|
| 1 | +# Whitemist |
| 2 | + |
| 3 | +## Prepare your installer environment |
| 4 | + |
| 5 | +1. Ensure port security is disabled among the nodes. Also ensure the right security groups are specified (for instance two SG's might be in conflict). |
| 6 | +2. Create the directory where WhiteMist configuration will reside, usually /etc/whitemist. |
| 7 | +``` |
| 8 | +sudo mkdir /etc/whitemist |
| 9 | +``` |
| 10 | +3. Prepare the following environment variables to customize your deployment, make sure you persist them on your .bashrc file. Basically, you need to define the “/etc/whitemist” folder as the target for WhiteMist. |
| 11 | +``` |
| 12 | +export WHITEMIST_CONFIG_DIR=/etc/whitemist |
| 13 | +``` |
| 14 | + |
| 15 | +4. Gather the IP addresses of your you K8s hosts and VIP (for WhiteMist Dashboard). The VIP should be a new IP available for assignment. In an Openstack environment, this can be a floating IP or a new "port" within the same network as the host nodes, available for This IP will be used by MetalLB for exposing the Metal LoadBalancer. |
| 16 | +5. Create and populate the WhiteMist configuration file in ${WHITEMIST_CONFIG_DIR}/cluster_configuration.yml |
| 17 | +``` |
| 18 | +# Metal Load Balancing |
| 19 | +metallb_enabled: true |
| 20 | +
|
| 21 | +# Kubernetes ingress controller |
| 22 | +ingress_nginx_enabled: true |
| 23 | +
|
| 24 | +# VIP address for your ingress controller |
| 25 | +vip_ingress: 10.100.17.7 # Virtual IP for your WhiteMist ingress controller |
| 26 | +
|
| 27 | +apiserver_vip_enabled: true |
| 28 | +apiserver_vip_interface: ens3 |
| 29 | +supplementary_addresses_in_ssl_keys: |
| 30 | + - 10.100.18.165 # Virtual IP for your WhiteMist VIP API access |
| 31 | +
|
| 32 | +# Install Prometheus Exporters to monitor this cluster |
| 33 | +install_kubeprometheus: true |
| 34 | +
|
| 35 | +# Kube-proxy proxyMode configuration. |
| 36 | +# Can be ipvs, iptables |
| 37 | +kube_proxy_mode: ipvs |
| 38 | +
|
| 39 | +# configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface |
| 40 | +# must be set to true for MetalLB to work |
| 41 | +kube_proxy_strict_arp: true |
| 42 | +
|
| 43 | +# Metrics Server options |
| 44 | +metrics_server_enabled: true |
| 45 | +metrics_server_kubelet_insecure_tls: true |
| 46 | +metrics_server_metric_resolution: 60s |
| 47 | +metrics_server_kubelet_preferred_address_types: "InternalIP" |
| 48 | +
|
| 49 | +# You can set MTU value here. If left undefined or empty, it will |
| 50 | +# not be specified in calico CNI config, so Calico will use built-in |
| 51 | +# defaults. The value should be a number, not a string. |
| 52 | +# If Whitemist is being deployed in openstack instances |
| 53 | +# must be set to 1400, otherwise comment it out |
| 54 | +calico_mtu: 1400 |
| 55 | +
|
| 56 | +# IP in IP encapsulation |
| 57 | +# With ipipMode set to Always, Calico routes traffic using IP in IP for |
| 58 | +# all traffic originating from a Calico enabled-host, to all Calico |
| 59 | +# networked containers and VMs within the IP pool. |
| 60 | +calico_ipip_mode: "Never" |
| 61 | +
|
| 62 | +# VXLAN encapsulation |
| 63 | +# With vxlanMode set to Always, Calico routes traffic using VXLAN for |
| 64 | +# all traffic originating from a Calico enabled host, to all Calico |
| 65 | +# networked containers and VMs within the IP pool. |
| 66 | +calico_vxlan_mode: "Always" |
| 67 | +
|
| 68 | +# Unattended upgrades |
| 69 | +enable_unattended_upgrades: false |
| 70 | +``` |
| 71 | +6. Select a Storage Provider |
| 72 | +To install OpenEBS, which is a fast storage provider for local volumes, you should add the following lines to your cluster_configuration.yml file: |
| 73 | +``` |
| 74 | +install_openebs: true |
| 75 | +# If you want to use Jiva, it needs ISCSI tools in order to work |
| 76 | +install_iscsi: true |
| 77 | +``` |
| 78 | +If instead you want to install Longhorn, use these settings below: |
| 79 | +``` |
| 80 | +install_longhorn: true |
| 81 | +install_iscsi: true # obligatory for LongHorn |
| 82 | +``` |
| 83 | +7. Prepare the following inventory file in ${WHITEMIST_CONFIG_DIR}/inventory.yml |
| 84 | + |
| 85 | +The ansible_host variables refer to the IP addresses of the host nodes (see step 4), each taking up a master or (worker) node role. Here you can also define which nodes will serve as K8S master (must be an odd number!) and which will be plain worker nodes. Master and worker roles can co-live in one physical node. |
| 86 | +``` |
| 87 | +all: |
| 88 | + hosts: |
| 89 | + node-0: |
| 90 | + ansible_user: ubuntu |
| 91 | + ansible_host: 10.100.32.138 |
| 92 | + node-1: |
| 93 | + ansible_user: ubuntu |
| 94 | + ansible_host: 10.100.35.216 |
| 95 | + node-2: |
| 96 | + ansible_user: ubuntu |
| 97 | + ansible_host: 10.100.32.29 |
| 98 | + node-3: |
| 99 | + ansible_user: ubuntu |
| 100 | + ansible_host: 10.100.32.192 |
| 101 | + node-4: |
| 102 | + ansible_user: ubuntu |
| 103 | + ansible_host: 10.100.33.6 |
| 104 | +
|
| 105 | + children: |
| 106 | + k8s_masters: # 3 master nodes |
| 107 | + hosts: |
| 108 | + node-0: {} |
| 109 | + node-1: {} |
| 110 | + node-2: {} |
| 111 | +
|
| 112 | + k8s_nodes: # 2 worker nodes |
| 113 | + hosts: |
| 114 | + node-3: {} |
| 115 | + node-4: {} |
| 116 | +``` |
| 117 | +8. Download the WhiteMist deployer file (this is for Kubernetes v1.30): |
| 118 | +``` |
| 119 | +wget --no-check-certificate https://storage.whitestack.com/whitemist/whitemist-deployer-nebulae.sh |
| 120 | +``` |
| 121 | +9. Apply executable permissions on the downloaded deployer and run it: |
| 122 | +``` |
| 123 | +wget --no-check-certificate https://storage.whitestack.com/whitemist/whitemist-deployer-nebulae.sh |
| 124 | +chmod +x whitemist-deployer-nebulae.sh |
| 125 | +./whitemist-deployer-nebulae.sh \ |
| 126 | +[--configdir ${WHITEMIST_CONFIG_DIR}] [--tag ${TAG}] |
| 127 | +``` |
| 128 | + |
| 129 | +## Run conformance tests |
| 130 | + |
| 131 | +1. Follow the [test instructions](https://github.com/cncf/k8s-conformance/blob/master/instructions.md#running) |
| 132 | + to run the conformance tests. |
| 133 | + |
| 134 | +``` |
| 135 | +sonobuoy run --mode=certified-conformance |
| 136 | +``` |
0 commit comments