Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Other] Setup test SCS cluster at Cloud&Heat with Yaook on virtual machines #414

Closed
anjastrunk opened this issue Dec 19, 2023 · 7 comments
Closed

[Other] Setup test SCS cluster at Cloud&Heat with Yaook on virtual machines #414

anjastrunk opened this issue Dec 19, 2023 · 7 comments
Assignees
@cah-hbaum
Labels
SCS-VP10 Related to tender lot SCS-VP10

Comments

@anjastrunk
Copy link
Contributor

anjastrunk commented Dec 19, 2023 •
edited
Loading

Provide an SCS cluster for testing purposes as well as a playground to evaluate costs to make existing Openstack and K8S clusters SCS compliant. The test cluster MUST be set up with the open source Lifecycle Management Tool for OpenStack and K8S Yaook to be not SCS compliant.

SCS test cluster is set up on virtual machines.
@anjastrunk anjastrunk added the SCS-VP10 Related to tender lot SCS-VP10 label Dec 19, 2023
@cah-hbaum
Copy link
Contributor

The Openstack cluster is already set up, we now need to check what exactly is necessary to make it compliant.
A good starting point would be to check the standards and tests already available in SCS.

@anjastrunk anjastrunk mentioned this issue Dec 19, 2023
Open
21 tasks
cah-hbaum added a commit that referenced this issue Jan 4, 2024
@cah-hbaum
Baseline cluster security (#414)
f15544f 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 4, 2024
@cah-hbaum
K8s cluster robustness features (#414)
67a1d8e 
This commit adds the standard for K8s robustness features, including Kube-API rate limiting, ETCD compaction as well as CA expiration avoidance.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 4, 2024
@cah-hbaum
Baseline cluster security (#414)
349f9ed 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 8, 2024
@cah-hbaum
fixup! Baseline cluster security (#414)
5610fe1 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 11, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
84fcef3 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 11, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
f846ba3 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 11, 2024
@cah-hbaum
Baseline cluster security (#414)
816bea6 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 11, 2024
@cah-hbaum
fixup! Baseline cluster security (#414)
1764487 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 12, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
e2469bb 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 12, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
3eb4898 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 15, 2024
@cah-hbaum
fixup! Baseline cluster security (#414)
a384624 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 17, 2024
@cah-hbaum
fixup! Baseline cluster security (#414)
db0487e 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 17, 2024
@cah-hbaum
fixup! Baseline cluster security (#414)
c9575ee 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 18, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
b9aa12d 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Jan 18, 2024
@cah-hbaum
fixup! K8s cluster robustness features (#414)
b9b4c9a 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
K8s cluster robustness features (#414)
2dcd745 
This commit adds the standard for K8s robustness features, including Kube-API rate limiting, ETCD compaction as well as CA expiration avoidance.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
5d22efb 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
021e0ea 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
a730e40 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
291582d 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
9aa1368 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
jschoone pushed a commit that referenced this issue Feb 1, 2024
@cah-hbaum @jschoone
fixup! K8s cluster robustness features (#414)
863ac32 
Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Feb 12, 2024
@cah-hbaum
Baseline cluster security (#414)
1662eab 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Feb 13, 2024
@cah-hbaum
Baseline cluster security (#414)
6870bf0 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Feb 14, 2024
@cah-hbaum
Baseline cluster security (#414)
29ca23d 
Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
cah-hbaum added a commit that referenced this issue Feb 14, 2024
@cah-hbaum @garloff
[Standardization] Baseline K8s cluster security (#415) (#376)
4c05b90 
* Kubernetes High Security setup (#415)

This commit adds a standard for high security setups, which should increase the overall of a Kubernetes cluster.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>

* Grammar / spelling fixes.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Fix small mistakes

Added some notes for the ports and shortened the motivation.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>

* Baseline cluster security (#414)

Renamed the file to better match its actual intention.

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>

---------

Signed-off-by: Hannes Baum <hannes.baum@cloudandheat.com>
Signed-off-by: Kurt Garloff <kurt@garloff.de>
Co-authored-by: Kurt Garloff <kurt@garloff.de>
@martinmo martinmo self-assigned this Feb 22, 2024
@cah-hbaum
Copy link
Contributor

cah-hbaum commented Mar 6, 2024 •
edited
Loading

We already setup a Yaook cluster on f1a, but its dormant for ~1,5 months now, since we're having problems with the network. To explain this a bit, it seems like a second network is needed to connect the virtual cluster to the provider network of f1a. This is required to setup an own internal provider network. I already talked with @horazont about this, but I personally had no idea that a second network was needed, so it wasn't created during my initial setup.

I already setup the new network, but it still needs to be integrated correctly.

The next step therefore would be to adapt this network to have a provider network in this Yaook test cluster.

Also sorry for the incosistent updates on this, I had quite a few things to do in the meantime...

@cah-hbaum
Copy link
Contributor

Had some help from @markus-hentsch with the networking part and I'm working on it again now.

@cah-hbaum
Copy link
Contributor

Progress report:
Neutron had some problems receiving certificates from the underlying cert_manager, probably due to version differences between the components of OpenStack. That was my fault, since I didn't pin the versions correctly.
I'm now trying to pin the Neutron version and after that every other version in order to get a consistent OpenStack.

I will see how the deployment is running after this.

@cah-hbaum
Copy link
Contributor

Deployment didn't come back up in a correct state, so I'm resetting the underlying K8s cluster right now in order to get the state of the Openstack cluster back.

@cah-hbaum
Copy link
Contributor

Thanks to @markus-hentsch and another colleague, I was able to setup a Yaook OpenStack cluster which is able to be pinged from outside over the internal provider network.
I'm now going over to write a script in order to setup all necessary resources to make the cluster SCS-compliant.

@cah-hbaum
Copy link
Contributor

If someone needs access to the cluster, just reach out to me (Matrix or mail) and I arrange something.

Closing for now, future work will be done in the follow up issues.

@markus-hentsch markus-hentsch mentioned this issue Mar 20, 2024
Merged
@anjastrunk anjastrunk mentioned this issue Apr 2, 2024
Closed
@anjastrunk anjastrunk changed the title [Other] Setup SCS test cluster at Cloud&Heat with Yaook [Other] Setup SCS cluster at Cloud&Heat with Yaook for testing purpose Apr 2, 2024
@anjastrunk anjastrunk changed the title [Other] Setup SCS cluster at Cloud&Heat with Yaook for testing purpose [Other] Setup test SCS cluster at Cloud&Heat with Yaook Apr 2, 2024
@anjastrunk anjastrunk changed the title [Other] Setup test SCS cluster at Cloud&Heat with Yaook [Other] Setup test SCS cluster at Cloud&Heat with Yaook on virtual machines Apr 2, 2024
@anjastrunk anjastrunk mentioned this issue Jun 3, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cah-hbaum cah-hbaum

Labels
SCS-VP10 Related to tender lot SCS-VP10
Projects
Sovereign Cloud Stack
Status: Done
Milestone
No milestone
Development

No branches or pull requests
3 participants
@martinmo @cah-hbaum @anjastrunk