Deployment scenarios

Automation Suite deployment architecture on OpenShift with secretstore configuration for credentials.

Automation Suite on OpenShift deployment

Deployment architecture

You can reference the following architecture diagrams to deploy Automation Suite on OpenShift.

Overview

The OpenShift architecture comprises the control plane nodes and the compute nodes. The control plane nodes host the control plane applications of Kubernetes, such as API servers, etcd, schedulers, etc., whereas the compute nodes host other applications like the monitoring stack, networking, etc. Automation Suite is also installed on the compute nodes.

Automation Suite relies on Istio for networking and ArgoCD for deployment. You can replace Istio with the OpenShift Service Mesh and ArgoCD with the OpenShift GitOps Operator.

The following components are also required:

• Redis
• An S3-compatible objectstore
• Microsoft SQL Server
• Block storage

You can meet the Redis requirement by using the Redis Enterprise Operator from OpenShift or installing High Availability Add-on on separate machines.

You can use OpenShift Data Foundation for the S3 Objectstore buckets and the block storage.

The Kubernetes cluster must have network connectivity and access to the secret store to retrieve credentials.

Deploying Automation Suite with a secretstore

Automation Suite requires several infrastructure credentials to deploy all its products.

Instead of defining credentials directly in the input.json file, you can configure a secretstore to securely manage and supply sensitive information. During deployment, uipathctl retrieves credentials from the configured secret store and applies them automatically.

You can store credentials such as:

• SQL credentials
  • Username
  • Password
  • SQL Connection Strings
• Storage credentials
  • S3/AWS
    • Access key
    • Secret key
    • ARN (Amazon Resource Name)
  • Azure
    • Account key
    • Client ID
    • Client secret
    • Subscription ID
    • Tenant ID
• Redis credentials
  • Password
  • License
• Kerberos authentication
  • AD username
  • User keytab
  • AD domain
  • Ticket lifetime

Note:

You cannot store certificate paths or certificate-related credentials as part of the secretstore.

Kubernetes Secret

You can use a Kubernetes Secret to provide all sensitive data instead of including it in input.json.

uipathctl uses the credentials stored in the Secret when deploying Automation Suite and its products.

Azure Key Vault

You can configure all sensitive data or credentials in an Azure Key Vault.

uipathctl uses the credentials stored in the Azure Key Vault when deploying Automation Suite.

HashiCorp Vault

You can configure all sensitive data or credentials in a HashiCorp Vault instance. HashiCorp Vault supports KV (Key-Value) secrets engine v1 and v2.

uipathctl authenticates to Vault using either Kubernetes service account tokens or AppRole credentials and retrieves the stored credentials when deploying Automation Suite.

AWS Secrets Manager

You can configure all sensitive data or credentials in AWS Secrets Manager. Secrets can be stored as key-value pairs or plaintext strings.

uipathctl uses the AWS SDK credential chain to authenticate and retrieve credentials from AWS Secrets Manager when deploying Automation Suite.