> ## Documentation Index > Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Pre-install checklist This checklist should be used to verify all requirements have been met prior to any installation. For many of these items, we have provided some commands or command templates to run in order to verify the given prerequisite, along with a typical output to give you an idea of the kind of information you should be given. Please run each of these commands, modified as appropriate for your environment, and copy the outputs into a document for sending to the Anaconda implementation team so that they may verify that the requirements are ready. ## Basic requirements * An [administration server](./zero-g#administration-server) has been provisioned with appropriate versions of `kubectl`, `helm`, and other tools needed to perform installation and administration tasks. Command: `helm version`: ``` version.BuildInfo{Version:"v3.7.1", GitCommit:"1d11fcb5d3f3bf00dbe6fe31b8412839a96b3dc4", GitTreeState:"clean", GoVersion:"go1.16.9"} ``` * The [API version](./zero-g#supported-kubernetes-versions) of the Kubernetes cluster is between 1.15 and 1.24. Command: `kubectl version`: ``` Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.12", GitCommit:"e2a822d9f3c2fdb5c9bfbe64313cf9f657f0a725", GitTreeState:"clean", BuildDate:"2020-05-06T05:17:59Z", GoVersion:"go1.12.17", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.12", GitCommit:"e2a822d9f3c2fdb5c9bfbe64313cf9f657f0a725", GitTreeState:"clean", BuildDate:"2020-05-06T05:09:48Z", GoVersion:"go1.12.17", Compiler:"gc", Platform:"linux/amd64"} ``` * All nodes nodes on which Anaconda Enterprise will be installed have [sufficient CPU and memory allocations](./zero-g#cpu-memory-and-nodes). Command: `kubectl get nodes -o=jsonpath="{range .items[*]}{.metadata.name}{'\t'}{.status.capacity.cpu}{'\t'}{.status.capacity.memory}{'\n'}{end}"`: ``` 10.234.2.18 16 65806876Ki 10.234.2.19 16 65806876Ki 10.234.2.20 16 65806876Ki 10.234.2.21 16 65806876Ki 10.234.2.6 16 65974812Ki ``` ## Access control and security * The [namespace](./zero-g#namespace-service-account-rbac) into which Anaconda Enterprise will be installed has been created. Command: `kubectl describe namespace `: ``` Name: default Labels: Annotations: Status: Active No resource quota. No resource limits. ``` * The [service account](./zero-g#namespace-service-account-rbac) that will be used during the installation process as well as by Anaconda Enterprise itself, has been created. Command: `kubectl describe sa `: ``` Name: anaconda-enterprise Namespace: default Labels: Annotations: Image pull secrets: Mountable secrets: anaconda-enterprise-token-cdmnf Tokens: anaconda-enterprise-token-cdmnf Events: ``` * *(OpenShift)* The Security Context Constraint (SCC) associated with the service account contains all of the necessary permissions. Note the example below uses the `anyuid` scc, however the `restricted` scc can also be used, as long as the `uid` range is known. Command: `oc describe scc `: ``` Name: anyuid Priority: 10 Access: Users: Groups: system:cluster-admins ``` * The `ClusterRole` resource associated with the service account has the necessary permissions to facilitate installation and operation. Command: `kubectl describe clusterrole `: ``` Name: anaconda-enterprise Labels: app.kubernetes.io/managed-by=Helm skaffold.dev/run-id=8d38b94a-ab82-49d7-a6fd-0bc0fb549d1c Annotations: meta.helm.sh/release-name: anaconda-enterprise meta.helm.sh/release-namespace: default PolicyRule: Resources Non-Resource URLs Resource Names Verbs --------- ----------------- -------------- ----- *.* [] [] [*] [*] [] [*] ``` The above example is fully permissive. See [this example](./guides/rbac) for a more realistic choice. * The numeric UID to use to run Anaconda Enterprise containers has been identified. Furthermore, GID 0 is verified to be permitted by the security context. *Please include the UID in your checklist results.* * Any [tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) and/or [node labels](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/) required to permit Anaconda Enterprise to run on its assigned nodes have been identified. Command (tolerations only): `kubectl get nodes -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.taints[*].key}{"\n"}{end}'` ## Storage * A Persistent Volume Claim (PVC) has been created within the application namespace, referencing a statically provisioned Persistent Volume that meets the [storage requirements](./zero-g#storage) for the `anaconda-storage` volume. Command: `kubectl describe pvc anaconda-storage`: ``` Name: anaconda-storage Namespace: default StorageClass: anaconda-storage Status: Bound Volume: anaconda-storage Labels: Annotations: pv.kubernetes.io/bind-completed: yes pv.kubernetes.io/bound-by-controller: yes Finalizers: [kubernetes.io/pvc-protection] Capacity: 500Gi Access Modes: RWO VolumeMode: Filesystem Mounted By: anaconda-enterprise-ap-git-storage-6658575d6f-vxj4s anaconda-enterprise-ap-object-storage-76bcfc4d44-ctlhp anaconda-enterprise-postgres-c76869799-cbqzq Events: ``` * A Persistent Volume Claim (PVC) has been created within the application namespace, referencing a statically provisioned Persistent Volume that meets the [storage requirements](./zero-g#storage) for the `anaconda-persistence` volume. Command: `kubectl describe pvc anaconda-persistence`: ``` Name: anaconda-persistence Labels: Annotations: pv.kubernetes.io/bound-by-controller: yes Finalizers: [kubernetes.io/pv-protection] StorageClass: Status: Bound Claim: default/anaconda-persistence Reclaim Policy: Retain Access Modes: RWX VolumeMode: Filesystem Capacity: 500Gi Node Affinity: Message: Source: Type: NFS (an NFS mount that lasts the lifetime of a pod) Server: 10.234.2.7 Path: /data/persistence ReadOnly: false Events: ``` ## Cluster Sizing / Resources * The cluster is sized appropriately (CPU / Memory) for user workload, including consideration for “burst” workloads. [Cluster considerations](../reference/understanding-ae5) * Resource Profiles have been determined, and created in the “values.yaml” file prior to install. [Resource Profile guide](../admin/resources/resource-profile) ## Networking * The domain name for the Anaconda Enterprise application has been identified. In the next several bullets, we will use the sample domain `anaconda.example.com` as a stand-in for this choice. *Please include this domain name in your checklist output.* * *If a customer-selected ingress controller is to be used*, this controller has already been installed, and its master IP address and `ingressClassName` value have been identified. *Please include both the IP address ingress class name in your checklist output.* * The DNS records for both `anaconda.example.com` and `*.anaconda.example.com` have been created, pointing to the IP address of the ingress controller. Command: `ping test.anaconda.example.com`: ``` PING test.anaconda.example.com (167.172.143.144): 56 data bytes ``` If the ingress controller is to be installed with Anaconda Enterprise, this may not be possible; in this case, it is sufficient to confirm that the networking team is prepared to instantiate these records immediately following installation. * A wildcard SSL secret for `anaconda.example.com` and `*.anaconda.example.com` has been created. The public and private keys for the main certificate, as well as the full public certificate chain, are accessible from the administration server. *Please share the public certificate chain in your checklist output*. * If the SSL secret was created using a private CA, the public root certificate has been obtained. ## Docker Images * *If a private Docker registry is to be used*, the full set of Docker images have been transferred to this registry. * If a [pull secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) is required to access the Docker images—whether from the standard Anaconda Enterprise Docker channel or the private registry—the secret has been created in the application namespace. Command: `kubectl get secret -n `