Details
-
Type:
Epic
-
Status: Done
-
Resolution: Done
-
Fix Version/s: None
-
Component/s: None
-
Labels:
-
Epic Name:Upgrade to Interim Kubernetes
-
Story Points:20
-
WBS:02C.07.09
-
Team:Data Facility
-
Cycle:Spring 2018
Description
Upgrade interim Kubernetes service for development use. Per conversations with the SLAC and SQuaRE teams, this will involve investigating Kubernetes versions with desired capabilities and installing requested system software and services on PDAC nodes. Ongoing administration is not covered in this epic.
Attachments
| Key | Summary | Story Points | Assignee | Status | |
|---|---|---|---|---|---|
|
|
2 | Andrew Loftus [X] (Inactive) | Done | ||
|
|
2 | Andrew Loftus [X] (Inactive) | Done | ||
|
|
3 | Andrew Loftus [X] (Inactive) | Done | ||
|
|
6 | Andrew Loftus [X] (Inactive) | Done | ||
|
|
3 | Andrew Loftus [X] (Inactive) | Done | ||
|
|
4 | Andrew Loftus [X] (Inactive) | Done |
Activity
I'm seeing an issue here with 1.9.3 as the control plane and client, and 1.9.2 client with 1.9.3 control plane I'm trying to track this down, and retesting something for 1.9.2's control plane with 1.9.2 client to be sure. I'll update here.
This was an issue where there was a race condition between when the firewall rules were set by kubernetes and when additional rules were put into place by puppet. An additional rule for port 6443 had to be introduced. This was tested under all configs listed above and works fine.
Hello Andrew Loftus [X], we will need to add the line:
Environment="KUBELET_EXTRA_ARGS=--fail-swap-on=false"
|
...to the top section of /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on the pdac nodes, if this file is under puppet control?
Additionally, we will need the kubelet systemd service enabled and started on all the nodes if systemd services are under puppet control?
Kubernetes installation has been up and running. Initial configuration changes in place and stable.
Kubernetes 1.9.3 installed here late this afternoon. That all works. I ran the multicast test with the Weave 1.7 overlay and that worked fine too. Installed the dashboard, and that responded as well. I say "responded" because I did that via wget, and not the browser, since I'm on a VPN here, and wasn't able to test it fully. The VPN is something to keep in mind for the iptables rules for those systems. I don't know how they're set since I don't have access to them, but we don't want that exposed on the open internet. Doing the dashboard via a VPN would be a better choice, I think.