K8s Prod Deployment

[devopscaxsol]

Hey Team,

I am planning to deploy in AWS EKS. I have read production deployment guide.

I only have question , how to setup DAPS and pass environment in sovity?

any documentation for this?

Please suggest.

BR,

[tmberthold]

Hello and thank you for asking.

DAPS related deployment guides are in the DAPS repo: https://github.com/sovity/sovity-daps?tab=readme-ov-file#getting-started

[devopscaxsol]

OK.

but in that repo there not much mentioned about k8s deployment production mode. is there any specific we have about K8S deployment of edc-ce and daps?

Thanks

[tmberthold]

We do provide general guidance and recommendations on what to consider for deployments, which you can find in our deployment guides or Reamdes of the repos. For some components, such as the sovity EDC CE, we additionally offer examples like Docker Compose setups to assist in getting started.

However, we do not have extra infrastructure-specific deployment instructions besides the general deployment guides, such as for Kubernetes (K8S) production deployment.

Nevertheless, as these are open-source repos, we warmly welcome contributions! If you have any lessons learned or specific insights about deploying on K8S, feel free to share them and we could potentially integrate them into the repos to benefit the community.

[devopscaxsol]

Hey team,

I have deploy https://github.com/sovity/sovity-daps?tab=readme-ov-file#getting-started in my aws eks environment.

URL i exposed like https://daps.edc.local

Now I want to integrate it with edc-ce where there is few argument we need for production deployment like,

MY_EDC_PARTICIPANT_ID: "xxx"
EDC_OAUTH_TOKEN_URL: 'https://daps.test.mobility-dataspace.eu/token'
EDC_OAUTH_PROVIDER_JWKS_URL: 'https://daps.test.mobility-dataspace.eu/jwks.json'

So My question is what will be idle value for above 3 ?

when I am running edc in aws eks i am getting error logs something like below,

2024-12-06 08:21:07 Error booting runtime: No setting found for key edc.oauth.token.url
org.eclipse.edc.spi.EdcException: No setting found for key edc.oauth.token.url
at org.eclipse.edc.spi.system.configuration.ConfigImpl.getNotNullValue(ConfigImpl.java:198)
at org.eclipse.edc.spi.system.configuration.ConfigImpl.getString(ConfigImpl.java:58)
at org.eclipse.edc.iam.oauth2.Oauth2ServiceExtension.createConfig(Oauth2ServiceExtension.java:154)
at org.eclipse.edc.iam.oauth2.Oauth2ServiceExtension.initialize(Oauth2ServiceExtension.java:114)
at org.eclipse.edc.boot.system.injection.lifecycle.InitializePhase.initialize(InitializePhase.java:37)
at org.eclipse.edc.boot.system.injection.lifecycle.ExtensionLifecycleManager.initialize(ExtensionLifecycleManager.java:61)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
at org.eclipse.edc.boot.system.ExtensionLoader.bootServiceExtensions(ExtensionLoader.java:67)
at org.eclipse.edc.boot.system.runtime.BaseRuntime.bootExtensions(BaseRuntime.java:141)
at org.eclipse.edc.boot.system.runtime.BaseRuntime.boot(BaseRuntime.java:202)
at org.eclipse.edc.boot.system.runtime.BaseRuntime.boot(BaseRuntime.java:84)
at org.eclipse.edc.boot.system.runtime.BaseRuntime.main(BaseRuntime.java:72)

[tmberthold]

Hello, the three variables mentioned must be set for the EDC to start and function correctly when connected to a DAPS. If the DAPS has been deployed correctly, it must have a URL where the EDC can retrieve tokens from the DAPS (EDC_OAUTH_TOKEN_URL) and where the EDC can retrieve the JWKS information at any time from the DAPS (EDC_OAUTH_PROVIDER_JWKS_URL). The MY_EDC_PARTICIPANT_ID is also derived from the DAPS configuration of the EDC's client; it must match the referringConnector entry in order to be able to later use ParticipantId-Restricted Policies.

[devopscaxsol]

Hi,

I found 3 values as mentioned for above variables like this,

"token_endpoint": "https://xxxx/realms/master/protocol/openid-connect/token"

"jwks_uri": "https://xxxx/realms/master/protocol/openid-connect/certs",

and

how to get from edc client ? MY_EDC_PARTICIPANT_ID

any suggestion can you please guide for this.

Thanks

[devopscaxsol]

Hello Team,

I have deployed edc in eks. but now I am getting ERROR like ,

Public Certificate Not FOUND

2024-12-10 01:53:43 Initialized org.eclipse.edc.connector.transfer.TransferProcessCommandExtension
2024-12-10 01:53:43 Initialized OAuth2 Core Default Services
2024-12-10 01:53:43 Initialized OAuth2 Client
2024-12-10 01:53:43 Error booting runtime: Public certificate not found: 1
org.eclipse.edc.spi.EdcException: Public certificate not found: 1
at org.eclipse.edc.iam.oauth2.Oauth2ServiceExtension.lambda$initialize$0(Oauth2ServiceExtension.java:117)
at java.base/java.util.Optional.orElseThrow(Unknown Source)
at org.eclipse.edc.iam.oauth2.Oauth2ServiceExtension.initialize(Oauth2ServiceExtension.java:117)
at org.eclipse.edc.boot.system.injection.lifecycle.InitializePhase.initialize(InitializePhase.java:37)
at org.eclipse.edc.boot.system.injection.lifecycle.ExtensionLifecycleManager.initialize(ExtensionLifecycleManager.java:61)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)

Any suggestion on this how to and what to do? which certificates where we need to put?

Thanks

[tmberthold]

Hi, now you are kind of in the productive deployment guide. This CE version requires working Connector certificates to sign the DAT-request towards the DAPS. It's in here:
https://github.com/sovity/edc-ce/tree/main/docs/deployment-guide/goals/production#edc-backend-configuration

# DAPS Credentials
EDC_OAUTH_CLIENT_ID: '_your SKI/AKI_'
EDC_KEYSTORE: '_path to .jks file in container_'
EDC_KEYSTORE_PASSWORD: '_your keystore password_'
EDC_OAUTH_CERTIFICATE_ALIAS: 1
EDC_OAUTH_PRIVATE_KEY_ALIAS: 1

[devopscaxsol]

I have resolved all hurdles for EDC with K8s deployments and its done. Thanks

[tmberthold]

Perfect!