration settings in which the default format is YAML. You can edit multiple objects, although changes are applied one at a time.

• Go to the YAML tab and click Edit YAML.

• Make the changes using the editor.

• Click Review & Save changes to compare the changes in the YAML file.

• Click Apply changes to confirm.

Delete a Node

You can also delete a node by clicking the Delete button present on the right-hand side.

The node will be deleted from the cluster.

Before installing Devtron's Modern Kubernetes Dashboard, make sure to fulfill the following requirements:

Create a Kubernetes Cluster

You can create a cluster using one of the following cloud providers as per your requirements:

Recommended Resources

The minimum cluster resource requirements for installing Modern Kubernetes Dashboard (as per the number of applications you want to manage on Devtron) are provided below:

Install Helm

Next Steps

Manifest

Events

Logs

Examining your cluster's pods helps you understand the health of your application. By inspecting pod logs, you can check the performance and identify if there are any failures. This is especially useful for debugging any issues effectively.

Moreover, you can download the pod logs for ease of sharing and troubleshooting as shown in the below video.

Frequent pod restarts can impact your application as it might lead to unexpected downtimes. In such cases, it is important to determine the root cause and take actions (both preventive and corrective) if needed.

In case any of your pod restarts, you can view its details from the pod listing screen:

• Last pod restart event, along with the timestamp and message

• Reason behind restart

• Container log before restart

• Node status and events

Terminal

Launching Ephemeral Container

1. In the Resource Browser, select Pod within Workloads.

2. Use the searchbar to find and locate the pod you wish to debug. Click the pod.

3. Go to the Terminal tab

4. Click Launch Ephemeral Container as shown below.

   You get 2 tabs:

   1. Basic - It provides the bare minimum configurations required to launch an ephemeral container.

   It contains 3 mandatory fields:

   • Container name prefix - Type a prefix to give to your ephemeral container, for e.g., debug. Your container name would look like debug-jndvs.

   • Image - Choose an image to run from the dropdown. Ephemeral containers need an image to run and provide the capability to debug, such as curl. You can use a custom image too.

   • Target Container name - Since a pod can have one or more containers, choose a target container you wish to debug, from the dropdown.

User with super-admin access can now troubleshoot cluster issues by accessing the cluster terminal from Devtron. You can select an image from the list that has all CLI utilities like kubectl, helm, netshoot etc. or can use a custom image, which is publicly available.

To troubleshoot a cluster or a specific node in a cluster, click the terminal icon on the right side.

• You will see the user-defined name for the cluster in Devtron. E.g. default-cluster.

• Select the node you wish to troubleshoot from the Node drop-down. E.g. demo-new.

• Select the namespace from the drop-down list which you have added in the Environment section.

• Select the image from the drop-down list which includes all CLI utilities or you can use a custom image, which is publicly available.

• Select the terminal shell from the drop-down list (e.g. sh, bash) to troubleshoot a node.

Use Case - Debugging Pods

You can also create a pod for debugging which will connect to the pod terminal. To find out why a particular pod is not running, you can check Pod Events and Pod Manifest for details.

The Auto select option automatically selects a node from a list of nodes and then creates a pod. Alternatively, you can choose a node of your choice from the same dropdown for debugging.

The Debug Mode is helpful in scenarios where you can't access your node by using an SSH connection. Enabling this feature opens an interactive shell directly on the node. This shell provides unrestricted access to the node, giving you enhanced debugging capabilities.

• Check the current state of the pod and recent events with the following command:

kubectl get pods

• To know more information about each of these pods and to debug a pod depending on the state of the pods, run the following command:

kubectl describe pod <podname>

Here, you can see configuration information about the container(s) and pod (labels, resource requirements, etc.), as well as status information about the container(s) and pod (state, readiness, restart count, events, etc.). Click here to know more about pod lifecycle.

Preface

In Argo CD, a user manages one dashboard for one ArgoCD instance. Therefore, with multiple ArgoCD instances, the process becomes cumbersome for the user to manage several dashboards.

With Devtron, you get an entire Argo CD app listing in one place. This listing includes:

• Argo CD apps present in the cluster where Devtron is installed

• Argo CD apps present in other clusters you added to Devtron

View ArgoCD App Listing

In the ArgoCD Apps tab, select the cluster(s) from the dropdown to view the Argo CD apps available in the chosen cluster(s).

Advantages

Devtron also bridges the gap for ArgoCD users by providing additional features as follows:

• Single-pane View: All Argo CD apps will show details such as their app status, environment, cluster, and namespace together in one dashboard.

• Feature-rich Options: Clicking an Argo CD app will give you access to its logs, terminal, events, manifest, available resource kinds, pod restart log, and many more.

If you wish to run kubectl commands from your local system, you need to have access to your cluster. Traditionally, the kubeconfig file (./kube/config) helps you connect with the cluster from your local system.

Challenges in Kubeconfig

Kubeconfig becomes painstakingly difficult to maintain especially when it comes to:

• Granting or revoking access to the cluster for multiple people

• Changing the permissions and subsequently the access token

• Adding/Updating/Deleting the entries of cluster URLs and tokens

• Keeping a record of multiple kubeconfig files

Our Solution

Devtron helps in reducing the challenges and simplifying the maintenance of kubeconfig file through:

• Devtron's Proxy URL for Cluster - A standardized URL that you can use in place of your Kubernetes cluster URL.

• Devtron's Access Token - A kubectl-compatible token which can be generated and centrally maintained from Global Configurations → Authorization → API tokens.

Steps

Prerequisite: An API token with necessary permissions for the user(s) to access the cluster.

If you are not a super-admin and can't generate a token yourself, you can find the session token (argocd.token) using the Developer Tools available in your web browser as shown below.

There are 2 methods of getting kubeconfig in your system:

• Quick Method

• Manual Method

Quick Method

1. In Resource Browser, hover on the cluster name and click the Get kubeconfig icon.

1. Copy the commands and run them on your terminal.

Manual Method

1. Go to ~/.kube folder on your local machine and open the config file. Or you may create one with the following content:

apiVersion: v1
kind: Config
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://<devtron_host_name>/orchestrator/k8s/proxy/cluster/<cluster_name>
  name: devtron-cluster
contexts:
- context:
    cluster: devtron-cluster
    user: admin
  name: devtron-cluster
current-context: devtron-cluster
users:
- name: admin
  user:
    token: <devtron_token>

1. Edit the following placeholders in the server field and the token field:

1. Test the connection to the cluster by running any kubectl command, e.g., kubectl get ns or kubectl get po -A

Assume your applications are running in a Kubernetes cluster on cloud. Now, if you wish to test or debug them on your local machine, you can perform port forwarding. It creates a tunnel between a port on your machine and a port on a resource within your cluster. Therefore, you can access applications running inside the cluster as though they are running locally on your machine.

Once you have successfully connected to the cluster, you may run the port-forward command. Refer kubectl port-forward to see a few examples.

View Helm Apps

1. From the left pane, go to Applications.

2. Click the Helm Apps tab.

You can see the Helm Apps available in your cluster. If you have connected more than one cluster to Devtron, you can use the Cluster selection dropdown to view the respective Helm Apps in your other clusters.

Deploy Helm Charts

1. Discover the Chart from Chart Store

• Select the Charts section from the left pane, you will be landed to the Chart Store page.

• Search nginx or any other charts in search filter.
• Click on chart and it will redirect you to Chart Details page where you can see a number of instances deployed by using the same chart.

2. Configure the Chart

• You may refer the README.md attached to the chart to know more about the chart configurations.
• Click Configure & Deploy and enter the following details:
• Once you choose a preferred chart version, chart value, and update the values.yaml using the editor, click Deploy to deploy the chart.

Create a Preset Value

• You can use the default values or create preset value by clicking on Create preset value.
• You can name your preset value, select a chart version, and change the configurations in the YAML file using the editor.
• Click on Save Value to save the template, and go back and choose your template from the dropdown for deployment.

3. Check Deployment Status

After clicking the Deploy button, you will land on the App Details page that shows the status of the chart deployment.

The status of the chart should be Healthy. It might take a few seconds after initiating the deployment of the chart. In case the status of the deployment shows Degraded or if takes a long time to get deployed, click Details in Application Status section on the same page or check the logs of the pods to debug the issue.

1. Shows status of deployed chart.

2. Shows the controller service accounts being used.

3. In the Configure tab, you can update, upgrade, or delete your chart instance.

4. From the Chart used section you can go to the charts page where you can see all the running instances of this chart.

5. Click the Deployment history tab to view the deployment history of Helm application and values.yaml corresponding to the deployment.

Update or Upgrade Helm Chart

• For update, you can change its Chart Version or values.yaml and then click Update And Deploy.
• For upgrade, click on Helm Chart field, search a chart name, change its values corresponding, and click Update And Deploy.
• After an update or upgrade, you will land on the App Details page where you can check the pods and service name.

5. Delete Chart Instances

Clicking on View Chart in Chart Used section in the App Details page will redirect you to the Chart Details page where you can see the number of instances installed by that chart along with an option to delete those chart instances too.

An incident response if delayed can impact businesses, revenue, and waste valuable engineering time. Devtron's Resource Watcher enables you to perform automated actions upon the occurrence of events:

• Create Event - Occurs when a new Kubernetes resource is created, for e.g., a new pod spun up to handle increased traffic.

• Update Event - Occurs when an existing Kubernetes resource is modified, for e.g., deployment configuration tweaked to increase the replica count.

• Delete Event - Occurs when an existing Kubernetes resource is deleted, for e.g., deletion of an orphaned pod.

You can make the Resource Watcher listen to the above events and accordingly trigger a webhook to notify the relevant party. Since manual intervention is absent, the timely response of this auto-remediation system improves your operational efficiency.

Creating a Watcher

This page allows you to create a watcher to track events and trigger a webhook. It also shows the existing list of watchers (if any).

1. Click + Create Watcher.
2. Creating a watcher consists of 4 parts, fill all the sections one by one:

Basic Details

Here, you can give a name and description to your watcher.

Namespaces to Watch

• You can watch the namespace(s) across All Clusters (existing and future).
• Or you can watch namespace(s) of Specific Clusters.

Intercept Change in Resources

Here, you can select the exact Kubernetes resource(s) you wish to track for changes (in the namespace(s) you selected in the previous step).

• You can choose the resource from the Resource kind(s) to watch dropdown. Enter the Group/Version/Kind (GVK) if it's a custom resource definition (CRD), for e.g., install.istio.io/v1apha1/IstioOperator

• Choose the event type your watcher should listen to: Created, Updated, Deleted.

Example: DEVTRON_FINAL_MANIFEST.status.currentReplicas == DEVTRON_FINAL_MANIFEST.spec.maxReplicas

Execute Runbook

Here, you can set up a webhook to receive notifications when specified changes in Kubernetes resources are detected.

• Webhook URL: Here, you'll provide the Webhook URL where you want the payload delivered. It must be valid and reachable for the watcher to work properly.

• Header Key-Value: Fill in any relevant header key-value pairs necessary for authentication or to include additional metadata for the receiving endpoint.

• Payload: Define what you want to deliver to the Webhook when this watcher is triggered. You can customize this payload with information related to changes in the intercepted resources. You can pass the properties of resource manifest in the webhook payload using the following keys:

  • To access initial resource manifest use DEVTRON_INITIAL_MANIFEST

  • To access final resource manifest use DEVTRON_FINAL_MANIFEST

  The above keys return values as stringified JSON

Click Create Watcher. Your watcher is now ready to intercept the changes to the selected resources.

Viewing Intercepted Changes

Details

This page allows you to view the changes to Kubernetes resources that you have selected for tracking changes.

It comes with the following items to help you locate the resource, where the event has been intercepted:

• Searchbox

• Cluster filter

• Namespace filter

• Action filter (event type, i.e., Created, Updated, Deleted)

• Watcher filter (to check the intercepted changes of a specific watcher)

You get the following details in the results shown on the page.

Change in Resource

You can check the changes in manifest by clicking View Manifest in Change In Resource column.

Use Cases

Live Stream Traffic Surge

A live streaming sports application experiences a surge in viewers during a major game. The Horizontal Pod Autoscaler (HPA) might not be able to handle the unexpected traffic if it's capped at a low max replica count.

1. Create a watcher named 'Live Stream Scaling Alert'.

2. Monitor updates to HPA resource in the application's namespace.

3. When currentReplicas count reaches maxReplicas, trigger a webhook to intimate the concerned users.

Pod Health Monitoring

A stock trading application constantly updates stock prices for its traders. If the pods become unhealthy, traders might see incorrect stock prices leading to bad investments.

1. Create a watcher named 'Pod Health Monitor'.

2. Track the pod workload of your application, if DEVTRON_FINAL_MANIFEST.status.phase != 'Running', trigger a webhook to notify the stakeholders.

If you have helm charts stored in your OCI registry, you can add the OCI registry to Devtron's Modern Kubernetes Dashboard and pull those helm charts to Devtron's [Chart Store].

You can configure an OCI registry using any registry provider of your choice, including:

• ECR

• Docker

• Azure

• Artifact Registry (GCP)

• Quay

Add Registry

1. From the left sidebar, go to Global Configurations → OCI Registry.
2. Click Add Registry.
3. Choose a provider from the Registry provider dropdown. View the Supported Registry Providers.
4. Under Registry type, you get the following options:

   • Private Registry: Choose this if your artifacts are hosted or should be hosted on a private registry restricted to authenticated users of that registry. Selecting this option requires you to enter your registry credentials (username and password/token).

   • Public Registry: Unlike private registry, this doesn't require your registry credentials. Only the registry URL and repository name(s) would suffice.

5. Assuming your registry type is private, here are few of the common fields you can expect:

   Fields

   Description

   Name

   Provide a name to your registry

   Registry URL

   Provide the URL of your registry in case it doesn't come prefilled. Do not include oci://, http://, or /https:// in the URL.

   Authentication Type

   Use as chart repository
6. Click Save.

Use as Chart Repository

Unlike Helm repos, OCI registries do not have an index file to discover all the charts. If you have helm charts pushed to your OCI registry, you can use that registry as a chart repository.

Upon enabling this option, Devtron can use your OCI registry as the chart source and pull the helm charts to display them on your Chart Store for easy deployment.

Tutorial

Steps

Search your OCI registry in the list and click it.

In the List of repositories field, add your chart repo(s). The format should be username/chartname. You can find the username from your registry provider account.

Supported Registry Providers

ECR

Amazon ECR is an AWS-managed container image registry service. The ECR provides resource-based permissions to the private repositories using AWS Identity and Access Management (IAM). ECR allows both Key-based and Role-based authentications.

Before you begin, create an IAM user and attach the ECR policy according to the authentication type.

Provide the following additional information apart from the common fields:

Docker

Provide the following additional information apart from the common fields:

Azure

For Azure, the service principal authentication method can be used to authenticate with username and password. Visit this link to get the username and password for this registry.

Provide the following additional information apart from the common fields:

Artifact Registry (GCP)

JSON key file authentication method can be used to authenticate with username and service account JSON file. Visit this link to get the username and service account JSON file for this registry.

Provide the following additional information apart from the common fields:

Quay

Provide the following additional information apart from the common fields:

Other

Provide below information if you select the registry type as Other.

Preface

Flux CD doesn't have any official dashboard; however, Devtron supports the listing of your Flux CD apps in one dashboard.

With Devtron, you get an entire Flux CD app listing in one place. This listing includes:

• Flux CD apps present in the cluster where Devtron is installed

• Flux CD apps present in other clusters you added to Devtron

View FluxCD App Listing

In the FluxCD Apps tab, select the cluster(s) from the dropdown to view the Flux CD apps available in the chosen cluster(s).

(Optional) Once you choose cluster(s), you may use the Template Type dropdown to further filter your Flux CD app listing based on its type, i.e., Kustomization or Helmrelease.

Click any Flux CD app to view its details as shown below.

Advantages

Devtron also bridges the gap for Flux CD users by providing additional features as follows:

• Single-pane View: All Flux CD apps will show details such as their app status, environment, cluster, and namespace together in one dashboard.

• Feature-rich Options: Clicking an Flux CD app will give you access to its logs, terminal, events, manifest, available resource kinds, pod restart log, and many more.

Introduction

The Chart Store shows all the Helm Charts added to the Chart Repository/OCI registry connected to Devtron.

Refer Manage Helm Apps to know the process of deploy helm charts from the chart store.

Populating your Charts to the Chart Store

1. From the left sidebar, go to Chart Store.

2. You can find your chart(s) either by using the search bar or by selecting your chart source.

You have successfully pulled your charts to the chart store.

Unable to find your Charts?

Deprecated charts won't show up in the Chart Store unless you enable the Show deprecated charts filter as shown below

Or, you may try performing a chart resync as shown below:

Introduction

bitnami/mysql Helm chart bootstraps a single node MySQL deployment on a Kubernetes cluster using the Helm package manager.

1. Discover MySQL chart from Chart Store

Select Charts from the left panel to visit the Chart Store page. You will see numerous of charts on the page from which you have to find bitnami/mysql chart. You also can use the search bar to search the MySQL chart.

2. Configure the Chart

• After selecting the bitnami/mysql Helm chart, click on Configure & Deploy.
• Enter the following details, to deploy MySQL chart:

  Key

  Description

  App Name

  Name of the Chart

  Project

  Select the name of your Project in which you want to deploy the chart

  Environment

  Select the environment in which you want to deploy the chart

  Chart Version

  Select the latest Chart Version

  Chart Value

  Select the default value or create a custom value

Configure Values

Using GUI

Set the following parameters in the chart, to be later used to connect MySQL with your Django Application.

Using YAML

Apart from GUI, you can directly edit the values.yaml file using the editor as shown below:

Finally, click on Deploy Chart to deploy the Chart.

3. Check the Status of Deployment

After clicking on Deploy you will be redirected to app details page where you can see deployment status of the chart. The Status of the chart should be Healthy. It might take few seconds after initiating the deployment of the chart.

In case the Status, of the deployment is Degraded or takes a long time to get deployed. Click on the Status or check the logs of the pods to debug the issue.

4. Extract the Service Name

Copy the service name, it will be used to connect your application to MySQL.

Introduction

Let's assume that you are creating an application and want to use mongodb to store data of your application. You can deploy mongodb using bitnami/mongodb Helm chart and connect it to your application.

This guide will introduce you to how to deploy the mongoDB's Helm chart.

1. Discover the Chart from the Chart Store

Visit the Chart Store page by clicking on Charts present on left panel and find bitnami/mongodb Helm Chart. You also can search mongodb chart using the search bar.

2. Configure the Chart

• After selecting the bitnami/mongodb Helm chart, click on Configure & Deploy.
• Enter the following details before deploying the mongoDB chart:

Configure Values

Using GUI

Set the following parameters in the chart.

Using YAML

Click on Deploy Chart once you have finished configuring the chart.

3. Check the Status of Deployment

After clicking on Deploy Chart, you will be redirected to App Details page that shows the deployment status of the chart. The Status of the chart should be Healthy. It might take few seconds after initiating the deployment.

In case the status of the deployment is Degraded or takes a long time to get deployed, click on Status or check the logs of the pods to debug the issue.

4. Extract the Service name

Copy the service name, it will be used to connect your application to mongoDB.

Projects are the logical grouping of your applications so that you can manage and control the access level of users.

Add Project

1. To add a project name, go to the Projects section of Global Configurations.

2. Click Add Project.

3. Provide a project name in the field and click Save.

You can add more chart repositories to Devtron. Once added, they will be available in the All Charts section of the Chart Store. Note: After the successful installation of Devtron, click Refetch Charts to sync and download all the default charts listed on the dashboard.

Add Chart Repository

1. From the left sidebar, go to Global Configurations → Chart Repositories.
2. Click Add repository.
3. You can connect public and private chart repositories on Devtron.
4. Provide the following information in each field:

   Fields

   Description

   Name

   Provide a Name for your chart repository. This name is used as a prefix for the chart names listed in the Helm chart section of your application.

   URL

   Enter the URL of your chart repository. For example: https://charts.bitnami.com/bitnami

   Username

   For private repositories, provide the username required for access.

   Password

   Enter the password associated with the username.

5. Check this box 'Allow Insecure Connection' if you want to allow insecure connections, such as HTTP connections, which may not verify SSL certificates.

Update Chart Repository

You can also update your saved chart repository settings.

1. Click the chart repository which you want to update.

2. Modify the required changes and click Update to save you changes.

Note:

• You can perform a dry run to validate the below chart repo configurations by clicking Validate.

• You can enable or disable your chart repository. If you enable it, then you will be able to see the enabled chart in All Charts section of the Chart Store.

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID

• clientSecret

Values to Provide

• redirectURI (provided in SSO Login Services by Devtron)

Reference

• View Google Documentation

• View Dex IdP Documentation

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID

• clientSecret

Values to Provide

• redirectURI (provided in SSO Login Services by Devtron)

Reference

• View GitLab Documentation

• View Dex IdP Documentation

This documentation helps you deploy a few Helm Charts available on Devtron.

Parts of Documentation

Introduction

Add Kubernetes Cluster

Use this option to add a managed or on-premise Kubernetes cluster.

1. Go to Global Configurations → Clusters & Environments.

2. Click the Add Cluster button on the top-right corner.

1. You can choose to add your Kubernetes cluster using either of the following methods:

Add Clusters Using Server URL & Bearer Token

To add a Kubernetes cluster on Devtron using a Server URL and bearer token, provide the information in the following fields:

Add Clusters Using Kubeconfig

To add clusters using kubeconfig, follow these steps:

1. First, navigate to the global configurations menu, and then go to "clusters and environment" section.

2. Click on the Add cluster button. In the options provided, choose the From kubeconfig option.

3. Next, either paste the kubeconfig file or browse for it and select the appropriate file.

4. Afterward, click on the Get cluster button. This action will display the cluster details alongside the kubeconfig.

1. Select the desired cluster and click on Save to successfully add the cluster to Devtron.

Add Environment

Once you have added your cluster in the Clusters & Environments, you can add the environment by clicking Add environment.

A new environment window pops up.

Click Save and your environment will be created.

Update Environment

• You can also update an environment by clicking the environment.

• You can change Production and Non-Production options only.

• You cannot change the Environment Name and Namespace Name.

• Make sure to click Update to update your environment.

Extras

Get Cluster Credentials

You can get the Server URL and Bearer Token by running the following command depending on the cluster provider:

Benefits of Self-hosted URL

• Disaster Recovery:

  • It is not possible to edit the server URL of a cloud specific provider. If you're using an EKS URL (e.g. *****.eu-west-1.elb.amazonaws.com), it will be a tedious task to add a new cluster and migrate all the services one by one.

  • But in case of using a self-hosted URL (e.g. clear.example.com), you can just point to the new cluster's server URL in DNS manager and update the new cluster token and sync all the deployments.

• Easy Cluster Migrations:

  • In case of managed Kubernetes clusters (like EKS, AKS, GKE etc) which is a cloud provider specific, migrating your cluster from one provider to another will result in waste of time and effort.

  • On the other hand, migration for a self-hosted URL is easy as the URL is of single hosted domain independent of the cloud provider.

The Authorization section describes how to authenticate and authorize access to resources, also managing role-based access levels in Devtron.

Access can be granted to a user via:

• SSO Login Services

• User Permissions

• Permission Groups

• API Tokens

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID

• clientSecret

Values to Provide

• redirectURI (provided in SSO Login Services by Devtron)

Reference

• View GitHub Documentation

• View Dex IdP Documentation

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID

• clientSecret

Values to Provide

• redirectURI (provided in SSO Login Services by Devtron)

Reference

• View Okta Documentation

• Configure Keycloak SSO

• Configure Okta SSO

• View Dex IdP Documentation

Prerequisites

Tutorial

Steps on Okta Admin Console

Once your Okta org is set up, create an app integration on Okta to get a Client ID and Client Secret.

1. In the Admin Console, go to Applications → Applications.

2. Click Create App Integration.

3. Select OIDC - OpenID Connect as the Sign-in method.

1. Select Web as the application type and click Next.

2. On the App Integration page:

   • Give a name to your application.

   • Select the Interaction Code and Refresh Token checkbox.

   • Now go to Devtron's Global Configurations → SSO Login Services → OIDC.

   • Copy the redirect URI given in the helper text (might look like: https://xxx.xxx.xxx/xxx/callback).

   • Return to the Okta screen, and remove the prefilled value in Sign-in redirect URIs.

   • Paste the copied URI in Sign-in redirect URIs.

   • Click Save.

3. On the General tab:

   • Note the Client ID value.

   • Click the Edit option.

   • In Client Authentication, choose Client Secret.

   • Click Save.

   • Click Generate new secret.

   • Note the Client Secret value.

Steps on Devtron

1. Go to the Global Configurations → SSO Login Services → OIDC.

2. In the URL field, enter the Devtron application URL (a valid https link) where it is hosted.

3. Under Configuration tab, locate the config object, and provide the clientID and clientSecret of the app integration you created on Okta.

5. Provide issuer value as https://${yourOktaDomain}. Replace ${yourOktaDomain} with your domain on Okta as shown in the video.

6. For providing redirectURI or callbackURI registered with the SSO provider, you can either select Configuration or Sample Script. Note that the redirect URI is already given in the helper text (as seen in the previous section).

7. Click Save to create and activate Okta SSO login.

Now your users will be able to log in to Devtron using the Okta authentication method. Note that existing signed-in users will be logged out and they have to log in again using their OIDC account.

Sample Configuration

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID
• clientSecret

Values to Provide

• redirectURI (already provided in SSO Login Services by Devtron)

Reference

Add User

To add a user, go to the Authorization > User Permissions section of Global Configurations. Click Add user.

There are two types of permissions in Devtron:

Assign Super admin permission

To assign a super admin access, go to the Authorization > User Permissions section of Global Configurations.

• Click Add user.

• Provide the email address of a user. You can add more than one email address. Please note that email address must be same as that in the email field in the JWT token returned by OIDC provider.

• Select Super admin permission and click Save.

Note:

• Only users with Super admin permission can assign super admin permissions to a user.

• We suggest that super admin access must be given to the selected users only.

Assign Specific permissions

To assign a specific permission, go to the Authorization > User Permissions section of Global Configurations.

• Click Add user.

• Provide the email address of a user. You can add more than one email address. Please note that email address must be same as that in the email field in the JWT token returned by OIDC provider.

• Select Specific permissions.

• Select the group permission from the drop-down list, if required.

Helm Apps Permissions

In Helm Apps option, you can provide access to a user to manage permission for Helm apps deployed from Devtron or outside Devtron.

Provide the information in the following fields:

You can add multiple rows for Helm app permission.

Once you have finished assigning the appropriate permissions for the users, Click Save.

Kubernetes Resources Permissions

Note: Only super admin users will be able to see Kubernetes Resources tab and provide permission to other users to access Resource Browser.

To provide Kubernetes resource permission, click Add permission.

On the Kubernetes resource permission, provide the information in the following fields:

Role-based Access Levels

Devtron supports the following levels of access:

1. View only: User with View only access has the least privilege. This user can only view the combination of environments and helm charts whose access is granted to that user. This user cannot view sensitive data like secrets used in the charts.

2. View and Edit: User with View and Edit access can view as well as edit the helm charts whose access is granted to that user.

3. Admin: User with Admin access can create, edit, delete, and view permitted Helm apps in the permitted projects.

You can add multiple rows for Kubernetes resource permission.

Once you have finished assigning the appropriate permissions for the users, Click Save.

Edit User Permissions

You can edit the user permissions by clicking the edit icon.

Edit the user permissions.

After you have done editing the user permissions, click Save.

If you want to delete the user/users with particular permissions, click Delete.

Sample Configuration

Values to fetch from LDAP

Devtron provides a sample configuration out of the box. Here are some values you need to fetch from your LDAP.

• bindDN

• bindPW

• baseDN

Reference

Sample Configuration

Values You Would Require at SSO Provider

Devtron provides a sample configuration out of the box. There are some values that you need to either get from your SSO provider or give to your SSO provider.

Values to Fetch

• clientID

• tenantID (required only if you want to use Azure AD for auto-assigning permissions)
• clientSecret

Values to Provide

• redirectURI (provided in SSO Login Services by Devtron)

Reference

The Resource Browser allows you to integrate monitoring graphs and dashboards from tools like Grafana, Kibana, Prometheus, and many more tools, with each cluster. This centralizes all monitoring visuals for your clusters in one place within Devtron, streamlining troubleshooting and significantly reducing manual effort.

It works similarly to a 'Single Pane of Glass (SPOG)' that displays data coming from different sources in a single unified view.

Tutorial

Steps

1. Go to Resource Browser and select your cluster.

2. Click the graph icon as shown below and click the Add Panel button.
3. Give a name to the monitoring dashboard and add the iframe code supplied by your graph/dashboard tool.
4. Click Save.

Once Devtron is installed, it has a built-in admin user with super-admin privileges having unrestricted access to all Devtron resources. We recommended to use this user only for initial and global configurations and then switch to local users or configure SSO-login.

Below are the SSO providers which are available in Devtron. Select one of the SSO providers (e.g., GitHub) to configure SSO:

Dex implements connectors that target specific identity providers for each connector configuration. You must have a created account for the corresponding identity provider and registered an app for client key and secret.

Refer the following documents for more detail.

• https://dexidp.io/docs/connectors/

• https://dexidp.io/docs/connectors/google/

Create SSO Configuration

• From the left sidebar, go to Global Configurations → Authorization → SSO Login Services

• Click any SSO Provider of your choice.

• In the URL field, enter the valid Devtron application URL where it is hosted.

• For providing redirectURI or callbackURI registered with the SSO provider, you can either select Configuration or Sample Script.

• Provide the client ID and client Secret of your SSO provider (e.g. If you select Google as SSO provider, then you must enter $GOOGLE_CLIENT_ID and $GOOGLE_CLIENT_SECRET in the client ID and client Secret respectively.)

• Select Save to create and activate SSO Login Service.

Note:

• Only single SSO login configuration can be active at one time. Whenever you create or update any SSO configuration, it will be activated and used by Devtron and previous configurations will be deleted.

• Except for the domain substring, URL and redirectURI remains same.

Update SSO Configuration

You can change SSO configuration anytime by updating the configuration and click Update. Note: In case of configuration change, all users will be logged out of Devtron and will have to login again.

Configuration Payload

• type : Any platform name such as (Google, GitLab, GitHub etc.)

• name : Identity provider platform name

• config : User can put connector details for this key. Platforms may not have same structure but common configurations are clientID, clientSecret, redirectURI.

• hostedDomains : Domains authorized for SSO login (e.g. gmail.com, devtron.ai)

Next Steps

Prerequisites

• Install and configure Keycloak on your server or cloud environment.

• Create a new realm in Keycloak for your application.

Steps on Keycloak Admin Console

Creating a Client

Here, we will add Devtron as a client for using Keycloak SSO.

1. In the Admin Console, go to Clients and click Create client.
2. Within General Settings:

   • Enter devtron in the Client ID field. We will use this ID while configuring SSO later in Devtron.

   • Enter Devtron in the Name field.
3. Within Capability config, turn on Client Authentication.
4. Within Login settings, enter https://<DEVTRON_BASE_URL>/orchestrator/api/dex/callback in the following fields.

   • Valid redirect URIs

   • Valid post logout redirect URIs

   • Web origins

   Click here to know where to find DEVTRON_BASE_URL.
5. Click Save.

Getting Client Secret

Here, we will obtain the secret we need while configuring SSO in Devtron.

1. Go to the Credentials tab of the client you created.
2. Use the copy button next to the Client Secret field and paste it somewhere for future reference.

Creating Users

Here, we will create a user that can log in to Devtron via SSO. We will assign a username and password that the user can enter while logging in to Devtron via Keycloak SSO.

1. In the Admin Console, go to Users and click Add user.

2. Give a username (e.g., usertest) in the Username field and enter the user's email address (e.g., usertest@example.com) in the Email field.
3. Click Create. Your user creation will be successful.

4. Go to the Credentials tab of the user you created.
5. Click Set password.

6. Enter the password and confirm it.

7. Click Save.

Retrieving Issuer URL

Here, we will obtain the Issuer URL we need while configuring SSO in Devtron.

1. In the Admin Console, go to Realm settings.

2. In the General tab, scroll down to the Endpoints field, and click the OpenID Endpoint Configuration link.
3. This will open a new page, copy the value of the key named issuer, and paste it somewhere for future reference.

Steps on Devtron

Configuring OIDC SSO

Here, we will set up an OIDC SSO and enter the values we obtained in the previous section.

1. Go to Global Configurations → SSO Login Services → OIDC.
2. Below the URL field, take the help of the Click to use option to populate the exact URL if the displayed one is incorrect.
3. In the Configuration editor, do the following:

   • In the issuer field, paste the URL you got while retrieving issuer URL.

   • In the clientID field, paste the ID you entered while creating the client.

   • In the clientSecret field, paste the secret you got under client credentials tab.

   • In the redirectURI field, make sure to enter the same redirect URI you gave in step 4 of client creation.
4. Click Save or Update to activate Keycloak SSO login.

Adding Users

Here, we will add the user we created in the Keycloak Admin Console. If this step is skipped, the user might not be able to log in to Devtron via Keycloak.

1. Go to Global Configurations → Authorization → User Permissions.

2. Click + Add Users.
3. In the Email addresses field, enter the email address of the user you created in Keycloak.
4. Assign necessary permissions to this new user. Refer user permissions to know more.

5. Click Save.

Now, you may log out and test the Keycloak OIDC login method using the user credentials. Clicking the Login with Oidc button will land you on Keycloak's login page.

External Links allow you to connect to the third-party applications within your Devtron dashboard for seamlessly monitoring/debugging/logging/analyzing your applications. You can select from the pre-defined third-party applications such as Grafana to link to your application for quick access.

Configured external links will be available on the App details page. You can also integrate Document or Folder using External Links.

Some of the third-party applications which are pre-defined on Devtron Dashboard are:

• Grafana

• Kibana

• Newrelic

• Coralogix

• Datadog

• Loki

• Cloudwatch

• Swagger

• Jira etc.