Quick Start

This quick start guide deploys an Akeyless Gateway with Secure Remote Access on Kubernetes cluster using the Akeyless CLI, this can also be achieved via Akeyless console.

For more deployment model check our Choose a deployment model guide.

Prerequisites

• Akeyless CLI installed.
• A Kubernetes Cluster
• kubectl installed context pointing to the Kubernetes Cluster
• Helm Installed
• Minimum 1 vCPU available with 2 GB RAM per resource
• The following ports need to be open on the cluster to internal network access only:

Create an Authentication Method

In this section, we will create an Authentication Method which will be used to authenticate your Akeyless Gateway to your Akeyless account.

For this guide, API Key authentication is used for simplicity.

Run the following command to create an API Key authentication method:

akeyless auth-method create api-key --name MyFirstAPIKey

Create an Access Role

In this section, we will create an Access Role that will be used to authorized your Gateway to execute actions in the Akeyless account.

1. Run the following command to create a new access role:

   Shell

   akeyless create-role --name MyFirstRole

2. Set the role with access to all Items under /path/to/folder/ with Read and List permissions:

   Shell

   akeyless set-role-rule --role-name MyFirstRole --path "/path/to/folder/\*" --capability read --capability list

3. Also, set the role with access to Targets:

   Shell

   akeyless set-role-rule --role-name MyFirstRole --path "/path/to/folder/\*" --rule-type target-rule --capability read --capability list

4. Associate the Authentication Method with the Role:

   Shell

   akeyless assoc-role-am --role-name MyFirstRole --am-name MyFirstAPIKey

   Now you have an Authentication Method with the right access to deploy the Gateway.

Create Your SSH Certificate Issuer

In order to create an SSH Certificates issuer, run the following commands:

1. Create a new RSA DFC Key in your Akeyless account:

   Shell

   akeyless create-dfc-key -n MyRSAKey -a RSA2048

2. Create the SSH Certificate Issuer:

   Shell

   akeyless create-ssh-cert-issuer --name your-ssh-cert-issuer-name --signer-key-name MyRSAKey --allowed-users 'ubuntu' --ttl 300

Configuration

In this section we will add the Akeyless Helm repository and configure your values.yaml before deploying the Gateway and Secure Remote Access.

Add the Akeyless Helm Repo

In order to Add the following repository to your Helm repository list, run the following commands:

1. Add the Akeyless Helm repository to your local Helm client:
   Shell

   helm repo add akeyless https://akeylesslabs.github.io/helm-charts

2. Update your local Helm repo cache so it picks up the latest chart version:
   Shell

   helm repo update

Configure the Helm Chart

Below is an explanation of the minimum required fields by section. Find them in the file and edit them as per the instructions:

1. Fetch the Default Values File:

   Shell

   helm show values akeyless/akeyless-gateway > values.yaml

2. Configure the Global Section:

   values.yaml

   ############
   ## Global ##
   ############
   
   akeylessGatewayAuth:
     gatewayAccessId: <your_access_id>
     gatewayAccessType: access_key
     gatewayCredentialsExistingSecret: akeyless-auth
   

   Where:

   • gatewayAccessId: Add your API Key's Access ID.
   • gatewayAccessType: keep as access_key for API Key authentication.
   • gatewayCredentialsExistingSecret: References a Kubernetes Secret that stores your API Key's Access Key. create it first by following API Key Authentication in the Akeyless Gateway chart.

3. Review the Gateway Section:

   The Gateway section controls the core Gateway deployment and needs no changes for a standard setup. By default it creates two Gateway replicas for high availability, You can customize that by changing the replicaCount variable.

4. Configure the Secure Remote Access Section:

   values.yaml

   ######################################################
   ## Default values for akeyless-secure-remote-access ##
   ######################################################
   sra:
     # Enable secure-remote-access. Valid values: true/false.
     enabled: true
     
       sshConfig:
       replicaCount: 1
   
       config:
            CAPublicKey: |
               ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAPzDVmeABzsGd0lEl9m2fdgmCzOLVmEGcLxNkn...
               ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD9SkmW9Ay7YwWQk9o3r6a4qQ7pI2Yw1M...

   Where:

   • sra: Set the enabled field to true. Note that the Remote Access deployment creates two more pods in the cluster, one for Web and one for SSH.
   • CAPublicKey: For this to work properly, you are also required to provide the matching public key of the key you used to create the SSH Certificate Issuer in Akeyless. You can provide one or more CA public keys. More info can be found here. Add each ssh-rsa value on a new line.

Deployment

In order to deploy the Helm chart with values.yaml configured and verify the Gateway and Remote Access pods come up correctly, run the following commands:

1. Deploy the Helm Chart:

   Shell

   helm install quick-start-gw akeyless/akeyless-gateway -f values.yaml

2. Verify the Deployment:

   Shell

   kubectl get pods -w

   Confirm the Gateway and Remote Access pods reach Running state

   ShellText

   kubectl get services

   Confirm that the Gateway and Remote Access services are available.

Retrieve the Gateway URL

In order to retrieve the Gateway URL run the following commands:

1. Get the external IP:

   Shell

   kubectl get services

   Look for the EXTERNAL-IP of the service starting with quick-start-gw.

2. Open the Gateway console: Copy the EXTERNAL-IP and open it in your browser on port 8000/console, for example: http://<Gateway-EXTERNAL-IP>:8000/console

3. If you see the login page, you've successfully deployed the Gateway.

Remote Access URLs

For Remote Access, you can access the following:

• The Secure Remote Access Internal Web Portal is located at http://<Gateway-EXTERNAL-IP>:8000/sra/portal

• Secure Remote Access can also be accessed using our public URL: https://zerotrust.akeyless.io. If you are using the public URL for RDP, Web, or similar sessions, you will be required to add your Web URL endpoint: http://<Gateway-EXTERNAL-IP>:8000/sra/web-client