Mercurial > code > home > repos > infra
annotate kube.py @ 300:e9950e0185b0
more hosts
author | drewp@bigasterisk.com |
---|---|
date | Wed, 07 Aug 2024 00:58:20 -0700 |
parents | a3b7b558b9b5 |
children | 3204157bb3e5 |
rev | line source |
---|---|
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
1 import os |
103
8b8ef9d8f0fd
dead code and templates, reformat, maybe a little refactor
drewp@bigasterisk.com
parents:
99
diff
changeset
|
2 |
8 | 3 from pyinfra import host |
4 from pyinfra.facts.files import FindInFile | |
12 | 5 from pyinfra.facts.server import Arch, LinuxDistribution |
6 from pyinfra.operations import files, server, systemd | |
8 | 7 |
40 | 8 # https://github.com/GoogleContainerTools/skaffold/releases |
295 | 9 skaffold_version = 'v2.11.1' |
40 | 10 |
8 | 11 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
12 def download_k3s(k3s_version): |
27
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
13 tail = 'k3s' if host.get_fact(Arch) == 'x86_64' else 'k3s-armhf' |
282 | 14 if host.get_fact(Arch) == 'aarch64': |
15 tail = 'k3s-arm64' | |
27
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
16 files.download( |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
17 src=f'https://github.com/rancher/k3s/releases/download/{k3s_version}/{tail}', |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
18 dest='/usr/local/bin/k3s', |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
19 user='root', |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
20 group='root', |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
21 mode='755', |
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
22 cache_time=43000, |
263 | 23 # force=True, # to get a new version |
27
7b22ff272001
refactor (may not be a correct commit)
drewp@bigasterisk.com
parents:
21
diff
changeset
|
24 ) |
8 | 25 |
99
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
26 |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
27 def install_skaffold(): |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
28 files.download(src=f'https://storage.googleapis.com/skaffold/releases/{skaffold_version}/skaffold-linux-amd64', |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
29 dest='/usr/local/bin/skaffold', |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
30 user='root', |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
31 group='root', |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
32 mode='755', |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
33 cache_time=1000) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
34 # one time; writes to $HOME |
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
288
diff
changeset
|
35 server.shell(commands="skaffold config set --global insecure-registries reg:5000") |
99
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
36 |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
37 |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
38 def host_prep(): |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
39 server.sysctl(key='net.ipv4.ip_forward', value="1", persist=True) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
40 server.sysctl(key='net.ipv6.conf.all.forwarding', value="1", persist=True) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
41 server.sysctl(key='fs.inotify.max_user_instances', value='8192', persist=True) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
42 server.sysctl(key='fs.inotify.max_user_watches', value='524288', persist=True) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
43 |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
44 # https://sysctl-explorer.net/net/ipv4/rp_filter/ |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
45 none, strict, loose = 0, 1, 2 |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
46 server.sysctl(key='net.ipv4.conf.default.rp_filter', value=loose, persist=True) |
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
47 |
268
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
48 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
49 # don't try to get aufs-dkms on rpi-- https://github.com/docker/for-linux/issues/709 |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
50 def podman_insecure_registry(reg): |
222 | 51 files.template(src='templates/kube/podman_registries.conf.j2', dest='/etc/containers/registries.conf.d/reg.conf', reg=reg) |
240 | 52 systemd.service(service='podman', user_mode=True) |
53 systemd.service(service='podman.socket', user_mode=True) | |
296 | 54 # and maybe edit /etc/containers/policy.json |
240 | 55 |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
56 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
57 def config_and_run_service(k3s_version, server_node, server_ip): |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
58 download_k3s(k3s_version) |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
59 service_name = 'k3s.service' if host.name == server_node else 'k3s-node.service' |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
60 role = 'server' if host.name == server_node else 'agent' |
103
8b8ef9d8f0fd
dead code and templates, reformat, maybe a little refactor
drewp@bigasterisk.com
parents:
99
diff
changeset
|
61 which_conf = 'config-server.yaml.j2' if host.name == server_node else 'config-agent.yaml.j2' |
8 | 62 |
294 | 63 files.put(src="files/kube/kubelet.config", dest="/etc/rancher/k3s/kubelet.config") |
64 | |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
65 # /var/lib/rancher/k3s/server/node-token is the source of the string in secrets/k3s_token, |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
66 # so this presumes a previous run |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
67 if host.name == server_node: |
99
6e159d3bdd40
rewrite k3s to match current config. many tests lying around in comments.
drewp@bigasterisk.com
parents:
89
diff
changeset
|
68 token = "ununsed" |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
69 else: |
267 | 70 # this assumes localhost is the k3s server. |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
71 if not os.path.exists('/var/lib/rancher/k3s/server/node-token'): |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
72 print("first pass is for server only- skipping other nodes") |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
73 return |
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
74 token = open('/var/lib/rancher/k3s/server/node-token', 'rt').read().strip() |
8 | 75 files.template( |
28 | 76 src=f'templates/kube/{which_conf}', |
21
948d9d72267d
k3s update and some config refactoring
drewp@bigasterisk.com
parents:
19
diff
changeset
|
77 dest='/etc/k3s_config.yaml', |
112 | 78 server_ip=server_ip, |
28 | 79 token=token, |
80 wg_ip=host.host_data['wireguard_address'], | |
8 | 81 ) |
84
eb38553a6806
trying to fix k3s networking but this doesn't work yet
drewp@bigasterisk.com
parents:
80
diff
changeset
|
82 files.template( |
28 | 83 src='templates/kube/k3s.service.j2', |
84 dest=f'/etc/systemd/system/{service_name}', | |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
85 role=role, |
8 | 86 ) |
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
288
diff
changeset
|
87 if not host.data.get('gpu'): |
268
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
88 # no supported gpu |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
89 ''' |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
90 kubectl label --overwrite node bang nvidia.com/gpu.deploy.gpu-feature-discovery=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
91 kubectl label --overwrite node bang nvidia.com/gpu.deploy.container-toolkit=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
92 kubectl label --overwrite node bang nvidia.com/gpu.deploy.dcgm-exporter=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
93 kubectl label --overwrite node bang nvidia.com/gpu.deploy.device-plugin=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
94 kubectl label --overwrite node bang nvidia.com/gpu.deploy.driver=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
95 kubectl label --overwrite node bang nvidia.com/gpu.deploy.mig-manager=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
96 kubectl label --overwrite node bang nvidia.com/gpu.deploy.operator-validator=false |
34ab4aec7d4b
notes and changes for getting nvidia gpu k3d support going, which was very hard
drewp@bigasterisk.com
parents:
267
diff
changeset
|
97 ''' |
28 | 98 systemd.service(service=service_name, daemon_reload=True, enabled=True, restarted=True) |
8 | 99 |
267 | 100 |
254 | 101 def setupNvidiaToolkit(): |
265 | 102 # guides: |
103 # https://github.com/NVIDIA/k8s-device-plugin#prerequisites | |
104 # https://docs.k3s.io/advanced#nvidia-container-runtime-support | |
105 # apply this once to kube-system: https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/v0.14.3/nvidia-device-plugin.yml | |
106 # apply this once: https://raw.githubusercontent.com/NVIDIA/gpu-feature-discovery/v0.8.2/deployments/static/nfd.yaml | |
107 # and: kubectl apply -f https://raw.githubusercontent.com/NVIDIA/gpu-feature-discovery/v0.8.2/deployments/static/gpu-feature-discovery-daemonset.yaml | |
108 | |
109 # k3s says they do this: | |
110 #server.shell('nvidia-ctk runtime configure --runtime=containerd --config /var/lib/rancher/k3s/agent/etc/containerd/config.toml') | |
111 | |
254 | 112 # then caller restarts k3s which includes containerd |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
113 |
265 | 114 # tried https://github.com/k3s-io/k3s/discussions/9231#discussioncomment-8114243 |
115 pass | |
116 | |
267 | 117 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
118 def make_cluster( |
267 | 119 server_ip, |
120 server_node, | |
121 nodes, | |
122 # https://github.com/k3s-io/k3s/releases | |
123 # 1.23.6 per https://github.com/cilium/cilium/issues/20331 | |
124 k3s_version, | |
125 ): | |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
126 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
127 if host.name in nodes + [server_node]: |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
128 host_prep() |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
129 files.directory(path='/etc/rancher/k3s') |
89
2fddde57231b
no connman to surprisingly rewrite net configs
drewp@bigasterisk.com
parents:
84
diff
changeset
|
130 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
131 # docs: https://rancher.com/docs/k3s/latest/en/installation/private-registry/ |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
132 # user confusions: https://github.com/rancher/k3s/issues/1802 |
220
416aa647efd9
registry hostname, add garage pi back to k8s
drewp@bigasterisk.com
parents:
204
diff
changeset
|
133 files.template(src='templates/kube/registries.yaml.j2', dest='/etc/rancher/k3s/registries.yaml', reg='reg:5000') |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
134 # also note that podman dropped the default `docker.io/` prefix on image names (see https://unix.stackexchange.com/a/701785/419418) |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
135 config_and_run_service(k3s_version, server_node, server_ip) |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
136 |
289
65e28d2e0cd8
move static templates to files/ ; use inventory tags for selecting hosts+features ; other refactors
drewp@bigasterisk.com
parents:
288
diff
changeset
|
137 if host.data.get('k8s_admin'): |
260 | 138 podman_insecure_registry(reg='reg:5000') |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
139 files.directory(path='/etc/rancher/k3s') |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
140 install_skaffold() |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
141 files.link(path='/usr/local/bin/kubectl', target='/usr/local/bin/k3s') |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
142 files.directory(path='/home/drewp/.kube', user='drewp', group='drewp') |
8 | 143 |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
144 # assumes our pyinfra process is running on server_node |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
145 files.put( |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
146 src='/etc/rancher/k3s/k3s.yaml', |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
147 dest='/etc/rancher/k3s/k3s.yaml', # |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
148 user='root', |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
149 group='drewp', |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
150 mode='640') |
267 | 151 server.shell( |
288 | 152 commands=f"kubectl config set-cluster default --server=https://{server_ip}:6443 --kubeconfig=/etc/rancher/k3s/k3s.yaml" |
153 ) | |
204
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
154 |
ad6e997fd323
prepare for k8s server host and registry host to change
drewp@bigasterisk.com
parents:
203
diff
changeset
|
155 |
288 | 156 make_cluster( |
157 server_ip="10.5.0.7", | |
158 server_node='ditto', | |
159 nodes=[ | |
160 'bang', | |
161 'slash', | |
162 'dash', | |
163 'ws-printer', | |
164 # 'gn-music', | |
165 'li-drums', | |
166 ], | |
167 k3s_version='v1.29.1+k3s1') | |
287 | 168 |
169 # consider https://github.com/derailed/k9s/releases/download/v0.32.4/k9s_Linux_amd64.tar.gz | |
296 | 170 |
171 # k label node ws-printer unschedulable=octoprint-allowed |