Skip to content

How-To: Webex Kubed

This page ports the procedures from the old docs/tools/kubernetes/how-to.md guide. Commands use placeholders where values are environment-specific or sensitive.

Create an ECR Repository for a Docker Image

  1. Open the wxcdi-observability/ecr.yaml file in the wbx3-application-groups repository.
  2. Add the image repository name and the correct artifact type using an existing WxCDI entry as the pattern.
  3. Open a pull request against the repository's current default branch.
  4. Add the onboarding label.
  5. Obtain the required application-group and platform review.
  6. Merge the approved change and confirm the onboarding pipeline created the repository.
  7. Verify it in the ECR synchronization portal before changing a Harness pipeline.

Repository: WebexPlatform/wbx3-application-groups

Create an ECR Repository for a Helm Chart

Use the same onboarding workflow as a Docker image, but declare the entry as the Helm-chart type expected by the application-group schema.

  1. Update application-groups/wxcdi-observability/ecr.yaml.
  2. Open a pull request and add the onboarding label.
  3. Complete review and merge.
  4. Confirm the onboarding pipeline succeeded.
  5. Search the ECR synchronization portal for the chart name.
  6. Publish a versioned chart through the managed chart pipeline.

Do not publish a chart manually before onboarding completes; the pipeline must own repository creation and permissions.

Log In to a Kubernetes Cluster

Prerequisites

  • Membership in the approved WxCDI Kubed access group/persona.
  • Membership in the wbx3-all MyID group.
  • Access to the required Keeper namespace through the approved WxCDI admin group.
  • vault-token-helper installed.
  • kubectl-wbx3 installed.
  • kubectl installed and no conflicting KUBECONFIG override.

The old guide recommends a specific historical kubectl-wbx3 version as a workaround for an mTLS issuer error. Do not pin to that version automatically; use the currently supported release from Webex Kubed and consult the platform owner if certificate issuance returns HTTP 403.

Keeper Authentication

  1. Open InfoSec Keeper.
  2. Select the approved namespace for the target environment.
  3. Authenticate with OIDC.
  4. Keep the token only in the active secured shell session.
export VAULT_ADDR=https://keeper.cisco.com
export VAULT_NAMESPACE=meetpaas/mccprod
vault login

Enter the token interactively when prompted. Do not include the token in the command line, shell history, screenshots, or documentation.

Kubed Login

Choose the cluster from Clusters & Access, then run:

export CLUSTER_NAME=<cluster-name>
export CLUSTER_DOMAIN=prod.infra.webex.com
export CNC_DOMAIN=prod.infra.webex.com
export CNC=mccprod
export VAULT_ADDR=https://keeper.cisco.com
export VAULT_NAMESPACE=meetpaas/mccprod

kubectl wbx3 login "${CLUSTER_NAME}" --role wxcdi-prod-admin

Verify the generated context before using it:

kubectl config current-context
kubectl auth can-i get pods --all-namespaces

The generated client certificate is temporary. Reauthenticate rather than copying the kubeconfig or certificate to another user or system.

View Available Helm Chart or Image Versions

  1. Open the ECR synchronization portal.
  2. Search for the exact image/chart name or wxcdi-observability.
  3. Open List of images for the intended repository.
  4. Record the tag and digest.
  5. Confirm the version was produced by the expected source commit and pipeline before selecting it in Helm values.

Generate an ECR Read/Write AppRole Credential

Privileged procedure

Generate AppRole Secret IDs only when authorized to manage the ECR pipeline identity. A Secret ID is a credential and must never be committed, pasted into chat/tickets, or retained in terminal output.

The wxcdi-ecr-readwrite persona is defined in the wbx3-application-groups repository.

  1. Authenticate to Keeper using the correct namespace and an identity allowed to manage the AppRole.
  2. Verify the AppRole path and policy in the persona source.
  3. Retrieve the current Role ID from Keeper. Do not copy a Role ID from documentation.
  4. Generate a new Secret ID through the approved Keeper workflow.
  5. Store the Secret ID directly in the managed Harness secret entry.
  6. Run a non-production authentication/build test.
  7. Revoke the superseded Secret ID after all consumers are verified.

The historical command shape is shown below without outputs:

export VAULT_NAMESPACE=<approved-namespace>
vault read auth/wxcdi-approle/role/wxcdi-ecr-readwrite/role-id
vault write -f auth/wxcdi-approle/role/wxcdi-ecr-readwrite/secret-id

Treat both command output and terminal scrollback as sensitive. Use the approved secure transfer mechanism to update Harness.

Manually Push an Image to ECR

Break-glass use only

Harness is the standard image publishing path. A manual push bypasses normal build evidence and should be used only under an approved change or incident procedure.

  1. Confirm the target ECR repository already exists.
  2. Build or obtain an image whose source commit, scan result, tag, and digest are known.
  3. Authenticate through the approved Keeper/AppRole helper and obtain short-lived AWS credentials in the current shell.
  4. Authenticate Docker without placing the password on the command line:
aws ecr get-login-password --region <aws-region> \
  | docker login --username AWS --password-stdin <ecr-registry>
  1. Tag and push the exact immutable version:
docker tag <local-image>:<tag> <ecr-registry>/<repository>:<tag>
docker push <ecr-registry>/<repository>:<tag>
  1. Record the resulting digest and compare it with the local image digest.
  2. Log out and clear temporary credentials:
docker logout <ecr-registry>
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
unset VAULT_TOKEN
  1. Update Helm configuration through pull request; do not modify a production Deployment directly.