forked from rook/rook
Blaine Gardner
0c721e05d5
Add the ability to specify node profiles in the multus validation test. This addresses a few points of early feedback on the validation tool. Statements below critique the tool's behavior before this patch. 1. The tool assumes all daemons are on public and cluster network, which means users who have a significantly smaller cluster net (a design choice) cannot run a single test to determine if Rook is likely to install correctly. 2. The tool does not have placement options to select only a subset of Kubernetes nodes to run validation on. 3. Users of multus seem to have a dedicated pool of storage nodes more often than the average Rook install. This makes sense for security- and perforance-minded users. The tool cannot run a single test to verify storage-only and general-workload nodes at one time. These points are addressed by allowing users to specify configurations for different "NodeTypes." Each NodeType config has options for selecting the number of OSDs as well as the number of other (non-OSD) Ceph daemons. This limits the unnecessary exhaustion of cluster network addresses from critique 1. Each NodeType config has its own placement (critique 2). Users can define as many NodeTypes as needed to test the network for their planned CephCluster. Specifically, this allows the tool to test storage-only nodes and generalized-workload nodes at the same time. An arbitrary number of NodeTypes are allowed to support even more highly specialized cluster setups, such as multiple tiers of storage nodes where some storage-only nodes may run more OSDs than others. Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
79 lines
3.0 KiB
YAML
79 lines
3.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: multus-validation-test-client-{{ .NodeType }}-{{ .ClientType }}-{{ .ClientID }}
|
|
labels:
|
|
app: multus-validation-test-client
|
|
nodeType: "{{ .NodeType }}"
|
|
clientType: "{{ .ClientType }}"
|
|
clientID: "{{ .ClientID }}"
|
|
app.kubernetes.io/name: "client"
|
|
app.kubernetes.io/instance: "client-{{ .NodeType }}-{{ .ClientType }}-{{ .ClientID }}"
|
|
app.kubernetes.io/component: "client"
|
|
app.kubernetes.io/part-of: "multus-validation-test"
|
|
app.kubernetes.io/managed-by: "rook-cli"
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: multus-validation-test-client
|
|
nodeType: "{{ .NodeType }}"
|
|
clientType: "{{ .ClientType }}"
|
|
clientID: "{{ .ClientID }}"
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: multus-validation-test-client
|
|
nodeType: "{{ .NodeType }}"
|
|
clientType: "{{ .ClientType }}"
|
|
clientID: "{{ .ClientID }}"
|
|
annotations:
|
|
k8s.v1.cni.cncf.io/networks: "{{ .NetworksAnnotationValue }}"
|
|
spec:
|
|
nodeSelector:
|
|
{{- range $k, $v := .Placement.NodeSelector }}
|
|
{{ $k }}: {{ $v }}
|
|
{{- end }}
|
|
tolerations:
|
|
{{- range $idx, $toleration := .Placement.Tolerations }}
|
|
- {{ $toleration.ToJSON }}
|
|
{{- end }}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
{{ $NginxImage := .NginxImage }} # base context not available in range below
|
|
{{ range $name, $address := .NetworkNamesAndAddresses }}
|
|
- name: readiness-check-web-server-{{ $name }}-addr
|
|
# use nginx image because it's already used for the web server pod and has a non-root user
|
|
image: "{{ $NginxImage }}"
|
|
command:
|
|
- sleep
|
|
- infinity
|
|
resources: {}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- "ALL"
|
|
# A readiness probe makes validation testing easier than investigate container logs.
|
|
# Additionally, readiness probe failures don't result in CrashLoopBackoff -- ideal here,
|
|
# where ever-longer back-offs would cause tests to run for much longer than necessary.
|
|
readinessProbe:
|
|
# Low failure threshold and high success threshold. Intended to be very sensitive to
|
|
# failures. If probe fails with any regularity, Ceph OSDs likely won't be stable.
|
|
failureThreshold: 1
|
|
successThreshold: 12
|
|
periodSeconds: 5
|
|
# Assumption: a network with a latency more than 4 seconds for this validation test's
|
|
# simple client-server response likely won't support acceptable performance for any
|
|
# production Ceph cluster.
|
|
timeoutSeconds: 4
|
|
# TODO: exec:curl works but httpGet fails. Why? need custom header?
|
|
exec:
|
|
command:
|
|
- "curl"
|
|
- "--insecure"
|
|
- "{{ $address }}:8080"
|
|
{{ end }}
|