3. Installation on Kubernetes (Helm)

This guide describes how to deploy QKDLite onto a Kubernetes cluster using Helm.

3.1. Prerequisites

Cluster

  • A reachable Kubernetes cluster, with kubectl configured against the target context.

  • One of the following mechanisms for external traffic:

    • A Gateway API controller with a GatewayClass installed, including the TCPRoute/TLSRoute CRDs

    • A LoadBalancer service implementation (e.g. MetalLB, ServiceLB)

Tooling

  • Helm 3.8 or later

Security material

  • TLS certificates: Root CA certificate, server certificate, and server key (see pqCAlite to Issue Certs for pqCAlite)

  • The passphrase protecting the TLS server key

Artifacts and access

3.2. Quick Installation

3.2.1. From script

  1. Execute the oci tooling script

    Listing 3.1  console on QKDLite main node
    $ cd QKDLite_helm
$ ./install_oci_tooling.sh

  2. Execute the installer script

    Listing 3.2  console on QKDLite main node
    $ cd QKDLite_helm
$ ./install_QKDLite_helm.sh

  3. Enter the namespace where QKDLite will be installed, and the release name of QKDLite

    Listing 3.3  console on QKDLite main node
    Setting up QKDLite environment
Enter Kubernetes namespace [default]:
Enter Helm Release Name [default]:

  4. Enter registry URL and Chart Url. The chart can either be a direct remote URL or a local file path. To use the remote registry press enter to continue.

    Listing 3.4  console on QKDLite main node
    Container registry to pull images from [qkdlite.azurecr.io]:
Enter Helm Chart Location [oci://qkdlite.azurecr.io/charts/qkdlite]:

  5. Enter the file path of the certificates and the passphrase

    Listing 3.5  console on QKDLite main node
    Setting up QKDLite TLS certs...
Path to ca.crt [../pqCAlite/certs/CA.crt]:
Path to tls.crt [../pqCAlite/certs/2607_test_server_test.crt]:
Path to tls.key [../pqCAlite/private/2607_test_server_test.key]:
TLS Key passphrase [optional, press Enter to skip]:

    Note

    Ensure that the tls.crt and tls.key chosen have a server prefix

  6. Enter the username and password of registry to retrieve images and helm package.

    Listing 3.6  console on QKDLite main node
    Setting up QKDLite registry secrets...
Does registry (qkdlite.azurecr.io) require authentication? [y/N]: y
Registry User: user
Registry Password:
Registry Password (confirm):
Login Succeeded

  7. Enter the main and remote node names.

    Note

    The Security Application Entity (SAE) name is required for the proper labelling of quantum keys to be provided via the ETSI server. For an exmaple, we can use “SAE_A” for QKDLITE_SAE_A and “SAE_B” for QKDLITE_SAE_B.

    If you are on QKDLITE_SAE_A, press Enter to use the defaults for “SAE_A” for main node and “SAE_B” for remote node. If you are on QKDLITE_SAE_B, enter “SAE_B” for main node and “SAE_A” for remote node.

    Listing 3.7  console on QKDLite main node
    Generating values file for QKDLite...
Name of local node (can be changed later) [SAE_A]:
Name of remote node (can be changed later) [SAE_B]:
Remote node IP address (can be changed later) [127.0.1.0]:

  8. Enter the Transport Key Data. Press enter to autogenerate a new value, or type to add in a existing Transport Key. The Transport Key Data must be the same for all paired nodes, otherwise key replication will fail.

    1. Auto Generation

      Listing 3.8  console on QKDLite main node
      Setting up secrets for QKDLite...
Transport Key Data [press Enter to autogenerate, or type to set]:
   ✓ Autogenerated

    2. Manual

      Listing 3.9  console on QKDLite main node
      Setting up secrets for QKDLite...
Transport Key Data [press Enter to autogenerate, or type to set]:
Transport Key Data (confirm):

  9. Enter the Bootstrap Key Data if bootstrap feature is needed. Press enter to autogenerate a new value, or type to add in a existing bootstrap key. The Bootstrap Key Data must be the same for all paired nodes, otherwise key replication will fail.

    1. Auto Generation

      Listing 3.10  console on QKDLite main node
      Bootstrap needed? [y/N]: y
Bootstrap Key Data [press Enter to autogenerate, or type to set]:
   ✓ Autogenerated

    2. Manual

      Listing 3.11  console on QKDLite main node
      Bootstrap needed? [y/N]: y
Bootstrap Key Data [press Enter to autogenerate, or type to set]:
Bootstrap Key Data (confirm):

  10. The script will proceed to install QKDLite.

    Listing 3.12  console on QKDLite main node
    Installing QKDLite with Helm...
Release "default" does not exist. Installing it now.
Pulled: qkdlite.azurecr.io/helm/qkdlite:0.1.4
Digest: sha256:84487e635790f1a4690758f4a86dfeb1b3265175dd0ef999d7ef4a510aca2abf
NAME: default
LAST DEPLOYED: Tue Jan 30 xx:xx:xx 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None

3.3. Verifying the Installation

$ kubectl get pods -n <namespace>

Confirm that all pods reach the Running state and that readiness probes pass before proceeding.

3.4. Upgrading

Apply changes to an existing release by editing values.yaml and running an upgrade.

$ ./install_QKDLite_helm.sh