This section describes the structure and configuration options available in the Cumulocity IoT Edge CR. Here is the Edge CR template (c8yedge.yaml) that you can edit and apply to your Kubernetes cluster to install or update Cumulocity IoT Edge.
The initial part of the CR defines the CRD details, and the CR name and namespace, which referred to in this document as EDGE-CR-NAME and EDGE-CR-NAMESPACE.
apiVersion: edge.cumulocity.com/v1
kind: CumulocityIoTEdge
metadata:
name: <EDGE-CR-NAME>
namespace: <EDGE-CR-NAMESPACE>
This section defines the Edge deployment’s configurations.
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| version | Yes | String | Edge version to deploy. For example, 1017.0.0 for 10.17 and 1017.0.1 for a fix-1 of 10.17. |
|
| licenseKey | Yes | String | Edge license key. | |
| company | Yes | String | Name of the “edge” tenant, for example, the company’s name. | |
| domain | Yes | String | A fully qualified domain name. For example, myown.iot.com. Here, you must have the Edge license for the domain name iot.com or myown.iot.com. |
|
| tlsSecretName | No | String | The Edge Operator generates and assigns self-signed certificates. | Name of the Kubernetes secret containing the TLS key and certificates for the name specified in the spec.domain field. See TLS secret for details.Info: The Edge Operator retrieves this secret from the |
| Yes | String | Email used for the admin user. | ||
| cloudTenant | No | Structure | Cloud tenant details to configure and manage Edge remotely. See Cloud Tenant for details. | |
| storageClassName | No | String | The Edge Operator requests three PVCs, as outlined below. - 75 GB, PVC named mongod-data-edge-db-rs0-0 made by MongoDB server for persisting application data. 75 GB is the default, and its value can be configured through the Edge CR field spec.mongodb.resources.requests.storage.- 10 GB, PVC named microservices-registry-data made by the private registry for persisting microservice images.- 5 GB, PVC named edge-logs made by the Edge logging component for persisting application and system logs.Each of these PVCs utilizes the StorageClass if specified within the Info: This value is used only during the Edge installation and can’t be changed for existing installations. |
|
| core | No | Structure | Cumulocity IoT platform configurations. For more information, see Cumulocity IoT Core configurations. | |
| mongodb | Yes | Structure | Configurations needed to deploy the MongoDB server managed by the Edge Operator or connect to an external one. For more information, see MongoDB. | |
| microservices | No | Array of Structure | The Edge Operator deploys all the default Cumulocity IoT microservices, which include the Apama, Smart Rules, OPCUA Management Server microservices. | Specify resources to allocate to each of the default Cumulocity IoT microservices deployed. For more information, see Microservices. |
Specifies the name of the Kubernetes secret containing the TLS key/certificates chain. The Edge Operator retrieves this secret from the EDGE-CR-NAMESPACE. Ensure that the secret is created before initiating the Edge deployment or update process.
This secret should contain the fields described in the table below.
| Field | Required | Type | Default | Description |
|---|---|---|---|---|
| tls.key | Yes | String | TLS Private key in the PEM format. | |
| tls.crt | Yes | String | Certificate chain of the private key in the PEM format. |
Edge can be managed, configured, and monitored remotely through a Cumulocity IoT cloud tenant. You can control and troubleshoot your Edge deployments remotely.
To enable this, first register Edge as a device in the Cumulocity IoT cloud tenant. You can register Edge by providing the Cumulocity IoT cloud tenant URI, and optionally, TLS key and certificate chain with which Edge connects to cloud through MQTT protocol using a X.509 certificate for authentication. If you do not provide the TLS key and the certificate chain, the Edge Operator uses an internally generated TLS key and certificate for identifying Edge as a device in the cloud tenant. For completing the registration process, sign into your cloud tenant and follow the steps described in Managing trusted certificates to add the Certificate Authority (CA) certificate to the trusted certificate list of your tenant. For more information, see Device certificates.
In case you let the Edge use the internally generated TLS key and certificates, you can download the CA certificate by using the command below:
kubectl get edge c8yedge -n c8yedge --output jsonpath='{.status.helpCommands.fetchGeneratedCACrt}' | sh
Once registered, you can access your Edge remotely as a device, monitor its metrics, upgrade its version and collect diagnostic data remotely.
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| domain | Yes | String | Cumulocity IoT cloud tenant domain. For example, <tenantid>.cumulocity.com |
|
| tlsSecretName | No | string | The name of the Kubernetes secret containing the TLS key and the certificate chain with which Edge connects to the cloud through MQTT protocol using a X.509 certificate for authentication. For more information, see TLS secret for details. Info: The Edge Operator retrieves this secret from the |
The core specification specifies the fields for configuring the Cumulocity IoT core node and its resource limits.
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| resources.limits | Yes | Structure | Defaults to CPU Limit: 3000m Memory Limit: 6GB |
Specify resource limits for the Cumulocity IoT Core container. For more information, see Resource limits specification. |
This field is necessary for one or more of the following reasons:
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| credentialsSecretName | No | String | Defaults to databaseAdmin and admin-pass as the database admin user and password for the Edge Operator managed MongoDB or fails with validation error for the externally hosted MongoDB server.Info: For the MongoDB managed by the Edge Operator, it is recommended to provide the database admin credentials secret, rather than relying on the default credentials assigned by the Edge Operator. |
Name of the Kubernetes Secret containing the database admin credentials with which the Edge Operator managed MongoDB must be configured or the database admin credentials of the externally hosted MongoDB server. For more information, see MongoDB Credentials Secret. Info: The Edge Operator retrieves this secret from the |
| connectionString | No | String | If not provided, the Edge Operator installs a single node MongoDB server and configures it with the admin credentials provided in spec.mongodb.credentialsSecretName |
Connection string of the externally hosted MongoDB server. URI format: mongodb://host1[:port1][,...hostN[:portN]]Info: If you do not provide this value, the Edge Operator installs a single node MongoDB server. Once Edge is installed and configured to use the MongoDB managed by the Edge Operator, you cannot provide the |
| tlsSecretName | No | String | Secret for supplying the Certificate Authority (CA) certificate to trust. For more information, see Externally hosted MongoDB TLS secret. Info: The Edge Operator retrieves this secret from the |
|
| resources.limits | Yes | Structure | Defaults to CPU Limit: 3000m Memory Limit: 6GB |
Specify resource limits for the MongoDB server pod. For more information see Resource limits specification. |
| resources.requests | No | Structure | Defaults to 75 GB | Specify the size of the Persistent Volume Claim (PVC) named mongod-data-edge-db-rs0-0 made by MongoDB server for persisting application data. For more information see MongoDB storage size. |
Structure for specifying the resource limits for the containers deployed by the Edge Operator.
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| cpu | No | String | Specific CPU limit in CPU units. For example, 1000m or 1M | |
| memory | No | String | Specific memory limit in memory units. For example, 1000M or 1G |
Specifies the Kubernetes secret containing the admin credentials with which the MongoDB managed by the Edge Operator must be configured or the admin credentials of the externally hosted MongoDB server. The Edge Operator retrieves this secret from the namespace EDGE-CR-NAMESPACE. It is important that this secret is created before initiating the Edge deployment or update process.
This secret should contain the fields described in the table below:
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| MONGODB_DATABASE_ADMIN_USER | Yes | String | Database admin username with which the MongoDB managed by the Edge Operator or the username of the externally hosted MongoDB server is configured. | |
| MONGODB_DATABASE_ADMIN_PASSWORD | Yes | String | Database admin password with which MongoDB managed by the Edge Operator or the password for the externally hosted MongoDB server is configured. | |
| MONGODB_USER_ADMIN_USER | No | String | userAdmin | Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_USER_ADMIN_PASSWORD | No | String | Password provided in the field MONGODB_DATABASE_ADMIN_PASSWORD |
Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_CLUSTER_ADMIN_USER | No | String | clusterAdmin | Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_CLUSTER_ADMIN_PASSWORD | No | String | Password provided in the field MONGODB_DATABASE_ADMIN_PASSWORD |
Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_CLUSTER_MONITOR_USER | No | String | clusterMonitor | Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_CLUSTER_MONITOR_PASSWORD | No | String | Password provided in the field MONGODB_DATABASE_ADMIN_PASSWORD |
Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_BACKUP_USER | No | String | backup | Only used when MongoDB is deployed and managed by the Edge Operator. |
| MONGODB_BACKUP_PASSWORD | No | String | Password provided in the field MONGODB_DATABASE_ADMIN_PASSWORD |
Only used when MongoDB is deployed and managed by the Edge Operator. |
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| ca.crt | No | String | Certificate Authority (CA) certificate in PEM format. Only required if the externally hosted MongoDB is TLS enabled with a self-signed certificate or a certificate not issued by a publicly trusted CA. |
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| storage | No | string | Default to 75 GB | Specify the PVC storage. Info: Once Edge is installed, you can only increase this value, but cannot reduce. |
The microservice specification allows specifying resources to allocate to a default microservice, which includes the Apama, Smart Rules, OPCUA Management Server and Device Simulator microservices.
Field |
Required | Type |
Default | Description |
|---|---|---|---|---|
| name | Yes | String | The name of the Cumulocity IoT microservice. The allowed values are apama-ctrl, smartrule, ssl-management-server, device-simulator, and opcua-mgmt-service | |
| resources.limits | No | Structure | Defaults to CPU Limit: 1000m Memory Limit: 1 GB |
Specify resource limits for the Cumulocity IoT microservice container. For more information see Resource limits specification. |