Skip to main content

VerteX Management Appliance

The VerteX Management Appliance is a solution for installing Palette VerteX on your infrastructure. It ships as a slim Appliance ISO paired with a Content bundle that you download separately. The ISO is used to boot the nodes, which are then clustered to form a Palette management cluster. You upload the content bundle after linking the nodes to provide the OS content and Palette VerteX packs needed to complete the installation.

Once Palette VerteX has been installed, you can download pack bundles and upload them to the internal Zot registry or an external registry. These pack bundles are used to create your cluster profiles. You will then be able to deploy clusters in your environment.

Third Party Packs​

There is an additional option to download and install the Third Party packs that provide complementary functionality to Palette VerteX. These packs are not required for Palette VerteX to function, but they do provide additional features and capabilities as described in the following table.

FeatureIncluded with Palette Third Party PackIncluded with Palette Third Party Conformance Pack
Backup and Restore✅❌
Configuration Security✅❌
Penetration Testing✅❌
Software Bill Of Materials (SBOM) scanning✅❌
Conformance Testing❌✅

Architecture​

The ISO file is built with the Operating System (OS), Kubernetes distribution, Container Network Interface (CNI), and Container Storage Interface (CSI). A Zot registry is also included in the Appliance Framework ISO. Zot is a lightweight, OCI-compliant container image registry that is used to store the Palette packs needed to create cluster profiles.

This solution is designed to be immutable, secure, and compliant with industry standards, such as the Federal Information Processing Standards (FIPS). The following table displays the infrastructure profile for the Palette VerteX appliance.

LayerComponentFIPS-compliant
OSUbuntu: Immutable Kairos✅
KubernetesPalette eXtended Kubernetes Edge (PXK-E)✅
CNICalico✅
CSIPiraeus✅
RegistryZot✅

Check the Component Updates in the Release Notes for the specific versions of each component as they may be updated between releases.

Supported Platforms​

The VerteX Management Appliance can be used on the following infrastructure platforms:

  • VMware vSphere
  • Bare Metal
  • Machine as a Service (MAAS)

Limitations​

  • Only public image registries are supported if you are choosing to use an external registry for your pack bundles.

Installation Steps​

Follow the instructions to install Palette VerteX using the VerteX Management Appliance on your infrastructure platform.

Prerequisites​

  • ISO management software installed on your local machine, such as mkisofs or genisoimage.

  • Access to the Artifact Studio to download the slim Palette VerteX ISO and the accompanying content bundle.

    tip

    If you do not have access to Artifact Studio, contact your Spectro Cloud representative or open a support ticket.

  • VerteX can be installed on a single node or on three nodes. For production environments, we recommend that three nodes be provisioned in advance for the Palette installation. We recommended the following resources for each node. Refer to the Palette Size Guidelines for additional sizing information.

    • 8 CPUs per node.

    • 16 GB memory per node.

    • Two disks per node.

      • The installation disk must be 300 GB minimum and 500 GB is recommended. This disk is used for the Palette VerteX ISO stack.

        You specify the device in the TUI as guided during the Install Palette VerteX steps.

        warning

        On legacy BIOS systems, the firmware attempts to boot devices in the order listed in the BIOS screen. To boot from the installed OS, the selected disk must be either the first device in the BIOS boot order or the only bootable device.

        If there are any partitions on the device you plan to use for the installation, you must delete them. For example, if the device is /dev/sda, issue the following command to delete all partitions on the device.

        wipefs --all /dev/sda
        danger

        Deleting partitions will erase all data on the device. Ensure that you back up any important data before proceeding.

      • Another disk must be at least 500 GB and is used for the storage pool. The default device selected is /dev/sdb. You can change the default device during the cluster creation steps in Local UI.

        danger

        This disk is wiped as part of the installation process. If using an existing disk, ensure that you back up any important data before proceeding.

    • At least one removable media connection must be available to attach the Palette VerteX ISO. This can be a physical or virtual connection depending on your infrastructure provider.

  • The following network ports must be accessible on each node for Palette to operate successfully.

    • TCP/443: Must be open between all Palette nodes and accessible for user connections to the Palette management cluster.

    • TCP/6443: Outbound traffic from the Palette management cluster to the deployed cluster's Kubernetes API server.

  • SSH access must be available to the nodes used for Palette installation.

  • Relevant permissions to install Palette on the nodes including permission to attach or mount an ISO and set nodes to boot from it.

    warning

    The ISO is only supported on Unified Extensible Firmware Interface (UEFI) systems. Ensure you configure the nodes to boot from the ISO in UEFI mode.

  • If you are using Proxmox Virtual Environment (VE) as the infrastructure provider for Palette, set the VM CPU type to host. The default setting in the Proxmox UI is typically different, and leaving it unchanged can result in MongoDB compatibility issues. For more information on CPU types, refer to the Proxmox VE documentation.

  • You can choose to use either an internal Zot registry that comes with Palette or an external registry of your choice. If using an external registry, you will need to provide the following information during the Palette installation process.

    • The DNS/IP endpoint and port for the external registry.
      • Ensure the nodes used to host the Palette management cluster have network access to the external registry server.
    • The username for the registry.
    • The password for the registry.
    • (Optional) The Certificate Authority (CA) certificate that was used to sign the external registry certificate in Base64 format.

    How to get Base64 encoded entries for a certificate

    You can get the Base64 encoded entry from your certificate by using the following command. Replace <certificate-file> with the filename of your certificate file.

    base64 --wrap 0 <certificate-file>

  • If you have an Ubuntu Pro subscription, you can provide the Ubuntu Pro token during the Palette installation process. This is optional but recommended for security and compliance purposes.

  • A virtual IP address (VIP) must be available for the Palette management cluster. This is assigned during the Palette installation process and is used for load balancing and high availability. The VIP must be accessible to all nodes in the Palette management cluster.

    How to discover free IPs in your environment

    You can discover free IPs in your environment by using a tool like arping or nmap. For example, you can issue the following command to probe a CIDR block for free IP addresses.

    nmap --unprivileged -sT -Pn 10.10.200.0/24

    This command will scan the CIDR block and output any hosts it finds.

    Example nmap output
    Nmap scan report for test-worker-pool-cluster2-6655ab7a-tyuio.company.dev (10.10.200.2)
    Host is up.
    All 1000 scanned ports on test-worker-pool-cluster2-6655ab7a-tyuio.company.dev (10.10.200.2) are in ignored states.
    Not shown: 1000 filtered tcp ports (no-response)

    For any free IP addresses, you can use arping to double-check if the IP is available.

    Example arping command
    arping -D -c 4 10.10.200.101
    Example arping output
    ARPING 10.10.200.101 from 0.0.0.0 ens103
    Sent 4 probes (4 broadcast(s))
    Received 0 response(s)

    If you receive no responses like the example output above, the IP address is likely free.

  • (Secure Boot only) If you enable Secure Boot on your server, register Spectro Cloud's trusted software certificate (MOK.der) so the appliance can boot and run storage components correctly. You can use either of the following methods:

    • BIOS method - Use one of the following collapsible sections below if your server supports uploading the certificate through firmware. This applies to Dell servers with Unified Extensible Firmware Interface (UEFI) and Hewlett Packard Enterprise (HPE) servers with iLO 5. Complete these steps before you boot the appliance ISO.

      Install Secure Boot on Hewlett Packard Enterprise iLO 5

      Before you begin, ensure that you have iLO 5 access with privileges to launch the remote console and change BIOS settings. You also need the MOK.der certificate file on your local computer. Skip to step 4 if you have already downloaded the certificate file.

      1. Navigate to Artifact Studio.
      2. Select the version corresponding to your Palette VerteX installer. Then, select Show Artifacts. The artifact list appears.
      3. Download the MOK Key for Secure Boot file.
      4. Power on or reboot the server. When prompted during Power-On Self-Test (POST), press F9 to enter System Utilities.
      5. Select System Configuration and press ENTER.
      6. Select BIOS/Platform Configuration (RBSU) > Server Security > Secure Boot Settings > Advanced Secure Boot Options.
      7. Select DB – Allowed Signatures Database > Enroll Signature. If Secure Boot is currently enabled, the Enroll Signature option will be unavailable. Temporarily disable Secure Boot and repeat the process.
      8. Drag the MOK.der file from your desktop onto the iLO Remote Console window. iLO mounts it as a virtual USB device automatically.
      9. Confirm any prompts.
      10. Verify that the new entry appears under DB – Allowed Signatures Database > View Signatures.
      11. Press ESC to exit the menus until the Save and Exit option is available.
      12. Save your changes. Exit the menu and reboot the server.
      Install Secure Boot on Dell Servers with UEFI

      Before you begin, you need the MOK.der certificate file on your local computer. Skip to step 4 if you have already downloaded the certificate file.

      1. Navigate to Artifact Studio.

      2. Select the version corresponding to your Palette VerteX installer. Then, select Show Artifacts. The artifact list appears.

      3. Download the MOK Key for Secure Boot file.

      4. Power on the server. Execute the following command to create a virtual CD/DVD drive containing an ISO file with the MOK.der certificate. Alternatively, you can save the file to a FAT32-formatted USB drive.

        mkisofs -output key.iso -volid cidata -joliet -rock MOK.der

      5. Reboot the server. When the Dell logo appears, press F2. The System Setup menu opens.

      6. Select System BIOS > Boot Settings.

      7. Ensure that the Boot Mode is set to UEFI.

      8. Press ESC to return to Boot Settings.

      9. Select System Security > Secure Boot Settings.

      10. Toggle Secure Boot to Enabled and Secure Boot Policy to Custom.

      11. Select Secure Boot Custom Policy Settings > Authorized Signature Database (db).

      12. Select Import New Entry. Then, select the virtual CD/DVD drive or USB drive containing the MOK.der file.

      13. Save your changes. Press ESC to return to Authorized Signature Database (db).

      14. Select View Entries. The MOK.der file shows in the database as DRBD Module Signing.

      15. Save your changes. Exit the menu and reboot the server.

    • MokManager method - Use this method if your BIOS does not support certificate upload or if BIOS enrollment did not load the storage module successfully. Boot the server from the appliance ISO, then complete the necessary steps in the Install section before selecting a disk.

Install Palette VerteX​

  1. Navigate to the Artifact Studio and log in. Under Install Palette VerteX, select the version to install and click Show Artifacts. Refer to the Artifact Studio guide for instructions on how to access and download artifacts.

    The following table describes the artifacts available for the VerteX Management Appliance.

    ArtifactDescription
    Content bundle (including Ubuntu)Content bundle to pair with the slim Appliance ISO. Includes the OS content and Palette VerteX packs.
    Appliance ISOSlim ISO without an embedded content bundle. Requires uploading the content bundle separately after installation.
    MOK Key for Secure BootMachine Owner Key (MOK) to use for secure boot with MokManager.

    Download both the Appliance ISO and Content bundle (including Ubuntu). Download the MOK Key for Secure Boot if you use secure boot on your host.

  2. Load the Palette VerteX ISO to a bootable device, such as a USB stick, or upload the ISO to a datastore in your VMware environment. You can use several software tools to create a bootable USB drive, such as balenaEtcher.

    • For VMware vSphere, you can upload the Palette VerteX ISO to a datastore using the vSphere Client or the govc CLI tool. Refer to the vSphere or govc documentation for more information.
    • For Bare Metal, you can use tools like scp or rsync to transfer the Palette VerteX ISO to the nodes, or use a USB drive to boot the nodes from the ISO.
    • For Machine as a Service (MAAS), you can upload and deploy ISOs using Packer. Refer to the MAAS documentation for more information.

    Ensure that the Palette VerteX ISO is accessible to all nodes that will be part of the Palette VerteX management cluster.

  3. Attach the Palette VerteX ISO to the nodes and ensure the boot order is set to boot from the Palette VerteX ISO first.

    For example, in VMware vSphere, the VMs will have the Palette VerteX ISO in CD/DVD drive 1. Refer to the documentation of your infrastructure provider for specific instructions on how to attach and boot from an ISO.

  4. Restart the nodes to start the installation process.

  5. Once the nodes have rebooted and entered the GRand Unified Bootloader (GRUB) menu, allow Palette VerteX to select the Palette Edge Interactive Installer boot option automatically.

    danger

    During the bootstrap process, the TUI performs a pre-installation check that checks all disks for partitions left behind by previous Kairos installations. This helps prevent stale partitions from causing unpredictable installation behavior.

    If any disks are affected, they are pre-selected for wiping; you can select additional disks as well. Wiping disks is optional and must be confirmed on the following screen. Carefully verify the selected disks before proceeding.

  6. (Secure Boot only) If you did not enroll the certificate through BIOS, expand the following section and complete the MokManager steps before you continue.

    Enroll DRBD Signing Key with MokManager

    Before you begin, you need Spectro Cloud's MOK.der certificate file on the server. Skip to step 5 if you already have the certificate file at /tmp/MOK.der.

    1. Navigate to Artifact Studio.

    2. In the section for your appliance, use the drop-down to the appropriate appliance version. Then, select Show Artifacts. The artifact list appears.

    3. Download the MOK Key for Secure Boot file.

    4. Copy the certificate file to your server at /tmp/MOK.der.

      scp <downloaded-filename>.der <username>@<node-ip>:/tmp/MOK.der

    5. On your server, copy mmx64.efi to the EFI boot partition. The appliance includes the file at /usr/lib/shim/mmx64.efi, but it may not be automatically copied to the EFI partition. MokManager needs this file at EFI/boot/mmx64.efi in order to launch at reboot. If your node uses a different disk, use lsblk -f to identify the FAT32 EFI partition, and replace /dev/sda1 in the following code block with the correct partition.

      MP=/tmp/cos_grub_fix
      mkdir -p "$MP"
      mount /dev/sda1 "$MP"
      install -m 0755 /usr/lib/shim/mmx64.efi "$MP/EFI/boot/mmx64.efi"
      ls -la "$MP/EFI/boot/"
      sha256sum /usr/lib/shim/mmx64.efi "$MP/EFI/boot/mmx64.efi"
      umount "$MP"
      rmdir "$MP"

    6. Verify both sha256sum outputs match. This confirms the copy is intact.

    7. Import the DRBD signing key.

      sudo mokutil --import /tmp/MOK.der
      tip

      If mokutil --import returns SKIP: already in db, the DRBD key is already enrolled in firmware db, which causes mokutil to skip the import. Remove the key from db first, using BIOS or racadm bioscert delete, and try again.

    8. When prompted, set a temporary password. This password is only used once.

    9. Confirm the import is queued. The DRBD signing key appears in the output.

      sudo mokutil --list-new

    10. Reboot the node.

      sudo reboot

    11. When the system reboots, a blue MokManager screen appears. Select Enroll MOK.

      tip

      If the blue MokManager screen does not appear at reboot, confirm mmx64.efi is present at \EFI\boot\mmx64.efi on the ESP. Repeat step 5 if it is not.

    12. Select View key 0 and confirm it is the DRBD signing key.

    13. Select Continue.

    14. Select Yes to confirm enrollment.

    15. Enter the temporary password you set in step 8.

    16. Select Reboot. The system continues booting normally.

    17. After boot, confirm the key is enrolled in the MOK list and visible to the kernel.

      sudo mokutil --list-enrolled | grep -i "DRBD Module Signing"

    18. Confirm the kernel has the key in its keyring. The DRBD signing key appears in at least one of these outputs.

      sudo keyctl list %:.machine 2>/dev/null | grep -i drbd
      sudo keyctl list %:.platform 2>/dev/null | grep -i drbd

  7. Once the Palette Edge Interactive Installer window appears, select the target disk for installation.

    danger

    Ensure you select the correct disk. The installation process erases all content on the target disk.

  8. Choose the post-installation action: nothing, reboot, or poweroff, then press ENTER.

  9. Review the Installation Summary.

  10. Press ENTER to start the installation.

  11. Wait for the installation process to complete. This will take at least 15 minutes, depending on the resources available on the nodes. If you selected the reboot option in step 7, the nodes will reboot and display the Palette TUI after completion. If you chose the poweroff action in step 7, power on the nodes.

  12. In the Palette TUI, provide credentials for the initial account. This account will be used to log in to Local UI and for SSH access to the node.

    FieldDescription
    UsernameProvide a username to use for the account.
    PasswordEnter a password for the account.
    Confirm PasswordRe-enter the password for confirmation.

    Press ENTER to continue.

  13. In the Palette TUI, the available configuration options are displayed and are described in the next three steps. Use the TAB key or the up and down arrow keys to switch between fields. When you make a change, press ENTER to apply the change. Use ESC to go back.

  14. In Hostname, check the existing hostname and, optionally, change it to a new one.

  15. In Network Adapter, select a network adapter to configure. By default, the network adapters request an IP automatically from the Dynamic Host Configuration Protocol (DHCP) server. The Classless Inter-Domain Routing (CIDR) block of an adapter's possible IP address is displayed in the Network Adapter screen without selecting an individual adapter.

    There are a few options you can configure for each network adapter.

    • You can change the IP addressing scheme of the adapter and choose static IP instead of DHCP. In Static IP mode, you need to provide a static IP address, subnet mask, and the address of the default gateway. Specifying a static IP removes the existing DHCP settings.

    • If desired, specify the VLAN ID. A VLAN ID enables you to logically segment network traffic on the same physical network interface, providing network isolation and enhanced traffic management. If you assign a VLAN ID, the host tags all outgoing packets from that adapter with the specified VLAN identifier.

    • You can also specify the Maximum Transmission Unit (MTU) for your network adapter. The MTU defines the largest size, in bytes, of a packet that can be sent over a network interface without needing to be fragmented.

  16. In DNS Configuration, specify the IP address of the primary and alternate name servers. You can optionally specify a search domain.

  17. After you are satisfied with the configurations, navigate to Quit and press ENTER to finish the configuration. Press ENTER again on the confirmation prompt.

    After a few seconds, the terminal displays the Device Info and prompts you to provision the device through Local UI.

    tip

    If you need to access the Palette TUI again, issue the palette-tui command in the terminal.

  18. Ensure you complete the configuration on each node before proceeding to the next step.

  19. Decide on the host that you plan to use as the leader of the group. Refer to Link Hosts for more information about leader hosts.

  20. Access the Local UI of the leader host. Local UI is used to manage the Palette VerteX nodes and perform administrative tasks. It provides a web-based interface for managing the Palette VerteX management cluster.

    In your web browser, go to https://<node-ip>:5080. Replace <node-ip> with the IP address of your node. If you have changed the default port of the console, replace 5080 with the Local UI port. The address of the Local UI console is also displayed on the terminal screen of the node.

    If you are accessing Local UI for the first time, a security warning may be displayed in your web browser. This is because Local UI uses a self-signed certificate. You can safely ignore this warning and proceed to Local UI.

  21. Log in to Local UI using the credentials you provided in step 11.

  22. (Optional) If you need to configure a HTTP proxy server for the node, follow the steps in the Configure HTTP-Proxy in Local UI guide. When done, proceed to the next step.

  23. From the left main menu, click Linked Edge Hosts.

  24. Click Generate token. The host begins generating tokens that you will use to link this host with other hosts. The Base64 encoded token contains the IP address of the host, as well as an OTP that will expire in two minutes. Once a token expires, the leader generates another token automatically.

  25. Click the Copy button to copy the token.

  26. Log in to Local UI on the host that you want to link to the leader host.

  27. From the left main menu, click Linked Edge Hosts.

  28. Click Link this device to another.

  29. In the pop-up box that appears, enter the token you copied from the leader host.

  30. Click Confirm.

  31. Repeat steps 25-29 for every host you want to link to the leader host.

  32. Confirm that all linked hosts appear in the Linked Edge Hosts table. The following columns should show the required statuses.

    ColumnStatus
    StatusReady
    ContentSynced
    HealthHealthy
    info

    Upload the Content bundle (including Ubuntu) to Local UI before proceeding. The Content column will not show Synced until the content bundle is uploaded and synchronized. Refer to Upload Content Bundle with Local UI or Upload Content Bundle with Palette CLI for the upload steps.

    Content synchronization will take at least five minutes to complete, depending on your network resources.

  33. On the left main menu, click Cluster.

  34. Click Create cluster.

  35. For Basic Information, provide a name for the cluster and optional tags in key:value format.

  36. In Cluster Profile, the Imported Applications preview section displays the applications that are included with the VerteX Management Appliance. These applications are pre-configured and used to deploy your Palette VerteX management cluster.

    Leave the default options in place and click Next.

  37. In Profile Config, configure the cluster profile settings to your requirements. Local UI groups the options into the Networking, Operating System, Storage, Container Registry, and Management Plane sections. Expand a section to display its options. Review the following tables for the available options.

    Networking​

    OptionDescriptionTypeDefault
    Pod CIDRThe CIDR range for the pod network. This is used to allocate IP addresses to pods in the cluster.CIDR notation100.64.0.0/18
    Service CIDRThe CIDR range for the service network. This is used to allocate IP addresses to services in the cluster.CIDR notation100.64.64.0/18

    Operating System​

    OptionDescriptionTypeDefault
    Ubuntu Pro Token (Optional)The token for your Ubuntu Pro subscription.StringNo default
    Image pull secret (Base64 format) (Optional)The image pull secret provided by Spectro Cloud support, encoded in Base64, that authenticates image pulls from Spectro Cloud OCI registries. The value is masked in Local UI. Leave the field blank if your appliance is airgapped and all workload clusters use mirror registries or image swap, or if you plan to add the secret later through the system console. Refer to Configure Image Pull Secret for more information.Base64 encoded stringNo default

    Storage​

    OptionDescriptionTypeDefault
    Storage Pool DriveThe storage pool device to use for the cluster. As mentioned in the Prerequisites, assign this to your second storage device.String/dev/sdb
    CSI Placement CountThe number of replicas for the Container Storage Interface (CSI) Persistent Volumes (PVs). The accepted values are 1 or 3. We recommend using 3 to provide high availability for the CSI volumes. This value must match the Mongo Replicas value.Integer3
    DRBD Compile ModeThe mode that loads the Distributed Replicated Block Device (DRBD) kernel module on each node. Refer to DRBD Kernel Module Loading for the available modes.String (enum)shipped_modules

    Container Registry​

    OptionDescriptionTypeDefault
    In Cluster Registry (Optional)- True - Use internal Zot registry
    - False - Use external registry.    		BooleanTrue
    OCI Pack Registry EndpointThe DNS/IP endpoint for the registry. Leave the default entry if using the internal Zot registry, which is a virtual IP address assigned by kube-vip. Adjust if using an external registry.String{{.spectro.system.cluster.kubevip}}
    OCI Pack Registry PortThe port for the registry. The default value can be changed for the internal Zot registry. Adjust if using an external registry.Integer30003
    OCI Pack Registry Base Content PathThe base path for the registry content for the internal or external registry. Palette VerteX packs are stored in this directory.Stringspectro-content
    OCI Pack Registry UsernameIf using the internal Zot registry, leave the default username or adjust to your requirements. If using an external registry, provide the appropriate username.Stringadmin
    OCI Pack Registry PasswordIf using the internal Zot registry, enter a password to your requirements. If using an external registry, provide the appropriate password.StringNo default - must be provided.
    OCI Registry Storage Size (GiB)The size of the storage for the OCI registry. This is used to store the images and packs in the registry. The default value is set to 100 GiB, but this should be increased to at least 250 GiB for production environments.Integer100
    OCI Pack Registry Ca Cert (Optional)- Internal Zot registry - Not required.
    - External registry - The CA certificate that was used to sign the external registry certificate.    		Base64 encoded stringNo default
    Image Replacement Rules (Optional)Set rules for replacing image references when using an external registry. For example, all: oci-registry-ip:oci-registry-port/spectro-content. Leave empty if using the internal Zot registry.StringNo default
    Enable Certificate RotationRotates the TLS certificate of the internal Zot registry automatically through cert-manager. Applies only to the internal Zot registry.BooleanFalse

    Management Plane​

    OptionDescriptionTypeDefault
    Root DomainThe root domain for the Palette VerteX installation. The default is the virtual IP address that kube-vip assigns to the cluster.String{{.spectro.system.cluster.kubevip}}
    Mongo ReplicasThe number of MongoDB replicas to create for the cluster. The accepted values are 1 or 3. We recommend using 3 to provide high availability for the MongoDB database. This value must match the CSI Placement Count value.Integer3
    Enable OpenTelemetryTurns on OpenTelemetry observability for the Palette VerteX management plane.BooleanFalse

    DRBD Kernel Module Loading​

    The VerteX Management Appliance uses the Piraeus CSI, which requires the DRBD kernel module on each node. The drbd-module-loader init container in the linstor-satellite pod loads this module using the mode that you select in DRBD Compile Mode, which sets the LB_HOW environment variable in the piraeus-operator pack. Starting with Palette VerteX 4.9.14, the following modes are available.

    ValueDescriptionRequirements
    shipped_modules (Default)Installs pre-built, pre-signed DRBD .deb packages from the container image.Compatible with Secure Boot.
    compileBuilds the DRBD kernel module from source on the target node at install time using Dynamic Kernel Module Support (DKMS).The OS image must include kernel headers that match the running kernel. Not compatible with Secure Boot.
    warning

    Do not select compile on nodes with Secure Boot enabled. Modules compiled on the node are unsigned, and the kernel refuses to load them. This causes the drbd-module-loader init container to fail and the VerteX Management Appliance installation to stall.

    Most deployments should keep the default value, shipped_modules.

    For more information about DRBD module loading modes and the container image requirements for compile mode, refer to the Piraeus CSI integration page.

  38. Click Next when you are done.

  39. In Cluster Config, configure the following options.

    Cluster Config Options​

    OptionDescriptionTypeDefault
    Network Time Protocol (NTP) (Optional)The NTP servers to synchronize time within the cluster.StringNo default
    SSH Keys (Optional)The public SSH keys to access the cluster nodes. Add additional keys by clicking Add Item.StringNo default
    Virtual IP Address (VIP)The virtual IP address for the cluster. This is used for load balancing and high availability.StringNo default

    Click Next when you are done.

  40. In Node Config, configure the following options.

    important

    You must assign at least three control plane nodes for high availability. You can remove the worker node pool as it is not required for the Palette VerteX management cluster. When doing this, ensure that the Allow worker capability option is enabled for the control plane node pool.

    Node Pool Options​

    OptionDescriptionTypeDefault
    Node pool nameThe name of the control plane node pool. This will be used to identify the node pool in Palette VerteX.Stringcontrol-plane-pool
    Allow worker capability (Optional)Whether to allow workloads to be scheduled on this control plane node pool. Ensure that this is enabled if no worker pool is assigned to the cluster.BooleanTrue
    Additional Kubernetes Node Labels (Optional)Tags for the node pool in key:value format. These tags can be used to filter and search for node pools in Palette VerteX.StringNo default
    TaintsTaints for the node pool in key=value:effect format. Taints are used to prevent pods from being scheduled on the nodes in this pool unless they tolerate the taint.- Key = string
    - Value = string
    - Effect = string (enum)    		No default
    Pool Configuration​

    The following options are available for both the control plane and worker node pools. You can configure these options to your requirements. You can also remove worker pools if not needed.

    OptionDescriptionTypeDefault
    ArchitectureThe CPU architecture of the nodes. This is used to ensure compatibility with the applications operating on the nodes.String (enum)amd64
    Add Edge HostsClick Add Item and select the other hosts that you installed using the VerteX Management Appliance ISO. These hosts will be added to the node pool. Each pool must contain at least one node.N/A- Control Plane Pool = Current host selected
    - Worker Pool = No host selected
    NIC NameThe name of the network interface card (NIC) to use for the nodes. Leave on Auto to let the system choose the appropriate NIC, or select one manually from the drop-down menu.N/AAuto
    Host Name (Optional)The hostname for the nodes. This is used to identify the nodes in the cluster. A generated hostname is provided automatically, which you can adjust to your requirements.Stringedge-*

  41. Click Next when you are done.

  42. In Review, check that your configuration is correct. If you need to make changes, click on any of the sections in the left sidebar to go back and edit the configuration.

    When you are satisfied with your configuration, click Deploy Cluster. This will start the cluster creation process.

    The cluster creation process will take 20 to 30 minutes to complete. You can monitor progress from the Overview tab on the Cluster page in the left main menu. The cluster is fully provisioned when the status changes to Running and the health status is Healthy.

  43. Once the cluster is provisioned, access the Palette VerteX system console using the virtual IP address (VIP) you configured earlier. Open your web browser and go to https://<vip-address>/system. Replace <vip-address> with the VIP you configured for the cluster.

    The first time you visit the system console, a warning message about an untrusted TLS certificate may appear. This is expected, as you have not yet uploaded your TLS certificate. You can ignore this warning message and proceed.

  44. You will be prompted to log in to Palette VerteX system console. Use admin as the username and admin as the password. You will be prompted to change the password after logging in.

  45. In the Account Info window, provide the following information.

    FieldDescription
    Email addressThis is used for notifications and password recovery as well as logging in to the Palette VerteX system console. This will not be active until you configure SMTP settings in Palette VerteX system console and verify your email address.
    Current passwordUse admin as the current password.
    New passwordEnter a new password for the account.
    Confirm new passwordRe-enter the new password for confirmation.

    Refer to Password Requirements and Security to learn about password requirements.

After logging in, a summary page is displayed. You now have access to the Palette VerteX system console, where you can manage your Palette VerteX environment.

If you are accessing the Palette VerteX system console for the first time, a security warning may be displayed in your web browser. This is because Palette VerteX is configured with a self-signed certificate. You can replace the self-signed certificate with your own SSL certificates as guided later in Next Steps.

warning

If your installation is not successful, verify that the piraeus-operator pack was correctly installed. For more information, refer to the Self-Hosted Installation - Troubleshooting guide.

Validate​

  1. Log in to the Local UI of the leader host using the URL https://<node-ip>:5080. Replace <node-ip> with the IP address of the leader host. If you have changed the default port of the console, replace 5080 with the Local UI port.

  2. In Local UI, click on Cluster in the left main menu.

  3. Check that the cluster status is Running and the health status is Healthy. In the Applications section on this page, the listed applications should be in the Running state.

  4. On the Cluster page, under Environment, click on the Admin Kubeconfig File to download it to your local machine.

  5. On your local machine, open a terminal session and export the KUBECONFIG environment variable to point to the downloaded kubeconfig file.

    export KUBECONFIG=/path/to/your/downloaded/kubeconfig

  6. Issue the following command to verify the Palette installation.

    kubectl get pods --all-namespaces --output custom-columns="NAMESPACE:metadata.namespace,NAME:metadata.name,STATUS:status.phase" \
    | grep --extended-regexp '^(cp-system|hubble-system|ingress-traefik|jet-system|ui-system)\s'

    Your output should look similar to the following.

    cp-system        spectro-cp-ui-5cb6d454f8-bndxb          Running
    hubble-system    auth-5586c867ff-mk6wn                   Running
    hubble-system    auth-5586c867ff-xm9mx                   Running
    hubble-system    cloud-7bfd6c7f55-bmpkm                  Running
    hubble-system    cloud-7bfd6c7f55-tmmjj                  Running
    hubble-system    configserver-697cf95f9f-z2tr6           Running
    hubble-system    event-8566675f7d-l7n8n                  Running
    hubble-system    event-8566675f7d-v8cmz                  Running
    hubble-system    event-8566675f7d-vtp8m                  Running
    hubble-system    foreq-59f8c6c584-47npj                  Running
    hubble-system    hashboard-5fcc8f448c-df5rj              Running
    hubble-system    hashboard-5fcc8f448c-xs6mr              Running
    hubble-system    hutil-5b49d6f5bc-5gcqc                  Running
    hubble-system    hutil-5b49d6f5bc-plg9j                  Running
    hubble-system    memstore-75b7d8bb5b-qtn7w               Running
    hubble-system    mgmt-5874d55cf6-2gh52                   Running
    hubble-system    mongo-0                                 Running
    hubble-system    mongo-1                                 Running
    hubble-system    mongo-2                                 Running
    hubble-system    msgbroker-0                             Running
    hubble-system    msgbroker-1                             Running
    hubble-system    oci-proxy-6bc464cf58-wwksw              Running
    hubble-system    reloader-reloader-59c87c446c-9cvk5      Running
    hubble-system    specman-0                               Running
    hubble-system    spectro-tunnel-647cf485b-xn87n          Running
    hubble-system    spectrocluster-85bf89dcdb-llsjj         Running
    hubble-system    spectrocluster-85bf89dcdb-m2c8w         Running
    hubble-system    spectrocluster-85bf89dcdb-tp9lk         Running
    hubble-system    spectrocluster-jobs-557bd5b798-fkzbm    Running
    hubble-system    spectrossh-74db5544bf-5t24s             Running
    hubble-system    system-6496bc487-cfchd                  Running
    hubble-system    system-6496bc487-mlxjk                  Running
    hubble-system    timeseries-7c4d6647b5-ckrnt             Running
    hubble-system    timeseries-7c4d6647b5-jb9tp             Running
    hubble-system    timeseries-7c4d6647b5-nl86q             Running
    hubble-system    user-57f7759745-8fjx8                   Running
    hubble-system    user-57f7759745-hxz4n                   Running
    ingress-traefik  traefik-ingress-controller-9dmzq        Running    
    ingress-traefik  traefik-ingress-controller-tpwtf        Running
    ingress-traefik  traefik-ingress-controller-xz4jf        Running     
    jet-system       jet-856db6655-k87k8                     Running
    ui-system        spectro-ui-bcff7f675-lds2l              Running

  7. Log in to the Palette VerteX system console using the virtual IP address (VIP) you configured earlier. Open your web browser and go to https://<vip-address>/system. Replace <vip-address> with the VIP you configured for the cluster.

  8. On the login page, use admin as the username and the new password you set during the initial login.

  9. On the Summary page, check that the On-prem system console is healthy message is displayed.

Upload Packs to Palette VerteX​

Follow the instructions to upload packs to your Palette VerteX instance. Packs are used to create cluster profiles and deploy workload clusters in your environment.

Prerequisites​

  • Access to the Artifact Studio to download the Palette VerteX pack bundles.

    tip

    If you do not have access to Artifact Studio, contact your Spectro Cloud representative or open a support ticket.

  • If using the internal Zot registry, ensure you have access to the Local UI of the leader node of the Palette VerteX management cluster. Also, verify that your local machine can access the Local UI, as airgapped environments may have strict network policies preventing direct access.

    • (Optional) The Palette CLI installed on your local machine if you prefer to use the command line for uploading packs. Refer to the Palette CLI guide for installation instructions.

  • If using an external registry, the Palette CLI must be installed on your local machine to upload the content to the external registry. Refer to the Palette CLI guide for installation instructions.

    • Ensure your local machine has network access to the external registry server and you have the necessary permissions to push images to the registry.

Upload Packs​

  1. Navigate to the Artifact Studio through a web browser and log in. Under Create pack bundle, select Build bundle.

  2. Select the Palette VerteX Appliance product on the Product selection step and build your pack bundles by following the prompts in the Artifact Studio.

    Refer to the Artifact Studio guide for detailed guidance on how to build pack bundles and verify the integrity of the downloaded files.

  3. Download the pack bundles to your local machine. Each pack is downloaded in .zst format.

  4. Log in to the Local UI of the leader host of the Palette VerteX management cluster. By default, Local UI is accessible at https://<node-ip>:5080. Replace <node-ip> with the IP address of the leader host.

  5. From the left main menu, click Content.

  6. Click Actions in the top right and select Upload Content from the drop-down menu.

  7. Click the upload icon to open the file selection dialog and select the downloaded pack ZST files from your local machine. You can select multiple files at once. Alternatively, you can drag and drop the files into the upload area.

    The upload process starts automatically once the files are selected. You can monitor the upload progress in the Upload Content dialog.

    Wait for the File(s) uploaded successfully confirmation message or the green check mark to appear next to the upload progress bar.

  8. Log in to the Palette VerteX system console.

  9. From the left main menu, select Administration, and then select the Pack Registries tab.

  10. Select the three-dot menu for the OCI Pack Registry and click Sync.

Validate​

  1. Log in to the Local UI of the leader host of the Palette VerteX management cluster.

  2. From the left main menu, click Content.

  3. Enter the filename of the uploaded pack in the Filter by name search bar. The pack should appear in the table below. You can repeat this step for each pack you uploaded.

(Optional) Upload Third Party Packs​

Follow the instructions to upload the Third Party packs to your Palette VerteX instance. The Third Party packs contain additional functionality and capabilities that enhance the Palette VerteX experience, such as backup and restore, configuration scanning, penetration scanning, SBOM scanning, and conformance scanning.

Prerequisites​

  • Access to the Artifact Studio to download the Third Party packs.

    tip

    If you do not have access to Artifact Studio, contact your Spectro Cloud representative or open a support ticket.

  • If using the internal Zot registry, ensure you have access to the Local UI of the leader node of the Palette VerteX management cluster. Also, verify that your local machine can access the Local UI, as airgapped environments may have strict network policies preventing direct access.

    • (Optional) The Palette CLI installed on your local machine if you prefer to use the command line for uploading packs. Refer to the Palette CLI guide for installation instructions.

  • If using an external registry, the Palette CLI must be installed on your local machine to upload the content to the external registry. Refer to the Palette CLI guide for installation instructions.

    • Ensure your local machine has network access to the external registry server and you have the necessary permissions to push images to the registry.

Upload Packs​

  1. Navigate to the Artifact Studio through a web browser and log in. Under Create pack bundle, select Build bundle.

  2. Select the Palette VerteX Appliance product on the Product selection step and select your current version on the Version selection step.

  3. On the Use case step, select the Add-on only option.

  4. On the Configure bundle step, enter Palette Third Party in the Search packs field and click Search. Alternatively, you can find the packs in the thirdparty category.

    Click the checkbox next to the Palette Third Party and Palette Third Party Conformance packs to select them, and click Next Step.

  5. On the Review and download step, click the I'm not a robot reCAPTCHA checkbox, and then click the Download bundle button to begin the download. Alternatively, you can click the Copy all URLs button to copy the download URLs to your clipboard.

    Wait until the packs have been downloaded to your local machine. The packs are downloaded in .zst format alongside a signature file in sig.bin format.

    tip

    Refer to the Artifact Studio guide for detailed guidance on how to verify the integrity of the downloaded files using the provided signature file.

  6. Log in to the Local UI of the leader host of the Palette VerteX management cluster. By default, Local UI is accessible at https://<node-ip>:5080. Replace <node-ip> with the IP address of the leader host.

  7. From the left main menu, click Content.

  8. Click Actions in the top right and select Upload Content from the drop-down menu.

  9. Click the upload icon to open the file selection dialog and select the Third Party ZST files from your local machine. Alternatively, you can drag and drop the files into the upload area.

    The upload process starts automatically once the files are selected. You can monitor the upload progress in the Upload Content dialog.

    Wait for the File(s) uploaded successfully confirmation message or the green check mark to appear next to the upload progress bar.

  10. Log in to the Palette VerteX system console.

  11. From the left main menu, select Administration, and then select the Pack Registries tab.

  12. Select the three-dot menu for the OCI Pack Registry and click Sync.

Validate​

  1. Log in to the Local UI of the leader host of the Palette VerteX management cluster. By default, Local UI is accessible at https://<node-ip>:5080. Replace <node-ip> with the IP address of the leader host.

  2. From the left main menu, click Content.

  3. Enter the filename of each Third Party pack in the Filter by name search bar. The packs should appear in the table.

Next Steps​

The following actions are recommended after installing Palette VerteX to ensure your environment is ready for use:

  • Assign your SSL certificates to Palette VerteX. Palette VerteX is installed with a self-signed SSL certificate. To assign a different SSL certificate, upload the certificate, key, and certificate authority files to Palette VerteX. You can upload the files using the system console. Refer to the Configure HTTPS Encryption page for instructions on how to upload the SSL certificate files to Palette VerteX.

  • Create a tenant in Palette VerteX to host your users. Refer to the Create a Tenant guide for instructions on how to create a tenant in Palette VerteX.

  • Activate your Palette VerteX installation before the trial mode expires. Refer to the Activate Installation guide for instructions on how to activate your installation.

  • Create additional system administrator accounts and assign roles to users in the system console. Refer to the Account Management guide for instructions on how to manage user accounts and roles in Palette VerteX.

  • Configure SMTP settings to enable email notifications and password recovery. Refer to the Configure SMTP Settings guide for instructions on how to configure SMTP settings in Palette VerteX.

  • Plan how to back up and restore your VerteX Management Appliance installation. Refer to the Back Up and Restore guide for the full procedure.

For all system management options in Palette VerteX, refer to the System Management guide.