1. Security Edge Protection Proxy (SEPP) Cloud Native Installation Guide
  2. SEPP Installation

4 SEPP Installation

Installation Preparation

This section explains the preparation required before deploying SEPP.

Table 4-1 Download Images and Helm files

Step # Procedure Description

1

img/icon.png 		Download the SEPP package file

Customers are required to download the SEPP package file from Oracle Software Delivery Cloud (OSDC). Package is named as follows: 

<nfname>-pkg-<marketing-release-number>.tgz

For example: ocsepp-pkg-1.2.0.0.0.tgz

Extracting "ocsepp-pkg-1.2.0.0.0.tgz" gives following :

  1. SEPP Docker Images File

    ocsepp-images-1.2.0.tar

  2. Helm File

    ocsepp-1.2.0.tgz

2

img/icon.png 		Untar the SEPP Package File

Untar the SEPP package to the specific repository 

tar -xvf <<nfname>-pkg-<marketing-release-number>>.tgz
  1. SEPP Docker Images File

    ocsepp-images-1.2.0.tar

  2. Helm File

    ocsepp-1.2.0.tgz

  3. Readme txt

    Readme.txt

3

img/icon.png 		Check the checksums Check the checksums of tarballs mentioned in Readme.txt. Refer to Readme.txt for the commands and checksum details.

4

img/icon.png 		Load the tarball to system

Execute the following command to push the docker images to docker registry: 

docker load --input <image_file_name.tar>

"ocsepp-images-1.2.0.tar" contains following docker images:

  1. ocsepp/server:1.2.0
  2. ocsepp/client:1.2.0
  3. ocsepp-nsregistration:1.2.0
  4. istio/pilot:1.2.0
  5. istio/proxyv2:1.2.0
  6. istio/node-agent-k8s:1.2.0

5

img/icon.png 		Push docker files to Docker registry (optional step) Execute the following command to push the docker files to docker registry: 
docker tag <image-name>:<image-tag> <docker-repo/<image-name>:<image-tag>

E.g: docker tag ocsepp/server:1.2.0 repo1/ocsepp1/server:1.2.0
docker push <docker_repo>/<image_name>:<image-tag>

E.g: docker push repo1/ocsepp1/server:1.2.0

7

img/icon.png 		Push helm files to helm repository Execute the following command to push the helm files to helm repository: 
helm push <helm_repo> <image_name>.tgz
E.g: helm push repo1 ocsepp-1.2.0.tgz

SEPP Preparation

Following attribute values can be updated in ocsepp-custom-values-server-1.2.0.yaml and ocsepp-custom-values-client-1.2.0.yaml file:

Table 4-2 SEPP Parameters

Attribute Name Attribute Description
nsRegistration.nf.profile A new profile values for SEPP
nsRegistration.nrf.host NRF server host
nsRegistration.nrf.port NRF server port
global.nsRegistration.image nrf client docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.nsRegistration.tag nrf client docker image tag
global.nsRegistration.pullPolicy nrf client docker image pull policy
global.n32Client.image N32C client docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.n32Client.tag N32C client docker image tag
global.n32Client.pullPolicy N32C client docker image pull policy.
global.n32Server.image N32C server docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.n32Server.tag N32C server docker image tag
global.n32Server.pullPolicy N32C server docker image pull policy
global.mysql.image mysql docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.mysql.tag mysql docker image tag
global.mysql.pullPolicy mysql docker image pull policy
global.pilot.image Istio pilot docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.pilot.tag Istio pilot docker image tag
global.pilot.pullPolicy Istio pilot docker image pull policy
global.proxy.image Istio proxy docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.proxy.tag Istio proxy docker image tag
global.proxy.pullPolicy Istio proxy docker image pull policy
global.sds.image Istio SDS docker image name. format is <repository name:port>/<image name>. if images is hosted locally then format is <image name>
global.sds.tag Istio SDS docker image tag
global.sds.pullPolicy Istio SDS docker image pull policy
config.localsepp.scp.ip IP address of SCP NF.
config.localsepp.scp.port Port of SCP NF.
config.localsepp.domain domain for Local SEPP
config.localsepp.securityCapability Security Capability supported by Local SEPP.
config.localsepp.tls.certificate Certificate
config.localsepp.tls.privateKey Private Key
config.remotesepps.domain Domain for Remote SEPP
config.remotesepps.caCertificate CA Certificate
config.remotesepps.n32c.ip N32C ip address
config.remotesepps.n32c.port N32C port
config.remotesepps.n32f.ip N32F ip address
config.remotesepps.n32f.port N32F port

SEPP Deployment

This section describes the steps to deploy SEPP Server and Client on CNE. The SEPP Server and the Client must be deployed in different clusters.

Server Deployment

This procedure describes the steps to deploy SEPP Server on CNE.

Table 4-3 SEPP Server Deployment

Step # Procedure Description

1

img/icon.png 		Prepare custom_values_server.yaml file

Prepare a custom_values_server.yaml file with the required parameter information. Refer to Server Yaml File for sample YAML file.

2

img/icon.png 		Navigate to the directory where ocsepp-1.2.0.tgz is extracted Navigate to the directory where ocsepp-1.2.0.tgz is extracted

3

img/icon.png 		Deploy SEPP Server Execute the following command:

helm install ocsepp-server/ --name <deployment_name> --namespace <namespace_name> -f <customized_server_yaml_file.yaml>

Where:

deployment_name and namespace_name: depends on customer configuration

customized_yaml_file.yaml: Yaml file after modifying the values based on the requirement.

4

img/icon.png 		Check repo status Execute helm ls to check the deployment status.

5

img/icon.png 		Check svc status Check if all the services are deployed and running:

kubectl -n <namespace_name> get services

Note: Status must be Running and Ready must be 1/1.

6

img/icon.png 		Verify SEPP deployment Execute command helm status <deployment_name> and verify deployment, pod and service status should be up.

Client Deployment

This procedure describes the steps to deploy SEPP Client on CNE.

Table 4-4 SEPP Client Deployment

Step # Procedure Description

1

img/icon.png 		Prepare custom_values_client.yaml file

Prepare a custom_values_client.yaml file with the required parameter information. Refer to Client Yaml File for sample YAML files.

2

img/icon.png 		Navigate to directory where ocsepp-1.2.0.tgz is extracted on Master node Navigate to directory where ocsepp-1.2.0.tgz is extracted on Master node :

3

img/icon.png 		Deploy SEPP Client Execute the following command:

helm install ocsepp-client/ --name <deployment_name> --namespace <namespace_name> -f <customized_client_yaml_file.yaml>

Where:

deployment_name and namespace_name: depends on customer configuration

customized_yaml_file.yaml: Yaml file after modifying the client parameter values based on the requirement.

Note: "SEPP Server Deployment" and "SEPP Client Deployment" should be deployed on SEPP2 and SEPP1 respectively as well to have both mode working on both SEPP nodes. Enable either Server or Client mode is supported per SEPP.

4

img/icon.png 		Check repo status Execute helm ls to check the deployment status.

5

img/icon.png 		Check svc status Check if all the services are deployed and running:

kubectl -n <namespace_name> get services

Note: Status must be Running and Ready must be 1/1.

Uninstall SEPP

Following sections explain the procedure to uninstall SEPP server and client.

Uninstall SEPP

Table 4-5 Uninstall SEPP

Step # Procedure Description

1

img/icon.png 		Uninstall SEPP client Execute command to uninstall SEPP client: 
helm delete sepp-client --purge

2

img/icon.png 		Uninstall SEPP Server Execute command to uninstall SEPP server: 
helm delete sepp-server --purge