Skip to content

Commit 76b6012

Browse files
jiridanekjiridanek
committed
pt1
1 parent 934024a commit 76b6012

File tree

1 file changed

+164
-0
lines changed

1 file changed

+164
-0
lines changed

‎.github/actions/provision-k8s/action.yml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: 'Provision K8s Cluster'
2+
description: 'Installs cri-o and provisions a single-node Kubernetes cluster using kubeadm'
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: Install cri-o
7+
id: install-crio
8+
shell: bash
9+
run: |
10+
set -Eeuxo pipefail
11+
12+
# the Microsoft repo's kubelet does not provide /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
13+
# [Service]
14+
# EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
15+
# ExecStart=/usr/bin/kubelet $KUBELET_KUBEADM_ARGS
16+
sudo ls /etc/apt/sources.list.d/
17+
sudo rm /etc/apt/sources.list.d/microsoft-prod.list
18+
19+
sudo apt-get update
20+
sudo apt-get install -y software-properties-common curl
21+
22+
# https://github.com/cri-o/packaging?tab=readme-ov-file#distributions-using-deb-packages
23+
24+
curl -fsSL https://pkgs.k8s.io/core:/stable:/v${KUBERNETES_VERSION}/deb/Release.key | \
25+
sudo gpg --dearmor --batch --yes -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
26+
27+
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${KUBERNETES_VERSION}/deb/ /" | \
28+
sudo tee /etc/apt/sources.list.d/kubernetes.list
29+
30+
curl -fsSL https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v${CRIO_VERSION}/deb/Release.key | \
31+
sudo gpg --dearmor --batch --yes -o /etc/apt/keyrings/cri-o-apt-keyring.gpg
32+
33+
echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v${CRIO_VERSION}/deb/ /" | \
34+
sudo tee /etc/apt/sources.list.d/cri-o.list
35+
36+
sudo apt-get update
37+
38+
# [ERROR FileExisting-conntrack]: conntrack not found in system path
39+
# see man apt-patterns for the ~name=version* syntax
40+
41+
# The following packages will be DOWNGRADED:
42+
# kubectl
43+
# E: Packages were downgraded and -y was used without --allow-downgrades.
44+
45+
sudo apt-get install -y --allow-downgrades \
46+
"cri-o=${CRIO_VERSION}.*" \
47+
"kubelet=${KUBERNETES_VERSION}.*" "kubeadm=${KUBERNETES_VERSION}.*" "kubectl=${KUBERNETES_VERSION}.*" \
48+
conntrack
49+
50+
# make use of /etc/cni/net.d/11-crio-ipv4-bridge.conflist so we don't
51+
# need a pod network and just use the default bridge
52+
sudo rm -rf /etc/cni/net.d/*
53+
# cat /etc/cni/net.d/11-crio-ipv4-bridge.conflist
54+
# https://github.com/containerd/containerd/blob/main/script%2Fsetup%2Finstall-cni
55+
# https://www.cni.dev/plugins/current/main/bridge/
56+
sudo cp ${{ github.action_path }}/../../../ci/cached-builds/11-crio-ipv4-bridge.conflist /etc/cni/net.d/11-crio-ipv4-bridge.conflist
57+
58+
sudo cp ${{ github.action_path }}/../../../ci/cached-builds/crio.conf /etc/crio/crio.conf.d/
59+
60+
sudo systemctl daemon-reload
61+
sudo systemctl start crio.service
62+
env:
63+
# TODO(jdanek): install also "cri-tools=${CRIO_VERSION}.*" when updating to 1.33
64+
CRIO_VERSION: 1.32
65+
# This has to be kept in sync with the packages above, otherwise
66+
# [ERROR KubeletVersion]: the kubelet version is higher than the control plane version.
67+
# This is not a supported version skew and may lead to a malfunctional cluster.
68+
# Kubelet version: "1.33.0" Control plane version: "1.30.12"
69+
KUBERNETES_VERSION: 1.33
70+
# Also update version in kubeadm.yaml
71+
72+
- run: sudo crictl info
73+
shell: bash
74+
75+
- name: Show crio debug data (on failure)
76+
if: ${{ failure() }}
77+
shell: bash
78+
run: |
79+
set -Eeuxo pipefail
80+
81+
sudo systemctl status crio.service || true
82+
sudo journalctl -xeu crio.service
83+
84+
# do this early, it's a good check that cri-o is not completely broken
85+
- name: "Show crio images information"
86+
shell: bash
87+
run: sudo crictl images
88+
89+
- name: Install Kubernetes cluster
90+
shell: bash
91+
run: |
92+
set -Eeuxo pipefail
93+
94+
sudo swapoff -a
95+
sudo modprobe br_netfilter
96+
sudo sysctl -w net.ipv4.ip_forward=1
97+
98+
# Was getting strange DNS resolution errors from pods that don't seem to want to go away sometimes:
99+
# Resolving raw.githubusercontent.com (raw.githubusercontent.com)... failed: Name or service not known.
100+
# wget: unable to resolve host address ‘raw.githubusercontent.com’
101+
# Here's what helped:
102+
# https://kubernetes.io/docs/tasks/administer-cluster/dns-debugging-resolution/#known-issues
103+
# https://github.com/kubernetes/kubernetes/blob/e4c1f980b76fecece30c2f77885a7117192170a6/CHANGELOG/CHANGELOG-1.30.md?plain=1#L1454
104+
# https://github.com/canonical/microk8s/issues/68#issuecomment-404923563
105+
sudo ufw allow in on cni0
106+
sudo ufw allow out on cni0
107+
sudo ufw default allow routed
108+
sudo iptables -P FORWARD ACCEPT
109+
sudo iptables -t nat -A POSTROUTING -s 10.85.0.0/16 -o eth0 -j MASQUERADE
110+
111+
sudo kubeadm reset -f --cri-socket=unix:///var/run/crio/crio.sock
112+
113+
# https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm
114+
sudo kubeadm init --config=${{ github.action_path }}/../../../ci/cached-builds/kubeadm.yaml
115+
116+
mkdir -p $HOME/.kube
117+
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
118+
sudo chown $(id -u):$(id -g) $HOME/.kube/config
119+
120+
- name: Show kubelet debug data (on failure)
121+
if: ${{ failure() }}
122+
shell: bash
123+
run: |
124+
set -Eeuxo pipefail
125+
126+
# [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
127+
sudo cat /var/lib/kubelet/kubeadm-flags.env || true
128+
# [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
129+
sudo cat /var/lib/kubelet/config.yaml || true
130+
131+
sudo systemctl cat kubelet.service || true
132+
133+
sudo cat /etc/systemd/system/kubelet.service.d/10-kubeadm.conf || true
134+
135+
sudo systemctl status kubelet || true
136+
sudo journalctl -xeu kubelet
137+
138+
# Here is one example how you may list all running Kubernetes containers by using crictl:
139+
sudo crictl --runtime-endpoint unix:///var/run/crio/crio.sock ps -a | grep kube | grep -v pause
140+
# Once you have found the failing container, you can inspect its logs with:
141+
# crictl --runtime-endpoint unix:///var/run/crio/crio.sock logs CONTAINERID
142+
143+
- name: Show nodes status and wait for readiness
144+
shell: bash
145+
run: |
146+
kubectl describe nodes
147+
kubectl wait --for=condition=Ready nodes --all --timeout=100s || (kubectl describe nodes && false)
148+
149+
- name: Wait for pods to be running
150+
shell: bash
151+
run: |
152+
set -Eeuxo pipefail
153+
kubectl wait deployments --all --all-namespaces --for=condition=Available --timeout=100s
154+
kubectl wait pods --all --all-namespaces --for=condition=Ready --timeout=100s
155+
156+
- name: "Install local-path provisioner"
157+
shell: bash
158+
run: |
159+
set -Eeuxo pipefail
160+
kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.31/deploy/local-path-storage.yaml
161+
kubectl wait deployments --all --namespace=local-path-storage --for=condition=Available --timeout=100s || (kubectl describe deployments --namespace=local-path-storage && false)
162+
# https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/
163+
kubectl get storageclass
164+
kubectl patch storageclass local-path -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

0 commit comments

Comments
 (0)