Skip to content

Commit 2767728

Browse files
robert-sanfeliurobert-sanfeliu
committed
Merge remote-tracking branch 'remotes/origin/main' into r1
2 parents a3c238f + 740ec01 commit 2767728

4 files changed

Lines changed: 254 additions & 77 deletions

File tree

‎installation-scripts-onm/MASTER_START_SCRIPT.sh‎

Lines changed: 165 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ echo "NEBULOUS_SCRIPTS_BRANCH is set to: $NEBULOUS_SCRIPTS_BRANCH"
1212
if [[ "$CONTAINERIZATION_FLAVOR" == "k3s" ]]; then
1313
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
1414
echo "KUBECONFIG=${KUBECONFIG}" | sudo tee -a /etc/environment
15+
else
16+
export KUBECONFIG=/home/ubuntu/.kube/config
17+
echo "KUBECONFIG=${KUBECONFIG}" | sudo tee -a /etc/environment
1518
fi
1619

1720
while true; do
@@ -38,47 +41,184 @@ then
3841
else
3942
echo "User Ubuntu is not found"
4043
fi
41-
#$dau kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml;
42-
$dau bash -c 'helm repo add cilium https://helm.cilium.io/ && helm repo update'
43-
$dau bash -c 'helm install cilium cilium/cilium --namespace kube-system --set encryption.enabled=true --set encryption.type=wireguard'
44+
$dau bash -c 'kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml';
45+
#$dau bash -c 'helm repo add cilium https://helm.cilium.io/ && helm repo update'
46+
#$#dau bash -c 'helm install cilium cilium/cilium --namespace kube-system --set encryption.enabled=true --set encryption.type=wireguard'
4447

4548
echo "Installing Vela CLI"
4649
$dau bash -c 'curl -fsSl https://kubevela.io/script/install.sh | bash'
4750
echo "Configuration complete."
4851

52+
cat > /home/ubuntu/kubevela-values.yaml << EOF
53+
nodeSelector:
54+
"node-role.kubernetes.io/control-plane": ""
55+
tolerations:
56+
- key: "node-role.kubernetes.io/control-plane"
57+
operator: "Exists"
58+
effect: "NoSchedule"
59+
EOF
60+
61+
$dau bash -c 'helm repo add kubevela https://kubevela.github.io/chart && helm repo update'
62+
63+
cat > /home/ubuntu/patch-pin-to-control-plane.yaml << EOF
64+
apiVersion: apps/v1
65+
kind: Deployment
66+
spec:
67+
template:
68+
spec:
69+
nodeSelector:
70+
"node-role.kubernetes.io/control-plane": ""
71+
tolerations:
72+
- key: "node-role.kubernetes.io/control-plane"
73+
operator: "Exists"
74+
effect: "NoSchedule"
75+
EOF
76+
4977
echo "Setting KubeVela..."
78+
# Delete the flag file if it exists
79+
$dau bash -c 'rm -f /tmp/vela_ready.flag'
5080
# Function to check for worker nodes and install KubeVela
5181
cat > /home/ubuntu/install_kubevela.sh << 'EOF'
5282
#!/bin/bash
83+
echo "Start install_kubevela.sh"
84+
echo "-----${KUBECONFIG}---------"
85+
sudo cat ${KUBECONFIG}
86+
echo "--------------"
87+
# Retry vela install with a 10-second delay between attempts
88+
attempt=1
89+
until sudo -H -E -u ubuntu bash -c 'helm upgrade --install --create-namespace -n vela-system kubevela kubevela/vela-core --version 1.9.11 --values /home/ubuntu/kubevela-values.yaml --wait'; do
90+
echo "Vela install failed. Retrying in 10 seconds... ($attempt/)"
91+
attempt=$((attempt+1))
92+
sleep 10
93+
done
94+
echo "Vela installation done."
95+
if [ "$SERVERLESS_ENABLED" == "yes" ]; then
96+
echo "Serverless installation."
97+
98+
# Install Cosign
99+
export COSIGN_VERSION=$(curl -s https://api.github.com/repos/sigstore/cosign/releases/latest | jq -r '.tag_name')
100+
sudo curl -LO "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64"
101+
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
102+
sudo chmod +x /usr/local/bin/cosign
103+
104+
# Update system and install jq
105+
sudo apt update
106+
sudo apt install -y jq
107+
108+
# Apply Knative Serving CRDs and core components
109+
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-crds.yaml
110+
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-core.yaml
111+
kubectl patch deployment -n knative-serving activator --patch "$(cat /home/ubuntu/patch-pin-to-control-plane.yaml)"
112+
kubectl patch deployment -n knative-serving autoscaler --patch "$(cat /home/ubuntu/patch-pin-to-control-plane.yaml)"
113+
kubectl patch deployment -n knative-serving controller --patch "$(cat /home/ubuntu/patch-pin-to-control-plane.yaml)"
114+
kubectl patch deployment -n knative-serving webhook --patch "$(cat /home/ubuntu/patch-pin-to-control-plane.yaml)"
115+
116+
# Download and apply Kourier
117+
sudo wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/kourier.yaml
118+
kubectl apply -f kourier.yaml
119+
120+
sudo wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/serverless-platform-definition.yaml
121+
kubectl apply -f serverless-platform-definition.yaml
122+
123+
124+
sudo wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/knative-serving-definition.yaml
125+
kubectl apply -f knative-serving-definition.yaml
126+
127+
sudo wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/config-features.yaml
128+
kubectl apply -f config-features.yaml
129+
130+
# Patch config-domain with PUBLIC_IP
131+
MASTER_IP=$(curl -s ifconfig.me)
132+
133+
# Patch config-domain with MASTER_IP
134+
kubectl patch configmap/config-domain \
135+
--namespace knative-serving \
136+
--type merge \
137+
--patch "{\"data\":{\"${MASTER_IP}.sslip.io\":\"\"}}"
138+
139+
# Patch config-network to use Kourier ingress
140+
kubectl patch configmap/config-network \
141+
--namespace knative-serving \
142+
--type merge \
143+
--patch '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}'
144+
145+
# Apply default domain configuration
146+
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-default-domain.yaml
147+
148+
if [ -n "$LOCAL_SERVERLESS_SERVICES" ]; then
149+
echo "LOCAL_SERVERLESS_SERVICES is set to: $LOCAL_SERVERLESS_SERVICES"
150+
151+
sudo wget -q -O /usr/local/bin/label-serverless-services.sh \
152+
https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/label-serverless-services.sh
153+
154+
sudo chmod +x /usr/local/bin/label-serverless-services.sh
155+
156+
sudo touch /var/log/label-serverless-services.log
157+
sudo chown ubuntu:ubuntu /var/log/label-serverless-services.log
158+
159+
nohup /usr/local/bin/label-serverless-services.sh \
160+
>> /var/log/label-serverless-services.log 2>&1 &
161+
fi
162+
fi
163+
echo "End install_kubevela.sh"
164+
EOF
165+
166+
chmod +x /home/ubuntu/install_kubevela.sh
167+
168+
cat > /home/ubuntu/kubevela_installer_service.sh << 'EOF'
169+
#!/bin/bash
170+
171+
is_vela_installed() {
172+
if vela ls &>/dev/null; then
173+
return 0
174+
else
175+
return 1
176+
fi
177+
}
53178
54179
# Wait for at least one worker node to be ready
55180
while true; do
56181
WORKER_NODES=$(sudo -H -E -u ubuntu kubectl get nodes --selector='!node-role.kubernetes.io/control-plane' -o json | jq '.items | length')
57182
if [ "$WORKER_NODES" -gt 0 ]; then
58183
echo "$(date '+%Y-%m-%d %H:%M:%S') - Found $WORKER_NODES worker node(s), proceeding with KubeVela installation..." >> /home/ubuntu/vela.txt
59-
sudo -H -E -u ubuntu bash -c 'nohup vela install --version 1.9.11 >> /home/ubuntu/vela.txt 2>&1'
60-
# Disable the service after successful installation
61-
sudo systemctl disable kubevela-installer.service
62-
exit 0
184+
/home/ubuntu/install_kubevela.sh >> /home/ubuntu/vela.txt 2>&1
185+
if is_vela_installed; then
186+
echo "Vela installation successful" >> /home/ubuntu/vela.txt
187+
# Disable the service after successful installation
188+
echo "Disabling kubevela-installer.service" >> /home/ubuntu/vela.txt
189+
sudo systemctl disable kubevela-installer.service
190+
# Create a flag file to indicate that vela is ready. This flag will be read by the script that runs `vela up -f ...`.
191+
# This is is needed to avoid the vela up command to fail if the vela installation has not completed yet.
192+
echo "touching /tmp/vela_ready.flag" >> /home/ubuntu/vela.txt
193+
touch /tmp/vela_ready.flag
194+
exit 0
195+
else
196+
echo "'vela ls' returned an error. Trying again in 30 seconds..." >> /home/ubuntu/vela.txt
197+
sleep 30
198+
fi
63199
fi
64200
echo "$(date '+%Y-%m-%d %H:%M:%S') - Waiting for worker nodes to be ready..." >> /home/ubuntu/vela.txt
65201
sleep 10
66202
done
67203
EOF
68-
69-
chmod +x /home/ubuntu/install_kubevela.sh
204+
chmod +x /home/ubuntu/kubevela_installer_service.sh
70205

71206
# Create systemd service file
72-
cat << 'EOF' | sudo tee /etc/systemd/system/kubevela-installer.service
207+
cat << EOF | sudo tee /etc/systemd/system/kubevela-installer.service
73208
[Unit]
74209
Description=KubeVela One-time Installer Service
75210
After=network.target
76211
77212
[Service]
78213
Type=simple
79214
User=ubuntu
80-
ExecStart=/home/ubuntu/install_kubevela.sh
215+
ExecStart=/home/ubuntu/kubevela_installer_service.sh
81216
Restart=no
217+
Environment="LOCAL_SERVERLESS_SERVICES=${LOCAL_SERVERLESS_SERVICES}"
218+
Environment="SERVERLESS_ENABLED=${SERVERLESS_ENABLED}"
219+
Environment="APPLICATION_ID=${APPLICATION_ID}"
220+
Environment="NEBULOUS_SCRIPTS_BRANCH=${NEBULOUS_SCRIPTS_BRANCH}"
221+
Environment="KUBECONFIG=${KUBECONFIG}"
82222
83223
[Install]
84224
WantedBy=multi-user.target
@@ -106,8 +246,8 @@ $dau bash -c 'helm install ems nebulous/ems-server \
106246
--set tolerations[0].effect="NoSchedule" \
107247
--set app_uuid=$APPLICATION_ID \
108248
--set broker_address=$BROKER_ADDRESS \
109-
--set image.tag="r1" \
110-
--set client.image.tag="ems-client-r1" \
249+
--set image.tag=$NEBULOUS_SCRIPTS_BRANCH \
250+
--set client.image.tag="ems-client-$NEBULOUS_SCRIPTS_BRANCH" \
111251
--set broker_port=$BROKER_PORT'
112252

113253

@@ -127,68 +267,6 @@ $dau bash -c 'helm install solver nebulous/nebulous-optimiser-solver \
127267
echo "Add volumes provisioner"
128268
$dau bash -c "kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.27/deploy/local-path-storage.yaml"
129269

130-
if [ "$SERVERLESS_ENABLED" == "yes" ]; then
131-
echo "Serverless installation."
132-
133-
# Install Cosign
134-
export COSIGN_VERSION=$(curl -s https://api.github.com/repos/sigstore/cosign/releases/latest | jq -r '.tag_name')
135-
curl -LO "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64"
136-
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
137-
sudo chmod +x /usr/local/bin/cosign
138-
139-
# Update system and install jq
140-
sudo apt update
141-
sudo apt install -y jq
142-
143-
# Apply Knative Serving CRDs and core components
144-
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-crds.yaml
145-
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-core.yaml
146-
147-
# Download and apply Kourier
148-
wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/kourier.yaml
149-
kubectl apply -f kourier.yaml
150-
151-
wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/serverless-platform-definition.yaml
152-
kubectl apply -f serverless-platform-definition.yaml
153-
154-
wget https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/config-features.yaml
155-
kubectl apply -f config-features.yaml
156-
157-
# Patch config-domain with PUBLIC_IP
158-
MASTER_IP=$(curl -s ifconfig.me)
159-
160-
# Patch config-domain with MASTER_IP
161-
kubectl patch configmap/config-domain \
162-
--namespace knative-serving \
163-
--type merge \
164-
--patch "{\"data\":{\"${MASTER_IP}.sslip.io\":\"\"}}"
165-
166-
# Patch config-network to use Kourier ingress
167-
kubectl patch configmap/config-network \
168-
--namespace knative-serving \
169-
--type merge \
170-
--patch '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}'
171-
172-
# Apply default domain configuration
173-
kubectl apply -f https://github.com/knative/serving/releases/download/knative-v1.12.4/serving-default-domain.yaml
174-
175-
kubectl apply -f https://raw.githubusercontent.com/kubevela/samples/master/06.Knative_App/componentdefinition-knative-serving.yaml
176-
177-
if [ -n "$LOCAL_SERVERLESS_SERVICES" ]; then
178-
echo "LOCAL_SERVERLESS_SERVICES is set to: $LOCAL_SERVERLESS_SERVICES"
179-
180-
sudo wget -q -O /usr/local/bin/label-serverless-services.sh \
181-
https://raw.githubusercontent.com/eu-nebulous/sal-scripts/$NEBULOUS_SCRIPTS_BRANCH/serverless/label-serverless-services.sh
182-
183-
sudo chmod +x /usr/local/bin/label-serverless-services.sh
184-
185-
sudo touch /var/log/label-serverless-services.log
186-
sudo chown ubuntu:ubuntu /var/log/label-serverless-services.log
187-
188-
nohup /usr/local/bin/label-serverless-services.sh \
189-
>> /var/log/label-serverless-services.log 2>&1 &
190-
fi
191-
fi
192270

193271
if [ "$WORKFLOW_ENABLED" == "yes" ]; then
194272
echo "Workflow installation.";
@@ -201,3 +279,15 @@ if [ "$WORKFLOW_ENABLED" == "yes" ]; then
201279
echo "Workflow installation completed.";
202280
fi
203281

282+
echo "Installing OPA Gatekeeper..."
283+
wget https://raw.githubusercontent.com/eu-nebulous/security-manager/dev/OPA-GATEKEEPER-INSTALL.sh
284+
chmod +x OPA-GATEKEEPER-INSTALL.sh
285+
./OPA-GATEKEEPER-INSTALL.sh
286+
287+
echo "Installing Security Manager..."
288+
$dau bash -c 'helm install security-manager nebulous/nebulous-security-manager \
289+
--set-file configMap.k3sConfig="$KUBECONFIG" \
290+
--set tolerations[0].key="node-role.kubernetes.io/control-plane" \
291+
--set tolerations[0].operator="Exists" \
292+
--set tolerations[0].effect="NoSchedule"'
293+

‎serverless/config-features.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,13 @@ data:
5050
#
5151
# WARNING: Cannot safely be disabled once enabled.
5252
# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector
53-
kubernetes.podspec-nodeselector: "disabled"
53+
kubernetes.podspec-nodeselector: "enabled"
5454

5555
# Indicates whether Kubernetes tolerations support is enabled
5656
#
5757
# WARNING: Cannot safely be disabled once enabled
5858
# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration
59-
kubernetes.podspec-tolerations: "disabled"
59+
kubernetes.podspec-tolerations: "enabled"
6060

6161
# Indicates whether Kubernetes FieldRef support is enabled
6262
#

‎serverless/knative-serving-definition.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
apiVersion: core.oam.dev/v1beta1
2+
kind: ComponentDefinition
3+
metadata:
4+
name: knative-serving
5+
annotations:
6+
definition.oam.dev/description: "Knative serving."
7+
spec:
8+
workload:
9+
definition:
10+
apiVersion: serving.knative.dev/v1
11+
kind: Service
12+
schematic:
13+
cue:
14+
template: |
15+
output: {
16+
apiVersion: "serving.knative.dev/v1"
17+
kind: "Service"
18+
metadata: {
19+
name: context.name
20+
labels: {
21+
"app.oam.dev/component": context.name
22+
}
23+
}
24+
spec: {
25+
template:
26+
spec:
27+
containers: [{
28+
name: context.name
29+
30+
image: parameter.image
31+
32+
if parameter.imagePullPolicy != _|_ {
33+
imagePullPolicy: parameter.imagePullPolicy
34+
}
35+
36+
if parameter.env != _|_ {
37+
env: parameter.env
38+
}
39+
40+
if parameter.resources != _|_ {
41+
resources: parameter.resources
42+
}
43+
}]
44+
}
45+
}
46+
parameter: {
47+
image: string
48+
imagePullPolicy?: string
49+
env?: [...{
50+
// +usage=Environment variable name
51+
name: string
52+
// +usage=The value of the environment variable
53+
value?: string
54+
// +usage=Specifies a source the value of this var should come from
55+
valueFrom?: {
56+
// +usage=Selects a key of a secret in the pod's namespace
57+
secretKeyRef: {
58+
// +usage=The name of the secret in the pod's namespace to select from
59+
name: string
60+
// +usage=The key of the secret to select from. Must be a valid secret key
61+
key: string
62+
}
63+
}
64+
}]
65+
resources?: {
66+
limits?: {
67+
cpu?: string
68+
memory?: string
69+
}
70+
requests?: {
71+
cpu?: string
72+
memory?: string
73+
}
74+
}
75+
}

0 commit comments

Comments
 (0)