Awesome

Mender

Mender is a robust and secure way to update all your software and deploy your IoT devices at scale with support for customization.

TL;DR;

Using helm:

helm install mender ./mender

Introduction

This chart bootstraps a Mender deployment on a Kubernetes cluster using the Helm package manager.

Prerequisites

• Kubernetes 1.26+
• Helm >= 3.10.0
• Object storage (AWS S3, Azure Blob Storage, GCS, MinIO, SeaweedFS)

Object storage setup

Supported object storage services are:

• Amazon S3
• Azure Blob Storage
• Google Cloud Storage
• Cloudflare R2

You can also use other S3-compatible object storage services like MinIO or SeaweedFS, for development and testing purposes only.

Following some setup sample. Please refer to the official documentation of the object storage service you are using for more information.

Amazon S3

Create a new bucket in Amazon S3, then a IAM user and its access key with the proper permissions to access the bucket.

You can find the required permissions in the Requirements section of the official documentation.

Then, export the following environment variables:

export AWS_ACCESS_KEY_ID="replace-with-your-access-key-id"
export AWS_SECRET_ACCESS="replace-with-your-secret-access-key"
export AWS_REGION="replace-with-your-aws-region"
export STORAGE_BUCKET="replace-with-your-bucket-name"

SeaweedFS

Alternatively to Amazon S3, you can install SeaweedFS, a compatible S3 solution.

Important: the following setup is intended for development and testing purposes only. For production usage, it's recommended to use an external object storage service like AWS S3 or Azure Blob Storage.

Installing SeaweedFS:

export STORAGE_CLASS="default"
export STORAGE_BUCKET="replace-with-your-bucket-name"

cat >seaweedfs.yml <<EOF
filer:
  s3:
    enabled: true
    enableAuth: true
    createBuckets:
      - name: "${STORAGE_BUCKET}"
  storageClass: ${STORAGE_CLASS}

s3:
  enabled: true
  enableAuth: true
EOF

helm repo add seaweedfs https://seaweedfs.github.io/seaweedfs/helm
helm repo update
helm install seaweedfs --wait -f seaweedfs.yml  seaweedfs/seaweedfs

Finally, export the following environment variables, needed for installing Mender:

export AWS_ACCESS_KEY_ID=$(kubectl get secret seaweedfs-s3-secret -o jsonpath='{.data.admin_access_key_id}' |base64 -d)
export AWS_SECRET_ACCESS_KEY=$(kubectl  get secret seaweedfs-s3-secret -o jsonpath='{.data.admin_secret_access_key}' |base64 -d)
export AWS_REGION="us-east-1"
export STORAGE_ENDPOINT="http://seaweedfs-s3:8333"

Installing Mender

This is the minimum configuration needed to install Mender:

export MENDER_SERVER_DOMAIN="mender.example.com"
export MENDER_SERVER_URL="https://${MENDER_SERVER_DOMAIN}"

cat >values.yaml <<EOF
global:
  s3:
    AWS_URI: "${MENDER_SERVER_URL}"
    AWS_BUCKET: "${STORAGE_BUCKET}"
    AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}"
    AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}"
  url: "${MENDER_SERVER_URL}"

ingress:
  enabled: true
  annotations:
    <your ingress controller specific annotations>
  hosts:
    - ${MENDER_SERVER_DOMAIN}
  tls:
    - secretName: <your-tls-secret>
      hosts:
        - ${MENDER_SERVER_DOMAIN}

api_gateway:
  storage_proxy:
    enabled: true
    url: "${STORAGE_ENDPOINT}"
    customRule: "PathRegexp(\`^/${STORAGE_BUCKET}\`)"

deployments:
  customEnvs:
    - name: DEPLOYMENTS_STORAGE_PROXY_URI
      value: "${MENDER_SERVER_URL}"

EOF

To install the chart with the release name my-release using helm:

helm install my-release -f values.yaml ./mender

The command deploys Mender on the Kubernetes cluster in the default configuration. The Parameters section lists the parameters that can be configured during installation.

Tip: List all releases using helm list

Upgrading from Helm Chart 5.x and Meneder Server 3.7.x

Please refer to this document for the upgrade procedure details.

Uninstalling the Chart

To uninstall/delete the my-release deployment:

helm delete my-release

The command removes all the Kubernetes components associated with the chart and deletes the release.

Complete list of parameters

The following table lists the global, default, and other parameters supported by the chart and their default values.

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

helm install my-release \
  --set mongodbRootPassword=secretpassword,mongodbUsername=my-user,mongodbPassword=my-password,mongodbDatabase=my-database \
  ./mender

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

helm install --name my-release -f values.yaml ./mender

Tip: You can use the default values.yaml

Parameters: api-gateway

The following table lists the parameters for the api-gateway component and their default values:

Parameters: deployments

The following table lists the parameters for the deployments component and their default values:

Parameters: device-auth

The following table lists the parameters for the device-auth component and their default values:

Parameters: gui

The following table lists the parameters for the gui component and their default values:

Parameters: inventory

The following table lists the parameters for the inventory component and their default values:

Parameters: reporting

The following table lists the parameters for the reporting component and their default values:

Parameters: tenantadm

The following table lists the parameters for the tenantadm component and their default values:

The default value for the rate limits are:

• Management APIs rate limits, per user:
  • 600 API calls/minute/user
• Device APIs rate limits, per device:
  • 60 API calls/minute
  • 1 API call/5 seconds for each API end-point

You can customize the default API limits setting a custom JSON document. See the default one here.

Parameters: useradm

The following table lists the parameters for the useradm component and their default values:

Parameters: workflows

The following table lists the parameters for the workflows-server component and their default values:

Parameters: create_artifact_worker

The following table lists the parameters for the create-artifact-worker component and their default values:

Parameters: auditlogs

The following table lists the parameters for the auditlogs component and their default values:

Parameters: iot-manager

The following table lists the parameters for the iot-manager component and their default values:

Parameters: deviceconnect

The following table lists the parameters for the deviceconnect component and their default values:

Parameters: deviceconfig

The following table lists the parameters for the deviceconfig component and their default values:

Parameters: devicemonitor

The following table lists the parameters for the devicemonitor component and their default values:

Parameters: generate_delta_worker

Please notice that this feature is still under active development and it is disabled by default

The following table lists the parameters for the generate-delta-worker component and their default values:

Parameters: redis

The following table lists the parameters for the redis component and their default values:

Create a tenant and a user from command line

Enterprise version

You can create a tenant from the command line of the tenantadm pod; the value printed is the newly generated tenant ID:

tenantadm create-org --name demo --username "admin@mender.io" --password "adminadmin" --plan enterprise
5dcd71624143b30050e63bed

You can create additional useres from the command line of the useradm pod:

useradm-enterprise create-user --username "demo@mender.io" --password "demodemo" --tenant-id "5dcd71624143b30050e63bed"
187b8101-4431-500f-88da-54709f51f2e6

Open Source version

If you are running the Open Source version of Mender, you won't have the tenantadm service. You can create users directly in the useradm pod:

useradm create-user --username "demo@mender.io" --password "demodemo"
187b8101-4431-500f-88da-54709f51f2e6

Test the service through the GUI

You can port-forward the mender-api-gateway Kubernetes service to verify the system is up and running:

kubectl port-forward service/mender-api-gateway 443:443

Contributing

We welcome and ask for your contribution. If you would like to contribute to Mender, please read our guide on how to best get started contributing code or documentation.

License

Mender is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.

Security disclosure

We take security very seriously. If you come across any issue regarding security, please disclose the information by sending an email to security@mender.io. Please do not create a new public issue. We thank you in advance for your cooperation.

Connect with us

• Join the Mender Hub discussion forum
• Follow us on Twitter. Please feel free to tweet us questions.
• Fork us on Github
• Create an issue in the bugtracker
• Email us at contact@mender.io
• Connect to the #mender IRC channel on Libera