Merge pull request #3200 from quay/project/kube-config

Kube QE user can create/modify deployment with config tool
2018-08-15 16:34:45 -04:00 · 2018-08-15 16:34:45 -04:00 · 3c8252d808
commit 3c8252d808
parent a66a4d6a10 eea5fe3391
28 changed files with 1087 additions and 297 deletions
--- a/config_app/_init_config.py
+++ b/config_app/_init_config.py
@ -12,6 +12,7 @@ STATIC_DIR = os.path.join(ROOT_DIR, 'static/')
 STATIC_LDN_DIR = os.path.join(STATIC_DIR, 'ldn/')
 STATIC_FONTS_DIR = os.path.join(STATIC_DIR, 'fonts/')
 TEMPLATE_DIR = os.path.join(ROOT_DIR, 'templates/')
+IS_KUBERNETES = 'KUBERNETES_SERVICE_HOST' in os.environ



--- a/config_app/c_app.py
+++ b/config_app/c_app.py
@ -7,7 +7,7 @@ from data import database, model
 from util.config.superusermanager import SuperUserManager
 from util.ipresolver import NoopIPResolver

-from config_app._init_config import ROOT_DIR
+from config_app._init_config import ROOT_DIR, IS_KUBERNETES
 from config_app.config_util.config import get_config_provider
 from util.security.instancekeys import InstanceKeys

@ -19,6 +19,9 @@ OVERRIDE_CONFIG_DIRECTORY = os.path.join(ROOT_DIR, 'config_app/conf/stack')
 INIT_SCRIPTS_LOCATION = '/conf/init/'

 is_testing = 'TEST' in os.environ
+is_kubernetes = IS_KUBERNETES
+
+logger.debug('Configuration is on a kubernetes deployment: %s' % IS_KUBERNETES)

 config_provider = get_config_provider(OVERRIDE_CONFIG_DIRECTORY, 'config.yaml', 'config.py',
                                      testing=is_testing)
--- a/config_app/config_endpoints/api/init.py
+++ b/config_app/config_endpoints/api/init.py
@ -1,6 +1,6 @@
 import logging

-from flask import Blueprint, request
+from flask import Blueprint, request, abort
 from flask_restful import Resource, Api
 from flask_restful.utils.cors import crossdomain
 from email.utils import formatdate
@ -8,7 +8,7 @@ from calendar import timegm
 from functools import partial, wraps
 from jsonschema import validate, ValidationError

-from config_app.c_app import app
+from config_app.c_app import app, IS_KUBERNETES
 from config_app.config_endpoints.exception import InvalidResponse, InvalidRequest

 logger = logging.getLogger(__name__)
@ -128,6 +128,15 @@ def validate_json_request(schema_name, optional=False):
    return wrapped
  return wrapper

+def kubernetes_only(f):
+  """ Aborts the request with a 400 if the app is not running on kubernetes """
+  @wraps(f)
+  def abort_if_not_kube(*args, **kwargs):
+    if not IS_KUBERNETES:
+      abort(400)
+
+    return f(*args, **kwargs)
+  return abort_if_not_kube

 nickname = partial(add_method_metadata, 'nickname')

--- a/config_app/config_endpoints/api/suconfig.py
+++ b/config_app/config_endpoints/api/suconfig.py
@ -3,9 +3,10 @@ import logging
 from flask import abort, request

 from config_app.config_endpoints.api.suconfig_models_pre_oci import pre_oci_model as model
-from config_app.config_endpoints.api import resource, ApiResource, nickname, validate_json_request
+from config_app.config_endpoints.api import resource, ApiResource, nickname, validate_json_request, kubernetes_only
 from config_app.c_app import (app, config_provider, superusers, ip_resolver,
                              instance_keys, INIT_SCRIPTS_LOCATION)
+from config_app.config_util.k8saccessor import KubernetesAccessorSingleton

 from data.database import configure
 from data.runmigration import run_alembic_migration
@ -259,6 +260,45 @@ class SuperUserConfigValidate(ApiResource):
    return validate_service_for_config(service, validator_context)


+@resource('/v1/kubernetes/deployments/')
+class SuperUserKubernetesDeployment(ApiResource):
+  """ Resource for the getting the status of Quay Enterprise deployments and cycling them """
+  schemas = {
+    'ValidateDeploymentNames': {
+      'type': 'object',
+      'description': 'Validates deployment names for cycling',
+      'required': [
+        'deploymentNames'
+      ],
+      'properties': {
+        'deploymentNames': {
+          'type': 'array',
+          'description': 'The names of the deployments to cycle'
+        },
+      },
+    }
+  }
+
+  @kubernetes_only
+  @nickname('scGetNumDeployments')
+  def get(self):
+    return KubernetesAccessorSingleton.get_instance().get_qe_deployments()
+
+  @kubernetes_only
+  @nickname('scCycleQEDeployments')
+  def put(self):
+    deployment_names = request.get_json()['deploymentNames']
+    return KubernetesAccessorSingleton.get_instance().cycle_qe_deployments(deployment_names)
+
+
+@resource('/v1/superuser/config/kubernetes')
+class SuperUserKubernetesConfiguration(ApiResource):
+  """ Resource for saving the config files to kubernetes secrets. """
+  @kubernetes_only
+  @nickname('scDeployConfiguration')
+  def post(self):
+    return config_provider.save_configuration_to_kubernetes()
+

@resource('/v1/superuser/config/file/<filename>')
 class SuperUserConfigFile(ApiResource):
--- a/config_app/config_endpoints/common.py
+++ b/config_app/config_endpoints/common.py
@ -7,8 +7,9 @@ from flask_restful import reqparse

 from config import frontend_visible_config

-from config_app.c_app import app
+from config_app.c_app import app, IS_KUBERNETES
 from config_app._init_config import ROOT_DIR
+from config_app.config_util.k8sconfig import get_k8s_namespace


 def truthy_bool(param):
@ -49,6 +50,7 @@ def render_page_template(name, route_data=None, js_bundle_name=DEFAULT_JS_BUNDLE
                               route_data=route_data,
                               main_scripts=main_scripts,
                               config_set=frontend_visible_config(app.config),
+                               kubernetes_namespace=IS_KUBERNETES and get_k8s_namespace(),
                               **kwargs)

    resp = make_response(contents)
--- a/config_app/config_util/config/TransientDirectoryProvider.py
+++ b/config_app/config_util/config/TransientDirectoryProvider.py
@ -2,6 +2,8 @@ import os
 from backports.tempfile import TemporaryDirectory

 from config_app.config_util.config.fileprovider import FileConfigProvider
+from config_app.config_util.k8saccessor import KubernetesAccessorSingleton
+

 class TransientDirectoryProvider(FileConfigProvider):
    """ Implementation of the config provider that reads and writes the data
@ -33,3 +35,12 @@ class TransientDirectoryProvider(FileConfigProvider):

    def get_config_dir_path(self):
        return self.config_volume
+
+    def save_configuration_to_kubernetes(self):
+        config_path = self.get_config_dir_path()
+
+        for name in os.listdir(config_path):
+            file_path = os.path.join(self.config_volume, name)
+            KubernetesAccessorSingleton.get_instance().save_file_as_secret(name, file_path)
+
+        return 200
--- a/config_app/config_util/k8saccessor.py
+++ b/config_app/config_util/k8saccessor.py
@ -0,0 +1,145 @@
+import logging
+import json
+import base64
+import datetime
+
+from requests import Request, Session
+
+from config_app.config_util.k8sconfig import KubernetesConfig
+
+logger = logging.getLogger(__name__)
+
+QE_DEPLOYMENT_LABEL = 'quay-enterprise-component'
+
+class KubernetesAccessorSingleton(object):
+    """ Singleton allowing access to kubernetes operations """
+    _instance = None
+
+    def __init__(self, kube_config=None):
+      self.kube_config = kube_config
+      if kube_config is None:
+        self.kube_config = KubernetesConfig.from_env()
+
+      KubernetesAccessorSingleton._instance = self
+
+    @classmethod
+    def get_instance(cls, kube_config=None):
+      """
+      Singleton getter implementation, returns the instance if one exists, otherwise creates the
+      instance and ties it to the class.
+      :return: KubernetesAccessorSingleton
+      """
+      if cls._instance is None:
+        return cls(kube_config)
+
+      return cls._instance
+
+    def save_file_as_secret(self, name, file_path):
+        with open(file_path) as f:
+            value = f.read()
+            self._update_secret_file(name, value)
+
+    def get_qe_deployments(self):
+      """"
+      Returns all deployments matching the label selector provided in the KubeConfig
+      """
+      deployment_selector_url = 'namespaces/%s/deployments?labelSelector=%s%%3D%s' % (
+        self.kube_config.qe_namespace, QE_DEPLOYMENT_LABEL, self.kube_config.qe_deployment_selector
+      )
+
+      response = self._execute_k8s_api('GET', deployment_selector_url, api_prefix='apis/extensions/v1beta1')
+      if response.status_code != 200:
+        return None
+      return json.loads(response.text)
+
+    def cycle_qe_deployments(self, deployment_names):
+      """"
+      Triggers a rollout of all desired deployments in the qe namespace
+      """
+
+      for name in deployment_names:
+        logger.debug('Cycling deployment %s', name)
+        deployment_url = 'namespaces/%s/deployments/%s' % (self.kube_config.qe_namespace, name)
+
+        # There is currently no command to simply rolling restart all the pods: https://github.com/kubernetes/kubernetes/issues/13488
+        # Instead, we modify the template of the deployment with a dummy env variable to trigger a cycle of the pods
+        # (based off this comment: https://github.com/kubernetes/kubernetes/issues/13488#issuecomment-240393845)
+        self._assert_success(self._execute_k8s_api('PATCH', deployment_url, {
+          'spec': {
+            'template': {
+              'spec': {
+                'containers': [{
+                  'name': 'quay-enterprise-app', 'env': [{
+                    'name': 'RESTART_TIME',
+                    'value': str(datetime.datetime.now())
+                  }]
+                }]
+              }
+            }
+          }
+        }, api_prefix='apis/extensions/v1beta1', content_type='application/strategic-merge-patch+json'))
+
+
+    def _assert_success(self, response):
+        if response.status_code != 200:
+            logger.error('Kubernetes API call failed with response: %s => %s', response.status_code,
+                         response.text)
+            raise Exception('Kubernetes API call failed: %s' % response.text)
+
+    def _update_secret_file(self, relative_file_path, value=None):
+        if '/' in relative_file_path:
+            raise Exception('Expected path from get_volume_path, but found slashes')
+
+        # Check first that the namespace for Quay Enterprise exists. If it does not, report that
+        # as an error, as it seems to be a common issue.
+        namespace_url = 'namespaces/%s' % (self.kube_config.qe_namespace)
+        response = self._execute_k8s_api('GET', namespace_url)
+        if response.status_code // 100 != 2:
+            msg = 'A Kubernetes namespace with name `%s` must be created to save config' % self.kube_config.qe_namespace
+            raise Exception(msg)
+
+        # Check if the secret exists. If not, then we create an empty secret and then update the file
+        # inside.
+        secret_url = 'namespaces/%s/secrets/%s' % (self.kube_config.qe_namespace, self.kube_config.qe_config_secret)
+        secret = self._lookup_secret()
+        if secret is None:
+            self._assert_success(self._execute_k8s_api('POST', secret_url, {
+                "kind": "Secret",
+                "apiVersion": "v1",
+                "metadata": {
+                    "name": self.kube_config.qe_config_secret
+                },
+                "data": {}
+            }))
+
+        # Update the secret to reflect the file change.
+        secret['data'] = secret.get('data', {})
+
+        if value is not None:
+            secret['data'][relative_file_path] = base64.b64encode(value)
+        else:
+            secret['data'].pop(relative_file_path)
+
+        self._assert_success(self._execute_k8s_api('PUT', secret_url, secret))
+
+    def _lookup_secret(self):
+        secret_url = 'namespaces/%s/secrets/%s' % (self.kube_config.qe_namespace, self.kube_config.qe_config_secret)
+        response = self._execute_k8s_api('GET', secret_url)
+        if response.status_code != 200:
+            return None
+        return json.loads(response.text)
+
+    def _execute_k8s_api(self, method, relative_url, data=None, api_prefix='api/v1', content_type='application/json'):
+        headers = {
+            'Authorization': 'Bearer ' + self.kube_config.service_account_token
+        }
+
+        if data:
+            headers['Content-Type'] = content_type
+
+        data = json.dumps(data) if data else None
+        session = Session()
+        url = 'https://%s/%s/%s' % (self.kube_config.api_host, api_prefix, relative_url)
+
+        request = Request(method, url, data=data, headers=headers)
+        return session.send(request.prepare(), verify=False, timeout=2)
--- a/config_app/config_util/k8sconfig.py
+++ b/config_app/config_util/k8sconfig.py
@ -0,0 +1,47 @@
+import os
+
+SERVICE_ACCOUNT_TOKEN_PATH = '/var/run/secrets/kubernetes.io/serviceaccount/token'
+
+DEFAULT_QE_NAMESPACE = 'quay-enterprise'
+DEFAULT_QE_CONFIG_SECRET = 'quay-enterprise-config-secret'
+
+# The name of the quay enterprise deployment (not config app) that is used to query & rollout
+DEFAULT_QE_DEPLOYMENT_SELECTOR = 'app'
+
+def get_k8s_namespace():
+  return os.environ.get('QE_K8S_NAMESPACE', DEFAULT_QE_NAMESPACE)
+
+class KubernetesConfig(object):
+  def __init__(self, api_host='', service_account_token=SERVICE_ACCOUNT_TOKEN_PATH,
+               qe_namespace=DEFAULT_QE_NAMESPACE,
+               qe_config_secret=DEFAULT_QE_CONFIG_SECRET,
+               qe_deployment_selector=DEFAULT_QE_DEPLOYMENT_SELECTOR):
+    self.api_host = api_host
+    self.qe_namespace = qe_namespace
+    self.qe_config_secret = qe_config_secret
+    self.qe_deployment_selector = qe_deployment_selector
+    self.service_account_token = service_account_token
+
+  @classmethod
+  def from_env(cls):
+    # Load the service account token from the local store.
+    if not os.path.exists(SERVICE_ACCOUNT_TOKEN_PATH):
+      raise Exception('Cannot load Kubernetes service account token')
+
+    with open(SERVICE_ACCOUNT_TOKEN_PATH, 'r') as f:
+      service_token = f.read()
+
+    api_host=os.environ.get('KUBERNETES_SERVICE_HOST', '')
+    port = os.environ.get('KUBERNETES_SERVICE_PORT')
+    if port:
+      api_host += ':' + port
+
+    qe_namespace = get_k8s_namespace()
+    qe_config_secret = os.environ.get('QE_K8S_CONFIG_SECRET', DEFAULT_QE_CONFIG_SECRET)
+    qe_deployment_selector = os.environ.get('QE_DEPLOYMENT_SELECTOR', DEFAULT_QE_DEPLOYMENT_SELECTOR)
+
+    return cls(api_host=api_host, service_account_token=service_token, qe_namespace=qe_namespace,
+               qe_config_secret=qe_config_secret, qe_deployment_selector=qe_deployment_selector)
+
+
+
--- a/config_app/config_util/test/test_k8saccessor.py
+++ b/config_app/config_util/test/test_k8saccessor.py
@ -0,0 +1,63 @@
+import pytest
+import re
+
+from httmock import urlmatch, HTTMock, response
+
+from config_app.config_util.k8saccessor import KubernetesAccessorSingleton
+from config_app.config_util.k8sconfig import KubernetesConfig
+
+@pytest.mark.parametrize('kube_config, expected_api, expected_query', [
+  ({'api_host':'www.customhost.com'},
+   '/apis/extensions/v1beta1/namespaces/quay-enterprise/deployments', 'labelSelector=quay-enterprise-component%3Dapp'),
+
+  ({'api_host':'www.customhost.com', 'qe_deployment_selector':'custom-selector'},
+   '/apis/extensions/v1beta1/namespaces/quay-enterprise/deployments', 'labelSelector=quay-enterprise-component%3Dcustom-selector'),
+
+  ({'api_host':'www.customhost.com', 'qe_namespace':'custom-namespace'},
+   '/apis/extensions/v1beta1/namespaces/custom-namespace/deployments', 'labelSelector=quay-enterprise-component%3Dapp'),
+
+  ({'api_host':'www.customhost.com', 'qe_namespace':'custom-namespace', 'qe_deployment_selector':'custom-selector'},
+   '/apis/extensions/v1beta1/namespaces/custom-namespace/deployments', 'labelSelector=quay-enterprise-component%3Dcustom-selector'),
+])
+def test_get_qe_deployments(kube_config, expected_api, expected_query):
+  config = KubernetesConfig(**kube_config)
+  url_hit = [False]
+
+  @urlmatch(netloc=r'www.customhost.com')
+  def handler(request, _):
+    assert request.path == expected_api
+    assert request.query == expected_query
+    url_hit[0] = True
+    return response(200, '{}')
+
+  with HTTMock(handler):
+    KubernetesAccessorSingleton._instance = None
+    assert KubernetesAccessorSingleton.get_instance(config).get_qe_deployments() is not None
+
+  assert url_hit[0]
+
+@pytest.mark.parametrize('kube_config, deployment_names, expected_api_hits', [
+  ({'api_host':'www.customhost.com'}, [], []),
+  ({'api_host':'www.customhost.com'}, ['myDeployment'], ['/apis/extensions/v1beta1/namespaces/quay-enterprise/deployments/myDeployment']),
+  ({'api_host':'www.customhost.com', 'qe_namespace':'custom-namespace'},
+   ['myDeployment', 'otherDeployment'],
+   ['/apis/extensions/v1beta1/namespaces/custom-namespace/deployments/myDeployment', '/apis/extensions/v1beta1/namespaces/custom-namespace/deployments/otherDeployment']),
+])
+def test_cycle_qe_deployments(kube_config, deployment_names, expected_api_hits):
+  KubernetesAccessorSingleton._instance = None
+
+  config = KubernetesConfig(**kube_config)
+  url_hit = [False] * len(expected_api_hits)
+  i = [0]
+
+  @urlmatch(netloc=r'www.customhost.com', method='PATCH')
+  def handler(request, _):
+    assert request.path == expected_api_hits[i[0]]
+    url_hit[i[0]] = True
+    i[0] += 1
+    return response(200, '{}')
+
+  with HTTMock(handler):
+    KubernetesAccessorSingleton.get_instance(config).cycle_qe_deployments(deployment_names)
+
+  assert all(url_hit)
--- a/config_app/docs/k8s_templates/config-tool-service-nodeport.yml
+++ b/config_app/docs/k8s_templates/config-tool-service-nodeport.yml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: quay-enterprise
+  name: quay-enterprise-config-tool
+spec:
+  type: NodePort
+  ports:
+    - protocol: TCP
+      port: 443
+      targetPort: 443
+      nodePort: 30090
+  selector:
+    quay-enterprise-component: config-tool
--- a/config_app/docs/k8s_templates/config-tool-serviceaccount.yml
+++ b/config_app/docs/k8s_templates/config-tool-serviceaccount.yml
@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+    name: qe-config-tool-serviceaccount
+    namespace: quay-enterprise
--- a/config_app/docs/k8s_templates/config-tool-servicetoken-role-binding.yml
+++ b/config_app/docs/k8s_templates/config-tool-servicetoken-role-binding.yml
@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: quay-enterprise-config-tool-writer
+  namespace: quay-enterprise
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: quay-enterprise-config-tool-role
+subjects:
+- kind: ServiceAccount
+  name: qe-config-tool-serviceaccount
--- a/config_app/docs/k8s_templates/config-tool-servicetoken-role.yml
+++ b/config_app/docs/k8s_templates/config-tool-servicetoken-role.yml
@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:  
+  name: quay-enterprise-config-tool-role
+  namespace: quay-enterprise
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - put
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - "extensions"
+  - "apps"
+  resources:
+  - deployments
+  verbs:
+  - list
+  - patch
--- a/config_app/docs/k8s_templates/qe-config-tool.yml
+++ b/config_app/docs/k8s_templates/qe-config-tool.yml
@ -0,0 +1,30 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  namespace: quay-enterprise
+  name: quay-enterprise-config-tool
+  labels:
+    quay-enterprise-component: config-tool
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      quay-enterprise-component: config-tool
+  template:
+    metadata:
+      namespace: quay-enterprise
+      labels:
+        quay-enterprise-component: config-tool
+    spec:
+      serviceAccountName: qe-config-tool-serviceaccount
+      volumes:
+        - name: configvolume
+          secret:
+            secretName: quay-enterprise-config-secret
+      containers:
+      - name: quay-enterprise-config-tool
+        image: config-app:latest # TODO: change to reference to quay image?
+        imagePullPolicy: IfNotPresent # enable when testing with minikube
+        args: ["config"]
+        ports:
+        - containerPort: 80
--- a/config_app/docs/kube_setup.md
+++ b/config_app/docs/kube_setup.md
@ -0,0 +1,143 @@
+# Quay Enterprise Installation on Kubernetes
+
+This guide walks through the deployment of [Quay Enterprise][quay-enterprise-tour] onto a Kubernetes cluster.
+After completing the steps in this guide, a deployer will have a functioning instance of Quay Enterprise orchestrated as a Kubernetes service on a cluster, and will be able to access the Quay Enterprise Setup tool with a browser to complete configuration of image repositories, builders, and users.
+
+[quay-enterprise-tour]: https://quay.io/tour/enterprise
+
+## Prerequisites
+
+A PostgreSQL database must be available for Quay Enterprise metadata storage.
+We currently recommend running this database server outside of the cluster.
+
+## Download Kubernetes Configuration Files
+
+Visit the [RedHat Documentation][RedHat-documentation] and download the pre-formatted pull secret, under "Account Assets". There are several formats of the secret, be sure to download the "dockercfg" format resulting in a `config.json` file. This pull secret is used to download the Quay Enterprise containers.
+
+This will be used later in the guide.
+
+[RedHat-documentation]: https://access.redhat.com/documentation/en-us/
+
+Next, download each of the following files to your workstation, placing them alongside your pull secret:
+
+- [quay-enterprise-namespace.yml](files/quay-enterprise-namespace.yml)
+- [quay-enterprise-config-secret.yml](files/quay-enterprise-config-secret.yml)
+- [quay-enterprise-redis.yml](files/quay-enterprise-redis.yml)
+- [quay-enterprise-app-rc.yml](files/quay-enterprise-app-rc.yml)
+- [quay-enterprise-service-nodeport.yml](files/quay-enterprise-service-nodeport.yml)
+- [quay-enterprise-service-loadbalancer.yml](files/quay-enterprise-service-loadbalancer.yml)
+
+## Role Based Access Control
+
+Quay Enterprise has native Kubernetes integrations. These integrations require Service Account to have access to Kubernetes API. When Kubernetes RBAC is enabled, Role Based Access Control policy manifests also have to be deployed.
+
+Kubernetes API has minor changes between versions 1.4 and 1.5, Download appropiate versions of Role Based Access Control (RBAC) Policies.
+
+### Kubernetes v1.6.x and later RBAC Policies 
+
+- [quay-servicetoken-role.yaml](files/quay-servicetoken-role-k8s1-6.yaml)
+- [quay-servicetoken-role-binding.yaml](files/quay-servicetoken-role-binding-k8s1-6.yaml)
+
+
+## Deploy to Kubernetes
+
+All Kubernetes objects will be deployed under the "quay-enterprise" namespace.
+The first step is to create this namespace:
+
+```sh
+kubectl create -f quay-enterprise-namespace.yml
+```
+
+Next, add your pull secret to Kubernetes (make sure you specify the correct path to `config.json`):
+
+```sh
+kubectl create secret generic coreos-pull-secret --from-file=".dockerconfigjson=config.json" --type='kubernetes.io/dockerconfigjson' --namespace=quay-enterprise
+```
+
+### Kubernetes v1.6.x and later : Deploy RBAC Policies
+
+```sh
+kubectl create -f quay-servicetoken-role-k8s1-6.yaml
+kubectl create -f quay-servicetoken-role-binding-k8s1-6.yaml
+```
+
+### Deploy Quay Enterprise objects
+
+Finally, the remaining Kubernetes objects can be deployed onto Kubernetes:
+
+```sh
+kubectl create -f quay-enterprise-config-secret.yml -f quay-enterprise-redis.yml -f quay-enterprise-app-rc.yml
+```
+
+## Expose via Kubernetes Service
+
+In order to access Quay Enterprise, a user must route to it through a Kubernetes Service.
+It is up to the deployer to decide which Service type is appropriate for their use case: a [LoadBalancer](http://kubernetes.io/docs/user-guide/services/#type-loadbalancer) or a [NodePort](http://kubernetes.io/docs/user-guide/services/#type-nodeport).
+
+A LoadBalancer is recommended if the Kubernetes cluster is integrated with a cloud provider, otherwise a NodePort will suffice.
+Along with this guide are examples of this service.
+
+### LoadBalancer
+
+Using the sample provided, a LoadBalancer Kubernetes Service can be created like so:
+
+```sh
+kubectl create -f quay-enterprise-service-loadbalancer.yml
+```
+
+kubectl can be used to find the externally-accessible URL of the quay-enterprise service:
+
+```sh
+kubectl describe services quay-enterprise --namespace=quay-enterprise
+```
+
+### NodePort
+
+Using the sample provided, a NodePort Kubernetes Service can be created like so:
+
+```sh
+kubectl create -f quay-enterprise-service-nodeport.yml
+```
+
+By default, the quay-enterprise service will be available on port 30080 on every node in the Kubernetes cluster.
+If this port conflicts with an existing Kubernetes Service, simply modify the sample configuration file and change the value of NodePort.
+
+## Continue with Quay Enterprise Setup
+
+All that remains is to configure Quay Enterprise itself through the configuration tool.
+
+Download the following files to your workstation:
+
+- [config-tool-service-nodeport.yml](k8s_templates/config-tool-service-nodeport.yml)
+- [config-tool-serviceaccount.yml](k8s_templates/config-tool-serviceaccount.yml)
+- [config-tool-servicetoken-role.yml](k8s_templates/config-tool-servicetoken-role.yml)
+- [config-tool-servicetoken-role-binding.yml](k8s_templates/config-tool-servicetoken-role-binding.yml)
+- [qe-config-tool.yml](k8s_templates/qe-config-tool.yml)
+
+### Configuring RBAC for the configuration tool
+
+Apply the following policies to allow the config tool to make changes to the Q.E. deployment:
+```bash
+kubectl apply -f config-tool-serviceaccount.yaml
+```
+```bash
+kubectl apply -f config-tool-servicetoken-role.yaml
+```
+```bash
+kubectl apply -f config-tool-servicetoken-role-binding.yaml
+```
+
+### Deploy Config Tool 
+
+Deploy the configuration tool and route a service to it:
+```bash
+kubectl apply -f qe-config-tool.yml -f config-tool-service-nodeport.yml
+```
+
+By default, the config-tool service will be available on port 30090 on every node in the Kubernetes cluster.
+Similar to the Quay application service, if this port conflicts with an existing Kubernetes Service, simply modify the sample configuration file and change the value of NodePort.
+Once at the Quay Enterprise setup UI, follow the setup instructions to finalize your installation.
+
+## Using the Configuration Tool
+Click on "Start New Configuration for this Cluster", and follow the instructions to create your configuration, downloading and saving it (to load as a backup or if you ever wish to change your settings).
+You will also be able to deploy the configuration to all instances by hitting "Deploy". Allow for a minute for the Quay instances to cycle the pods, and your configuration will be enacted once the pods have started.
--- a/config_app/js/components/config-setup-app/config-setup-app.component.html
+++ b/config_app/js/components/config-setup-app/config-setup-app.component.html
@ -1,4 +1,4 @@
-<div ng-if="$ctrl.state === 'choice'">
+<div ng-if="$ctrl.state === 'choice' && $ctrl.kubeNamespace === false">
    <div class="co-dialog modal fade initial-setup-modal in" id="setupModal" style="display: block;">
        <div class="modal-backdrop fade in" style="height: 1000px;"></div>
        <div class="modal-dialog fade in">
@ -22,6 +22,40 @@
        </div><!-- /.modal-dialog -->
    </div>
 </div>
+<div ng-if="$ctrl.state === 'choice' && $ctrl.kubeNamespace !== false">
+    <div class="co-dialog modal fade initial-setup-modal in" id="kubeSetupModal" style="display: block;">
+        <div class="modal-backdrop fade in" style="height: 1000px;"></div>
+        <div class="modal-dialog fade in">
+            <div class="modal-content">
+                <!-- Header -->
+                <div class="modal-header">
+                    <h4 class="modal-title"><span>Choose an option for the <code>{{ $ctrl.kubeNamespace }}</code> namespace</span></h4>
+                </div>
+                <!-- Body -->
+                <div class="config-setup-wrapper">
+                    <a class="config-setup_option" ng-click="$ctrl.chooseSetup()">
+                        <i class="fas fa-edit fa-2x"></i>
+                        <div>Start new configuration for this cluster</div>
+                    </a>
+                    <a class="config-setup_option" ng-click="$ctrl.choosePopulate()">
+                        <i class="fas fa-cloud-download-alt fa-2x"></i>
+                        <div>Modify configuration for this cluster</div>
+                    </a>
+                    <a class="config-setup_option" ng-click="$ctrl.chooseLoad()">
+                        <i class="fas fa-upload fa-2x"></i>
+                        <div>Populate this cluster from a previously created configuration</div>
+                    </a>
+                </div>
+            </div><!-- /.modal-content -->
+        </div><!-- /.modal-dialog -->
+    </div>
+</div>
 <div ng-if="$ctrl.state === 'setup'" class="setup" setup-completed="$ctrl.setupCompleted()"></div>
 <load-config ng-if="$ctrl.state === 'load'" config-loaded="$ctrl.configLoaded()"></load-config>
-<download-tarball-modal ng-if="$ctrl.state === 'download'" loaded-config="$ctrl.loadedConfig"></download-tarball-modal>
+<download-tarball-modal
+        ng-if="$ctrl.state === 'download'"
+        loaded-config="$ctrl.loadedConfig"
+        is-kubernetes="$ctrl.kubeNamespace !== false"
+        choose-deploy="$ctrl.chooseDeploy()">
+</download-tarball-modal>
+<kube-deploy-modal ng-if="$ctrl.state === 'deploy'"></kube-deploy-modal>
--- a/config_app/js/components/config-setup-app/config-setup-app.component.ts
+++ b/config_app/js/components/config-setup-app/config-setup-app.component.ts
@ -1,6 +1,8 @@
 import { Component, Inject } from 'ng-metadata/core';
 const templateUrl = require('./config-setup-app.component.html');

+declare var window: any;
+
 /**
 * Initial Screen and Choice in the Config App
 */
@ -13,12 +15,18 @@ export class ConfigSetupAppComponent {
        : 'choice'
        | 'setup'
        | 'load'
-        | 'download';
+        | 'populate'
+        | 'download'
+        | 'deploy';

    private loadedConfig = false;
+    private kubeNamespace: string | boolean = false;

    constructor(@Inject('ApiService') private apiService) {
        this.state = 'choice';
+        if (window.__kubernetes_namespace) {
+            this.kubeNamespace = window.__kubernetes_namespace;
+        }
    }

    private chooseSetup(): void {
@ -36,6 +44,10 @@ export class ConfigSetupAppComponent {
        this.loadedConfig = true;
    }

+    private choosePopulate(): void {
+        this.state = 'populate';
+    }
+
    private configLoaded(): void {
        this.state = 'setup';
    }
@ -43,4 +55,8 @@ export class ConfigSetupAppComponent {
    private setupCompleted(): void {
        this.state = 'download';
    }
+
+    private chooseDeploy(): void {
+        this.state = 'deploy';
+    }
 }
--- a/config_app/js/components/cor-loader/cor-loader.html
+++ b/config_app/js/components/cor-loader/cor-loader.html
@ -0,0 +1,5 @@
+<div class="co-m-loader co-an-fade-in-out">
+  <div class="co-m-loader-dot__one"></div>
+  <div class="co-m-loader-dot__two"></div>
+  <div class="co-m-loader-dot__three"></div>
+</div>
--- a/config_app/js/components/cor-loader/cor-loader.js
+++ b/config_app/js/components/cor-loader/cor-loader.js
@ -0,0 +1,15 @@
+const templateUrl = require('./cor-loader.html');
+
+angular.module('quay-config')
+    .directive('corLoader', function() {
+        var directiveDefinitionObject = {
+            templateUrl,
+            replace: true,
+            restrict: 'C',
+            scope: {
+            },
+            controller: function($rootScope, $scope, $element) {
+            }
+        };
+        return directiveDefinitionObject;
+    });
--- a/config_app/js/components/download-tarball-modal/download-tarball-modal.component.html
+++ b/config_app/js/components/download-tarball-modal/download-tarball-modal.component.html
@ -23,7 +23,7 @@
                            see the docs.
                        </a>
                        <div class="modal__warning-box">
-                            <div class="fas co-alert co-alert-warning">
+                            <div class="co-alert co-alert-warning">
                                <strong>Warning: </strong>
                                Your configuration and certificates are kept <i>unencrypted</i>. Please keep this file secure.
                            </div>
@ -35,19 +35,23 @@
                            see the docs.
                        </a>
                        <div class="modal__warning-box">
-                            <div class="fas co-alert co-alert-warning">
+                            <div class="co-alert co-alert-warning">
                                <strong>Warning: </strong>
                                Your configuration and certificates are kept <i>unencrypted</i>. Please keep this file secure.
                            </div>
                        </div>
                    </div>
-                </div>
-                <div class="modal-footer">
-                    <button class="btn btn-primary"
+                    <button class="btn btn-default btn-lg download-button"
                            ng-click="$ctrl.downloadTarball()">
                        <i class="fa fa-download" style="margin-right: 10px;"></i>Download Configuration
                    </button>
                </div>
+                <div ng-if="$ctrl.isKubernetes" class="modal-footer">
+                    <button class="btn btn-primary"
+                            ng-click="$ctrl.goToDeploy()">
+                        <i class="far fa-paper-plane" style="margin-right: 10px;"></i>Go to deployment rollout
+                    </button>
+                </div>
            </div><!-- /.modal-content -->
        </div><!-- /.modal-dialog -->
    </div>
--- a/config_app/js/components/download-tarball-modal/download-tarball-modal.component.ts
+++ b/config_app/js/components/download-tarball-modal/download-tarball-modal.component.ts
@ -1,4 +1,4 @@
-import { Input, Component, Inject } from 'ng-metadata/core';
+import {Input, Component, Inject, Output, EventEmitter} from 'ng-metadata/core';
 const templateUrl = require('./download-tarball-modal.component.html');
 const styleUrl = require('./download-tarball-modal.css');

@ -14,12 +14,14 @@ declare const FileSaver: any;
 })
 export class DownloadTarballModalComponent {
    @Input('<') public loadedConfig;
+    @Input('<') public isKubernetes;
+    @Output() public chooseDeploy = new EventEmitter<any>();

    constructor(@Inject('ApiService') private ApiService) {

    }

-    private downloadTarball() {
+    private downloadTarball(): void {
        const errorDisplay: Function = this.ApiService.errorDisplay(
          'Could not save configuration. Please report this error.'
        );
@ -31,4 +33,8 @@ export class DownloadTarballModalComponent {
            FileSaver.saveAs(resp, 'quay-config.tar.gz');
        }, errorDisplay);
    }
+
+    private goToDeploy() {
+        this.chooseDeploy.emit({});
+    }
 }
--- a/config_app/js/components/download-tarball-modal/download-tarball-modal.css
+++ b/config_app/js/components/download-tarball-modal/download-tarball-modal.css
@ -1,7 +1,18 @@
 .co-dialog .modal-body.download-tarball-modal {
    padding: 15px;
+    display: flex;
+    flex-direction: column;
 }

 .modal__warning-box {
    margin-top: 15px;
 }
+
+.download-tarball-modal .download-button {
+    align-self: center;
+}
+
+.download-tarball-modal .download-button:hover {
+    background-color: #dddddd;
+    text-decoration: none;
+}
--- a/config_app/js/components/kube-deploy-modal/kube-deploy-modal.component.html
+++ b/config_app/js/components/kube-deploy-modal/kube-deploy-modal.component.html
@ -0,0 +1,53 @@
+<div>
+    <div class="co-dialog modal fade initial-setup-modal in" id="setupModal" style="display: block;">
+        <div class="modal-backdrop fade in" style="height: 1000px;"></div>
+        <div class="modal-dialog fade in">
+            <div class="modal-content">
+                <!-- Header -->
+                <div class="modal-header">
+                    <span class="cor-step-bar">
+                        <span class="cor-step active" title="Configure Database" text="1"></span>
+                        <span class="cor-step active" title="Setup Database" icon="database"></span>
+                        <span class="cor-step active" title="Create Superuser" text="2"></span>
+                        <span class="cor-step active" title="Configure Registry" text="3"></span>
+                        <span class="cor-step active" title="Validate Configuration" text="4"></span>
+                        <span class="cor-step active" title="Setup Complete" icon="download"></span>
+                        <span class="cor-step active" title="Deploy Complete" icon="paper-plane"></span>
+                    </span>
+                    <h4 class="modal-title"><span>Deploy configuration</span></h4>
+                </div>
+                <!-- Body -->
+                <div class="modal-body">
+                    <div class="cor-loader" ng-if="$ctrl.state === 'loadingDeployments'"></div>
+                    <div class="kube-deploy-modal__body" ng-if="$ctrl.deploymentsStatus.length > 0">
+                        <span class="kube-deploy-modal__list-header">The following deployments will be affected:</span>
+                        <ul class="kube-deploy-modal__list">
+                            <li class="kube-deploy-modal__list-item" ng-repeat="deployment in $ctrl.deploymentsStatus">
+                                <i class="fa ci-k8s-logo"></i>
+                                <code>{{deployment.name}}</code> with {{deployment.numPods}} <b> {{ deployment.numPods === 1 ? ' pod' : ' pods' }}</b>
+                            </li>
+                        </ul>
+                        <button ng-if="$ctrl.state === 'readyToDeploy'" class="btn btn-primary btn-lg" ng-click="$ctrl.deployConfiguration()">
+                            <i class="far fa-paper-plane" style="margin-right: 10px;"></i>
+                            Populate configuration to deployments
+                        </button>
+                        <div ng-if="$ctrl.state === 'deployingConfiguration'">
+                            <div class="cor-loader"></div>
+                            Deploying configuration...
+                        </div>
+                        <div ng-if="$ctrl.state === 'cyclingDeployments'">
+                            <div class="cor-loader"></div>
+                            Cycling deployments...
+                        </div>
+                        <div ng-if="$ctrl.state === 'deployed'">
+                            Configuration successfully deployed!
+                        </div>
+                    </div>
+                    <div ng-if="$ctrl.state === 'error'">
+                        {{ $ctrl.errorMessage }}
+                    </div>
+                </div>
+            </div><!-- /.modal-content -->
+        </div><!-- /.modal-dialog -->
+    </div>
+</div>
--- a/config_app/js/components/kube-deploy-modal/kube-deploy-modal.component.ts
+++ b/config_app/js/components/kube-deploy-modal/kube-deploy-modal.component.ts
@ -0,0 +1,53 @@
+import {Component, Inject} from 'ng-metadata/core';
+const templateUrl = require('./kube-deploy-modal.component.html');
+const styleUrl = require('./kube-deploy-modal.css');
+
+@Component({
+    selector: 'kube-deploy-modal',
+    templateUrl,
+    styleUrls: [ styleUrl ],
+})
+export class KubeDeployModalComponent {
+    private state
+        : 'loadingDeployments'
+        | 'readyToDeploy'
+        | 'deployingConfiguration'
+        | 'cyclingDeployments'
+        | 'deployed'
+        | 'error';
+
+    private errorMessage: string;
+
+    private deploymentsStatus: { name: string, numPods: number }[] = [];
+
+    constructor(@Inject('ApiService') private ApiService) {
+        this.state = 'loadingDeployments';
+
+        ApiService.scGetNumDeployments().then(resp => {
+            this.deploymentsStatus = resp.items.map(dep => ({ name: dep.metadata.name, numPods: dep.status.replicas }));
+            this.state = 'readyToDeploy';
+        }).catch(err => {
+            this.state = 'error';
+            this.errorMessage = `There are no Quay deployments active in this namespace. \
+                                Please check that you are running this \
+                                tool in the same namespace as the Quay Enterprise application\
+                                Associated error message: ${err.toString()}`;
+        })
+    }
+
+    deployConfiguration(): void {
+        this.ApiService.scDeployConfiguration().then(() => {
+            const deploymentNames: string[]= this.deploymentsStatus.map(dep => dep.name);
+
+            this.ApiService.scCycleQEDeployments({ deploymentNames }).then(() => {
+                this.state = 'deployed'
+            }).catch(err => {
+                this.state = 'error';
+                this.errorMessage = `Could cycle the deployments with the new configuration. Error: ${err.toString()}`;
+            })
+        }).catch(err => {
+            this.state = 'error';
+            this.errorMessage = `Could not deploy the configuration. Error: ${err.toString()}`;
+        })
+    }
+}
--- a/config_app/js/components/kube-deploy-modal/kube-deploy-modal.css
+++ b/config_app/js/components/kube-deploy-modal/kube-deploy-modal.css
@ -0,0 +1,31 @@
+.kube-deploy-modal__body {
+    display: flex;
+    flex-direction: column;
+    padding: 15px;
+    list-style: none;
+}
+
+.kube-deploy-modal__list {
+    padding-top: 10px;
+    padding-left: 15px;
+    margin-bottom: 15px;
+    list-style: none;
+}
+
+.kube-deploy-modal__list-header {
+    font-size: 16px;
+}
+
+.kube-deploy-modal__list-item {
+    padding-top: 5px;
+}
+
+.kube-deploy-modal__list-item i {
+    padding-right: 5px;
+}
+
+.kube-deploy-modal__body .btn {
+    align-self: center;
+    margin-top: 20px;
+    margin-bottom: 10px;
+}
--- a/config_app/js/config-app.module.ts
+++ b/config_app/js/config-app.module.ts
@ -4,6 +4,7 @@ import * as restangular from 'restangular';
 import { ConfigSetupAppComponent } from './components/config-setup-app/config-setup-app.component';
 import { DownloadTarballModalComponent } from './components/download-tarball-modal/download-tarball-modal.component';
 import { LoadConfigComponent } from './components/load-config/load-config.component';
+import { KubeDeployModalComponent } from './components/kube-deploy-modal/kube-deploy-modal.component';

 const quayDependencies: string[] = [
    'restangular',
@ -45,6 +46,7 @@ function provideConfig($provide: ng.auto.IProvideService,
        ConfigSetupAppComponent,
        DownloadTarballModalComponent,
        LoadConfigComponent,
+        KubeDeployModalComponent,
    ],
    providers: []
 })
--- a/config_app/static/css/config-setup-app-component.css
+++ b/config_app/static/css/config-setup-app-component.css
@ -3,21 +3,26 @@
 }

 .config-setup_option {
-    font-size: x-large;
+    font-size: 22px;
    height: 250px;
    display: flex;
    flex: 1;
    flex-direction: column;
    align-items: center;
-    justify-content: center;
    padding: 15px;
    margin: 15px;
+    justify-content: space-evenly;
 }

 .config-setup_option i {
    padding-bottom: 10px;
 }

+.config-setup_option div {
+    text-align: center;
+    min-height: 100px;
+}
+
 .config-setup_option:hover {
    background-color: #dddddd;
    text-decoration: none;
--- a/config_app/templates/index.html
+++ b/config_app/templates/index.html
@ -4,6 +4,7 @@
    <script type="text/javascript">
      window.__endpoints = {{ route_data|tojson|safe }}.paths;
      window.__config = {{ config_set|tojson|safe }};
+      window.__kubernetes_namespace = {{ kubernetes_namespace|tojson|safe }};
    </script>