This article is designed to share an idea of testing/working with Viya4 on custom made environments, locally, in cloud, or wherever.
First of all prepare 4 VMs, 12 vCPU, 24 GB RAM each. Ubuntu 20.04 LTS. Here's my example:
# 1. VMKUB01 Master node : Ubuntu 20.04 LTS, 500 GB Storage Space, 24 GB RAM, 12 vCPU
# 2. VMKUB02 Worker node 1 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 3. VMKUB03 Worker node 2 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 4. VMKUB03 Worker node 3 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
You cannot deploy Viya4 on single machine, kubernetes doesn't allow to run 110+ pods on one node :). You could use whole script or do this step by step to better understand what's going on.
Remember that 80% is preparing cluster.. 20% is Viya files configuration and deployment.
Scripts and whole idea are designed in some steps:
- Prepare VMs.
- Prepare files from portal.
- 1st Script on master node:
- # Step 1 , preinstall
- # Step 2 , Kubernets install
- # Step 3, turn off swap
- # Step 4, OS Tuning
- # Step 5, Installing more packets
- # Step 6, Docker install
- # Step 7, create kubernetes cluster
- # Step 8, Install kubernetes networking - calico and metallb
- # Step 9, Install helm
- # Step 10, Install ingress
- # Step 11, Install and configure NFS Server
- # Step 12, Install NFS Subdir External Provisoiner
- # Step 13, Creating pod security policies
- # Step 14, check if NFS works
- # Step 15, SCP files to workers
- Script on each worker node:
- # Step 1 , preinstall
- # Step 2 , Kubernets install
- # Step 3, turn off swap
- # Step 4, OS Tuning
- # Step 5, Installing more packets
- # Step 6, Docker install
- # Step 7, Joining kubernetes cluster
- Now you should be able to list working nodes
sudo su -l root
root@vmkub01:~# kubectl get nodes
NAME STATUS ROLES AGE VERSION
vmkub01 Ready control-plane,master 2d15h v1.21.5
vmkub02 Ready <none> 2d15h v1.21.5
vmkub03 Ready <none> 2d15h v1.21.5
vmkub04 Ready <none> 2d15h v1.21.5
- Install portainer (it's quite helpful)
root@vmkub01:~# kubectl get all -n portainer
NAME READY STATUS RESTARTS AGE
pod/portainer-5d6dbf85dd-2mdtl 1/1 Running 1 2d15h
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/portainer LoadBalancer 10.111.183.207 10.0.110.101 9000:31659/TCP,9443:31248/TCP,8000:30691/TCP 2d15h
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/portainer 1/1 1 1 2d15h
NAME DESIRED CURRENT READY AGE
replicaset.apps/portainer-5d6dbf85dd 1 1 1 2d15h
- 2nd Script on Master node:
- # Step 1, Install Kustomize
- # Step 2, Install CertManager
- # Step 3, Create CA and Issuer with CertManager for full-TLS deployment
- # Step 4, deploying operator
- # Step 5, building directory structure
- # Step 6, Installation
- # Namespace
- # Ingress
- # TLS
- # StorageClass
- # License
- # SAS Orchestration
- # Install
- After some time check status of sasoperator with
kubectl -n sasoperator get sasdeployment
root@vmkub01:~# kubectl -n sasoperator get sasdeployment
NAME STATE CADENCENAME CADENCEVERSION CADENCERELEASE AGE
sas-viya SUCCEEDED stable 2021.1.6 20211104.1636065570555 2d11h
I really enjoyed watching progress with portainer 🙂
Prepare deployment files from portal (mine are):
License file : SASViyaV4_9XXXXX_0_stable_2021.1.6_license_2021-10-21T071701.jwt
Certs file : SASViyaV4_9XXXXX_certs.zip
TGZ file : SASViyaV4_9XXXXX_0_stable_2021.1.6_20211020.1634741786565_deploymentAssets_2021-10-21T071710.tgz
At the installation time use same account (it helps a lot) with same pw at each machine. My account is called gabos
After successful OS installation log in via ssh by your account on Master node.
Copy via scp or any other manager your deployment files to /home/gabos/ (your account ofc)
Edit new file (vi script.sh), paste whole script below and edit it with your needs (variables), make it executable (chmod +x script.sh), and run.
1st Script on master node :
#!/bin/bash
# This script is designed and released by Gabos Software, feel free to use it and make it better
## Configuration section, it has important variables in order to prepare whole environment.
# It's hardcoded for environemnt like :
# 1. VMKUB01 Master node : Ubuntu 20.04 LTS, 500 GB Storage Space, 24 GB RAM, 12 vCPU
# 2. VMKUB02 Worker node 1 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 3. VMKUB03 Worker node 2 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 4. VMKUB03 Worker node 3 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# I prepared all OSes with user account called "gabos"
# HOST
export NAZWADNS="vmkub01.local" # This is the dns name by that you want to connect to your website , you will access SAS Viya only by this name like https://vmkub01.local , remember that this name should resolv loadbalancer IP address at the host station connection to Viya
export KUBEJOIN="/home/gabos/KUBEJOIN.log" # This is path used where would be located file with kubernetes access token
# NFS :
export STORAGEFOLDER="/home/saspodstorage" # This folder would be created in order to store presistents volumes for NFS server
export NFSRULES="*(rw,sync,no_subtree_check,crossmnt,fsid=0)" # you shouldn't touch this
export NFSNETWORK="10.0.110.0/24" # it's no longer used, NFS would be accessbile "world"-style
export NFSSERVER="10.0.110.95" # This is yout VMKUB01 - master node, nfs server IP
# NODES :
export WORKER1="10.0.110.96" # first worker node
export WORKER1DNS="vmkub02.local" # it wouldn't be used but in any case - fill this
export WORKER2="10.0.110.97" # second worker node
export WORKER2DNS="vmkub03.local" # it wouldn't be used but in any case - fill this
export WORKER3="10.0.110.98" # third worker node
export WORKER3DNS="vmkub04.local" # it wouldn't be used but in any case - fill this
export KUBEJOINREMOTE1="gabos@$WORKER1:/home/gabos/KUBEJOIN.log" # here is path for kubejoin.log file in worker1, te file will be send via scp from master to worker
export KUBEJOINREMOTE2="gabos@$WORKER2:/home/gabos/KUBEJOIN.log" # here is path for kubejoin.log file in worker2, te file will be send via scp from master to worker
export KUBEJOINREMOTE3="gabos@$WORKER3:/home/gabos/KUBEJOIN.log" # here is path for kubejoin.log file in worker3, te file will be send via scp from master to worker
# KUBERNETES :
export NETWORKCIDR="192.168.0.0/16" # this is inner kubernetes network, used when kubeadm create command goes in
export NETWORKADDR="10.0.110.95" # should me the same as NFSSERVER , it's master node IP Address
export METALLBADDR="10.0.110.100-10.0.110.120" # you should provide some addresses for load balancers, this ip will be used for ingress nginx to route your traffic.
export SASNAMESPACE="sasoperator" # this is namespace for sasoperator and sas deployment, you shouldn't change it
# -------------------------------------------------------------------------------------------------------------------------------------
# !!!!!!!!!!! DO NOT TOUCH THE VARIABLES BELOW !!!!!!!!!!!!
export PREINST1="vim git curl wget pip apt-transport-https nfs-common"
export PREINST2="gnupg2 software-properties-common ca-certificates"
export DOCKERINST="containerd.io docker-ce docker-ce-cli"
export KUBEVERSION="1.21.5-00"
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
# Step 1 , preinstall
echo -e "Preinstalling \v packets\v"
sudo apt update
sudo apt -y install $PREINST1
clear
# --------------------------------------------------------
# Step 2 , Kubernets install
echo -e "Installing kubernetes\v"
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt update
sudo apt-get install -y kubelet=$KUBEVERSION kubectl=$KUBEVERSION kubeadm=$KUBEVERSION
sudo apt-mark hold kubelet kubeadm kubectl
clear
# --------------------------------------------------------
# Step 3, turn off swap
echo -e "Turning\v off\v SWAPu\v"
sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
sudo swapoff -a
clear
# --------------------------------------------------------
# Step 4, OS Tuning
echo -e "Tuning\v OS\v"
sudo modprobe overlay
sudo modprobe br_netfilter
sudo tee /etc/sysctl.d/kubernetes.conf<<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sudo sysctl --system
clear
# --------------------------------------------------------
# Step, 5 Installing more packets
echo -e "Installing \v packets 2 \v"
sudo apt install -y $PREINST2
clear
# --------------------------------------------------------
# Step 6, Docker install
echo -e "Installing \v Docker\v"
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt update
sudo apt install -y $DOCKERINST
sudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2"
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl enable docker
clear
# --------------------------------------------------------
# Step 7, create kubernetes cluster
echo -e "Rozpoczynam\v konfigurajce\v Kubernetes\v"
sudo systemctl enable kubelet
sudo kubeadm config images pull
sudo kubeadm init --pod-network-cidr=$NETWORKCIDR --apiserver-advertise-address=$NETWORKADDR >> $KUBEJOIN
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
echo "export KUBECONFIG=$HOME/.kube/config" | tee -a ~/.bashrc
clear
# --------------------------------------------------------
# Step 8, Install kubernetes networking - calico and metallb
echo -e "Kubernets \v configuration\v"
wget https://docs.projectcalico.org/manifests/calico.yaml
kubectl apply -f calico.yaml
kubectl taint nodes --all node-role.kubernetes.io/master-
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.10.3/manifests/namespace.yaml
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.10.3/manifests/metallb.yaml
sudo tee metallbcm.yml << EOF
apiVersion: v1
kind: ConfigMap
metadata:
namespace: metallb-system
name: config
data:
config: |
address-pools:
- name: default
protocol: layer2
addresses:
- $METALLBADDR
EOF
kubectl create -f metallbcm.yml
clear
# --------------------------------------------------------
# Step 9, Install helm
echo -e "Installing\v HELM\v"
curl https://baltocdn.com/helm/signing.asc | sudo apt-key add -
echo "deb https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
sudo apt-get update
sudo apt-get install helm
clear
# --------------------------------------------------------
# Step 10, Install ingress
echo -e "Ingress\v Nginx 0.43 \v"
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.43.0/deploy/static/provider/baremetal/deploy.yaml
sed -i 's/NodePort/LoadBalancer/g' deploy.yaml
kubectl create ns ingress-nginx
kubectl apply -f deploy.yaml
kubectl wait --namespace ingress-nginx \
--for=condition=ready pod \
--selector=app.kubernetes.io/component=controller \
--timeout=180s
clear
# --------------------------------------------------------
# Step 11, Install and configure NFS Server
echo -e "NFS \v"
sudo apt -y install nfs-kernel-server
sudo cat /proc/fs/nfsd/versions
sudo mkdir -p /srv/nfs4/nfs-share
sudo mkdir -p $STORAGEFOLDER
sudo mount --bind $STORAGEFOLDER /srv/nfs4/nfs-share
sudo echo "$STORAGEFOLDER /srv/nfs4/nfs-share none bind 0 0" >> /etc/fstab
sudo mount -a
sudo ufw allow from $NFSNETWORK to any port nfs
sudo echo "/srv/nfs4/nfs-share $NFSRULES" >> /etc/exports
sudo chmod 777 -R $STORAGEFOLDER
sudo exportfs -ar
sudo exportfs -v
sudo systemctl restart nfs-server
sleep 1m
clear
# --------------------------------------------------------
# Step 12, Install NFS Subdir External Provisoiner
kubectl create ns $SASNAMESPACE
echo -e "NFS \v Subdir \v Subdir \v External \v Provisioner"
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm repo update
helm install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
--set nfs.server=$NFSSERVER \
--set nfs.path=/srv/nfs4/nfs-share \
--set storageClass.defaultClass=true \
--set storageClass.accessModes=ReadWriteMany \
--namespace $SASNAMESPACE
# --------------------------------------------------------
# Step 13, Creating pod security policies
echo -e "PSP\v"
tee psp-privileged.yaml << EOF
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: privileged
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
privileged: true
allowPrivilegeEscalation: true
allowedCapabilities:
- '*'
volumes:
- '*'
hostNetwork: true
hostPorts:
- min: 0
max: 65535
hostIPC: true
hostPID: true
runAsUser:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'RunAsAny'
fsGroup:
rule: 'RunAsAny'
EOF
tee psp-baseline.yaml << EOF
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: baseline
annotations:
# Optional: Allow the default AppArmor profile, requires setting the default.
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
privileged: false
# The moby default capability set, minus NET_RAW
allowedCapabilities:
- 'CHOWN'
- 'DAC_OVERRIDE'
- 'FSETID'
- 'FOWNER'
- 'MKNOD'
- 'SETGID'
- 'SETUID'
- 'SETFCAP'
- 'SETPCAP'
- 'NET_BIND_SERVICE'
- 'SYS_CHROOT'
- 'KILL'
- 'AUDIT_WRITE'
# Allow all volume types except hostpath
volumes:
# 'core' volume types
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
# Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use.
- 'csi'
- 'persistentVolumeClaim'
- 'ephemeral'
# Allow all other non-hostpath volume types.
- 'awsElasticBlockStore'
- 'azureDisk'
- 'azureFile'
- 'cephFS'
- 'cinder'
- 'fc'
- 'flexVolume'
- 'flocker'
- 'gcePersistentDisk'
- 'gitRepo'
- 'glusterfs'
- 'iscsi'
- 'nfs'
- 'photonPersistentDisk'
- 'portworxVolume'
- 'quobyte'
- 'rbd'
- 'scaleIO'
- 'storageos'
- 'vsphereVolume'
hostNetwork: false
hostIPC: false
hostPID: false
readOnlyRootFilesystem: false
runAsUser:
rule: 'RunAsAny'
seLinux:
# This policy assumes the nodes are using AppArmor rather than SELinux.
# The PSP SELinux API cannot express the SELinux Pod Security Standards,
# so if using SELinux, you must choose a more restrictive default.
rule: 'RunAsAny'
supplementalGroups:
rule: 'RunAsAny'
fsGroup:
rule: 'RunAsAny'
EOF
tee psp-restricted.yaml << EOF
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: false
# Required to prevent escalations to root.
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
# Allow core volume types.
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
# Assume that ephemeral CSI drivers & persistentVolumes set up by the cluster admin are safe to use.
- 'csi'
- 'persistentVolumeClaim'
- 'ephemeral'
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
# Require the container to run without root privileges.
rule: 'MustRunAsNonRoot'
seLinux:
# This policy assumes the nodes are using AppArmor rather than SELinux.
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
readOnlyRootFilesystem: false
EOF
kubectl apply -f psp-restricted.yaml
kubectl apply -f psp-baseline.yaml
kubectl apply -f psp-privileged.yaml
kubectl get psp restricted -o custom-columns=NAME:.metadata.name,"SECCOMP":".metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/allowedProfileNames"
clear
# --------------------------------------------------------
# Step 14, check if NFS works
sudo tee test-pod.yaml << EOF
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: test-claim
spec:
accessModes:
- ReadWriteOnce
storageClassName: nfs-client
resources:
requests:
storage: 1Mi
---
kind: Pod
apiVersion: v1
metadata:
name: test-pod
spec:
containers:
- name: test-pod
image: gcr.io/google_containers/busybox:1.24
command:
- "/bin/sh"
args:
- "-c"
- "touch /mnt/SUCCESS && exit 0 || exit 1"
volumeMounts:
- name: nfs-pvc
mountPath: "/mnt"
restartPolicy: "Never"
volumes:
- name: nfs-pvc
persistentVolumeClaim:
claimName: test-claim
EOF
kubectl apply -f test-pod.yaml -n sasoperator
sleep 1m
kubectl describe pod test-pod -n sasoperator
clear
# --------------------------------------------------------
# Step 15, SCP files to workers
scp $KUBEJOIN $KUBEJOINREMOTE1
scp $KUBEJOIN $KUBEJOINREMOTE2
scp $KUBEJOIN $KUBEJOINREMOTE3
# --------------------------------------------------------
1st Script on each worker :
#!/bin/bash
# This script is designed and released by Gabos Software, feel free to use it and make it better
## Configuration section, it has important variables in order to prepare whole environment.
# It's hardcoded for environemnt like :
# 1. VMKUB01 Master node : Ubuntu 20.04 LTS, 500 GB Storage Space, 24 GB RAM, 12 vCPU
# 2. VMKUB02 Worker node 1 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 3. VMKUB03 Worker node 2 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 4. VMKUB03 Worker node 3 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# I prepared all OSes with user account called "gabos"
# HOST
export KUBEJOIN="/home/gabos/KUBEJOIN.log" # local path to kubejoin file (scped before)
# !!!!!!!!!!! DO NOT TOUCH THE VARIABLES BELOW !!!!!!!!!!!!
export PREINST1="vim git curl wget pip apt-transport-https nfs-common"
export PREINST2="gnupg2 software-properties-common ca-certificates"
export DOCKERINST="containerd.io docker-ce docker-ce-cli"
export KUBEVERSION="1.21.5-00"
# -----------------------------------------------------------------
# Step 1 , preinstall
echo -e "Preinstall\v 1\v"
sudo apt update
sudo apt -y install $PREINST1
clear
# Step 2 , Kubernets install
echo -e "Installing kubernetes\v"
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt update
sudo apt-get install -y kubelet=$KUBEVERSION kubectl=$KUBEVERSION kubeadm=$KUBEVERSION
sudo apt-mark hold kubelet kubeadm kubectl
clear
# --------------------------------------------------------
# Step 3, turn off swap
echo -e "Turning\v off\v SWAPu\v"
sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
sudo swapoff -a
clear
# --------------------------------------------------------
# Step 4, OS Tuning
echo -e "Tuning\v OS\v"
sudo modprobe overlay
sudo modprobe br_netfilter
sudo tee /etc/sysctl.d/kubernetes.conf<<EOF
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
EOF
sudo sysctl --system
clear
# --------------------------------------------------------
# Step, 5 Installing more packets
echo -e "Installing \v packets 2 \v"
sudo apt install -y $PREINST2
clear
# --------------------------------------------------------
# Step 6, Docker install
echo -e "Installing \v Docker\v"
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt update
sudo apt install -y $DOCKERINST
sudo mkdir -p /etc/systemd/system/docker.service.d
sudo tee /etc/docker/daemon.json <<EOF
{
"exec-opts": ["native.cgroupdriver=systemd"],
"log-driver": "json-file",
"log-opts": {
"max-size": "100m"
},
"storage-driver": "overlay2"
}
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker
sudo systemctl enable docker
clear
# --------------------------------------------------------
# Step 7, joining kubernetes cluster
echo -e "Joining \v kuberenets cluster\v"
sudo systemctl enable kubelet
cat $KUBEJOIN | grep 'kubeadm join' -A 1$
export JOINCMD=$(cat $KUBEJOIN | grep 'kubeadm join' -A 1)
export JOINCMD=$(echo $JOINCMD | sed 's/\\//g')
sudo $JOINCMD
# --------------------------------------------------------
2nd Script on master node :
#!/bin/bash
# This script is designed and released by Gabos Software, feel free to use it and make it better
## Configuration section, it has important variables in order to prepare whole environment.
# It's hardcoded for environemnt like :
# 1. VMKUB01 Master node : Ubuntu 20.04 LTS, 500 GB Storage Space, 24 GB RAM, 12 vCPU
# 2. VMKUB02 Worker node 1 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 3. VMKUB03 Worker node 2 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# 4. VMKUB03 Worker node 3 : Ubuntu 20.04 LTS, 200 GB Storage Space, 24 GB RAM, 12 vCPU
# I prepared all OSes with user account called "gabos"
export NAZWADNS="vmkub01.local" # This is the dns name by that you want to connect to your website , you will access SAS Viya only by this name like https://vmkub01.local , remember that this name should resolv loadbalancer IP address at the host station connection to Viya
# Config
export SCIEZKA="/home/gabos" # work folder where are all the files
export PLIKDEPLOY="SASViyaV4_9XXXX_0_stable_2021.1.6_20211020.1634741786565_deploymentAssets_2021-10-21T071710.tgz" # tgz deploy file
export PLIKLICENCJA="SASViyaV4_9XXXX_0_stable_2021.1.6_license_2021-10-21T071701.jwt" # license file
export PLIKCERTS="SASViyaV4_9XXXX_certs.zip" # certs file
export SASNAMESPACE="sasoperator" # this is namespace for sasoperator and sas deployment, you shouldn't change it
export CADENCE="stable" # installation type, it could be lts or stable, read about it in documentation or just copy from deploy file name
export CADENCEVERSION="2021.1.6" # full version description, read about it in documentation or just copy from deploy file name
# all of the files should be in path called "SCIEZKA"
# Step 1, Install Kustomize
snap install kustomize
# Step 2, Install CertManager
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install \
cert-manager jetstack/cert-manager \
--namespace cert-manager \
--create-namespace \
--version v1.5.4 \
--set installCRDs=true
# Step 3, Create CA and Issuer with CertManager for full-TLS deployment
cd $SCIEZKA
kubectl create namespace sandbox
tee CAAuthority.yaml << EOF
apiVersion: v1
kind: Namespace
metadata:
name: sandbox
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned-issuer
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: my-selfsigned-ca
namespace: sandbox
spec:
isCA: true
commonName: my-selfsigned-ca
secretName: root-secret
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: selfsigned-issuer
kind: ClusterIssuer
group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: sas-viya-issuer
namespace: sandbox
spec:
ca:
secretName: root-secret
EOF
kubectl apply -f CAAuthority.yaml -n sandbox
# Step 4, deploying operator
cd $SCIEZKA
mkdir operator-deploy
cp $PLIKDEPLOY operator-deploy
cd operator-deploy
tar xvfz $PLIKDEPLOY
cp -r sas-bases/examples/deployment-operator/deploy/* .
chmod +w site-config/transformer.yaml
# Zmiana wartosci dla namespace i clusterbinding
sed -i 's/{{ NAME-OF-CLUSTERROLEBINDING }}/sasoperator/g' site-config/transformer.yaml
sed -i 's/{{ NAME-OF-NAMESPACE }}/sasoperator/g' site-config/transformer.yaml
kustomize build . | kubectl -n sasoperator apply -f -
kubectl get all -n sasoperator
# ------------------
# Step 5, building directory structure
cd $SCIEZKA
mkdir deploy
cp $PLIKDEPLOY deploy
cd deploy
tar xvfz $PLIKDEPLOY
rm -rf $PLIKDEPLOY
mkdir site-config
# -------------------------
# Step 6, Installation
cd $SCIEZKA
cd deploy
tee kustomization.yaml << EOF
namespace: {{ NAME-OF-NAMESPACE }}
resources:
- sas-bases/base
- sas-bases/overlays/cert-manager-issuer
- sas-bases/overlays/network/networking.k8s.io
- sas-bases/overlays/cas-server
- sas-bases/overlays/internal-postgres
# If your deployment contains programming-only offerings only, comment out the next line
- sas-bases/overlays/internal-elasticsearch
- sas-bases/overlays/update-checker
- sas-bases/overlays/cas-server/auto-resources
configurations:
- sas-bases/overlays/required/kustomizeconfig.yaml
transformers:
# If your deployment does not support privileged containers or if your deployment
# contains programming-only offerings, comment out the next line
- sas-bases/overlays/internal-elasticsearch/sysctl-transformer.yaml
- sas-bases/overlays/required/transformers.yaml
- site-config/security/cert-manager-provided-ingress-certificate.yaml
- sas-bases/overlays/cas-server/auto-resources/remove-resources.yaml
# If your deployment contains programming-only offerings only, comment out the next line
- sas-bases/overlays/internal-elasticsearch/internal-elasticsearch-transformer.yaml
# Mount information
# - site-config/{{ DIRECTORY-PATH }}/cas-add-host-mount.yaml
components:
- sas-bases/components/security/core/base/full-stack-tls
- sas-bases/components/security/network/networking.k8s.io/ingress/nginx.ingress.kubernetes.io/full-stack-tls
patches:
- path: site-config/storageclass.yaml
target:
kind: PersistentVolumeClaim
annotationSelector: sas.com/component-name in (sas-backup-job,sas-data-quality-services,sas-commonfiles,sas-cas-operator,sas-pyconfig)
# License information
# secretGenerator:
# - name: sas-license
# type: sas.com/license
# behavior: merge
# files:
# - SAS_LICENSE=license.jwt
configMapGenerator:
- name: ingress-input
behavior: merge
literals:
- INGRESS_HOST={{ NAME-OF-INGRESS-HOST }}
- name: sas-shared-config
behavior: merge
literals:
- SAS_SERVICES_URL=https://{{ NAME-OF-INGRESS-HOST }}:{{ PORT }}
# - SAS_URL_EXTERNAL_VIYA={{ EXTERNAL-PROXY-URL }}
EOF
# Change {{ NAME-OF-NAMESPACE }}
sed -i 's/{{ NAME-OF-NAMESPACE }}/sasoperator/g' kustomization.yaml
# Del auto-resources
sed -i '/auto-resources/d' kustomization.yaml
# Ingress
export INGRESS_HOST=$(kubectl -n ingress-nginx get service ingress-nginx-controller -o jsonpath='{.status.loadBalancer.ingress[*].ip}')
sed -i "s/{{ NAME-OF-INGRESS-HOST }}/$NAZWADNS/g" kustomization.yaml
export INGRESS_HTTPS_PORT=$(kubectl -n ingress-nginx get service ingress-nginx-controller -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
sed -i "s/{{ PORT }}/$INGRESS_HTTPS_PORT/g" kustomization.yaml
# TLS
cd $SCIEZKA
cd deploy
mkdir site-config/security
cp sas-bases/examples/security/cert-manager-provided-ingress-certificate.yaml site-config/security/cert-manager-provided-ingress-certificate.yaml
sed -i "s/{{ CERT-MANAGER-ISSUER-NAME }}/sas-viya-issuer/g" site-config/security/cert-manager-provided-ingress-certificate.yaml
sed -i "s/{{ CERT-MANAGER_ISSUER_NAME }}/sas-viya-issuer/g" site-config/security/cert-manager-provided-ingress-certificate.yaml
# StorageClass
cd $SCIEZKA
cd deploy
export STORAGECLASS=$(kubectl get storageclass -o jsonpath='{.items[*].metadata.name}')
tee site-config/storageclass.yaml << EOF
kind: RWXStorageClass
apiVersion: storage.k8s.io/v1beta1
metadata:
name: wildcard
spec:
storageClassName: $STORAGECLASS
EOF
# License
cd $SCIEZKA
mkdir license
cp $PLIKLICENCJA license
# SAS Orchestration
docker pull cr.sas.com/viya-4-x64_oci_linux_2-docker/sas-orchestration:1.64.0-20211012.1634057996496
docker tag cr.sas.com/viya-4-x64_oci_linux_2-docker/sas-orchestration:1.64.0-20211012.1634057996496 sas-orchestration
mkdir /home/user
mkdir /home/user/kubernetes
cp $HOME/.kube/config /home/user/kubernetes/config
chmod 777 /home/user/kubernetes/config
kubectl get psp restricted -o custom-columns=NAME:.metadata.name,"SECCOMP":".metadata.annotations.seccomp\.security\.alpha\.kubernetes\.io/allowedProfileNames"
cd $SCIEZKA
# Install
docker run --rm \
-v $(pwd):/tmp/files \
sas-orchestration \
create sas-deployment-cr \
--deployment-data /tmp/files/$PLIKCERTS \
--license /tmp/files/$PLIKLICENCJA \
--user-content /tmp/files/deploy \
--cadence-name $CADENCE \
--cadence-version $CADENCEVERSION \
> viya4-sasdeployment.yaml
kubectl apply -f viya4-sasdeployment.yaml -n sasoperator
kubectl -n sasoperator get sasdeployment
