Changes

== Kubernetes and pre-requisites (every node) ==

Install Kubernetes on Ubuntu 18.04. Assuming version 1.14.2 3 is pulled, check how to fix version. On new systems, copy over the install script from the master node.

== Create cluster configuration scripts Spin up the master node == Use kubeadm with vanilla defaults to initialize the control plane. <syntaxhighlight lang="bash">> sudo systemctl enable docker.service> sudo kubeadm init</syntaxhighlight> If this fails at any point, use kubeadm reset after problems have been fixed before trying to re-initialize. 

> cd init/templates# edit cluster information in the following config file> nano make_init_config.sh> touch /home/kubernetes/.rnd> ./make_init_configfinalize_master.sh

== Spin up the Update kubelet configuration for master node == Edit /etc/kubernetes/manifests/kube-controller-manager.yaml: <syntaxhighlight lang="bash">spec: containers: - command: # add these two - --allocate-node-cidrs=true - --cluster-cidr=10.244.0.0/16</syntaxhighlight> Copy certs/ca.crt (certificate for ccu.uni-konstanz.de) to /usr/share/ca-certificates/ca-dex.pem.

Use kubeadm with the generated config to initialize the control planeEdit /etc/kubernetes/manifests/kube-apiserver.yaml:

> cd spec: containers: - command: # add these five - --oidc-issuer-url=https:/home/kubernetesccu.uni-konstanz.de:32000/clustersdex - --oidc-client-id=loginapp - --oidc-ca-file=/usr/ccushare/ca-certificates/ca-dex.pem> sudo systemctl enable docker.service - --oidc-username-claim=name> sudo kubeadm init --config kubeadm-initoidc-config.yamlgroups-claim=groups

If this fails at any point, use kubeadm reset after problems have been fixed before trying to re-initialize== Daemonsets on Master node == === Flannel daemonset (pod network for communication) === <syntaxhighlight lang="bash">> cd init> ./start_pod_network.sh</syntaxhighlight>

* Flannel === nVidia daemonset (node communication)===

* Update kubelet configuration for master The daemonset should be active on any nodewith an nVidia GPU.

The master node should now login to the docker registry of the cluster. <syntaxhighlight lang=== DEX with LDAP ==="bash">> docker login https://ccu.uni-konstanz.de:5000Username: bastian.goldlueckePassword:</syntaxhighlight> Also, we need to provide the read-only secret for the docker registry in every namespace.

TODO: outdated, switched to containerized DEX. Check what still needs to be donehowto.

# Create secrets for TLS connectionsFinally, use certs we need to set up all the rules for ccurbac.uni-konstanz.de <syntaxhighlight lang="bash">> cd rbac## Modify ca-cmgenerate namespaces for user groups> .yml to contain correct ca/generate_namespaces.sh#label all compute nodes for which namespace they serve# Run upload_ccu_tls(after they are up, needs to be redone when new nodes are added)> ./label_nodes.sh# Spin set up login application service.access rights for namespaces## Modify loginapp> kubectl apply -cmf rbac.yml: server configyaml## Modify loginappset up rights for which namespaces can access which compute node> kubectl apply -ing-srvf node_to_groups.ymlyaml</syntaxhighlight> == Persistent volumes == === Local persistent volumes === Check directory local_storage: service data, mapping of ports to outside world## Modify loginapp-deploy* clone the git repository for the provisioner using clone_provisioner.sh (delete first if already here).yml* install helm: ID secret for TLS## Run start-login-serviceinstall_helm.sh, get_helm.sh. Do NOT run helm init (unsafe and soon obsolete).# Spin * set up dexand run provisioner: <syntaxhighlight lang="bash">> cd install## Modify dex-cm> generate_config.yml: server data and LDAP configurationsh## Modify dex-ing> kubectl apply -srvf install_storageclass.yml: service data, mapping of ports to outside worldyaml## Modify dex> kubectl apply -deployf install_service.yml: ID secret for TLSyaml## Run start> kubectl apply -dex-servicef provisioner_generated.shyaml</syntaxhighlight> After local persistent volumes on the nodes have been generated in /mnt/kubernetes, they should show up under <syntaxhighlight lang="bash">> kubectl get pv</syntaxhighlight>