Command-line deployment

These steps describe the provider-neutral Kubernetes and Helm workflow. Distribution-specific prerequisites, image locations, and values are supplied with the approved Trinetra package. Google Cloud Marketplace customers must also review Google Cloud Marketplace BYOL.

Client tools and context

Install kubectl and Helm 3, authenticate to the destination cluster, and confirm that kubectl config current-context identifies the intended Kubernetes cluster. Record the approved chart version and image digest; do not substitute a mutable or unapproved image.

For Trinetra 5.5.3, the declared minimum is Kubernetes 1.27.0 and the Marketplace image architecture is linux/amd64. Google Cloud Marketplace deployment requires an existing GKE cluster with Workload Identity Federation. See the Marketplace compatibility boundaries before installation.

Obtain and verify the chart

The CLI package is the same Trinetra 5.5.3 Helm chart used by the Marketplace deployer. Obtain the approved public configuration package referenced by the Marketplace release, then confirm these files exist before continuing:

test -f chart/trinetra/Chart.yaml
test -f chart/trinetra/values.yaml
test -d chart/trinetra/templates
helm lint ./chart/trinetra

Do not substitute the internal product source repository or an unreviewed chart. The public repository URL must be taken from the Public Git repo field of the published Marketplace release.

Resolve and pin the immutable image digest

The Marketplace 5.5.3 application image is:

gcr.io/lnp-technologies-public/trinetra-byol:5.5.3

Resolve its immutable digest and verify that the digest exists:

export TRINETRA_IMAGE="gcr.io/lnp-technologies-public/trinetra-byol"
export TRINETRA_VERSION="5.5.3"
export TRINETRA_DIGEST="$(gcloud container images describe \
  "${TRINETRA_IMAGE}:${TRINETRA_VERSION}" \
  --format='value(image_summary.digest)')"

test -n "$TRINETRA_DIGEST"
gcloud container images describe "${TRINETRA_IMAGE}@${TRINETRA_DIGEST}"

Record the returned sha256:… value in the change record. The install command below uses tag@digest; Kubernetes resolves the immutable digest while retaining the release tag for readability.

Prepare values

Copy the values template supplied with the distribution to a private working file. Set the cloud scope, evidence storage, Kubernetes service accounts, initial administrator, and secrets for that environment. Do not commit the completed file. Google Cloud Marketplace fields are documented in Marketplace parameters.

For direct Helm deployment, create the three Kubernetes service accounts before installation. On GKE, annotate each Kubernetes service account with its dedicated Google service account and grant the Workload Identity User binding. The controller identity receives only the Google Cloud permissions needed for enabled discovery and approved actions; UI and probe require no Kubernetes API permissions from the chart.

The values controller.serviceAccountName, ui.serviceAccountName, and probe.serviceAccountName are Kubernetes names such as trinetra-controller, not Google service-account email addresses.

Install

kubectl create namespace trinetra-system

helm upgrade --install trinetra ./chart/trinetra \
  --namespace trinetra-system \
  --values ./customer-values.yaml \
  --set-string image.repository="$TRINETRA_IMAGE" \
  --set-string image.tag="${TRINETRA_VERSION}@${TRINETRA_DIGEST}" \
  --wait \
  --timeout 10m

For an existing namespace, omit the create command. If the organization uses GitOps, translate the reviewed values into its approved secret and release process.

Verify

kubectl -n trinetra-system get deployments,pods,services,pvc
kubectl -n trinetra-system rollout status deployment/trinetra-controller --timeout=5m
kubectl -n trinetra-system rollout status deployment/trinetra-ui --timeout=5m
kubectl -n trinetra-system rollout status deployment/trinetra-probe --timeout=5m
kubectl -n trinetra-system get deployments \
  -l app.kubernetes.io/instance=trinetra \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.template.spec.containers[0].image}{"\n"}{end}'

Every displayed application image must contain the recorded @sha256: digest.

With the default private service, open a temporary local connection:

kubectl -n trinetra-system port-forward service/trinetra-ui 8080:80

Open http://127.0.0.1:8080, sign in, and change any temporary password. Do not expose the plain HTTP service to the internet.

Optional customer-managed HTTPS ingress

External ingress is optional and is not created by the Trinetra chart. The supported default is ClusterIP plus port forwarding or a private customer access path. If the customer already operates an NGINX-compatible ingress controller, create a TLS secret and an ingress that forwards only to the UI service:

The example assumes the Helm release is named trinetra. If another release name is used, replace the backend service name trinetra-ui with <release-name>-ui.

export TRINETRA_HOST="trinetra.example.com"

kubectl -n trinetra-system create secret tls trinetra-ui-tls \
  --cert=./tls.crt \
  --key=./tls.key

cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trinetra-ui
  namespace: trinetra-system
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["${TRINETRA_HOST}"]
      secretName: trinetra-ui-tls
  rules:
    - host: "${TRINETRA_HOST}"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: trinetra-ui
                port:
                  number: 80
EOF

Replace nginx with the customer's installed ingress class and follow that controller's certificate, health-check, firewall, and identity documentation. Restrict source networks, enforce HTTPS, preserve secure cookies, and do not expose the controller or probe services. Customer security review is required before external access.

Complete the activation, enrolment, discovery, Dry run, and evidence checks in Getting started.

Upgrade

Back up persistent data, review the release notes, pin the approved image version and digest, then run:

helm upgrade trinetra ./chart/trinetra \
  --namespace trinetra-system \
  --values ./customer-values.yaml \
  --set-string image.repository="$TRINETRA_IMAGE" \
  --set-string image.tag="${TRINETRA_VERSION}@${TRINETRA_DIGEST}" \
  --wait \
  --timeout 10m

Repeat readiness, entitlement, discovery, Dry run, and evidence checks. Keep the prior release and configuration available for rollback.

Uninstall

After exporting required records and backing up persistent data:

helm uninstall trinetra --namespace trinetra-system

Review persistent volumes, services, load balancers, secrets, workload identities, IAM bindings, and evidence storage separately. Remove them only under the customer's retention and change-control policy.