FR: Update process should not depend on internet access from the cpu nor storage nodes.

0-complexity / openvcloud

OpenvCloud

Other

2 stars 4 forks source link

FR: Update process should not depend on internet access from the cpu nor storage nodes. #1901

Open dinosn opened 5 years ago

dinosn commented 5 years ago

Hi,

As we are proceeding with more strict and isolated environments the direct access to the internet from the CPU nodes and storage nodes should not be considered requirement.

The upgrade process should be done in such case that one system eg, controller 1/2 or 3 will have access in the net and will perform the package delivery to all other nodes.

In that way we can work with flexibility in isolated environment and further enhance our network security.

FastGeert commented 5 years ago

This is solved in 2.4.6. All software is now issued via docker images. Installation / update procedure of OVC components all happens from the controller. Only OVS is still installed from the apt repositories of OVS. But we also could just serve them from the controller.

FastGeert commented 5 years ago

Create an apt repository docker image that clones the OVS apt repository + holds all ubuntu packages.

Adapt installation / update procedure to install from our own shipped docker image apt repository.
sources.list should only contain our own apt repository hosted locally on all our boxes (controllers / cpu nodes / storage)

See https://help.ubuntu.com/community/Repositories/Personal

dinosn commented 5 years ago

Seems a good solution !

FastGeert commented 5 years ago

Apt related
- Add docker ce as part of the controller installer image. Also adapt installation docs.
- Deploy the apt repository as part of the kubernetes install. Make it available to all nodes internally (not to the internet). Add it to the pxeboot pod. Publish a fixed domain name (eg apt.local) pointing to the floating ip of the pxeboot pod.
- Fix the images (controller & node) to only point to the locally hosted apt repo (deb http://apt.local:3142 binary/)
- Create an update script to fix all sources.list to only point to our local apt repository
OVS
- Make the ovs image self contained. Should not have clone git repos / install packages during the installation process.
Docker related
- Install / uprade from our own docker image repository