diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..85e7c1d --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/.idea/ diff --git a/Initial_Setup/README.md b/Initial_Setup/README.md new file mode 100644 index 0000000..54b3af2 --- /dev/null +++ b/Initial_Setup/README.md @@ -0,0 +1,8 @@ + +# Pi4 + +For debian [Pi4 images](https://raspi.debian.net/tested-images/): + +- Use a keyboard and a screen to log in into `root` (password is empty) and set whatever. +- install `python3, python3-apt`. +- `ln -s /usr/bin/python3 /usr/bin/python` diff --git a/armbian_initial_setup.yaml b/Initial_Setup/armbian_initial_setup.yaml similarity index 60% rename from armbian_initial_setup.yaml rename to Initial_Setup/armbian_initial_setup.yaml index 86e12c9..ffcad36 100644 --- a/armbian_initial_setup.yaml +++ b/Initial_Setup/armbian_initial_setup.yaml @@ -4,6 +4,7 @@ - name: Pre Setup hosts: all gather_facts: false + become: true vars: # Connect @@ -13,8 +14,8 @@ # New values ## Users - new_user_name: "orangepi" - new_user_pass: "orangepi" + new_user_name: "kuser" + new_user_pass: "kuser1234" new_root_pass: "1234" ## Locales @@ -24,9 +25,29 @@ # SSH with ROOT tasks: + # Install sudo and locale thingies + - name: apt update + ansible.builtin.apt: + update_cache: yes + + - name: apt upgrade + ansible.builtin.apt: + name: "*" + state: latest + + - name: Install sudo + ansible.builtin.apt: + pkg: + - sudo + - locales + - locales-all + + - name: update facts + setup: # Set locale # https://serverfault.com/a/981742 + # https://andreas.scherbaum.la/blog/archives/941-Configuring-locales-in-Debian-and-Ubuntu,-using-Ansible-Reloaded.html - name: Ensure localisation files for '{{ new_locale }}' are available locale_gen: name: "{{ new_locale }}" @@ -42,19 +63,18 @@ register: locale_status changed_when: false - - name: Parse 'LANG' from current locale and language configuration - set_fact: - locale_lang: "{{ locale_status.stdout | regex_search('LANG=([^\n]+)', '\\1') | first }}" +# - name: Parse 'LANG' from current locale and language configuration +# set_fact: +# locale_lang: "{{ locale_status.stdout | regex_search('LANG=([^\n]+)', '\\1') | first }}" - - name: Parse 'LANGUAGE' from current locale and language configuration - set_fact: - locale_language: "{{ locale_status.stdout | regex_search('LANGUAGE=([^\n]+)', '\\1') | default([locale_lang], true) | first }}" +# - name: Parse 'LANGUAGE' from current locale and language configuration +# set_fact: +# locale_language: "{{ locale_status.stdout | regex_search('LANGUAGE=([^\n]+)', '\\1') | default([locale_lang], true) | first }}" - name: Configure locale to '{{ new_locale }}' and language to '{{ new_language }}' command: localectl set-locale LANG={{ new_locale }} LANGUAGE={{ new_language }} - changed_when: locale_lang != new_locale or locale_language != new_language - become: yes # no idea if it's needed nor I care about - +# changed_when: locale_lang != new_locale or locale_language != new_language +# become: yes # no idea if it's needed nor I care about # Wheel group with sudo access # https://stackoverflow.com/a/33362805 @@ -62,7 +82,7 @@ group: name: wheel state: present - become: true +# become: true - name: Allow 'wheel' group to have passwordless sudo ansible.builtin.lineinfile: @@ -71,24 +91,24 @@ regexp: '^%wheel' line: '%wheel ALL=(ALL) PASSWD: ALL' validate: visudo -cf %s - become: true +# become: true -# Create orangepi user (will bother about it later) move to -> kuser (kluster user) +# Create `orangepi` (or whatever user u want to create) user (will bother about it later) # maybe move to -> kuser (kluster user)? - name: Add user new_user_name ansible.builtin.user: name: "{{ new_user_name }}" password: "{{ new_user_pass | password_hash }}" shell: /bin/bash - become: true +# become: true - name: adding user '{{ new_user_name }}' to group wheel - user: + ansible.builtin.user: name: '{{ new_user_name }}' groups: sudo append: yes - become: true +# become: true # Set root password to whatever shit @@ -97,7 +117,7 @@ ansible.builtin.user: name: root password: "{{ new_root_pass | password_hash }}" - become: yes +# become: yes # Disable SSH with ROOT @@ -107,10 +127,11 @@ regexp: '^PermitRootLogin' line: PermitRootLogin = no backrefs: yes - become: yes +# become: yes # REBOOT - name: reboot - ansible.builtin.shell: 'sleep 1 && dhclient -r && dhclient && reboot' + ansible.builtin.reboot: +# ansible.builtin.shell: 'sleep 1 && dhclient -r && dhclient && reboot' ignore_unreachable: true - become: yes +# become: yes diff --git a/inventory.yaml b/inventory.yaml index 8f6b8f1..f5981d1 100644 --- a/inventory.yaml +++ b/inventory.yaml @@ -1,10 +1,11 @@ masters: hosts: - masterk.filter.home: + pi4.filter.home: +# masterk.filter.home: vars: is_master: yes -slaves: - hosts: - slave[01:01].filter.home: - vars: - is_master: no +#slaves: +# hosts: +# slave[01:01].filter.home: +# vars: +# is_master: no diff --git a/ksetup/K/testD/Deployment.yaml b/ksetup/K/testD/Deployment.yaml new file mode 100755 index 0000000..233fd2c --- /dev/null +++ b/ksetup/K/testD/Deployment.yaml @@ -0,0 +1,25 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: helloworld-nginx + labels: + app: helloworld +spec: + replicas: 1 + selector: + matchLabels: + app: helloworld + template: + metadata: + labels: + app: helloworld + spec: + containers: + - name: helloworld + image: nginx + resources: + requests: + cpu: "100m" + imagePullPolicy: IfNotPresent #Always + ports: + - containerPort: 80 diff --git a/ksetup/K/testD/Gateway.yaml b/ksetup/K/testD/Gateway.yaml new file mode 100644 index 0000000..8e13616 --- /dev/null +++ b/ksetup/K/testD/Gateway.yaml @@ -0,0 +1,14 @@ +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: helloworld-gateway +spec: + selector: + istio: public-ingress + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" diff --git a/ksetup/K/testD/README.md b/ksetup/K/testD/README.md new file mode 100755 index 0000000..0641ada --- /dev/null +++ b/ksetup/K/testD/README.md @@ -0,0 +1,236 @@ +--- +gitea: none +include_toc: true +--- + + +# Description + +This is the most basic example, most of the examples spread through this [repository](../../) will be using variants of this. + +This example configures: + + Generic Kubernetes resources: + - 1 Service + - 1 Deployment + + Istio resources: + - 1 Gateway + - 1 Virtual Service + +> **Note:**\ +> I don't intend to explain thing related to Kubernetes unless necessary. + +# Configuration + +## Service + +Creates a service named `helloworld`. + +This service listens for the port `80` expecting `HTTP` traffic and will forward the incoming traffic towards the port `80` from the destination pod. + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: helloworld + labels: + app: helloworld + service: helloworld +spec: + ports: + - port: 80 + name: http + selector: + app: helloworld +``` + +## Deployment + +Deploys a Nginx server that listens for the port `80`. + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: helloworld-nginx + labels: + app: helloworld +spec: + replicas: 1 + selector: + matchLabels: + app: helloworld + template: + metadata: + labels: + app: helloworld + spec: + containers: + - name: helloworld + image: nginx + resources: + requests: + cpu: "100m" + imagePullPolicy: IfNotPresent #Always + ports: + - containerPort: 80 +``` + +## Gateway + +Deploys an Istio gateway that's listening to the port `80` for `HTTP` traffic. + +It doesn't filter for any specific host. + +The `selector` field is used to "choose" which Istio Load Balancers will have this gateway assigned to. + +The Istio `default` profile creates a Load Balancer in the namespace `istio-system` that has the label `istio: ingressgateway` set, allowing us to target that specific Load Balancer and assign this gateway resource to it. + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: Gateway +metadata: + name: helloworld-gateway +spec: + selector: + istio: ingressgateway + servers: + - port: + number: 80 + name: http + protocol: HTTP + hosts: + - "*" +``` + +## VirtualService + +The Virtual Service resources are used to route and filter the received traffic from the gateway resources, and route it towards the desired destination. + +On this example we select the gateway `helloworld-gateway`, which is the [gateway that 's described in the `Gateway` section](#gateway). + +On this resource, we are also not limiting the incoming traffic to any specific host, allowing for all the incoming traffic to go through the rules set. + +Here we created a rule that will be applied on `HTTP` related traffic (including `HTTPS` and `HTTP2`) when the destination path is exactly `/helloworld`. + +This traffic will be forwarded to the port `80` of the destination service `helloworld` (the full path URL equivalent would be `helloworld.$NAMESPACE.svc.cluster.local`). + +Additionally, there will be an internal URL rewrite set, as if the URL is not modified, it would attempt to reach to the `/helloworld` path from the Nginx deployment, which currently has no content and would result in an error code `404` (Not found). + +```yaml +apiVersion: networking.istio.io/v1alpha3 +kind: VirtualService +metadata: + name: helloworld-vs +spec: + hosts: + - "*" + gateways: + - helloworld-gateway + http: + - match: + - uri: + exact: /helloworld + route: + - destination: + host: helloworld + port: + number: 80 + rewrite: + uri: "/" +``` + +# Walkthrough + +## Deploy resources + +Deploy the resources. + +```shell +kubectl apply -f ./ +``` +```text +deployment.apps/helloworld-nginx created +gateway.networking.istio.io/helloworld-gateway created +service/helloworld created +virtualservice.networking.istio.io/helloworld-vs created +``` + +## Wait for the deployment to be ready + +Wait for the Nginx deployment to be up and ready. + +```shell +kubectl get deployment helloworld-nginx -w +``` +```text +NAME READY UP-TO-DATE AVAILABLE AGE +helloworld-nginx 1/1 1 1 44s +``` + +## Test the service + +### Get LB IP + +To perform the desired tests, we will need to obtain the IP Istio Load Balancer that we selected in the [Gateway section](#gateway). + +On my environment, the IP is the `192.168.1.50`. + +```shell +kubectl get svc -l istio=ingressgateway -A +``` +```text +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +istio-ingressgateway LoadBalancer 10.97.47.216 192.168.1.50 15021:31316/TCP,80:32012/TCP,443:32486/TCP 39h +``` + +### Curl /helloworld + +Due to accessing the path `/helloworld`, we are triggering the rule set on the [VirtualService configuration](#virtualservice), sending a request to the Nginx backend and returning us its contents. + +```shell +curl 192.168.1.50/helloworld -s | grep "