ONAP on | ||||
|
|
|
| |
| Microsoft Azure | Google Compute | OpenStack | ||
| Sponsor | Microsoft | Intel/Windriver | ||
This is a private page under daily continuous modification to keep it relevant as a live reference (don't edit it) For general support consult the official documentation at http://onap.readthedocs.io/en/latest/submodules/oom.git/docs/oom_quickstart_guide.html and https://onap.readthedocs.io/en/beijing/submodules/oom.git/docs/oom_cloud_setup_guide.html and raise DOC JIRA's for any modifications required to them. |
|---|
This page details deployment of ONAP on any environment that supports Kubernetes based containers.
Quickstart
In review
OOM-710 - Getting issue details... STATUS , OOM-716 - Getting issue details... STATUS , OOM-715 - Getting issue details... STATUS ,
OOM-714 - Getting issue details... STATUS
OOM-711 - Getting issue details... STATUS
OOM-713 - Getting issue details... STATUS
Undercloud Install - Rancher/Kubernetes/Helm/Docker
Run the following script on a clean Ubuntu 16.04 VM anywhere - it will provision and register your kubernetes system as a collocated master/host.
Ideally you install a clustered set of hosts away from the master VM - you can do this by deleting the host from the cluster after it is installed below and run the (docker, nfs and the rancher agent docker on each host)/
Scripted undercloud(Helm/Kubernetes/Docker) and ONAP install - Single VM
Prerequisites
Create a single VM - 128G+
See recommended cluster configurations on ONAP Deployment Specification for Finance and Operations#AmazonAWS
Create a 0.0.0.0/0 ::/O open security group
Use github to OAUTH authenticate your cluster just after installing it.
Last test 20180905
# 0 - verify the security group has all protocols (TCP/UCP) for 0.0.0.0/0 and ::/0
# 1 - configure combined master/host VM - 26 min
git clone https://gerrit.onap.org/r/logging-analytics
sudo logging-analytics/deploy/rancher/oom_rancher_setup.sh -b master -s cd.onap.info -e onap
# on a 244G R4.8xlarge vm - 26 min later k8s cluster is up
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system heapster-6cfb49f776-5pq45 1/1 Running 0 10m
kube-system kube-dns-75c8cb4ccb-7dlsh 3/3 Running 0 10m
kube-system kubernetes-dashboard-6f4c8b9cd5-v625c 1/1 Running 0 10m
kube-system monitoring-grafana-76f5b489d5-zhrjc 1/1 Running 0 10m
kube-system monitoring-influxdb-6fc88bd58d-9494h 1/1 Running 0 10m
kube-system tiller-deploy-8b6c5d4fb-52zmt 1/1 Running 0 2m
# 2 - increase max pods from 110 to 500
#"ADDITIONAL_KUBELET_FLAGS":"--max-pods=500"
ubuntu@ip-172-31-27-183:~$ curl 'http://127.0.0.1:8880/v2-beta/projecttemplate' --data-binary '{"type":"projectTemplate","baseType":"projectTemplate","name":"k8smaxpodstemplate","state":"active","accountId":null,"created":"2018-06-13T19:03:59Z","createdTS":1528916639000,"data":{"fields":{"stacks":[{"name":"network-services","templateId":"library:infra*network-services"},{"name":"ipsec","templateId":"library:infra*ipsec"},{"name":"scheduler","templateId":"library:infra*scheduler"},{"name":"healthcheck","templateId":"library:infra*healthcheck"}]}},"description":null,"externalId":"catalog://library:project*cattle:0","isPublic":false,"kind":"projectTemplate","removeTime":null,"removed":null,"stacks":[{"type":"catalogTemplate","name":"healthcheck","templateId":"library:infra*healthcheck"},{"type":"catalogTemplate","name":"kubernetes","answers":{"CONSTRAINT_TYPE":"none","CLOUD_PROVIDER":"rancher","AZURE_CLOUD":"AzurePublicCloud","AZURE_TENANT_ID":"","AZURE_CLIENT_ID":"","AZURE_CLIENT_SECRET":"","AZURE_SEC_GROUP":"","RBAC":false,"REGISTRY":"","BASE_IMAGE_NAMESPACE":"","POD_INFRA_CONTAINER_IMAGE":"rancher/pause-amd64:3.0","HTTP_PROXY":"","NO_PROXY":"rancher.internal,cluster.local,rancher-metadata,rancher-kubernetes-auth,kubernetes,169.254.169.254,169.254.169.250,10.42.0.0/16,10.43.0.0/16","ENABLE_ADDONS":true,"ENABLE_RANCHER_INGRESS_CONTROLLER":true,"RANCHER_LB_SEPARATOR":"rancherlb","DNS_REPLICAS":"1","ADDITIONAL_KUBELET_FLAGS":"--max-pods=500","FAIL_ON_SWAP":"false","ADDONS_LOG_VERBOSITY_LEVEL":"2","AUDIT_LOGS":false,"ADMISSION_CONTROLLERS":"NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota","SERVICE_CLUSTER_CIDR":"10.43.0.0/16","DNS_CLUSTER_IP":"10.43.0.10","KUBEAPI_CLUSTER_IP":"10.43.0.1","KUBERNETES_CIPHER_SUITES":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305","DASHBOARD_CPU_LIMIT":"100m","DASHBOARD_MEMORY_LIMIT":"300Mi","INFLUXDB_HOST_PATH":"","EMBEDDED_BACKUPS":true,"BACKUP_PERIOD":"15m0s","BACKUP_RETENTION":"24h","ETCD_HEARTBEAT_INTERVAL":"500","ETCD_ELECTION_TIMEOUT":"5000"},"templateId":"library:infra*k8s"},{"type":"catalogTemplate","name":"network-services","templateId":"library:infra*network-services"},{"type":"catalogTemplate","name":"ipsec","templateId":"library:infra*ipsec"}],"transitioning":"no","transitioningMessage":null,"transitioningProgress":null,"uuid":null}' --compressed
# return
{"id":"1pt6","type":"projectTemplate","links":{"self":"http:\/\/127.0.0.1:8880\/v2-beta\/projecttemplates\/1pt6","account":"http:\/\/127.0.0.1:8880\/v2-beta\/projecttemplates\/1pt6\/account","accounts":"http:\/\/127.0.0.1:8880\/v2-beta\/projecttemplates\/1pt6\/accounts"},"actions":{"remove":"http:\/\/127.0.0.1:8880\/v2-beta\/projecttemplates\/1pt6\/?action=remove"},"baseType":"projectTemplate","name":null,"state":"activating","accountId":"1a1","created":"2018-09-05T14:41:18Z","createdTS":1536158478000,"data":{},"description":null,"externalId":null,"isPublic":false,"kind":"projectTemplate","removeTime":null,"removed":null,"stacks":null,"transitioning":"yes","transitioningMessage":"In Progress","transitioningProgress":null,"uuid":"25742dfb-335b-428b-9218-508d340f5b45"}
# 3 - secure via github oauth the master - immediately to lock out crypto miners
http://cd.onap.info:8880
# it takes about 1 min to run the script and 1 minute for the etcd and healthcheck containers to go green on each host
# check the master cluster
ubuntu@ip-172-31-27-183:~$ kubectl top nodes
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
ip-172-31-27-183.us-east-2.compute.internal 282m 0% 3592Mi 1%
# fix helm on the master after adding nodes to the master - only if the server helm version is less than the client helm version (rancher 1.6.18 does not have this issue)
sudo helm init --upgrade
sudo helm repo add local http://127.0.0.1:8879
# 7 - after cluster is up - run cd.sh script to get onap up - customize your values.yaml - the 2nd time you run the script
# clean install - will clone new oom repo
sudo logging-analytics/deploy/cd.sh -b master -e onap -c true -d true -w true
# check midway
ubuntu@ip-172-31-27-183:~$ kubectl get pods --all-namespaces | wc -l
163
ubuntu@ip-172-31-27-183:~$ kubectl get pods --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system heapster-6cfb49f776-5pq45 1/1 Running 0 1h
kube-system kube-dns-75c8cb4ccb-7dlsh 3/3 Running 0 1h
kube-system kubernetes-dashboard-6f4c8b9cd5-v625c 1/1 Running 0 1h
kube-system monitoring-grafana-76f5b489d5-zhrjc 1/1 Running 0 1h
kube-system monitoring-influxdb-6fc88bd58d-9494h 1/1 Running 0 1h
kube-system tiller-deploy-8b6c5d4fb-52zmt 1/1 Running 0 58m
onap onap-aaf-cm-65b685449-ss2gx 1/1 Running 0 29m
onap onap-aaf-cs-6ddbb9d674-j4pdz 1/1 Running 0 29m
onap onap-aaf-fs-7b96687d64-zjz6c 1/1 Running 0 29m
onap onap-aaf-gui-77d9f8f54-z7jm5 1/1 Running 0 29m
onap onap-aaf-hello-76cb4d748c-nsvcm 1/1 Running 0 29m
onap onap-aaf-locate-7866799fd9-rssdj 1/1 Running 0 29m
onap onap-aaf-oauth-564bbbf568-s2xq8 1/1 Running 0 29m
onap onap-aaf-service-657df4578d-6lvw4 1/1 Running 0 29m
onap onap-aaf-sms-844c974c6-l4n84 1/1 Running 0 29m
onap onap-aaf-sms-quorumclient-0 1/1 Running 0 29m
onap onap-aaf-sms-quorumclient-1 0/1 Pending 0 17m
onap onap-aaf-sms-vault-0 2/2 Running 1 29m
onap onap-aai-58d48f4f94-9lxjr 0/1 Init:0/1 2 29m
onap onap-aai-babel-7dcc9f857c-mn578 2/2 Running 0 29m
onap onap-aai-cassandra-0 1/1 Running 1 29m
onap onap-aai-cassandra-1 0/1 Pending 0 17m
onap onap-aai-champ-68ff644d85-g7tpt 0/1 Init:0/1 1 29m
onap onap-aai-data-router-666d76b58-79zld 1/1 Running 0 29m
onap onap-aai-elasticsearch-6fd5bb7756-jqml2 1/1 Running 0 29m
onap onap-aai-gizmo-856f86d664-gg2qh 1/2 CrashLoopBackOff 6 29m
onap onap-aai-modelloader-688b8f8cf-m6z76 2/2 Running 0 29m
onap onap-aai-resources-65c9779cdc-q25m8 1/2 Running 2 29m
onap onap-aai-search-data-64495685dd-kdmdh 2/2 Running 0 29m
onap onap-aai-sparky-be-7964567995-xlnqm 0/2 Init:0/1 0 29m
onap onap-aai-traversal-697c9bc645-hh8fp 0/2 Init:0/1 0 29m
onap onap-aai-traversal-update-query-data-g9pkx 0/1 Init:0/1 2 29m
onap onap-appc-0 1/2 Running 0 29m
onap onap-appc-ansible-server-5cc8b5d65b-25dxl 0/1 Init:0/1 2 29m
onap onap-appc-cdt-6b747775d5-fbb24 1/1 Running 0 29m
onap onap-appc-db-0 2/2 Running 0 29m
onap onap-appc-dgbuilder-6bcd76fc85-lhght 1/1 Running 0 29m
onap onap-brmsgw-74d69dcbd-2npgb 1/1 Running 0 28m
onap onap-clamp-6644d787dc-5qpqz 2/2 Running 0 29m
onap onap-clamp-dash-es-589bb7f658-br7hp 1/1 Running 0 29m
onap onap-clamp-dash-kibana-64ffb8c479-r62tv 1/1 Running 0 29m
onap onap-clamp-dash-logstash-c56cdb596-5b6qx 1/1 Running 0 29m
onap onap-clampdb-59cc6b8cc8-f2nb8 1/1 Running 0 29m
onap onap-cli-65558c66cf-kkmkq 1/1 Running 0 29m
onap onap-consul-68dfcd6d85-7t4qm 1/1 Running 0 29m
onap onap-consul-server-0 1/1 Running 0 29m
onap onap-consul-server-1 0/1 Pending 0 26m
onap onap-dbc-pg-0 1/1 Running 0 29m
onap onap-dbc-pg-1 0/1 Pending 0 13m
onap onap-dcae-bootstrap-7fbf9d6846-2cvns 1/1 Running 0 29m
onap onap-dcae-cloudify-manager-759dc977fc-2nq7r 1/1 Running 0 29m
onap onap-dcae-db-0 1/1 Running 0 29m
onap onap-dcae-db-1 0/1 Pending 0 14m
onap onap-dcae-healthcheck-7bc4c7ddfb-tvnx8 1/1 Running 0 29m
onap onap-dcae-redis-0 1/1 Running 0 29m
onap onap-dcae-redis-1 0/1 Pending 0 23m
onap onap-dmaap-bus-controller-79b79dbfdf-xljjd 1/1 Running 0 29m
onap onap-dmaap-dr-db-5b9898d7d9-v6wrj 1/1 Running 0 29m
onap onap-dmaap-dr-node-66cb7b978f-c4c4w 1/1 Running 0 29m
onap onap-dmaap-dr-prov-65f6979c56-2njcn 1/1 Running 0 29m
onap onap-drools-0 1/1 Running 0 29m
onap onap-esr-8698b9645-fssmd 2/2 Running 0 29m
onap onap-esr-gui-859fd85568-k2srv 1/1 Running 0 29m
onap onap-kube2msb-fbbdf4499-xx6nc 1/1 Running 0 29m
onap onap-log-elasticsearch-7557486bc4-k44x5 1/1 Running 0 29m
onap onap-log-kibana-fc88b6b79-2r62s 1/1 Running 0 29m
onap onap-log-logstash-wfd2b 1/1 Running 0 29m
onap onap-message-router-546c549f8d-z25pc 1/1 Running 0 29m
onap onap-message-router-kafka-747885ffc9-vj2k6 1/1 Running 0 29m
onap onap-message-router-zookeeper-54bf7fc969-dv84v 1/1 Running 0 29m
onap onap-msb-consul-df5cdcdbb-vr67g 1/1 Running 0 29m
onap onap-msb-discovery-748d88fb76-stxj6 2/2 Running 0 29m
onap onap-msb-eag-c89d486c4-lvwc9 2/2 Running 0 29m
onap onap-msb-iag-77f69996d9-7qdh4 2/2 Running 0 28m
onap onap-multicloud-6dc6c6b7c7-mqjzv 2/2 Running 0 28m
onap onap-multicloud-ocata-59f57458c9-cblgq 2/2 Running 0 28m
onap onap-multicloud-vio-85b5bfc64d-sfkht 2/2 Running 0 28m
onap onap-multicloud-windriver-7f54bd5849-wd9l9 2/2 Running 0 28m
onap onap-nbi-66746c558-w42db 1/1 Running 1 28m
onap onap-nbi-mariadb-67db6865f4-9ckgr 1/1 Running 0 28m
onap onap-nbi-mongo-0 1/1 Running 0 29m
onap onap-nexus-d8dd55b95-9nvn9 1/1 Running 0 28m
onap onap-oof-85864d6586-xxv98 0/1 ErrImagePull 0 28m
onap onap-oof-has-api-8594d77774-rcd4m 1/1 Running 0 28m
onap onap-oof-has-cassandra-56dd9c466c-2hj8h 1/1 Running 0 28m
onap onap-oof-has-controller-5977b5cc7f-25825 1/1 Running 0 28m
onap onap-oof-has-data-ccc79dbbc-4vmvs 1/1 Running 0 28m
onap onap-oof-has-music-6f78f5565c-nq74d 1/1 Running 0 28m
onap onap-oof-has-reservation-6d584d75f7-7dlhb 1/1 Running 0 28m
onap onap-oof-has-solver-556775f99c-749kx 1/1 Running 0 28m
onap onap-oof-has-zookeeper-5bd9cdc875-cw5xv 1/1 Running 0 28m
onap onap-pap-76486b4b54-w4b6g 2/2 Running 0 28m
onap onap-pdp-0 2/2 Running 0 29m
onap onap-policy-apex-pdp-0 1/1 Running 0 29m
onap onap-policydb-5f876cf8bf-mlgvj 1/1 Running 0 28m
onap onap-pomba-aaictxbuilder-56d98d7649-v2rql 2/2 Running 0 28m
onap onap-pomba-contextaggregator-765844bbc9-p2pm5 1/1 Running 0 28m
onap onap-pomba-data-router-97fcf9597-rwv6t 1/1 Running 1 28m
onap onap-pomba-elasticsearch-6c8d7bb4f9-8znlf 1/1 Running 0 28m
onap onap-pomba-kibana-d76b6dd4c-5khqv 0/1 Init:CrashLoopBackOff 5 28m
onap onap-pomba-networkdiscovery-85d76975b7-gmhvg 1/2 CrashLoopBackOff 6 28m
onap onap-pomba-networkdiscoveryctxbuilder-c89786dfc-h7gch 1/2 CrashLoopBackOff 6 28m
onap onap-pomba-sdcctxbuilder-5bc9cdcd77-n47vd 1/1 Running 0 28m
onap onap-pomba-search-data-65c86fbcf9-vdpsk 2/2 Running 0 28m
onap onap-pomba-servicedecomposition-557dd9d669-vlxbb 2/2 Running 0 28m
onap onap-pomba-validation-service-946ff6dfd-5jk6n 0/1 Pending 0 28m
onap onap-portal-app-8486dc7ff8-dp5ks 0/2 Pending 0 28m
onap onap-portal-cassandra-8588fbd698-x959j 0/1 Pending 0 28m
onap onap-portal-db-7d6b95cd94-22cd9 0/1 Pending 0 28m
onap onap-portal-db-config-ftdvj 0/2 Init:0/1 0 3m
onap onap-portal-sdk-77cd558c98-62vgc 0/2 Pending 0 28m
onap onap-portal-widget-6469f4bc56-mrlxk 0/1 Pending 0 28m
onap onap-portal-zookeeper-5d8c598c4c-fdb9w 0/1 Pending 0 28m
onap onap-robot-67fdd89766-slvk4 0/1 Pending 0 28m
onap onap-sdc-be-8447b4d544-52bhr 0/2 Pending 0 28m
onap onap-sdc-be-config-backend-gnz5q 0/1 Init:0/1 0 3m
onap onap-sdc-cs-6cb64768b8-rrbj5 0/1 Pending 0 28m
onap onap-sdc-cs-config-cassandra-4kv9c 0/1 Init:0/1 0 6s
onap onap-sdc-es-config-elasticsearch-4fdds 0/1 Init:0/1 0 4m
onap onap-sdc-es-dd9fd5967-nsh7b 0/1 Pending 0 28m
onap onap-sdc-fe-6967b675bf-qg777 0/2 Pending 0 28m
onap onap-sdc-kb-6dc5df7864-tktlq 0/1 Pending 0 28m
onap onap-sdc-onboarding-be-6cb8cbcb95-jd2sv 0/2 Pending 0 28m
onap onap-sdc-onboarding-be-cassandra-init-tx2j5 0/1 Init:0/1 0 11m
onap onap-sdc-wfd-be-869dfc785c-2fvmx 0/1 Pending 0 28m
onap onap-sdc-wfd-be-workflow-init-8xsw5 0/1 Init:0/1 0 4m
onap onap-sdc-wfd-fe-579c5b5ffb-9wbx8 0/2 Pending 0 28m
onap onap-sdnc-0 2/2 Running 0 29m
onap onap-sdnc-ansible-server-9c6fd76-xg2dg 0/1 Pending 0 28m
onap onap-sdnc-db-0 2/2 Running 0 29m
onap onap-sdnc-dgbuilder-75cdf97945-b26ps 0/1 Pending 0 28m
onap onap-sdnc-dmaap-listener-7cb56d7bcb-rz5hc 0/1 Pending 0 28m
onap onap-sdnc-portal-7b779f87f5-5cqh5 0/1 Pending 0 28m
onap onap-sdnc-ueb-listener-5bcdbb8677-psw7v 0/1 Init:0/1 0 28m
onap onap-sniro-emulator-f668fdb9-4k5pn 0/1 Pending 0 28m
onap onap-so-57d4b4f65c-7cwjs 0/2 Pending 0 28m
onap onap-so-db-765df45b64-q4wt9 0/1 Pending 0 28m
onap onap-uui-cf7f9c4c4-46rp7 0/1 Pending 0 28m
onap onap-uui-server-6c8ff6544-kwg8l 0/1 Pending 0 28m
onap onap-vfc-catalog-5bd7d6bddf-mm7zx 0/2 Pending 0 28m
onap onap-vfc-db-678f484cdd-cwl5x 0/1 Pending 0 28m
onap onap-vfc-ems-driver-b58764c48-tmsnf 0/1 Pending 0 28m
onap onap-vfc-generic-vnfm-driver-84bf45c5df-wgsgs 0/2 Pending 0 28m
onap onap-vfc-huawei-vnfm-driver-64c9ddcffd-ddv6n 0/2 Pending 0 28m
onap onap-vfc-juju-vnfm-driver-557758b87f-44s8j 0/2 Pending 0 28m
onap onap-vfc-multivim-proxy-5986c8695-kxxxp 0/1 Pending 0 28m
onap onap-vfc-nokia-v2vnfm-driver-56955fcd5d-f6hwh 0/1 Pending 0 28m
onap onap-vfc-nokia-vnfm-driver-65fdfd478-56bld 0/2 Pending 0 28m
onap onap-vfc-nslcm-74cfb48956-rqt24 0/2 Pending 0 28m
onap onap-vfc-resmgr-5b55888bb4-t6lpb 0/2 Pending 0 28m
onap onap-vfc-vnflcm-646584d587-9cmmk 0/2 Pending 0 28m
onap onap-vfc-vnfmgr-bcbc9c877-s6jsl 0/2 Pending 0 28m
onap onap-vfc-vnfres-6848d65656-k5lld 0/2 Pending 0 28m
onap onap-vfc-workflow-5c788dd6d5-82chh 0/1 Pending 0 28m
onap onap-vfc-workflow-engine-59d9f97858-nz572 0/1 Pending 0 28m
onap onap-vfc-zte-sdnc-driver-856fc764f5-fxhxr 0/1 Pending 0 28m
onap onap-vfc-zte-vnfm-driver-75d9b75b4b-vj9cd 0/2 Pending 0 28m
onap onap-vid-84c88db589-n2gcm 0/2 Pending 0 28m
onap onap-vid-mariadb-galera-0 1/1 Running 0 29m
onap onap-vnfsdk-58d8dfbbc-8zflg 0/1 Pending 0 28m
onap onap-vnfsdk-postgres-c4685d6c4-9btjh 0/1 Pending 0 28m
onap vid-config-galera-wc77p 0/1 Init:0/1 0 3m
# within an hour DCAE comes up and orchestrates a couple more containers itself
Scripted undercloud(Helm/Kubernetes/Docker) and ONAP install - clustered
Prerequisites
Add an NFS (EFS on AWS) share
Create a 1 + N cluster
See recommended cluster configurations on ONAP Deployment Specification for Finance and Operations#AmazonAWS
Create a 0.0.0.0/0 ::/O open security group
Use github to OAUTH authenticate your cluster just after installing it.
# 0 - verify the security group has all protocols (TCP/UCP) for 0.0.0.0/0 and ::/0 # 1 - configure master - 15 min git clone https://gerrit.onap.org/r/logging-analytics sudo logging-analytics/deploy/rancher/oom_rancher_setup.sh -b master -s ld.onap.info -e onap # on a 16G R4.xlarge vm - 23 min later k8s cluster is up kubectl get pods --all-namespaces kube-system heapster-76b8cd7b5-g7p6n 1/1 Running 0 8m kube-system kube-dns-5d7b4487c9-jjgvg 3/3 Running 0 8m kube-system kubernetes-dashboard-f9577fffd-qldrw 1/1 Running 0 8m kube-system monitoring-grafana-997796fcf-g6tr7 1/1 Running 0 8m kube-system monitoring-influxdb-56fdcd96b-x2kvd 1/1 Running 0 8m kube-system tiller-deploy-54bcc55dd5-756gn 1/1 Running 0 2m # 2 - secure via github oauth the master - immediately to lock out crypto miners http://ld.onap.info:8880 # 3 - delete the master from the hosts in rancher http://ld.onap.info:8880 # 4 - create NFS share on master https://us-east-2.console.aws.amazon.com/efs/home?region=us-east-2#/filesystems/fs-92xxxxx # add -h 1.2.10 (if upgrading from 1.6.14 to 1.6.18 of rancher) sudo logging-analytics/deploy/aws/oom_cluster_host_install.sh -n false -s ld.onap.info -e fs-nnnnnn1b -r us-west-1 -t 371AEDC88zYAZdBXPM -c true -v true # 5 - create NFS share and register each node - do this for all nodes git clone https://gerrit.onap.org/r/logging-analytics # add -h 1.2.10 (if upgrading from 1.6.14 to 1.6.18 of rancher) sudo logging-analytics/deploy/aws/oom_cluster_host_install.sh -n true -s ld.onap.info -e fs-nnnnnn1b -r us-west-1 -t 371AEDC88zYAZdBXPM -c true -v true # it takes about 1 min to run the script and 1 minute for the etcd and healthcheck containers to go green on each host # check the master cluster kubectl top nodes NAME CPU(cores) CPU% MEMORY(bytes) MEMORY% ip-172-31-19-9.us-east-2.compute.internal 9036m 56% 53266Mi 43% ip-172-31-21-129.us-east-2.compute.internal 6840m 42% 47654Mi 38% ip-172-31-18-85.us-east-2.compute.internal 6334m 39% 49545Mi 40% ip-172-31-26-114.us-east-2.compute.internal 3605m 22% 25816Mi 21% # fix helm on the master after adding nodes to the master - only if the server helm version is less than the client helm version (rancher 1.6.18 does not have this issue) sudo helm init --upgrade sudo helm repo add local http://127.0.0.1:8879 # 7 - after cluster is up - run cd.sh script to get onap up - customize your values.yaml - the 2nd time you run the script # clean install - will clone new oom repo sudo logging-analytics/deploy/cd.sh -b master -e onap -c true -d true -w true # rerun install - no delete of oom repo sudo logging-analytics/deploy/cd.sh -b master -e onap -c false -d true -w true
Full Entrypoint Install
Two choices, run the single oom_deployment.sh via your ARM, CloudFormation, Heat template wrapper as a oneclick or use the 2 step procedure above.
entrypoint aws/azure/openstack | Ubuntu 16 rancher install | oom deployment CD script | |
|---|---|---|---|
Deployment Profile
Minimum Single VM Deployment
A single 122g R4.4xlarge VM in progress
| # | Team | container | Required y/n/fw/fwCl | Ram | Cpu | nodeport | Type | logback | Dependencies | |
|---|---|---|---|---|---|---|---|---|---|---|
| aaf | ||||||||||
| aai | y | |||||||||
| appc | fwCL | |||||||||
| clamp | fwCL | |||||||||
| cli | ||||||||||
| consul | ||||||||||
| fwCL | ||||||||||
| dmaap | y | |||||||||
| esr | ||||||||||
| log | n | |||||||||
sniro- emulator | n | |||||||||
| oof | n | |||||||||
| msb | n | |||||||||
| multicloud | n | |||||||||
| nbi | ||||||||||
| policy | y | |||||||||
| pomba | ||||||||||
| portal | y | |||||||||
| robot | y | |||||||||
| sdc | y | |||||||||
| sdnc | y | |||||||||
| so | y | |||||||||
| uui | n | |||||||||
| vfc | n | |||||||||
| vid | y | |||||||||
| vnfsdk | n |
| deployment | containers | |
|---|---|---|
| minimum (no vfwCL) | ||
| medium (vfwCL) | ||
| full |
Container Issues
20180901
amdocs@ubuntu:~/_dev/oom/kubernetes$ kubectl get pods --all-namespaces | grep 0/1 onap onap-aai-champ-68ff644d85-mpkb9 0/1 Running 0 1d onap onap-pomba-kibana-d76b6dd4c-j4q9m 0/1 Init:CrashLoopBackOff 472 1d amdocs@ubuntu:~/_dev/oom/kubernetes$ kubectl get pods --all-namespaces | grep 1/2 onap onap-aai-gizmo-856f86d664-mf587 1/2 CrashLoopBackOff 568 1d onap onap-pomba-networkdiscovery-85d76975b7-w9sjl 1/2 CrashLoopBackOff 573 1d onap onap-pomba-networkdiscoveryctxbuilder-c89786dfc-rtdqc 1/2 CrashLoopBackOff 569 1d onap onap-vid-84c88db589-vbfht 1/2 CrashLoopBackOff 616 1d with clamp and pomba enabled (ran clamp first) amdocs@ubuntu:~/_dev/oom/kubernetes$ sudo helm upgrade -i onap local/onap --namespace onap -f dev.yaml Error: UPGRADE FAILED: failed to create resource: Service "pomba-kibana" is invalid: spec.ports[0].nodePort: Invalid value: 30234: provided port is already allocated
Full ONAP Cluster
see the AWS cluster install below
Requirements
Hardware Requirements
| VMs | RAM | HD | vCores | Ports | Network |
|---|---|---|---|---|---|
| 1 | 55-70G at startup
| 40G per host min (30G for dockers) 100G after a week 5G min per NFS 4GBPS peak | (need to reduce 152 pods to 110) 8 min 60 peak at startup recommended 16-64 vCores  | see list on PortProfile Recommend 0.0.0.0/0 (all open) inside VPC Block 10249-10255 outside secure 8888 with oauth | 170 MB/sec peak 1200 |
| 3+ | 85G Recommend min 3 x 64G class VMs Try for 4 | master: 40G hosts: 80G (30G of dockers) NFS: 5G | 24 to 64 | ||
This is snapshot of the CD system running on Amazon AWS at http://jenkins.onap.info/job/oom-cd-master/ It is a 1 + 4 node cluster composed of four 64G/8vCore R4.2xLarge VMs
|
Amazon AWS
Account Provider: (2) Robin of Amazon and Michael O'Brien of Amdocs
Amazon has donated an allocation enough for 512G of VM space (a large 4 x 122G/16vCore cluster and a secondary 9 x 16G cluster) in order to run CD systems since Dec 2017 - at a cost savings of at least $500/month - thank you very much Amazon in supporting ONAP See example max/med allocations for IT/Finance in ONAP Deployment Specification for Finance and Operations#AmazonAWS |
Amazon AWS is currently hosting our RI for ONAP Continuous Deployment - this is a joint Proof Of Concept between Amazon and ONAP.
Auto Continuous Deployment via Jenkins and Kibana
AWS CLI Installation
Install the AWS CLI on the bastion VM
https://docs.aws.amazon.com/cli/latest/userguide/cli-install-macos.html
OSX
obrien:obrienlabs amdocs$ pip --version pip 9.0.1 from /Library/Python/2.7/site-packages/pip-9.0.1-py2.7.egg (python 2.7) obrien:obrienlabs amdocs$ curl -O https://bootstrap.pypa.io/get-pip.py obrien:obrienlabs amdocs$ python3 get-pip.py --user Requirement already up-to-date: pip in /Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages obrien:obrienlabs amdocs$ pip3 install awscli --upgrade --user Successfully installed awscli-1.14.41 botocore-1.8.45 pyasn1-0.4.2 s3transfer-0.1.13
Ubuntu
obrien:obrienlabs amdocs$ ssh ubuntu@dev.onap.info $ sudo apt install python-pip $ pip install awscli --upgrade --user $ aws --version aws-cli/1.14.41 Python/2.7.12 Linux/4.4.0-1041-aws botocore/1.8.45
Windows Powershell
Configure Access Keys for your Account
$aws configure AWS Access Key ID [None]: AK....Q AWS Secret Access Key [None]: Dl....l Default region name [None]: us-east-1 Default output format [None]: json $aws ec2 describe-regions --output table || ec2.ca-central-1.amazonaws.com | ca-central-1 || ....
Option 0: Deploy OOM Kubernetes to a spot VM
Peak Performance MetricsWe hit a peak of 44 cores during startup, with an external network peak of 1.2Gbps (throttled nexus servers at ONAP), a peak SSD write rate of 4Gbps and 55G ram on a 64 vCore/256G VM on AWS Spot.
Kubernetes Installation via CLI
Allocate an EIP static public IP (one-time)
https://docs.aws.amazon.com/cli/latest/reference/ec2/allocate-address.html
$aws ec2 allocate-address
{ "PublicIp": "35.172..", "Domain": "vpc", "AllocationId": "eipalloc-2f743..."}
Create a Route53 Record Set - Type A (one-time)
$ cat route53-a-record-change-set.json
{"Comment": "comment","Changes": [
{ "Action": "CREATE",
"ResourceRecordSet": {
"Name": "amazon.onap.cloud",
"Type": "A", "TTL": 300,
"ResourceRecords": [
{ "Value": "35.172.36.." }]}}]}
$ aws route53 change-resource-record-sets --hosted-zone-id Z...7 --change-batch file://route53-a-record-change-set.json
{ "ChangeInfo": { "Status": "PENDING", "Comment": "comment",
"SubmittedAt": "2018-02-17T15:02:46.512Z", "Id": "/change/C2QUNYTDVF453x" }}
$ dig amazon.onap.cloud
; <<>> DiG 9.9.7-P3 <<>> amazon.onap.cloud
amazon.onap.cloud. 300 IN A 35.172.36..
onap.cloud. 172800 IN NS ns-1392.awsdns-46.org.
Request a spot EC2 Instance
# request the usually cheapest $0.13 spot 64G EBS instance at AWS
aws ec2 request-spot-instances --spot-price "0.25" --instance-count 1 --type "one-time" --launch-specification file://aws_ec2_spot_cli.json
# don't pass in the the following - it will be generated for the EBS volume
"SnapshotId": "snap-0cfc17b071e696816"
launch specification json
{ "ImageId": "ami-c0c964ba",
"InstanceType": "r4.2xlarge",
"KeyName": "obrien_systems_aws_2015",
"BlockDeviceMappings": [
{"DeviceName": "/dev/sda1",
"Ebs": {
"DeleteOnTermination": true,
"VolumeType": "gp2",
"VolumeSize": 120
}}],
"SecurityGroupIds": [ "sg-322c4842" ]}
# results
{ "SpotInstanceRequests": [{ "Status": {
"Message": "Your Spot request has been submitted for review, and is pending evaluation.",
"Code": "pending-evaluation",
Get EC2 instanceId after creation
aws ec2 describe-spot-instance-requests --spot-instance-request-id sir-1tyr5etg
"InstanceId": "i-02a653592cb748e2x",
Associate EIP with EC2 Instance
Can be done separately as long as it is in the first 30 sec during initialization and before rancher starts on the instance.
$aws ec2 associate-address --instance-id i-02a653592cb748e2x --allocation-id eipalloc-375c1d0x
{ "AssociationId": "eipassoc-a4b5a29x"}
Reboot EC2 Instance to apply DNS change to Rancher in AMI
$aws ec2 reboot-instances --instance-ids i-02a653592cb748e2x
Clustered Deployment
look at https://github.com/kubernetes-incubator/external-storage
EC2 Cluster Creation
EFS share for shared NFS
"From the NFS wizard"
Setting up your EC2 instance
- Using the Amazon EC2 console, associate your EC2 instance with a VPC security group that enables access to your mount target. For example, if you assigned the "default" security group to your mount target, you should assign the "default" security group to your EC2 instance. Learn more
- Open an SSH client and connect to your EC2 instance. (Find out how to connect)
If you're not using the EFS mount helper, install the NFS client on your EC2 instance:- On an Ubuntu instance:
sudo apt-get install nfs-common
- On an Ubuntu instance:
Mounting your file system
- Open an SSH client and connect to your EC2 instance. (Find out how to connect)
- Create a new directory on your EC2 instance, such as "efs".
- sudo mkdir efs
- Mount your file system. If you require encryption of data in transit, use the EFS mount helper and the TLS mount option. Mounting considerations
- Using the EFS mount helper:
sudo mount -t efs fs-43b2763a:/ efs - Using the EFS mount helper and encryption of data in transit:
sudo mount -t efs -o tls fs-43b2763a:/ efs - Using the NFS client:
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 fs-43b2763a.efs.us-east-2.amazonaws.com:/ efs
- Using the EFS mount helper:
If you are unable to connect, see our troubleshooting documentation.
https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html
EFS/NFS Provisioning Script for AWS
ubuntu@ip-172-31-19-239:~$ git clone https://gerrit.onap.org/r/logging-analytics Cloning into 'logging-analytics'... ubuntu@ip-172-31-19-239:~$ sudo cp logging-analytics/deploy/aws/oom_cluster_host_install.sh . ubuntu@ip-172-31-19-239:~$ sudo ./oom_cluster_host_install.sh -n true -s clusters.onap.info -e fs-0000001b -r us-west-1 -t 5EA8A:15000:MWcEyoKw -c true -v # fix helm after adding nodes to the master ubuntu@ip-172-31-31-219:~$ sudo helm init --upgrade $HELM_HOME has been configured at /home/ubuntu/.helm. Tiller (the Helm server-side component) has been upgraded to the current version. ubuntu@ip-172-31-31-219:~$ sudo helm repo add local http://127.0.0.1:8879 "local" has been added to your repositories ubuntu@ip-172-31-31-219:~$ sudo helm repo list NAME URL stable https://kubernetes-charts.storage.googleapis.com local http://127.0.0.1:8879
4 Node Kubernetes Cluster on AWS
Notice that we are vCore bound Ideally we need 64 vCores for a minimal production system
Client Install
# setup the master
git clone https://gerrit.onap.org/r/logging-analytics
sudo logging-analytics/deploy/rancher/oom_rancher_setup.sh -b master -s cluster.onap.info -e onap
# manually delete the host that was installed on the master - in the rancher gui for now
# run without a client on the master
sudo logging-analytics/deploy/aws/oom_cluster_host_install.sh -n false -s cluster.onap.info -e fs-nnnnnn1b -r us-west-1 -t 371AEDC88zYAZdBXPM -c true -v true
ls /dockerdata-nfs/
onap test.sh
# run the script from git on each cluster node
git clone https://gerrit.onap.org/r/logging-analytics
sudo logging-analytics/deploy/aws/oom_cluster_host_install.sh -n true -s cluster.onap.info -e fs-nnnnnn1b -r us-west-1 -t 371AEDC88zYAZdBXPM -c true -v true
# check a node
ls /dockerdata-nfs/
onap test.sh
sudo docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6e4a57e19c39 rancher/healthcheck:v0.3.3 "/.r/r /rancher-en..." 1 second ago Up Less than a second r-healthcheck-healthcheck-5-f0a8f5e8
f9bffc6d9b3e rancher/network-manager:v0.7.19 "/rancher-entrypoi..." 1 second ago Up 1 second r-network-services-network-manager-5-103f6104
460f31281e98 rancher/net:holder "/.r/r /rancher-en..." 4 seconds ago Up 4 seconds r-ipsec-ipsec-5-2e22f370
3e30b0cf91bb rancher/agent:v1.2.9 "/run.sh run" 17 seconds ago Up 16 seconds rancher-agent
# On the master - fix helm after adding nodes to the master
sudo helm init --upgrade
$HELM_HOME has been configured at /home/ubuntu/.helm.
Tiller (the Helm server-side component) has been upgraded to the current version.
sudo helm repo add local http://127.0.0.1:8879
# check the cluster on the master
kubectl top nodes
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
ip-172-31-16-85.us-west-1.compute.internal 129m 3% 1805Mi 5%
ip-172-31-25-15.us-west-1.compute.internal 43m 1% 1065Mi 3%
ip-172-31-28-145.us-west-1.compute.internal 40m 1% 1049Mi 3%
ip-172-31-21-240.us-west-1.compute.internal 30m 0% 965Mi 3%
# important: secure your rancher cluster by adding an oauth github account - to keep out crypto miners
http://cluster.onap.info:8880/admin/access/github
# now back to master to install onap
sudo cp logging-analytics/deploy/cd.sh .
sudo ./cd.sh -b master -e onap -c true -d true -w false -r false
136 pending > 0 at the 1th 15 sec interval
ubuntu@ip-172-31-28-152:~$ kubectl get pods -n onap | grep -E '1/1|2/2' | wc -l
20
120 pending > 0 at the 39th 15 sec interval
ubuntu@ip-172-31-28-152:~$ kubectl get pods -n onap | grep -E '1/1|2/2' | wc -l
47
99 pending > 0 at the 93th 15 sec interval
after an hour most of the 136 containers should be up
kubectl get pods --all-namespaces | grep -E '0/|1/2'
onap onap-aaf-cs-59954bd86f-vdvhx 0/1 CrashLoopBackOff 7 37m
onap onap-aaf-oauth-57474c586c-f9tzc 0/1 Init:1/2 2 37m
onap onap-aai-champ-7d55cbb956-j5zvn 0/1 Running 0 37m
onap onap-drools-0 0/1 Init:0/1 0 1h
onap onap-nexus-54ddfc9497-h74m2 0/1 CrashLoopBackOff 17 1h
onap onap-sdc-be-777759bcb9-ng7zw 1/2 Running 0 1h
onap onap-sdc-es-66ffbcd8fd-v8j7g 0/1 Running 0 1h
onap onap-sdc-fe-75fb4965bd-bfb4l 0/2 Init:1/2 6 1h
# cpu bound - a small cluster has 4x4 cores - try to run with 4x16 cores
ubuntu@ip-172-31-28-152:~$ kubectl top nodes
NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
ip-172-31-28-145.us-west-1.compute.internal 3699m 92% 26034Mi 85%
ip-172-31-21-240.us-west-1.compute.internal 3741m 93% 3872Mi 12%
ip-172-31-16-85.us-west-1.compute.internal 3997m 99% 23160Mi 75%
ip-172-31-25-15.us-west-1.compute.internal 3998m 99% 27076Mi 88%
# for reference
register_node() {
#constants
DOCKERDATA_NFS=dockerdata-nfs
DOCKER_VER=17.03
USERNAME=ubuntu
if [[ "$IS_NODE" != false ]]; then
sudo curl https://releases.rancher.com/install-docker/$DOCKER_VER.sh | sh
sudo usermod -aG docker $USERNAME
fi
sudo apt-get install nfs-common -y
sudo mkdir /$DOCKERDATA_NFS
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 $AWS_EFS.efs.$AWS_REGION.amazonaws.com:/ /$DOCKERDATA_NFS
if [[ "$IS_NODE" != false ]]; then
echo "Running agent docker..."
if [[ "$COMPUTEADDRESS" != false ]]; then
echo "sudo docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.2.9 http://$MASTER:8880/v1/scripts/$TOKEN"
sudo docker run --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.2.9 http://$MASTER:8880/v1/scripts/$TOKEN
else
echo "sudo docker run -e CATTLE_AGENT_IP=\"$ADDRESS\" --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.2.9 http://$MASTER:8880/v1/scripts/$TOKEN"
sudo docker run -e CATTLE_AGENT_IP="$ADDRESS" --rm --privileged -v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/rancher:/var/lib/rancher rancher/agent:v1.2.9 http://$MASTER:8880/v1/scripts/$TOKEN
fi
fi
}
IS_NODE=false
MASTER=
TOKEN=
AWS_REGION=
AWS_EFS=
COMPUTEADDRESS=true
ADDRESS=
VALIDATE=
while getopts ":u:n:s:e:r:t:c:a:v" PARAM; do
case $PARAM in
u)
usage
exit 1
;;
n)
IS_NODE=${OPTARG}
;;
s)
MASTER=${OPTARG}
;;
e)
AWS_EFS=${OPTARG}
;;
r)
AWS_REGION=${OPTARG}
;;
t)
TOKEN=${OPTARG}
;;
c)
COMPUTEADDRESS=${OPTARG}
;;
a)
ADDRESS=${OPTARG}
;;
v)
VALIDATE=${OPTARG}
;;
?)
usage
exit
;;
esac
done
if [ -z $MASTER ]; then
usage
exit 1
fi
register_node $IS_NODE $MASTER $AWS_EFS $AWS_REGION $TOKEN $COMPUTEADDRESS $ADDRESS $VALIDATE
Kubernetes Installation via CloudFormation
ONAP Installation
SSH and upload OOM
oom_rancher_install.sh is in OOM-715 - Getting issue details... STATUS under https://gerrit.onap.org/r/#/c/32019/
Run OOM
see OOM-710 - Getting issue details... STATUS
cd.sh in OOM-716 - Getting issue details... STATUS under https://gerrit.onap.org/r/#/c/32653/
Scenario: installing Rancher on clean Ubuntu 16.04 64g VM (single collocated server/host) and the master branch of onap via OOM deployment (2 scripts)
1 hour video of automated installation on an AWS EC2 spot instance
Run Healthcheck
Run Automated Robot parts of vFirewall VNF
Report Results
Stop Spot Instance
$ aws ec2 terminate-instances --instance-ids i-0040425ac8c0d8f6x
{ "TerminatingInstances": [ {
"InstanceId": "i-0040425ac8c0d8f63",
"CurrentState": {
"Code": 32,
"Name": "shutting-down" },
"PreviousState": {
"Code": 16,
"Name": "running"
} } ]}
Verify Instance stopped
Video on Installing and Running the ONAP Demos#ONAPDeploymentVideos
WE can run ONAP on an AWS EC2 instance for $0.17/hour as opposed to Rackspace at $1.12/hour for a 64G Ubuntu host VM.
I have created an AMI on Amazon AWS under the following ID that has a reference 20170825 tag of ONAP 1.0 running on top of Rancher
ami-b8f3f3c3 : onap-oom-k8s-10
EIP 34.233.240.214 maps to http://dev.onap.info:8880/env/1a7/infra/hosts
A D2.2xlarge with 61G ram on the spot market https://console.aws.amazon.com/ec2sp/v1/spot/launch-wizard?region=us-east-1 at $0.16/hour for all of ONAP
It may take up to 3-8 min for kubernetes pods to initialize as long as you preload the docker images OOM-328 - Getting issue details... STATUS
Workaround for the disk space error - even though we are running with a 1.9 TB NVMe SSD
https://github.com/kubernetes/kubernetes/issues/48703
Use a flavor that uses EBS like M4.4xLarge which is OK
Use a flavor that uses EBS like M4.4xLarge which is OK - except for AAI right now
Expected Monthly Billing
r4.2xlarge is the smallest and most cost effective 64g min instance to use for full ONAP deployment - it requires EBS stores. This is assuming 1 instance up at all times and a couple ad-hoc instances up a couple hours for testing/experimentation.
Option 1: Migrating Heat to CloudFormation
Resource Correspondence
| ID | Type | Parent | AWS | Openstack |
|---|---|---|---|---|
Using the CloudFormationDesigner
https://console.aws.amazon.com/cloudformation/designer/home?region=us-east-1#
Decoupling and Abstracting Southbound Orchestration via Plugins
Part of getting another infrastructure provider like AWS to work with ONAP will be in identifying and decoupling southbound logic from any particular cloud provider using an extensible plugin architecture on the SBI interface.
see Multi VIM/Cloud (5/11/17), VID project (5/17/17), Service Orchestrator (5/14/17), ONAP Operations Manager (5/10/17), ONAP Operations Manager / ONAP on Containers
Design Issues
DI 1: Refactor nested orchestration in DCAE
Replace the DCAE Controller
DI 2: Elastic IP allocation
DI 3: Investigate Cloudify plugin for AWS
Cloudify is Tosca based - https://github.com/cloudify-cosmo/cloudify-aws-plugin
DI 4: 20180803" Investigate ISTIO service mesh
https://istio.io/docs/setup/kubernetes/quick-start/
LOG-592 - Getting issue details... STATUS
Links
Waiting for the EC2 C5 instance types under the C620 chipset to arrive at AWS so we can experiment under EC2 Spot - http://technewshunter.com/cpus/intel-launches-xeon-w-cpus-for-workstations-skylake-sp-ecc-for-lga2066-41771/ https://aws.amazon.com/about-aws/whats-new/2016/11/coming-soon-amazon-ec2-c5-instances-the-next-generation-of-compute-optimized-instances/
http://docs.aws.amazon.com/cli/latest/userguide/cli-install-macos.html
use
curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip" unzip awscli-bundle.zip sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws aws --version aws-cli/1.11.170 Python/2.7.13 Darwin/16.7.0 botocore/1.7.28
EC2 VMs
AWS Clustered Deployment
AWS EC2 Cluster Creation
AWS EFS share for shared NFS
You need an NFS share between the VM's in your Kubernetes cluster - an Elastic File System share will wrap NFS
"From the NFS wizard"
Setting up your EC2 instance
- Using the Amazon EC2 console, associate your EC2 instance with a VPC security group that enables access to your mount target. For example, if you assigned the "default" security group to your mount target, you should assign the "default" security group to your EC2 instance. Learn more
- Open an SSH client and connect to your EC2 instance. (Find out how to connect)
If you're not using the EFS mount helper, install the NFS client on your EC2 instance:- On an Ubuntu instance:
sudo apt-get install nfs-common
- On an Ubuntu instance:
Mounting your file system
- Open an SSH client and connect to your EC2 instance. (Find out how to connect)
- Create a new directory on your EC2 instance, such as "efs".
- sudo mkdir efs
- Mount your file system. If you require encryption of data in transit, use the EFS mount helper and the TLS mount option. Mounting considerations
- Using the EFS mount helper:
sudo mount -t efs fs-43b2763a:/ efs - Using the EFS mount helper and encryption of data in transit:
sudo mount -t efs -o tls fs-43b2763a:/ efs - Using the NFS client:
sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 fs-43b2763a.efs.us-east-2.amazonaws.com:/ efs
- Using the EFS mount helper:
If you are unable to connect, see our troubleshooting documentation.
https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html
Automated
Manual
ubuntu@ip-10-0-0-66:~$ sudo apt-get install nfs-common ubuntu@ip-10-0-0-66:~$ cd / ubuntu@ip-10-0-0-66:~$ sudo mkdir /dockerdata-nfs root@ip-10-0-0-19:/# sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 fs-43b2763a.efs.us-east-2.amazonaws.com:/ /dockerdata-nfs # write something on one vm - and verify it shows on another ubuntu@ip-10-0-0-8:~$ ls /dockerdata-nfs/ test.sh
Microsoft Azure
Subscription Sponsor: (1) Microsoft
VMs
Deliverables are deployment scripts, arm/cli templates for various deployment scenarios (single, multiple, federated servers)
In review OOM-711 - Getting issue details... STATUS
Quickstart
Single collocated VM
Automation is currently only written for single VM that hosts both the rancher server and the deployed onap pods. Use the ARM template below to deploy your VM and provision it (adjust your config parameters)
Two choices, run the single oom_deployment.sh ARM wrapper - or use it to bring up an empty vm and run oom_entrypoint.sh manually. Once the VM comes up the oom_entrypoint.sh script will run - which will download the oom_rancher_setup.sh script to setup docker, rancher, kubernetes and helm - the entrypoint script will then run the cd.sh script to bring up onap based on your values.yaml config by running helm install on it.
# login to az cli, wget the deployment script, arm template and parameters file - edit the parameters file (dns, ssh key ...) and run the arm template wget https://git.onap.org/logging-analytics/plain/deploy/azure/oom_deployment.sh wget https://git.onap.org/logging-analytics/plain/deploy/azure/_arm_deploy_onap_cd.json wget https://git.onap.org/logging-analytics/plain/deploy/azure/_arm_deploy_onap_cd_z_parameters.json # either run the entrypoint which creates a resource template and runs the stack - or do those two commands manually ./oom_deployment.sh -b master -s azure.onap.cloud -e onap -r a_auto-youruserid_20180421 -t arm_deploy_onap_cd.json -p arm_deploy_onap_cd_z_parameters.json # wait for the VM to finish in about 75 min or watch progress by ssh'ing into the vm and doing root@ons-auto-201803181110z: sudo tail -f /var/lib/waagent/custom-script/download/0/stdout # if you wish to run the oom_entrypoint script yourself - edit/break the cloud init section at the end of the arm template and do it yourself below # download and edit values.yaml with your onap preferences and openstack tenant config wget https://jira.onap.org/secure/attachment/11414/values.yaml # download and run the bootstrap and onap install script, the -s server name can be an IP, FQDN or hostname wget https://git.onap.org/logging-analytics/plain/deploy/rancher/oom_entrypoint.sh chmod 777 oom_entrypoint.sh sudo ./oom_entrypoint.sh -b master -s devops.onap.info -e onap # wait 15 min for rancher to finish, then 30-90 min for onap to come up
OOM-714 - Getting issue details... STATUS see https://jira.onap.org/secure/attachment/11455/oom_openstack.yaml and https://jira.onap.org/secure/attachment/11454/oom_openstack_oom.env
LOG-320 - Getting issue details... STATUS see https://git.onap.org/logging-analytics/tree/deploy/rancher/oom_entrypoint.sh
customize your template (true/false for any components, docker overrides etc...)
https://jira.onap.org/secure/attachment/11414/values.yaml
Run oom_entrypoint.sh after you verified values.yaml - it will run both scripts below for you - a single node kubernetes setup running what you configured in values.yaml will be up in 50-90 min. If you want to just configure your vm without bringing up ONAP - comment out the cd.sh line and run that separately.
LOG-325 - Getting issue details... STATUS see wget https://git.onap.org/logging-analytics/plain/deploy/rancher/oom_rancher_setup.sh
LOG-326 - Getting issue details... STATUS see wget https://git.onap.org/logging-analytics/plain/deploy/cd.sh
Verify your system is up by doing a kubectl get pods --all-namespaces and checking the 8880 port to bring up the rancher or kubernetes gui.
Login to Azure CLI
https://portal.azure.com/#blade/HubsExtension/Resources/resourceType/Microsoft.Resources%2Fresources
Download Azure ONAP ARM template
see
OOM-711 - Getting issue details... STATUS
Edit Azure ARM template environment parameters
Create Resource Group
az group create --name onap_eastus --location eastus
Run ARM template
az group deployment create --resource-group onap_eastus --template-file oom_azure_arm_deploy.json --parameters @oom_azure_arm_deploy_parameters.json
Wait for Rancher/Kubernetes install
The oom_entrypoint.sh script will be run as a cloud-init script on the VM - see
LOG-320 - Getting issue details... STATUS
which runs
LOG-325 - Getting issue details... STATUS
Wait for OOM ONAP install
see
LOG-326 - Getting issue details... STATUS
Verify ONAP installation
kubectl get pods --all-namespaces # raise/lower onap components from the installed directory if using the oneclick arm template # amsterdam only root@ons-auto-master-201803191429z:/var/lib/waagent/custom-script/download/0/oom/kubernetes/oneclick# ./createAll.bash -n onap
Azure CLI Installation
Requirements
Azure subscription
OSX
https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest
Install homebrew first (reinstall if you are on the latest OSX 10.13.2 https://github.com/Homebrew/install because of 3718)
Will install Python 3.6
$brew update $brew install azure-cli
https://docs.microsoft.com/en-us/cli/azure/get-started-with-azure-cli?view=azure-cli-latest
$ az login
To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code E..D to authenticate.
[ {
"cloudName": "AzureCloud",
"id": "f4...b",
"isDefault": true,
"name": "Pay-As-You-Go",
"state": "Enabled",
"tenantId": "bcb.....f",
"user": {
"name": "michael@....org",
"type": "user"
}}]
Bastion/Jumphost VM in Azure
https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-apt?view=azure-cli-latest
# in root AZ_REPO=$(lsb_release -cs) echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | sudo tee /etc/apt/sources.list.d/azure-cli.list apt-key adv --keyserver packages.microsoft.com --recv-keys 52E16F86FEE04B979B07E28DB02C46DF417A0893 apt-get install apt-transport-https apt-get update && sudo apt-get install azure-cli az login # verify root@ons-dmz:~# ps -ef | grep az root 1427 1 0 Mar17 ? 00:00:00 /usr/lib/linux-tools/4.13.0-1011-azure/hv_vss_daemon -n
Windows Powershell
https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?view=azure-cli-latest
ARM Template
Follow https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-create-first-template
Create a Storage Account
$ az login
To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code E...Z to authenticate.
$ az group create --name examplegroup --location "South Central US"
{
"id": "/subscriptions/f4b...e8b/resourceGroups/examplegroup",
"location": "southcentralus",
"managedBy": null,
"name": "examplegroup",
"properties": {
"provisioningState": "Succeeded"
},
"tags": null
}
obrien:obrienlabs amdocs$ vi azuredeploy_storageaccount.json
obrien:obrienlabs amdocs$ az group deployment create --resource-group examplegroup --template-file azuredeploy_storageaccount.json
{
"id": "/subscriptions/f4...e8b/resourceGroups/examplegroup/providers/Microsoft.Resources/deployments/azuredeploy_storageaccount",
"name": "azuredeploy_storageaccount",
"properties": {
"additionalProperties": {
"duration": "PT32.9822642S",
"outputResources": [
{
"id": "/subscriptions/f4..e8b/resourceGroups/examplegroup/providers/Microsoft.Storage/storageAccounts/storagekj6....kk2w",
"resourceGroup": "examplegroup"
}],
"templateHash": "11440483235727994285"},
"correlationId": "41a0f79..90c291",
"debugSetting": null,
"dependencies": [],
"mode": "Incremental",
"outputs": {},
"parameters": {},
"parametersLink": null,
"providers": [
{
"id": null,
"namespace": "Microsoft.Storage",
"registrationState": null,
"resourceTypes": [
{
"aliases": null,
"apiVersions": null,
"locations": [
"southcentralus"
],
"properties": null,
"resourceType": "storageAccounts"
}]}],
"provisioningState": "Succeeded",
"template": null,
"templateLink": null,
"timestamp": "2018-02-17T16:15:11.562170+00:00"
},
"resourceGroup": "examplegroup"}
Pick a region
az account list-locations northcentralus for example
Create a resource group
# create a resource group if not already there az group create --name obrien_jenkins_b_westus2 --location westus2
Create a VM
We need a 128G VM with at least 8vCores (peak is 60) and a 100+GB drive. The sizes are detailed on https://docs.microsoft.com/en-ca/azure/virtual-machines/windows/sizes-memory - we will use the Standard_D32s_v3 type
We need an "all open 0.0.0.0/0" security group and a reassociated data drive as boot drive - see the arm template in LOG-321
Get the ARM template
see open review in OOM-711 - Getting issue details... STATUS
"ubuntuOSVersion": "16.04.0-LTS"
"imagePublisher": "Canonical",
"imageOffer": "UbuntuServer",
"vmSize": "Standard_E8s_v3"
"osDisk": {"createOption": "FromImage"},"dataDisks": [{"diskSizeGB": 511,"lun": 0, "createOption": "Empty" }]
Follow
https://github.com/Azure/azure-quickstart-templates/tree/master/101-acs-kubernetes
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy
https://github.com/Azure/azure-quickstart-templates/tree/master/101-vm-simple-linux
It needs a security group https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-create-nsg-arm-template
{
"apiVersion": "2017-03-01",
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[variables('networkSecurityGroupName')]",
"location": "[resourceGroup().location]",
"tags": { "displayName": "NSG - Front End" },
"properties": {
"securityRules": [
{
"name": "in-rule",
"properties": {
"description": "All in",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 100,
"direction": "Inbound"
}
},
{
"name": "out-rule",
"properties": {
"description": "All out",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 101,
"direction": "Outbound"
}
}
]
}
}
,
{
"apiVersion": "2017-04-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[resourceGroup().location]",
"dependson": [
"[concat('Microsoft.Network/networkSecurityGroups/', variables('networkSecurityGroupName'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix')]",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
}
}
}
]
}
},
# validate first (validate instead of create) az group deployment create --resource-group obrien_jenkins_b_westus2 --template-file oom_azure_arm_deploy.json --parameters @oom_azure_arm_cd_amsterdam_deploy_parameters.json
SSH into your VM and run the Kubernetes and OOM installation scripts
Use the entrypoint script in OOM-710 - Getting issue details... STATUS
# clone the oom repo to get the install directory git clone https://gerrit.onap.org/r/oom # run the Rancher RI installation (to install kubernetes) oom/install/rancher/oom_rancher_install.sh -b master -s 192.168.240.32 -e onap # run the oom deployment script # get a copy of onap-parametes.yaml and place in this folder oom/install/deployment/cd.sh -b master -s 192.168.240.32 -e onap
oom_rancher_install.sh is in OOM-715 - Getting issue details... STATUS under https://gerrit.onap.org/r/#/c/32019/
cd.sh in OOM-716 - Getting issue details... STATUS under https://gerrit.onap.org/r/#/c/32653/
Delete the VM and resource group
# delete the vm and resources az group deployment delete --resource-group ONAPAMDOCS --name oom_azure_arm_deploy # the above deletion will not delete the actual resources - only a delete of the group or each individual resource works # optionally delete the resource group az group delete --name ONAPAMDOCS -y
Azure devops
create static IP
az network public-ip create --name onap-argon --resource-group a_ONAP_argon_prod_donotdelete --location eastus --allocation-method Static
ONAP on Azure Container Service
AKS Installation
Follow https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-deploy-cluster
Register for AKS preview via az cli
obrienbiometrics:obrienlabs michaelobrien$ az provider register -n Microsoft.ContainerService Registering is still on-going. You can monitor using 'az provider show -n Microsoft.ContainerService'
Create an AKS resource group
Raise your AKS vCPU quota - optional
http://aka.ms/corequotaincrease
https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/newsupportrequest
Deployment failed. Correlation ID: 4b4707a7-2244-4557-855e-11bcced556de. Provisioning of resource(s) for container service onapAKSCluster in resource group onapAKS failed. Message: Operation results in exceeding quota limits of Core. Maximum allowed: 10, Current in use: 10, Additional requested: 1. Please read more about quota increase at http://aka.ms/corequotaincrease.. Details:
Create AKS cluster
obrienbiometrics:obrienlabs michaelobrien$ az aks create --resource-group onapAKS --name onapAKSCluster --node-count 1 --generate-ssh-keys - Running .. "fqdn": "onapaksclu-onapaks-f4....3.hcp.eastus.azmk8s.io",
AKS cluster VM granularity
The cluster will start with a 3.5G VM before scaling
Resources for your AKS cluster
Bring up AAI only for now
Design Issues
Resource Group
A resource group makes it easier to package and remove everything for a deployment - essentially making the deployment stateless
Network Security Group
Global or local to the resource group?
Static public IP
Register a CNAME for an existing domain and use the same IP address everytime the deployment comes up
Entrypoint cloud init script
How to attach the cloud init script to provision the VM
ARM template chaining
passing derived varialbles into the next arm template - for example when bringing up an entire federated set in one or more DCs
see script attached to
Troubleshooting
DNS propagation and caching
It takes about 2 min for DNS entries to propagate out from A record DNS changes. For example the following IP/DNS association took 2 min to appear in dig.
obrienbiometrics:onap_oom_711_azure michaelobrien$ dig azure.onap.info ; <<>> DiG 9.9.7-P3 <<>> azure.onap.info ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10599 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;azure.onap.info. IN A ;; ANSWER SECTION: azure.onap.info. 251 IN A 52.224.233.230 ;; Query time: 68 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Feb 20 10:26:59 EST 2018 ;; MSG SIZE rcvd: 60 obrienbiometrics:onap_oom_711_azure michaelobrien$ dig azure.onap.info ; <<>> DiG 9.9.7-P3 <<>> azure.onap.info ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30447 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;azure.onap.info. IN A ;; ANSWER SECTION: azure.onap.info. 299 IN A 13.92.225.167 ;; Query time: 84 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Feb 20 10:27:04 EST 2018
Corporate Firewall Access
Inside the corporate firewall - avoid it
PS C:\> az login
Please ensure you have network connection. Error detail: HTTPSConnectionPool(host='login.microsoftonline.com', port=443)
: Max retries exceeded with url: /common/oauth2/devicecode?api-version=1.0 (Caused by NewConnectionError('<urllib3.conne
ction.VerifiedHTTPSConnection object at 0x04D18730>: Failed to establish a new connection: [Errno 11001] getaddrinfo fai
led',))
at home or cell hotspot
PS C:\> az login
To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code E...2W to authenticate.
[ { "cloudName": "AzureCloud", "id": "4...da1", "isDefault": true, "name": "Microsoft Azure Internal Consumption", "state": "Enabled", "tenantId": "72f98....47", "user": { "name": "fran...ocs.com", "type": "user" }]
On corporate account (need permissions bump to be able to create a resource group prior to running an arm template
https://wiki.onap.org/display/DW/ONAP+on+Kubernetes+on+Microsoft+Azure#ONAPonKubernetesonMicrosoftAzure-ARMTemplate
PS C:\> az group create --name onapKubernetes --location eastus
The client 'fra...s.com' with object id '08f98c7e-...ed' does not have authorization to per
form action 'Microsoft.Resources/subscriptions/resourcegroups/write' over scope '/subscriptions/42e...8
7da1/resourcegroups/onapKubernetes'.
try my personal = OK
PS C:\> az login
To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code EE...ULR to authenticate.
Terminate batch job (Y/N)? y
# hangs when first time login in a new pc
PS C:\> az login
To sign in, use a web browser to open the page https://aka.ms/devicelogin and enter the code E.PBKS to authenticate.
[ { "cloudName": "AzureCloud", "id": "f4b...b", "isDefault": true "name": "Pay-As-You-Go", "state": "Enabled", "tenantId": "bcb...f4f", "user": "name": "michael@obrien...org", "type": "user" } }]
PS C:\> az group create --name onapKubernetes2 --location eastus
{ "id": "/subscriptions/f4b....b/resourceGroups/onapKubernetes2", "location": "eastus", "managedBy": null, "name": "onapKubernetes2", "properties": { "provisioningState": "Succeeded" }, "tags": null}
Design Issues
20180228: Deployment delete does not delete resources without a resourceGroup delete
I find that a delete deployment deletes the deployment but not the actual resources. The workaround is to delete the resource group - but in some constrained subscriptions the cli user may not have the ability to create a resource group - and hence delete it.
see
https://github.com/Azure/azure-sdk-for-java/issues/1167
deleting the resources manually for now - is a workaround if you cannot create/delete resource groups
# delete the vm and resources az group deployment delete --resource-group ONAPAMDOCS --name oom_azure_arm_deploy
# the above deletion will not delete the actual resources - only a delete of the group or each individual resource works
# optionally delete the resource group az group delete --name ONAPAMDOCS -y
However modifying the template to add resources works well. For example adding a reference to a network security group
20180228: Resize the OS disk
ONAP requires at least 75g - the issue is than in most VM templates on Azure - the OS disk is 30g - we need to either switch to the data disk or resize the os disk.
# add diskSizeGB to the template
"osDisk": {
"diskSizeGB": 255,
"createOption": "FromImage"
},
ubuntu@oom-auto-deploy:~$ df
Filesystem 1K-blocks Used Available Use% Mounted on
udev 65989400 0 65989400 0% /dev
tmpfs 13201856 8848 13193008 1% /run
/dev/sda1 259142960 1339056 257787520 1% /
tmpfs 66009280 0 66009280 0% /dev/shm
tmpfs 5120 0 5120 0% /run/lock
tmpfs 66009280 0 66009280 0% /sys/fs/cgroup
none 64 0 64 0% /etc/network/interfaces.dynamic.d
/dev/sdb1 264091588 60508 250592980 1% /mnt
tmpfs 13201856 0 13201856 0% /run/user/1000
ubuntu@oom-auto-deploy:~$ free
total used free shared buff/cache available
Mem: 132018560 392336 131242164 8876 384060 131012328
20180301: Add oom_entrypoint.sh bootstrap script to install rancher and onap
in review under OOM-715
https://jira.onap.org/secure/attachment/11206/oom_entrypoint.sh
If using amsterdam - swap out the onap-parameters.yaml (the curl is hardcoded to a master branch version)
20180303: cloudstorage access on OSX via Azure Storage Manager
use this method instead of installing az cli directly - for certain corporate oauth configurations
https://azure.microsoft.com/en-us/features/storage-explorer/
Install AZM using the name and access key of a storage account created manually or by enabling the az cli on the browser
20180318: add oom_entrypoint.sh to cloud-init on the arm template
See https://docs.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines/extensions it looks like Azure has a similar setup to AWS ebextentions
Targetting
| type | string | No | Specifies the type of the extension; an example is "CustomScriptExtension". |
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/extensions-customscript
deprecated
{
"apiVersion": "2015-06-15",
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),'/onap')]",
"location": "[resourceGroup().location]",
"dependsOn": ["[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"],
"properties": {
"publisher": "Microsoft.Azure.Extensions",
"type": "CustomScript",
"typeHandlerVersion": "1.9",
"autoUpgradeMinorVersion": true,
"settings": {
"fileUris": [ "https://jira.onap.org/secure/attachment/11263/oom_entrypoint.sh" ],
"commandToExecute": "[concat('./' , parameters('scriptName'), ' -b master -s dns/pub/pri-ip -e onap' )]" }
}
}
use
{
"apiVersion": "2017-12-01",
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),'/onap')]",
"location": "[resourceGroup().location]",
"dependsOn": ["[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"],
"properties": {
"publisher": "Microsoft.Azure.Extensions",
"type": "CustomScript",
"typeHandlerVersion": "2.0",
"autoUpgradeMinorVersion": true,
"settings": {
"fileUris": [ "https://jira.onap.org/secure/attachment/11281/oom_entrypoint.sh" ],
"commandToExecute": "[concat('./' , parameters('scriptName'), ' -b master ', ' -s ', 'ons-auto-201803181110z', ' -e onap' )]"
}
}
}
ubuntu@ons-dmz:~$ ./oom_deployment.sh
Deployment template validation failed: 'The template resource 'entrypoint' for type 'Microsoft.Compute/virtualMachines/extensions' at line '1' and column '6182' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-template/#resources for usage details.'.
ubuntu@ons-dmz:~$ ./oom_deployment.sh
Deployment failed. Correlation ID: 532b9a9b-e0e8-4184-9e46-6c2e7c15e7c7. {
"error": {
"code": "ParentResourceNotFound",
"message": "Can not perform requested operation on nested resource. Parent resource '[concat(parameters('vmName'),'' not found."
}
}
fixed 20180318:1600
Install runs - but I need visibility - checking /var/lib/waagent/custom-script/download/0/
progress
./oom_deployment.sh
# 7 min to delete old deployment
ubuntu@ons-dmz:~$ az vm extension list -g a_ONAP_auto_201803181110z --vm-name ons-auto-201803181110z
..
"provisioningState": "Creating",
"settings": {
"commandToExecute": "./oom_entrypoint.sh -b master -s ons-auto-201803181110zons-auto-201803181110z.eastus.cloudapp.azure.com -e onap",
"fileUris": [
"https://jira.onap.org/secure/attachment/11263/oom_entrypoint.sh"
ubuntu@ons-auto-201803181110z:~$ sudo su -
root@ons-auto-201803181110z:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
83458596d7a6 rancher/server:v1.6.14 "/usr/bin/entry /u..." 3 minutes ago Up 3 minutes 3306/tcp, 0.0.0.0:8880->8080/tcp rancher_server
root@ons-auto-201803181110z:~# tail -f /var/log/azure/custom-script/handler.log
time=2018-03-18T22:51:59Z version=v2.0.6/git@1008306-clean operation=enable seq=0 file=0 event="download complete" output=/var/lib/waagent/custom-script/download/0
time=2018-03-18T22:51:59Z version=v2.0.6/git@1008306-clean operation=enable seq=0 event="executing command" output=/var/lib/waagent/custom-script/download/0
time=2018-03-18T22:51:59Z version=v2.0.6/git@1008306-clean operation=enable seq=0 event="executing public commandToExecute" output=/var/lib/waagent/custom-script/download/0
root@ons-auto-201803181110z:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
539733f24c01 rancher/agent:v1.2.9 "/run.sh run" 13 seconds ago Up 13 seconds rancher-agent
83458596d7a6 rancher/server:v1.6.14 "/usr/bin/entry /u..." 5 minutes ago Up 5 minutes 3306/tcp, 0.0.0.0:8880->8080/tcp rancher_server
root@ons-auto-201803181110z:~# ls -la /var/lib/waagent/custom-script/download/0/
total 31616
-rw-r--r-- 1 root root 16325186 Aug 31 2017 helm-v2.6.1-linux-amd64.tar.gz
-rw-r--r-- 1 root root 4 Mar 18 22:55 kube_env_id.json
drwxrwxr-x 2 ubuntu ubuntu 4096 Mar 18 22:53 linux-amd64
-r-x------ 1 root root 2822 Mar 18 22:51 oom_entrypoint.sh
-rwxrwxrwx 1 root root 7288 Mar 18 22:52 oom_rancher_setup.sh
-rwxr-xr-x 1 root root 12213376 Mar 18 22:53 rancher
-rw-r--r-- 1 root root 3736787 Dec 20 19:41 rancher-linux-amd64-v0.6.7.tar.gz
drwxr-xr-x 2 root root 4096 Dec 20 19:39 rancher-v0.6.7
testing via http://jenkins.onap.cloud/job/oom_azure_deployment/
Need the ip address and not the domain name - via linked template
or
https://docs.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses
https://github.com/Azure/azure-quickstart-templates/issues/583
Arm templates cannot specify a static ip - without a private subnet
reference(variables('publicIPAddressName')).ipAddress
for
reference(variables('nicName')).ipConfigurations[0].properties.privateIPAddress
Using the hostname instead of the private/public ip works (verify /etc/hosts though)
obrienbiometrics:oom michaelobrien$ ssh ubuntu@13.90.207.60 ubuntu@ons-auto-201803181110z:~$ sudo su - root@ons-auto-201803181110z:/var/lib/waagent/custom-script/download/0# cat stdout INFO: Running Agent Registration Process, CATTLE_URL=http://ons-auto-201803181110z:8880/v1 INFO: Attempting to connect to: http://ons-auto-201803181110z:8880/v1 INFO: http://ons-auto-201803181110z:8880/v1 is accessible INFO: Inspecting host capabilities INFO: Boot2Docker: false INFO: Host writable: true INFO: Token: xxxxxxxx INFO: Running registration INFO: Printing Environment INFO: ENV: CATTLE_ACCESS_KEY=9B0FA1695A3E3CFD07DB INFO: ENV: CATTLE_HOME=/var/lib/cattle INFO: ENV: CATTLE_REGISTRATION_ACCESS_KEY=registrationToken INFO: ENV: CATTLE_REGISTRATION_SECRET_KEY=xxxxxxx INFO: ENV: CATTLE_SECRET_KEY=xxxxxxx INFO: ENV: CATTLE_URL=http://ons-auto-201803181110z:8880/v1 INFO: ENV: DETECTED_CATTLE_AGENT_IP=172.17.0.1 INFO: ENV: RANCHER_AGENT_IMAGE=rancher/agent:v1.2.9 INFO: Launched Rancher Agent: b44bd62fd21c961f32f642f7c3b24438fc4129eabbd1f91e1cf58b0ed30b5876 waiting 7 min for host registration to finish 1 more min KUBECTL_TOKEN base64 encoded: QmFzaWMgUWpBNE5EWkdRVE5HTmpKRVFVRkZOa1k1UlRNNlMzZzBWRTVUZVc5VGEycFhaVE5HTm5rNWNGWlhVRWg0TVVkV1ZEbDVTRmQxUkc1d2MwWTJRZz09 run the following if you installed a higher kubectl version than the server helm init --upgrade Verify all pods up on the kubernetes system - will return localhost:8080 until a host is added kubectl get pods --all-namespaces NAMESPACE NAME READY STATUS RESTARTS AGE kube-system heapster-76b8cd7b5-v5jrd 1/1 Running 0 5m kube-system kube-dns-5d7b4487c9-9bwk5 3/3 Running 0 5m kube-system kubernetes-dashboard-f9577fffd-cpwv7 1/1 Running 0 5m kube-system monitoring-grafana-997796fcf-s4sjm 1/1 Running 0 5m kube-system monitoring-influxdb-56fdcd96b-2mn6r 1/1 Running 0 5m kube-system tiller-deploy-cc96d4f6b-fll4t 1/1 Running 0 5m
20180318: Create VM image without destroying running VM
In AWS we can select the "no reboot" option and create an image from a running VM as-is with no effect on the running system.
Having issues with the Azure image creator - it is looking for the ubuntu pw even though I only use key based access
20180319: New Relic Monitoring
20180319: document devops flow
aka: travellers guide
20180319: Document Virtual Network Topology
20180429: Helm repo n/a after reboot - rerun helm serve
If you run into issues doing a make all - your helm server is not running
# rerun helm serve & helm repo add local http://127.0.0.1:8879
20180516: Clustered NFS share via Azure Files
Need a cloud native NFS wrapper like EFS(AWS) - looking at Azure files
Training
(Links below from Microsoft - thank you)
General Azure Documentation
Azure Site http://azure.microsoft.com
Azure Documentation Site https://docs.microsoft.com/en-us/azure/
Azure Training Courses https://azure.microsoft.com/en-us/training/free-online-courses/
Azure Portal http://portal.azure.com
Developer Documentation
Azure AD Authentication Libraries https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-authentication-libraries
Java Overview on Azure https://azure.microsoft.com/en-us/develop/java/
Java Docs for Azure https://docs.microsoft.com/en-us/java/azure/
Java SDK on GitHub https://github.com/Azure/azure-sdk-for-java
Python Overview on Azure https://azure.microsoft.com/en-us/develop/python/
Python Docs for Azure https://docs.microsoft.com/en-us/python/azure/
Python SDK on GitHub https://github.com/Azure/azure-sdk-for-python
REST Api and CLI Documentation
REST API Documentation https://docs.microsoft.com/en-us/rest/api/
CLI Documentation https://docs.microsoft.com/en-us/cli/azure/index
Other Documentation
Using Automation for VM shutdown & startup https://docs.microsoft.com/en-us/azure/automation/automation-solution-vm-management
Azure Resource Manager (ARM) QuickStart Templates https://github.com/Azure/azure-quickstart-templates
Known Forks
The code in this github repo has 2 month old copies of cd.sh and oom_rancher_install.sh
https://github.com/taranki/onap-azure
Use the official ONAP code in
https://gerrit.onap.org/r/logging-analytics
The original seed source from 2017 below is deprecated - use onap links above
https://github.com/obrienlabs/onap-root
Links
https://azure.microsoft.com/en-us/services/container-service/
https://docs.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines
https://kubernetes.io/docs/concepts/containers/images/#using-azure-container-registry-acr
https://azure.microsoft.com/en-us/features/storage-explorer/
https://docs.microsoft.com/en-ca/azure/virtual-machines/linux/capture-image
AKS
Google GCE
Account Provider: Michael O'Brien of Amdocs
OOM Installation on a GCE VM
The purpose of this page is to detail getting ONAP on Kubernetes (OOM) setup on a GCE VM.
I recommend using the ONAP on Kubernetes on Amazon EC2 Amazon EC2 Spot API - as it runs around $0.12-0.25/hr at 75% off instead of the $0.60 below (33% off for reserved instances) - this page is here so we can support GCE and also work with the kubernetes open source project in a space it was originally designed in at Google.
Login to your google account and start creating a 128g Ubuntu 16.04 VM
Install google command line tools
?????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? Components ? ??????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? Status ? Name ? ID ? Size ? ??????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? Not Installed ? App Engine Go Extensions ? app-engine-go ? 97.7 MiB ? ? Not Installed ? Cloud Bigtable Command Line Tool ? cbt ? 4.0 MiB ? ? Not Installed ? Cloud Bigtable Emulator ? bigtable ? 3.5 MiB ? ? Not Installed ? Cloud Datalab Command Line Tool ? datalab ? < 1 MiB ? ? Not Installed ? Cloud Datastore Emulator ? cloud-datastore-emulator ? 17.7 MiB ? ? Not Installed ? Cloud Datastore Emulator (Legacy) ? gcd-emulator ? 38.1 MiB ? ? Not Installed ? Cloud Pub/Sub Emulator ? pubsub-emulator ? 33.2 MiB ? ? Not Installed ? Emulator Reverse Proxy ? emulator-reverse-proxy ? 14.5 MiB ? ? Not Installed ? Google Container Local Builder ? container-builder-local ? 3.7 MiB ? ? Not Installed ? Google Container Registry's Docker credential helper ? docker-credential-gcr ? 2.2 MiB ? ? Not Installed ? gcloud Alpha Commands ? alpha ? < 1 MiB ? ? Not Installed ? gcloud Beta Commands ? beta ? < 1 MiB ? ? Not Installed ? gcloud app Java Extensions ? app-engine-java ? 116.0 MiB ? ? Not Installed ? gcloud app PHP Extensions ? app-engine-php ? 21.9 MiB ? ? Not Installed ? gcloud app Python Extensions ? app-engine-python ? 6.2 MiB ? ? Not Installed ? kubectl ? kubectl ? 15.9 MiB ? ? Installed ? BigQuery Command Line Tool ? bq ? < 1 MiB ? ? Installed ? Cloud SDK Core Libraries ? core ? 5.9 MiB ? ? Installed ? Cloud Storage Command Line Tool ? gsutil ? 3.3 MiB ? ??????????????????????????????????????????????????????????????????????????????????????????????????????????????? ==> Source [/Users/michaelobrien/gce/google-cloud-sdk/completion.bash.inc] in your profile to enable shell command completion for gcloud. ==> Source [/Users/michaelobrien/gce/google-cloud-sdk/path.bash.inc] in your profile to add the Google Cloud SDK command line tools to your $PATH. gcloud init obrienbiometrics:google-cloud-sdk michaelobrien$ source ~/.bash_profile obrienbiometrics:google-cloud-sdk michaelobrien$ gcloud components update All components are up to date.
Connect to your VM by getting a dynamic SSH key
obrienbiometrics:google-cloud-sdk michaelobrien$ gcloud compute ssh instance-1
WARNING: The public SSH key file for gcloud does not exist.
WARNING: The private SSH key file for gcloud does not exist.
WARNING: You do not have an SSH key for gcloud.
WARNING: SSH keygen will be executed to generate a key.
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /Users/michaelobrien/.ssh/google_compute_engine.
Your public key has been saved in /Users/michaelobrien/.ssh/google_compute_engine.pub.
The key fingerprint is:
SHA256:kvS8ZIE1egbY+bEpY1RGN45ruICBo1WH8fLWqO435+Y michaelobrien@obrienbiometrics.local
The key's randomart image is:
+---[RSA 2048]----+
| o=o+* o |
| . .oo+*.= . |
|o o ..=.=+. |
|.o o ++X+o |
|. . ..BoS |
| + * . |
| . . . |
| . o o |
| .o. *E |
+----[SHA256]-----+
Updating project ssh metadata.../Updated [https://www.googleapis.com/compute/v1/projects/onap-184300].
Updating project ssh metadata...done.
Waiting for SSH key to propagate.
Warning: Permanently added 'compute.2865548946042680113' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.10.0-37-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
Get cloud support with Ubuntu Advantage Cloud Guest:
http://www.ubuntu.com/business/services/cloud
0 packages can be updated.
0 updates are security updates.
michaelobrien@instance-1:~$
Open up firewall rules or the entire VM
We need at least port 8880 for rancher
obrienbiometrics:20171027_log_doc michaelobrien$ gcloud compute firewall-rules create open8880 --allow tcp:8880 --source-tags=instance-1 --source-ranges=0.0.0.0/0 --description="8880" Creating firewall...|Created [https://www.googleapis.com/compute/v1/projects/onap-184300/global/firewalls/open8880]. Creating firewall...done. NAME NETWORK DIRECTION PRIORITY ALLOW DENY open8880 default INGRESS 1000 tcp:8880
Better to edit the existing internal firewall rule to the CIDR 0.0.0.0/0
Continue with ONAP on Kubernetes
ONAP on Kubernetes#QuickstartInstallation
Kubernetes
Verify your Kubernetes cluster is functioning properly - Tiller is up
Check the dashboard
http://dev.onap.info:8880/r/projects/1a7/kubernetes-dashboard:9090/#!/pod?namespace=_all
check kubectl
check tiller container is in state Running - not just tiller-deploy
ubuntu@a-onap-devops:~$ kubectl get pods --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system heapster-6cfb49f776-9lqt2 1/1 Running 0 20d
kube-system kube-dns-75c8cb4ccb-tw992 3/3 Running 0 20d
kube-system kubernetes-dashboard-6f4c8b9cd5-rcbp2 1/1 Running 0 20d
kube-system monitoring-grafana-76f5b489d5-r99rh 1/1 Running 0 20d
kube-system monitoring-influxdb-6fc88bd58d-h875w 1/1 Running 0 20d
kube-system tiller-deploy-645bd55c5d-bmxs7 1/1 Running 0 20d
onap logdemonode-logdemonode-5c8bffb468-phbzd 2/2 Running 0 20d
onap onap-log-elasticsearch-7557486bc4-72vpw 1/1 Running 0 20d
onap onap-log-kibana-fc88b6b79-d88r7 1/1 Running 0 20d
onap onap-log-logstash-9jlf2 1/1 Running 0 20d
onap onap-portal-app-8486dc7ff8-tssd2 2/2 Running 0 5d
onap onap-portal-cassandra-8588fbd698-dksq5 1/1 Running 0 5d
onap onap-portal-db-7d6b95cd94-66474 1/1 Running 0 5d
onap onap-portal-sdk-77cd558c98-6rsvq 2/2 Running 0 5d
onap onap-portal-widget-6469f4bc56-hms24 1/1 Running 0 5d
onap onap-portal-zookeeper-5d8c598c4c-hck2d 1/1 Running 0 5d
onap onap-robot-6f99cb989f-kpwdr 1/1 Running 0 20d
ubuntu@a-onap-devops:~$ kubectl describe pod tiller-deploy-645bd55c5d-bmxs7 -n kube-system
Name: tiller-deploy-645bd55c5d-bmxs7
Namespace: kube-system
Node: a-onap-devops/172.17.0.1
Start Time: Mon, 30 Jul 2018 22:20:09 +0000
Labels: app=helm
name=tiller
pod-template-hash=2016811718
Annotations: <none>
Status: Running
IP: 10.42.0.5
Controlled By: ReplicaSet/tiller-deploy-645bd55c5d
Containers:
tiller:
Container ID: docker://a26420061a01a5791401c2519974c3190bf9f53fce5a9157abe7890f1f08146a
Image: gcr.io/kubernetes-helm/tiller:v2.8.2
Image ID: docker-pullable://gcr.io/kubernetes-helm/tiller@sha256:9b373c71ea2dfdb7d42a6c6dada769cf93be682df7cfabb717748bdaef27d10a
Port: 44134/TCP
Command:
/tiller
--v=2
State: Running
Started: Mon, 30 Jul 2018 22:20:14 +0000
Ready: True
Monitoring
Grafana Dashboards
There is a built in grafana dashboard (thanks Mandeep Khinda and James MacNider) that once enabled can show more detail about the cluster you are running - you need to expose the nodeport and target the VM the pod is on.
The CD system one is running below http://master3.onap.info:32628/dashboard/db/cluster?orgId=1&from=now-12h&to=now
# expose the nodeport kubectl expose -n kube-system deployment monitoring-grafana --type=LoadBalancer --name monitoring-grafana-client service "monitoring-grafana-client" exposed # get the nodeport pod is running on kubectl get services --all-namespaces -o wide | grep graf kube-system monitoring-grafana ClusterIP 10.43.44.197 <none> 80/TCP 7d k8s-app=grafana kube-system monitoring-grafana-client LoadBalancer 10.43.251.214 18.222.4.161 3000:32628/TCP 15s k8s-app=grafana,task=monitoring # get the cluster vm DNS name ubuntu@ip-10-0-0-169:~$ kubectl get pods --all-namespaces -o wide | grep graf kube-system monitoring-grafana-997796fcf-7kkl4 1/1 Running 0 5d 10.42.84.138 ip-10-0-0-80.us-east-2.compute.internal
Kubernetes DevOps
downgrade docker if required
sudo apt-get autoremove -y docker-engine
Change max-pods from default 110 pod limit
Rancher ships with a 110 pod limit - you can override this on the kubernetes template for 1.10
Manual procedure:
20180905_rancher_increase_110_pod_limit.mp4
OOM-1137 - Getting issue details... STATUS
Or capture the output of the REST PUT call - and add around line 140 of the script https://git.onap.org/logging-analytics/tree/deploy/rancher/oom_rancher_setup.sh#n140
Operations
Get failed/pending containers
kubectl get pods --all-namespaces | grep -E "0/|1/2" | wc -l
kubectl cluster-info # get pods/containers kubectl get pods --all-namespaces # get port mappings kubectl get services --all-namespaces -o wide NAMESPACE NAME READY STATUS RESTARTS AGE default nginx-1389790254-lgkz3 1/1 Running 1 5d kube-system heapster-4285517626-x080g 1/1 Running 1 6d kube-system kube-dns-638003847-tst97 3/3 Running 3 6d kube-system kubernetes-dashboard-716739405-fnn3g 1/1 Running 2 6d kube-system monitoring-grafana-2360823841-hr824 1/1 Running 1 6d kube-system monitoring-influxdb-2323019309-k7h1t 1/1 Running 1 6d kube-system tiller-deploy-737598192-x9wh5 1/1 Running 1 6d # ssh into a pod kubectl -n default exec -it nginx-1389790254-lgkz3 /bin/bash # get logs kubectl -n default logs -f nginx-1389790254-lgkz3
Exec
kubectl -n onap-aai exec -it aai-resources-1039856271-d9bvq bash
Bounce/Fix a failed container
Periodically one of the higher containers in a dependency tree will not get restarted in time to pick up running child containers - usually this is the kibana container
Fix this or "any" container by deleting the container in question and kubernetes will bring another one up.
root@a-onap-auto-20180412-ref:~# kubectl get services --all-namespaces | grep log onap dev-vfc-catalog ClusterIP 10.43.210.8 <none> 8806/TCP 5d onap log-es NodePort 10.43.77.87 <none> 9200:30254/TCP 5d onap log-es-tcp ClusterIP 10.43.159.93 <none> 9300/TCP 5d onap log-kibana NodePort 10.43.41.102 <none> 5601:30253/TCP 5d onap log-ls NodePort 10.43.180.165 <none> 5044:30255/TCP 5d onap log-ls-http ClusterIP 10.43.13.180 <none> 9600/TCP 5d root@a-onap-auto-20180412-ref:~# kubectl get pods --all-namespaces | grep log onap dev-log-elasticsearch-66cdc4f855-wmpkz 1/1 Running 0 5d onap dev-log-kibana-5b6f86bcb4-drpzq 0/1 Running 1076 5d onap dev-log-logstash-6d9fdccdb6-ngq2f 1/1 Running 0 5d onap dev-vfc-catalog-7d89bc8b9d-vxk74 2/2 Running 0 5d root@a-onap-auto-20180412-ref:~# kubectl delete pod dev-log-kibana-5b6f86bcb4-drpzq -n onap pod "dev-log-kibana-5b6f86bcb4-drpzq" deleted root@a-onap-auto-20180412-ref:~# kubectl get pods --all-namespaces | grep log onap dev-log-elasticsearch-66cdc4f855-wmpkz 1/1 Running 0 5d onap dev-log-kibana-5b6f86bcb4-drpzq 0/1 Terminating 1076 5d onap dev-log-kibana-5b6f86bcb4-gpn2m 0/1 Pending 0 12s onap dev-log-logstash-6d9fdccdb6-ngq2f 1/1 Running 0 5d onap dev-vfc-catalog-7d89bc8b9d-vxk74 2/2 Running 0 5d
Remove containers stuck in terminating
a helm namespace delete or a kubectl delete or a helm purge may not remove everything based on hanging PVs - use
#after a sudo helm delete --purge onap melliott [12:11 PM] kubectl delete pods <pod> --grace-period=0 --force -n onap
Persistent Volumes
Several applications in ONAP require persistent configuration or storage outside of the stateless docker containers managed by Kubernetes. In this case Kubernetes can act as a direct wrapper of native docker volumes or provide its own extended dynamic persistence for use cases where we are running scaled pods on multiple hosts.
https://kubernetes.io/docs/concepts/storage/persistent-volumes/
The SDNC clustering poc - https://gerrit.onap.org/r/#/c/25467/23
For example the following has a patch that exposes a dir into the container just like a docker volume or a volume in docker-compose - the issue here is mixing emptyDir (exposing dirs between containers) and exposing dirs outside to the FS/NFS
https://jira.onap.org/browse/LOG-52
This is only one way to do a static PV in K8S
https://jira.onap.org/secure/attachment/10436/LOG-50-expose_mso_logs.patch
Token
Thanks Joey
root@ip-172-31-27-86:~# kubectl describe secret $(kubectl get secrets | grep default | cut -f1 -d ' ') Name: default-token-w1jq0 Namespace: default Labels: <none> Annotations: kubernetes.io/service-account.name=default kubernetes.io/service-account.uid=478eae11-f0f4-11e7-b936-022346869a82 Type: kubernetes.io/service-account-token Data ==== ca.crt: 1025 bytes namespace: 7 bytes token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImRlZmF1bHQtdG9rZW4tdzFqcTAiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoiZGVmYXVsdCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjQ3OGVhZTExLWYwZjQtMTFlNy1iOTM2LTAyMjM0Njg2OWE4MiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OmRlZmF1bHQifQ.Fjv6hA1Kzurr-Cie5EZmxMOoxm-3Uh3zMGvoA4Xu6h2U1-NBp_fw_YW7nSECnI7ttGz67mxAjknsgfze-1JtgbIUtyPP31Hp1iscaieu5r4gAc_booBdkV8Eb8gia6sF84Ye10lsS4nkmmjKA30BdqH9qjWspChLPdGdG3_RmjApIHEOjCqQSEHGBOMvY98_uO3jiJ_XlJBwLL4uydjhpoANrS0xlS_Evn0evLdits7_piklbc-uqKJBdZ6rWyaRbkaIbwNYYhg7O-CLlUVuExynAAp1J7Mo3qITNV_F7f4l4OIzmEf3XLho4a1KIGb76P1AOvSrXgTzBq0Uvh5fUw |
Auto Scaling
Using the example on page 122 of Kubernetes Up & Running.
kubectl run nginx --image=nginx:1.7.12 kubectl get deployments nginx kubectl scale deployments nginx --replicas=3 kubectl get deployments nginx kubectl get replicasets --selector=run=nginx kubectl get pods --all-namespaces kubectl scale deployments nginx --replicas=64
Openstack
Windriver Intel Lab
see OOM-714 - Getting issue details... STATUS
Openlab VNC and CLI
The following is missing some sections and a bit out of date (v2 deprecated in favor of v3)
| Get an openlab account - Integration / Developer Lab Access | Stephen Gooch provides excellent/fast service - raise a JIRA like the following OPENLABS-75 - Getting issue details... STATUS |
Install openVPN - Using Lab POD-ONAP-01 Environment For OSX both Viscosity and TunnelBlick work fine |
|
| Login to Openstack |
|
| Install openstack command line tools | Tutorial: Configuring and Starting Up the Base ONAP Stack#InstallPythonvirtualenvTools(optional,butrecommended) |
| get your v3 rc file |
|
| verify your openstack cli access (or just use the jumpbox) | obrienbiometrics:aws michaelobrien$ source logging-openrc.sh obrienbiometrics:aws michaelobrien$ openstack server list +--------------------------------------+---------+--------+-------------------------------+------------+ | ID | Name | Status | Networks | Image Name | +--------------------------------------+---------+--------+-------------------------------+------------+ | 1ed28213-62dd-4ef6-bdde-6307e0b42c8c | jenkins | ACTIVE | admin-private-mgmt=10.10.2.34 | | +--------------------------------------+---------+--------+-------------------------------+------------+ |
| get some elastic IP's | You may need to release unused IPs from other tenants - as we have 4 pools of 50
|
| fill in your stack env parameters | to fill in your config (mso) settings in values.yaml follow https://onap.readthedocs.io/en/beijing/submodules/oom.git/docs/oom_quickstart_guide.html section "To generate openStackEncryptedPasswordHere" example ubuntu@ip-172-31-54-73:~/_dev/log-137-57171/oom/kubernetes/so/resources/config/mso$ cat encryption.key aa3871669d893c7fb8abbcda31b88b4f ubuntu@ip-172-31-54-73:~/_dev/log-137-57171/oom/kubernetes/so/resources/config/mso$ echo -n "55" | openssl aes-128-ecb -e -K aa3871669d893c7fb8abbcda31b88b4f -nosalt | xxd -c 256 -p a355b08d52c73762ad9915d98736b23b |
| Run the HEAT stack | obrienbiometrics:onap_oom-714_heat michaelobrien$ openstack stack list +--------------------------------------+----------------------------+-----------------+----------------------+----------------------+ | ID | Stack Name | Stack Status | Creation Time | Updated Time | +--------------------------------------+----------------------------+-----------------+----------------------+----------------------+ | 52379aea-d0a9-48db-a13e-35ca00876768 | dcae | CREATE_COMPLETE | 2018-03-04T22:02:12Z | 2018-03-04T22:02:12Z | | 15203d3e-b603-4ccd-8be8-57c93f90da80 | oom20181214_obrien_rancher | CREATE_COMPLETE | 2018-02-15T01:26:27Z | 2018-02-15T01:26:27Z | +--------------------------------------+----------------------------+-----------------+----------------------+----------------------+ obrienbiometrics:onap_oom-714_heat michaelobrien$ openstack stack create -t oom_openstack.yaml -e logging_openstack_oom.env OOM20180507a +---------------------+-----------------------------------------+ | Field | Value | +---------------------+-----------------------------------------+ | id | f40a14a1-8114-463c-b1ba-c4df28215385 | | stack_name | OOM20180507a | | description | Heat template to install OOM components | | creation_time | 2018-05-07T16:47:53Z | | updated_time | 2018-05-07T16:47:53Z | | stack_status | CREATE_IN_PROGRESS | | stack_status_reason | Stack CREATE started | +---------------------+-----------------------------------------+ |
| ssh in | obrienbiometrics:onap_oom-714_heat michaelobrien$ ssh ubuntu@10.12.6.151 ubuntu@onap-oom-obrien-rancher:~$ docker version Client: Version: 17.03.2-ce API version: 1.27 |
| install Kubernetes stack (rancher, k8s, helm) | Get the latest oom_entrypoint.sh until OOM-710 is merged directly on the JIRA OOM-710 - Getting issue details... STATUS git clone https://gerrit.onap.org/r/logging-analytics cp logging-analytics/deploy/rancher/oom_entrypoint.sh . sudo chmod 777 oom_entrypoint.sh sudo vi /etc/hosts # put 127.0.0.1 your-host-name above ifconfig # get artifacts - but dont run yet sudo ./oom_entrypoint.sh -b master -s 10.12.6.151 -e onap # take out docker install line - already done - rerun sudo vi oom_rancher_setup.sh sudo ./oom_entrypoint.sh -b master -s 10.12.6.151 -e onap # wait 90 min kubectl get pods --all-namespaces kubectl get pods --all-namespaces | grep 0/ # note this will saturate your 64g vm unless you run a cluster or turn off parts of onap sudo vi oom/kubernetes/onap/values.yaml # rerun cd.sh sudo ./cd.sh -b master -e onap -c true -d true -w false -r false |
ONAP Usage
Accessing an external Node Port
Elasticsearch port example
# get pod names and the actual VM that any pod is on
ubuntu@ip-10-0-0-169:~$ kubectl get pods --all-namespaces -o wide | grep log-
onap onap-log-elasticsearch-756cfb559b-wk8c6 1/1 Running 0 2h 10.42.207.254 ip-10-0-0-227.us-east-2.compute.internal
onap onap-log-kibana-6bb55fc66b-kxtg6 0/1 Running 16 1h 10.42.54.76 ip-10-0-0-111.us-east-2.compute.internal
onap onap-log-logstash-689ccb995c-7zmcq 1/1 Running 0 2h 10.42.166.241 ip-10-0-0-111.us-east-2.compute.internal
onap onap-vfc-catalog-5fbdfc7b6c-xc84b 2/2 Running 0 2h 10.42.206.141 ip-10-0-0-227.us-east-2.compute.internal
# get nodeport
ubuntu@ip-10-0-0-169:~$ kubectl get services --all-namespaces -o wide | grep log-
onap log-es NodePort 10.43.82.53 <none> 9200:30254/TCP 2h app=log-elasticsearch,release=onap
onap log-es-tcp ClusterIP 10.43.90.198 <none> 9300/TCP 2h app=log-elasticsearch,release=onap
onap log-kibana NodePort 10.43.167.146 <none> 5601:30253/TCP 2h app=log-kibana,release=onap
onap log-ls NodePort 10.43.250.182 <none> 5044:30255/TCP 2h app=log-logstash,release=onap
onap log-ls-http ClusterIP 10.43.81.173 <none> 9600/TCP 2h app=log-logstash,release=onap
# check nodeport outside container
ubuntu@ip-10-0-0-169:~$ curl ip-10-0-0-111.us-east-2.compute.internal:30254
{
"name" : "-pEf9q9",
"cluster_name" : "onap-log",
"cluster_uuid" : "ferqW-rdR_-Ys9EkWw82rw",
"version" : {
"number" : "5.5.0",
"build_hash" : "260387d",
"build_date" : "2017-06-30T23:16:05.735Z",
"build_snapshot" : false,
"lucene_version" : "6.6.0"
}, "tagline" : "You Know, for Search"
}
# check inside docker container - for reference
ubuntu@ip-10-0-0-169:~$ kubectl exec -it -n onap onap-log-elasticsearch-756cfb559b-wk8c6 bash
[elasticsearch@onap-log-elasticsearch-756cfb559b-wk8c6 ~]$ curl http://127.0.0.1:9200
{
"name" : "-pEf9q9",
ONAP Deployment Specification
Performance
Cluster Performance
ONAP runs best on a large cluster. As of 20180508 there are 152 pods (above the 110 limit per VM). ONAP is also vCPU bound - therefore try to run with a minimum of 24 vCores, ideally 32 to 64.
Even though most replicaSets are set at 3 - try to have at least 4 nodes so we can survive a node failure and still be able to run all the pods. The memory profile is around 85g right now.
Security Profile
ONAP will require certain ports open by CIDR to several static domain names in order to deploy defined in a security group. At runtime the list is reduced.
Ideally these are all inside a private network.
It looks like we will need a standard public/private network locked down behind a combined ACL/SG for AWS VPC or a NSG for Azure where we only expose what we need outside the private network.
Still working on a list of ports but we should not need any of these exposed if we use a bastion/jumpbox + nat combo inside the network.
Known Security Vulnerabilities
https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c
https://github.com/kubernetes/kubernetes/pull/59666 fixed in Kubernetes 1.10
ONAP Port Profile
ONAP on deployment will require the following incoming and outgoing ports. Note: within ONAP rest calls between components will be handled inside the Kubernetes namespace by the DNS server running as part of K8S.
| port | protocol | incoming/outgoing | application | source | destination | Notes |
|---|---|---|---|---|---|---|
| 22 | ssh | ssh | developer vm | host | ||
| 443 | tiller | client | host | |||
| 8880 | http | rancher | client | host | ||
| 9090 | http | kubernetes | host | |||
| 10001 | https | nexus3 | nexus3.onap.org | |||
| 10003 | https | nexus3 | nexus3.onap.org | |||
| https | nexus | nexus.onap.org | ||||
https ssh | git | git.onap.org | ||||
| 30200-30399 | http/https | REST api | developer vm | host | ||
| 32628 | http | grafana | dashboard for the kubernetes cluster - must be enabled | |||
| 5005 | tcp | java debug port | developer vm | host | ||
| Lockdown ports | ||||||
| 8080 | outgoing | |||||
| 10250-10255 | in/out | Lock these down via VPC or a source CIDR that equals only the server/client IP list https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c |
Azure Security Group
AWS VPC + Security Group
OOM Deployment Specification - 20180507 Beijing/master
The generated host registration docker call is the same as the one generated by the wiki - minus server IP (currently single node cluster)
| |
| |
| |
| |
|
Links
https://kubernetes.io/docs/user-guide/kubectl-cheatsheet/
ONAP on Kubernetes#QuickstartInstallation
https://kubernetes.io/docs/tasks/run-application/run-replicated-stateful-application/
https://kubernetes.io/docs/tasks/job/fine-parallel-processing-work-queue/
Access the ONAP portal via the 8989 LoadBalancer Mandeep Khinda merged in for OOM-633 - Getting issue details... STATUS and documented at http://onap.readthedocs.io/en/latest/submodules/oom.git/docs/oom_user_guide.html#accessing-the-onap-portal-using-oom-and-a-kubernetes-cluster