Install Tembo Self Hosted on Azure

Installing Tembo Self Hosted on Azure

This guide describes the steps to install Tembo Self Hosted on Azure, enabling you to deploy a high-performance, fully-extensible managed Postgres service within an Azure Kubernetes Service (AKS) cluster.

Step 1: Prerequisites

Before starting this tutorial, you must install and configure the following tools and resources necessary to create and manage Tembo Self Hosted on an Azure AKS cluster.

AKS Cluster
Kubernetes (kubectl)
Azure CLI (az)
Helm CLI
Obtain a Clerk authentication key from Tembo

Step 2: Prepare for Tembo installation

Prepare Tembo helm chart installation by running a script using the command below.

bash <(curl -s https://raw.githubusercontent.com/tembo-io/tembo-self-hosted/main/scripts/azure/aks-setup.sh)

Step 3: Install the Tembo Self Hosted Helm chart

Add Helm repo for Tembo & do an update

helm repo add tembo https://tembo-io.github.io/tembo
helm repo update

Now, create a file my-values.yaml with the following content:

global:
  baseDomain: tembo.mydomain.com
tembo:
  cpWebserver:
    env:
      - name: CLERK_SECRET_KEY
        value: <secret-key>
      - name: CLERK_WEBHOOK_SIGNING_SECRET
        value: <signing-secret>
      - name: STRIPE_SECRET_KEY
        value: <secret-key>
      - name: STRIPE_WEBHOOK_SIGNING_SECRET
        value: <signing-secret>
      - name: METRONOME_SECRET_KEY
        value: <secret-key>

The basedomain is used to access tembo ui, api, dataplane & instances provisioned so you must set that up first.

Now, let’s install the Tembo Self Hosted Helm chart in your EKS cluster:

helm install tembo tembo/tembo -f my-values.yaml -n tembo --create-namespace

Check the status of installation:

❯ kubectl get po
NAME                                         READY   STATUS      RESTARTS      AGE
control-plane-1                              1/1     Running     0             82m
control-plane-queue-1                        1/1     Running     0             79m
tembo-cloudnative-pg-749dcfc655-756mm        1/1     Running     0             83m
tembo-conductor-fb7878d7-tvh94               1/1     Running     0             77m
tembo-conductor-watcher-7ff9547686-6sld8     1/1     Running     0             77m
tembo-controller-57899fffc4-d4j55            1/1     Running     0             82m
tembo-cp-reconciler-76bd8777b6-z2nq8         1/1     Running     0             81m
tembo-cp-service-75bccdddbd-b8xbk            1/1     Running     0             78m
tembo-cp-webserver-686fb69bb5-w5g6g          1/1     Running     0             78m
tembo-dataplane-webserver-7f9bd5cbf7-gkk2w   1/1     Running     0             83m
tembo-init-cp-db-lxl2t                       0/1     Completed   0             83m
tembo-init-cp-queue-db-lljgr                 0/1     Completed   0             83m
tembo-label-namespace-ggnml                  0/1     Completed   0             83m
tembo-pod-init-74975dbcb8-d9jpk              1/1     Running     0             83m
tembo-tembo-ui-685ccc9996-n8tmv              1/1     Running     0             83m

Step 4: Configure DNS for Traefik’s Load Balancer

To properly route traffic to your Traefik load balancer, you need to configure a DNS CNAME record through your DNS provider. Follow the steps below to create a wildcard CNAME record, which is essential because each PostgreSQL instance has its own subdomain for its connection string.

Step 4.1: Set up a DNS Zone in Azure Portal

Create a DNS zone for your chosen Tembo Self Hosted subdomain, e.g. tembo.mydomain.com.

For more information, see Create a DNS Zone.

Step 4.2: Identify Traefik’s Load Balancer external IP

kubectl get svc -n traefik
NAME      TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                       AGE
traefik   LoadBalancer   10.200.50.100   4.150.40.100  1234:56789/TCP,80:12345/TCP   45m

In the example above, the Load Balancer’s external IP would be 4.150.40.100.

Step 4.3: Create an `A` record to re-route traffic to Traefik’s Load Balancer

export RESOURCE_GROUP_NAME="MC_${RESOURCE_GROUP}_${CLUSTER_NAME}_${REGION}"
# Must have previously set this DNS Zone up in the Azure Portal
export DNS_ZONE_NAME="tembo.mydomain.com"
export RECORD_SET_NAME="*"
# EXTERNAL-IP as shown in `k get svc -n traefik` 
export LOAD_BALANCER_PUBLIC_IP="4.150.40.100"

az network dns zone create --resource-group $RESOURCE_GROUP_NAME --name $DNS_ZONE_NAME

az network dns record-set a add-record --resource-group $RESOURCE_GROUP_NAME --zone-name $DNS_ZONE_NAME --record-set-name $RECORD_SET_NAME --ipv4-address $LOAD_BALANCER_PUBLIC_IP

For more detailed information, refer to Create a DNS zone and record using the Azure portal.

Step 4.4. Verify DNS settings

After creating the CNAME record, verify that the DNS settings are correctly propagating and resolving.

You can use nslookup to check if your DNS settings are working correctly:

nslookup test.tembo.mydomain.com
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	test.tembo.mydomain.com
Address: 203.0.113.10
Name:	test.tembo.mydomain.com
Address: 203.0.113.20