Offline On-Premise

Deploy and run Fission in a Kubernetes cluster with restricted or no internet access — for example due to business or compliance reasons — by mirroring every required image into a registry the cluster can reach.

This guide assumes your CI/CD tooling has internet access, even though the Kubernetes cluster itself does not.

Cloning Fission Images

Before installing Fission you will need to make container images available in a container registry which is accessible to the Kubernetes cluster. You can download and retag them or export and import image tar files based on your setup.

For a core Fission install you will need the following images:

ghcr.io/fission/fission-bundle
ghcr.io/fission/fetcher
ghcr.io/fission/pre-upgrade-checks
busybox

If you enable the optional logger (influxdb.enabled=true), also mirror:

fluent/fluent-bit
influxdb:1.8

Image references and tags can change between releases. Run helm show values --version 1.27.0 fission-charts/fission-all against the chart you intend to install and mirror exactly the images it lists.

In addition, you will need to import environment images which will be used by functions. For example, if you are only going to use python and node environments then you will need to import the following images:

ghcr.io/fission/python-env
ghcr.io/fission/node-env

Deploying Fission

With Helm

If the Kubernetes cluster has Helm installed, download the chart for the version you want from the charts repo and install it by passing the tar file or by extracting the chart into a directory. The key step is to update the image references in values.yaml to point at your internal registry.

$ helm install ./fission-all-1.27.0.tgz

On-premise environments generally can’t provision a LoadBalancer, so expose the services as type NodePort instead:

routerServiceType: NodePort
serviceType: NodePort

To enable Prometheus with Fission, download the Prometheus chart and mirror its images into your registry before installing Fission.

Without Helm

If you are not using Helm, use the YAML files from Fission releases to install Fission instead. Once downloaded, edit the YAML to point at your mirrored Fission images, and at your mirrored Prometheus images if you want to enable Prometheus.

Change every service of type LoadBalancer to NodePort. The service is then reachable on the host’s IP and NodePort.

type: NodePort

Running Fission

Builder

In an offline setup, the builder can’t fetch dependencies from the internet. If you use a private artifact manager such as Artifactory or Nexus, configure its URL in the respective build tool. Check that build tool’s documentation for how to point it at a custom artifact server.

LoadBalancer & Accessing Fission Functions

As with the install step above, on-premise environments can’t provision a LoadBalancer, so services are exposed as type NodePort instead.

To expose functions outside the cluster through an ingress controller, use the --createingress flag when creating routes. Functions are then reachable on the ingress controller’s NodePort plus the function path.