This guide covers most of the advanced installation procedures that you may need to implement.

Modifying the default domain

The default configuration sets "kiuwan.onpremise.local" as the default domain to access Kiuwan On-Premises.

We encourage you to change the default domain, but take into account that this means updating the provided certificates to keep your installation connections secure.

Step 1: Edit the global configuration file

Using your preferred editor, open the default configuration file located in your config-shared volume:

sudo vim
[VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Set kiuwan.domain as kiuwan.onpremise.local 

Step 2: Update load balancer configuration

Once you have selected your new domain and if you are using the provided Apache load balancer, you should edit the main Apache configuration file:

sudo vim [VOLUMES_DIR]/config-shared/ApacheLoadBalancer/conf/httpd.conf 

Edit this line and change the default domain (kiuwan.onpremise.local) to your new domain:

Define kiuwanDomain 
kiuwan.onpremise.local

If you have externalized the provided Apache load balancer, you should edit the equivalent configuration file to set the new domain.

Step 3: Generate new certificates

Please refer to the Managing certificates guide and follow the needed steps depending on your needs.

Once this is done, you should have these files under the [INSTALLER_DIR]/user-content/certs folder:

• cacert.pem
• domainkey.pem
• domaincert.pem
• domainkeystore.jks
• truststore.jks

Step 4: Complete your installation

If you are performing a new Kiuwan On-Premises installation, please refer to the steps indicated in the following sections, depending on your installation needs:

• Installation: single-host and minimum configuration
• Installation: advanced configuration

If you have already installed Kiuwan On-Premises, you need to stop your containers, update the deployed configuration, and restart them. To do so, execute these commands:

cd [INSTALLER_DIR]
sudo ./stop-all.sh
cd [INSTALLER_DIR]/docker
sudo ./update.sh
cd [INSTALLER_DIR]
sudo ./start-all.sh

Step 5: Update your DNS or hosts files

If you are modifying an existing Kiuwan On-Premises installation, you will need to update your DNS or hosts files.

Note that if you have generated new certificates signed by a different CA than the one that signed the previous ones, you should update your Kiuwan On-Premises clients' certificates or truststores. 

• Add kiuwan.onpremise.local to your hosts file.

For testing purposes or if you choose the second option, edit this file in the host where you plan to access Kiuwan from:

• Windows OS: C:\Windows\System32\drivers\etc\hosts
• Linux OS: /etc/hosts

Add the following entry to the previous file:

[kiuwan_on_premise_host_ip] 
[kiuwan_on_premise_host]

Modifying access protocols

Kiuwan On-Premises installation supports configuring access protocols for:

• Apache load balancer: HTTPS (default protocol) or HTTP.
• Kiuwan front instances: HTTPS (default protocol), HTTP, or AJP.

If you need to change the default access protocols, please take into account:

• Apache load balancer configuration must be manually modified, both when using the provided services or when externalizing it.
• Plaintext connections are not secure.

Step 1: Configure Apache load balancer access protocol

In case you are using the provided Apache service for load balancing or your own Apache as a front-end server, you should manually configure how it accesses Kiuwan, by editing its configuration file. For the provided services you can edit the file like this:

sudo vim [VOLUMES_DIR]/config-shared/ApacheLoadBalancer/conf/httpd.conf

Look for the balancer proxy definition (<Proxy "balancer://mycluster">) and make sure the used protocol matches your needs.

The following example show the needed configuration for accessing two Kiuwan On-Premises front instances through AJP protocol:

BalancerMember "ajp://wildflykiuwan-f1:8443" route=kwf1 loadfactor=1 connectiontimeout=5 timeout=600 retry=60 hcmethod=TCP hcpasses=2 hcinterval=15 hcfails=1
BalancerMember "ajp://wildflykiuwan-f2:8443" route=kwf2 loadfactor=1 connectiontimeout=5 timeout=600 retry=60 hcmethod=TCP hcpasses=2 hcinterval=15 hcfails=1

The following example show the needed configuration for accessing two Kiuwan On-Premises front instances through HTTP protocol:

BalancerMember "http://wildflykiuwan-f1:8443" route=kwf1 loadfactor=1 connectiontimeout=5 timeout=600 retry=60 hcmethod=GET hcexpr=ok200 hcuri=/saas/rest/health hcpasses=1 hcinterval=15 hcfails=2
BalancerMember "http://wildflykiuwan-f2:8443" route=kwf2 loadfactor=1 connectiontimeout=5 timeout=600 retry=60 hcmethod=GET hcexpr=ok200 hcuri=/saas/rest/health hcpasses=1 hcinterval=15 hcfails=2

Note that if you are not using a front-end server because you want to access directly to a single Kiuwan front instance, you will be forced to use either HTTPS or HTTP protocols to be able to access Kiuwan On-Premises from a web browser.

ProxyPreserveHost Off

Step 2: Configure Kiuwan front instances access protocol

Kiuwan On-Premises front instances expose a single port for communicating either by using HTTPS, HTTP, or AJP protocols. To configure the protocol to use, edit the main configuration file located in your config-shared volume:

sudo vim [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Look for the "kiuwan-nodes.access.protocol property and set its value to either "https", "http" or "ajp" depending on the protocol you want to use. For example, to use the AJP protocol:

kiuwan-nodes.access.protocol=ajp

Note that this only sets how Kiuwan front servers are configured. You must configure how Kiuwan will generate access URLs for you by following the next step.

Step 3: Configure client access protocol for URL generation

Kiuwan instances need to know how you are accessing your Kiuwan On-Premises installation to correctly generate dynamic URLs. To configure this, edit the main configuration file, located in your config-shared volume:

sudo vim [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Look for the "kiuwan.protocol" property and set its value to either "https" or "http". For example, if you want to access Kiuwan On-Premises through https:

kiuwan.protocol=https

Note that "https" and "http" are the only two allowed options here, as you only can access Kiuwan On-Premises from a web browser through one of these protocols.

Step 4: Restart your servers

In case you have made modifications to the provided Apache load balancer, you should restart the server:

cd [INSTALLER_DIR]/docker
sudo ./stop-infrastructure.sh apacheloadbalancer
sudo ./start-infrastructure.sh apacheloadbalancer

If you are using your front-end server, please restart to apply the changes.

In case you have made modifications to the globalConfig.properties file, you should restart the Kiuwan servers:

cd [INSTALLER_DIR]
sudo ./stop-kiuwan.sh
sudo ./start-kiuwan.sh

Modifying exposed ports

Kiuwan On-Premises installation supports changing which ports will be exposed to the outside of the Docker network by any of these services:

• Apache load balancer.
• Kiuwan front instances.
• MySQL database.

Note that the port used by the provided containers inside the Kiuwan Docker Network (172.172.0.0/16) is fixed and cannot be changed. Only the exposed ports are configurable. The following table shows which ports are used by each container inside the Docker network and how they are mapped to the outside by default:

Note that containers can only be accessed from outside its host when at least one port is exposed. These considerations should be taken into account as well:

• If you are accessing any container through HTTPS and you change the provided ports you should update your certificates in order to modify the provided SANs (Subject Alternative Names). Please refer to Managing certificates page for more information.
• On single hosts installations where the provided front-end server (apacheloadbalancer) or the provided MySQL (mysqlkiuwan) are not externalized, changing Kiuwan front instances ports or MySQL port is not usually needed unless there are port conflicts on your host. As we recommend using a dedicated host for Kiuwan On-Premises installations, this should not be the case in most installations. By default, the provided Apache access Kiuwan front instances through port 8443 and Kiuwan access MySQL through port 3306, as they belong to the same Docker network.
• When using an externalized front-end server, it may be needed to change the Kiuwan front instances ports if your company has strict traffic guidelines or you just prefer using ports that you are more comfortable with.
• In case you are using your MySQL server, Kiuwan should be instructed to use the port in which your MySQL server is listening to.
• In case you are using the provided MySQL container on a different host and you want to modify the exposed port by the container you must change both the MySQL exposed port and the port used by Kiuwan to communicate with MySQL. Both ports must match.

cd [INSTALLER_DIR]/docker
sudo ./stop-infrastructure.sh apacheloadbalancer
sudo ./start-infrastructure.sh apacheloadbalancer

cd [INSTALLER_DIR]
sudo ./stop-kiuwan.sh
sudo ./start-kiuwan.sh

Modifying exposed ports in Apache load balancer

When using the provided Apache load balancer, the following properties found in the globalConfig.properties main configuration file will set the exposed ports:

• kiuwan.port.apache.http: sets the exposed port for HTTP.
• kiuwan.port.apache.https: sets the exposed port for HTTPS.

Ports set must be different to avoid conflicts. Note that the provided Apache container will expose both ports to listen HTTPS and HTTP traffic, but you can unset any of them by modifying the provided configuration file.

Step 1: Modify globalConfig.properties file

In case you modify the default ports, you must change the httpd.conf file located under [VOLUMES_DIR]/config-shared/ApacheLoadBalancer/conf folder.

Locate the properties shown above and set them to the ports that you want to expose (default configuration is shown below):

kiuwan.port.apache.http=80
kiuwan.port.apache.https=443

Step 2: Modify httpd.conf file

First, locate the ports Apache will listen to and set your selected ports. Default configuration is shown below (ports 80 and 443):

Listen 80
Listen 443

Second, locate the default virtual host entry and change the assigned port. Default configuration is shown below (port 443):

<VirtualHost *:443>

Open browser and visit https://localhost/saas/web/dashboard/dashboard

Modifying exposed ports in Kiuwan front instances

To change the exposed port of a Kiuwan front instance, edit the main configuration file (globalConfig.properties):

sudo vim [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Locate the following properties (default values are shown):

kiuwan.port.front1=8143
kiuwan.port.front2=8243
kiuwan.port.front3=8343
kiuwan.port.front4=8443
kiuwan.port.front5=8543
kiuwan.port.front6=8643
kiuwan.port.front7=8743
kiuwan.port.front8=8843

By default, only one front instance will be started, but it is recommended to change all available instances just in case you need to add front instances in the future.

Note that the previous properties set the ports that will be exposed outside Kiuwan Docker network. Changing these ports is only recommended when externalizing the Apache load balancer service, as the internal port (8443) will be used when this service is inside the Docker network.

Modifying exposed ports in MySQL

To change the exposed port of the provided MySQL service, edit the main configuration file (globalConfig.properties):

sudo vim [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Locate the following property (default value is shown):

kiuwan.port.mysql=3306

Note that the previous property sets the port that will be exposed outside Kiuwan Docker network. Changing these ports is only recommended when externalizing the MySQL service, as the internal port (3306) will be used when this service is inside the Docker network.

Setting which ports Kiuwan should use

Kiuwan instances must know which ports you are exposing both in:

• The provided apache load balancer or your front-end server.
• The provided MySQL database or your MySQL instance.

As both services can be externalized, there are two additional properties to configure these ports (found in the main configuration file [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties):

• kiuwan.port: the port that will be used when generating dynamic URLs from Kiuwan. This port must match the one exposed by the front-end server.
• mysql.port: the port that will be used by Kiuwan to connect to the MySQL host. This port must match the one exposed by the MySQL server.

Configuration examples

Example 1

The following table shows how to set the values in globalConfig.properties file for installation where:

• All Kiuwan containers are deployed in the same host (single host installation).
• Apache load balancer externalized. The Apache server listens to port 444.
• Apache will access Kiuwan On-Premises front servers through port 8009. If new front instances are added, the next port will be used for the new instance.
• MySQL has been externalized and is accessible though port 3344.

The front-end server must use ports 8009, 8010, etc. to access Kiuwan front servers.

Example 2

The following table shows how to set the values in globalConfig.properties file for installation where:

• All Kiuwan containers are deployed in the same host (single host installation).
• Apache load balancer is NOT externalized and will listen to port 80 for HTTP and port 443 for HTTPS.
• Kiuwan On-Premises front servers should be accessible from the outside through port 8080. If new front instances are added, the next port will be used for the new instance.
• MySQL has NOT been externalized and will be accessible through port 3406 for direct external connections to the database.

The front-end server must use port 8443 to access Kiuwan front servers, as it belongs to the same Docker network, but a user will be able to access these front servers through ports 8080, 8081, etc. from outside the Kiuwan On-Premises host.

Configure a password in Redis

The default configuration of Kiuwan does not set any password in Redis. 

To configure a password in Redis and configure Kiuwan to connect to Redis using a password, follow these steps:

 If you are installing Kiuwan for the first time, make sure that you have completed at least the “Step 6: initialize your volumes” described in Kiuwan On-Premises Distributed Installation Guide before continuing.

Step 1: Stop Kiuwan

If you are installing Kiuwan for the first time in your instance, skip this step.

If you are modifying the configuration of an existing Kiuwan installation stop executing it:

cd [INSTALLER_DIR]
sudo ./stop-kiuwan.sh
sudo ./start-kiuwan.sh

Step 2: Edit the global configuration file

Using your preferred editor, open the default configuration file located in your config-shared volume. In the following example, the used editor is vim:

sudo vim [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Edit these properties and assign a password to be used on connecting to Redis, you should set the same value for both redis.cache and redis.store password:

• redis.cache.password={YOUR_REDIS_PASSWORD}

• redis.store.password={YOUR_REDIS_PASSWORD}

Step 3: Activate authentication in Redis

You should edit the Redis configuration files located in the following path:

sudo vim [VOLUMES_DIR]/config-shared/Redis/conf/redis[1-6].conf

Add the following lines in each of them (6 files in total):

requirepass {YOUR_REDIS_PASSWORD}
masterauth {YOUR_REDIS_PASSWORD}

If you have externalized the Redis installation, you should edit the equivalent configuration file to activate the authentication and restart the externalized Redis installation.

Step 4: Propagate the changes in Kiuwan

If you are installing Kiuwan for the first time in your instance, skip this step.

To propagate the changes in globalConfig.properties, execute the following commands:

cd [INSTALLER_DIR]/docker
sudo ./update.sh

Step 5: Start kiuwan

All the required changes are completed. If you are installing Kiuwan for the first time make sure that you complete all the installation steps and start Kiuwan. 

If you are modifying an existing installation start Kiuwan and the setup is completed:

cd [INSTALLER_DIR]
sudo ./start-all.sh

Externalizing services

Kiuwan On-Premises uses three main services under its infrastructure's hood:

• Apache - used as a load balancer when multiple Kiuwan frontal instances are running.
• Redis - an in-memory cache to speed up response times.
• MySQL - Kiuwan's main database.

If you want to use your services for any of the previous ones, Kiuwan On-Premises can connect to them by bypassing their creation at installation time.

Configuring services to externalize

First of all, you will need to edit the main configuration file and mark which services you want to externalize:

• [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

This table shows the properties you should modify when externalizing each service:

When setting to "true" any of the previous properties, the corresponding service will be externalized and the installation tool will not manage any related instance. Note that all the configuration will be up to you, as the Kiuwan On-Premise installer will only be able to configure how Kiuwan On-Premise will connect to your services.

Externalizing Apache

When externalizing this service you should take into account that:

• Each Kiuwan On-Premises frontal instance domain name is wildflykiuwan-f[n], [n] being the frontal instance number. Note that depending on your installation needs you may want to access each instance via IP or its hostname.
• Each Kiuwan On-Premises frontal instance only exposes one port for https/http/ajp traffic. By default, the port 8[n]43, [n] being the frontal instance number will be exposed. If you need to change the exposed ports refer to  Changing exposed ports for more information.
• In case you are accessing through https scheme, you should provide your frontal service the needed certificates to make https connections available (please refer to Managing certificates for more information):
  • domaincert.pem
  • domainkey.pem
  • cacert.pem

Modify globalConfig.properties and set kiuwan.externalize.apacheloadbalancer=true

Refer to ModifyingexposedportsinKiuwanfrontinstances and modify the exposed ports in Kiuwan front instances.

Offload load balancer through container, which is mapped to local port 80 and 443.

Open browser and visit https://localhost/saas/web/dashboard/dashboard 

Externalizing Redis

Kiuwan On-Premises must work with your Redis installation that it complies with these characteristics:

• Redis version must be equal or higher than 5.0.4.
• Redis must be configured as a cluster.
• Eviction policy must be set to "noeviction" (refer to Redis official documentation, maxmemory-policy configuration property).

In case you set Redis as an external service, Kiuwan On-Premises needs to know where the Redis nodes are deployed and which ports to use when connecting to them.

In case you use a special DNS that can resolve the same host to different hosts and ports (DNS Round-Robin or equivalent), you should configure just a single host in the redis.[cache|store].nodes properties.

All the needed configuration is located in the main configuration file:

• [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

The following table shows the properties to configure (note that you should set the same configuration for both "cache" and "store" Redis configurations):

Externalizing MySQL

When externalizing MySQL note that your MySQL installation should comply with these characteristics:

• MySQL version 5.7
• The maximum number of connections: 130 per Kiuwan On-Premises instance.

Step 1: Create Kiuwan On-Premises schemas

You should create the needed schemas in your MySQL installation. To do so, please execute this script with a user that has schema creation privileges:

create database opt_activity CHARACTER SET utf8 COLLATE utf8_unicode_ci;
create database opt_cinc CHARACTER SET utf8 COLLATE utf8_unicode_ci;
create database opt_metamodel CHARACTER SET utf8 COLLATE utf8_unicode_ci;
create database opt_qmm CHARACTER SET utf8 COLLATE utf8_unicode_ci;
create database opt_transaction CHARACTER SET utf8 COLLATE utf8_unicode_ci;
create database opt_insight CHARACTER SET utf8 COLLATE utf8_unicode_ci;

To generate the required tables, run all the .sql scripts present in the directories:

/installation/resources/install-db and /installation/resources/install-db-data-core

Step 2: Create Kiuwan On-Premises user

You should create the user that will be connecting to Kiuwan On-Premises schemas. Please run this script as an admin user to do so:

create user '[USER]'@'%' identified by '[PASSWORD]';
grant all privileges on `opt_%`.* to '[USER]'@'%' identified by
'[PASSWORD]';
flush privileges;

Note that you should replace [USER] with the desired user name and [PASSWORD] with the desired password.

Step 3: Configure your installation

The following table shows the properties to configure for Kiuwan On-Premises to connect to your MySQL instance:

mysql.host

mysql.port

mysql.username

mysql.password

Step 4: Set kiuwan.externalize.mysql=true in globalConfig.properties

Open browser and visit  https://localhost/saas/web/dashboard/dashboard

Using Amazon S3 as file repository

Kiuwan On-Premises uses these shared file repositories to store analysis related data:

• kiuwanCentralRepository: stores analysis results files.
• kiuwanSourceCodeRepository: stores source code.
• kiuwanCustomConfigRepository: stores centralized analysis configuration files.

These Kiuwan On-Premises internal file repositories can be replaced with Amazon S3 buckets.

To do so, you should first configure these properties in the main configuration file ([VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties):

• centralFileRepository.type=s3
• sourceCodeFileRepository.type=s3
• customConfigFileRepository.type=s3

The following table shows the properties you should modify when making Kiuwan On-Premises connect to AWS S3 buckets:

Automatic data purge

To keep used disk space under control, Kiuwan On-Premises is capable of automatically purge unnecessary files and, optionally, old data that you may not need anymore.

By default, Kiuwan On-Premises purges:

• Analyses that are not among the last 50 processed (for each application).
• Analyses older than 5 years (1825 days).
• Support files older than 6 months (180 days).

The previous thresholds can be configured through the following properties:

• kiuwan.purge.analysis.lastAnalysesToKeep
• kiuwan.purge.analysis.antiquity.days
• kiuwan.purge.support.files.antiquity.days

In case you do not want to delete and purge any of your data, simply change the active flag to false in the following properties:

• kiuwan.purge.analysis.data.active
• kiuwan.purge.support.files.active

Also, turn off kiuwan.purge.analysis.files.active flag, but this is only recommended for troubleshooting purposes since you will deactivate a task that only purges temporary files that are not needed when using Kiuwan On-Premises.

All the configuration properties can be found inside the main configuration file:

• [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Internally, Kiuwan On-Premises uses 5 scheduled tasks to implement file and data purge:

• Soft-delete “old” analyses: performs a logical deletion of analyses that are considered “old”.
• Purge soft-deleted analysis data: purges the data associated with soft-deleted analyses.
• Purge “old” support files: purges “old” files that have been stored for support purposes.
• Purge analysis shared files: purges files that belong to soft-deleted analyses (stored in the data-shared volume).
• Purge analysis local temporary files: purges internal temporary data that belong to “old” analyses and is not needed anymore (locally stored on front and analyzer nodes).

The previous tasks are executed on a daily basis, following this timetable:

Configuration options reference

All configuration properties you can modify are located in this file, located inside your config-shared volume:

• [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Here is a complete list of the properties you can configure and their meaning (default passwords are omitted):

Supported timezones reference

The following table shows the available timezones that can be set to the Kiuwan On-Premises server when editing the main configuration file located in:

• [VOLUMES_DIR]/config-shared/globalConfig/globalConfig.properties

Note that you can set only one of these values to the timezone property found in the previous file: