mirrors/node-feature-discovery
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/node-feature-discovery.git synced 2024-12-15 17:50:49 +00:00
Code Activity
node-feature-discovery/nfd-worker-job.yaml.template

79 lines
2.3 KiB
Text
Raw Normal View History

Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
apiVersion: batch/v1
kind: Job
metadata:
labels:
app: node-feature-discovery
Split NFD into client and server Refactor NFD into a simple server-client system. Labeling is now done by a separate 'nfd-master' server. It is a simple service with small codebase, designed for easy isolation. The feature discovery part is implemented in a 'nfd-worker' client which sends labeling requests to nfd-server, thus, requiring no access/permissions to the Kubernetes API itself. Client-server communication is implemented by using gRPC. The protocol currently consists of only one request, i.e. the labeling request. The spec templates are converted to the new scheme. The nfd-master server can be deployed using the nfd-master.yaml.template which now also contains the necessary RBAC configuration. NFD workers can be deployed by using the nfd-worker-daemonset.yaml.template or nfd-worker-job.yaml.template (most easily used with the label-nodes.sh script). Only nfd-worker currently support config file or options. The (default) NFD config file is renamed to nfd-worker.conf.
2019-01-11 13:55:28 +00:00
name: nfd-worker
Makefile: create default yamls, configurable namespace - Create default yamls for deploying master and worker. - Use kube-system namespace by default. - Configurable namespace: make IMAGE_REGISTRY=myhost:5000 K8S_NAMESPACE=my-nfd-devel
2019-05-28 14:13:52 +00:00
namespace: node-feature-discovery
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
spec:
docs: describe deployment using templates Use the existing content as a base but with heave editing. Move local examples involving make to the developers guide. Drop the really hackish label-nodes.sh. Just replace it with command line examples in the documentation. If somebody really is dying for this write it from scratch and put under scripts/hack.
2020-10-01 12:37:34 +00:00
completions: NUM_NODES
parallelism: NUM_NODES
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
template:
metadata:
labels:
app: node-feature-discovery
spec:
Implement TLS server authentication Add support for TLS authentication. When enabled, nfd-worker verifies that nfd-master has a valid certificate, i.e. signed by the given root certificate and its Common Name (CN) matches the DNS name of the nfd-master service being used. TLS authentication is enabled by specifying --key-file and --cert-file on nfd-master, and, --ca-file on nfd-worker.
2019-01-29 14:21:48 +00:00
dnsPolicy: ClusterFirstWithHostNet
Use pod anti-affinity in the worker Job template spec Use pod anti-affinity to explicitly indicate that pods should be scheduled on separate nodes. And, remove the obscure and non-obvious ports definition whose only purpose was to reach the same effect.
2018-09-03 08:37:47 +00:00
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: kubernetes.io/hostname
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- node-feature-discovery
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
containers:
- env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
Change deployment templates to point to staging image Latest changes on the templates make them unusable with v0.6.0 release. Going forward, we should keep it this way - templates in the master branch should use staging image corresponding the template.
2020-10-08 17:23:43 +00:00
image: gcr.io/k8s-staging-nfd/node-feature-discovery:master
Split NFD into client and server Refactor NFD into a simple server-client system. Labeling is now done by a separate 'nfd-master' server. It is a simple service with small codebase, designed for easy isolation. The feature discovery part is implemented in a 'nfd-worker' client which sends labeling requests to nfd-server, thus, requiring no access/permissions to the Kubernetes API itself. Client-server communication is implemented by using gRPC. The protocol currently consists of only one request, i.e. the labeling request. The spec templates are converted to the new scheme. The nfd-master server can be deployed using the nfd-master.yaml.template which now also contains the necessary RBAC configuration. NFD workers can be deployed by using the nfd-worker-daemonset.yaml.template or nfd-worker-job.yaml.template (most easily used with the label-nodes.sh script). Only nfd-worker currently support config file or options. The (default) NFD config file is renamed to nfd-worker.conf.
2019-01-11 13:55:28 +00:00
name: nfd-worker
Add container security context to the sample deployment specs Run under strict rules. We shouldn't need any special privileges.
2020-05-28 12:16:15 +00:00
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: true
runAsNonRoot: true
Split NFD into client and server Refactor NFD into a simple server-client system. Labeling is now done by a separate 'nfd-master' server. It is a simple service with small codebase, designed for easy isolation. The feature discovery part is implemented in a 'nfd-worker' client which sends labeling requests to nfd-server, thus, requiring no access/permissions to the Kubernetes API itself. Client-server communication is implemented by using gRPC. The protocol currently consists of only one request, i.e. the labeling request. The spec templates are converted to the new scheme. The nfd-master server can be deployed using the nfd-master.yaml.template which now also contains the necessary RBAC configuration. NFD workers can be deployed by using the nfd-worker-daemonset.yaml.template or nfd-worker-job.yaml.template (most easily used with the label-nodes.sh script). Only nfd-worker currently support config file or options. The (default) NFD config file is renamed to nfd-worker.conf.
2019-01-11 13:55:28 +00:00
command:
- "nfd-worker"
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
args:
- "--oneshot"
Implement TLS server authentication Add support for TLS authentication. When enabled, nfd-worker verifies that nfd-master has a valid certificate, i.e. signed by the given root certificate and its Common Name (CN) matches the DNS name of the nfd-master service being used. TLS authentication is enabled by specifying --key-file and --cert-file on nfd-master, and, --ca-file on nfd-worker.
2019-01-29 14:21:48 +00:00
- "--server=nfd-master:8080"
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
volumeMounts:
Implement kernel config detection This implementation only detects kconfig options ("NO_HZ", "NO_HZ_IDLE", "NO_HZ_FULL" and "PREEMPT"). The corresponding node labels will be node.alpha.kubernetes-incubator.io/nfd-kernel-config.<option name> Currently, only bool and tristate (i.e. '=y' or '=m') kernel config options are supported. Other kconfig types (e.g. string or int) are simply ignored. If the kconfig flag is set to '=y' or '=m', the corresponding node label will be present and it's value will be 'true'.
2018-07-05 13:29:38 +00:00
- name: host-boot
mountPath: "/host-boot"
readOnly: true
Implement OS release detection Implement new 'system' feature source. It now detects OS release information from the os-release file, assumed to be available at /host-etc/os-release. It currently creates two labels (assuming that the corresponding fields are found in the os-release file), with example values: feature.node.kubernetes.io/system-os_release.ID=opensuse feature.node.kubernetes.io/system-os_release.VERSION_ID=42.3 Also, update the template spec to mount /etc/os-release file from the host inside the container.
2018-07-10 09:00:02 +00:00
- name: host-os-release
mountPath: "/host-etc/os-release"
readOnly: true
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
- name: host-sys
mountPath: "/host-sys"
Make all mounts in deployment templates read-only NFD-Worker does not need write access.
2020-11-20 09:32:33 +00:00
readOnly: true
Mount source.d and features.d in template YAMLs Signed-off-by: Jordan Jacobelli <jjacobelli@nvidia.com>
2019-04-20 00:21:38 +00:00
- name: source-d
mountPath: "/etc/kubernetes/node-feature-discovery/source.d/"
Make all mounts in deployment templates read-only NFD-Worker does not need write access.
2020-11-20 09:32:33 +00:00
readOnly: true
Mount source.d and features.d in template YAMLs Signed-off-by: Jordan Jacobelli <jjacobelli@nvidia.com>
2019-04-20 00:21:38 +00:00
- name: features-d
mountPath: "/etc/kubernetes/node-feature-discovery/features.d/"
Make all mounts in deployment templates read-only NFD-Worker does not need write access.
2020-11-20 09:32:33 +00:00
readOnly: true
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
restartPolicy: Never
volumes:
Implement kernel config detection This implementation only detects kconfig options ("NO_HZ", "NO_HZ_IDLE", "NO_HZ_FULL" and "PREEMPT"). The corresponding node labels will be node.alpha.kubernetes-incubator.io/nfd-kernel-config.<option name> Currently, only bool and tristate (i.e. '=y' or '=m') kernel config options are supported. Other kconfig types (e.g. string or int) are simply ignored. If the kconfig flag is set to '=y' or '=m', the corresponding node label will be present and it's value will be 'true'.
2018-07-05 13:29:38 +00:00
- name: host-boot
hostPath:
path: "/boot"
Implement OS release detection Implement new 'system' feature source. It now detects OS release information from the os-release file, assumed to be available at /host-etc/os-release. It currently creates two labels (assuming that the corresponding fields are found in the os-release file), with example values: feature.node.kubernetes.io/system-os_release.ID=opensuse feature.node.kubernetes.io/system-os_release.VERSION_ID=42.3 Also, update the template spec to mount /etc/os-release file from the host inside the container.
2018-07-10 09:00:02 +00:00
- name: host-os-release
hostPath:
path: "/etc/os-release"
Convert templates and examples from json to yaml (#108) Convert resource templates from json to yaml Yaml is easier and less error prone to modify by hand. It also allows comments which can be especially useful in the templates.
2018-09-27 11:54:45 +00:00
- name: host-sys
hostPath:
path: "/sys"
Mount source.d and features.d in template YAMLs Signed-off-by: Jordan Jacobelli <jjacobelli@nvidia.com>
2019-04-20 00:21:38 +00:00
- name: source-d
hostPath:
path: "/etc/kubernetes/node-feature-discovery/source.d/"
- name: features-d
hostPath:
path: "/etc/kubernetes/node-feature-discovery/features.d/"
Copy permalink