codius / codius-install Goto Github PK

how to update /tmp/codius/config.env and re-run kubectl apply -k /tmp/codius

# kubectl logs -n kube-system   kata-deploy-vgh2q
time="2020-07-24T21:22:22Z" level=info msg="Preparing data dir /var/lib/rancher/k3s/data/6ab65ee0083924a980f6161177c37163fa68681b710316bb3dc59f118ff27636"
Failed to get D-Bus connection: Permission denied
cp: cannot stat '/etc/containerd/config.toml': Permission denied

https://rancher.com/docs/k3s/latest/en/advanced/#experimental-selinux-support
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#assign-selinux-labels-to-a-container
https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-kubeadm-kubelet-and-kubectl (see CentOS, RHEL or Fedora)

https://github.com/joohoi/acme-dns#register-endpoint

https://github.com/KnicKnic/temp-kubernetes-ci

Loggfile:

Firewall was modified by installer:

add a timeout here:

install kata containers and codius (and network policy controller?)

https://github.com/kata-containers/packaging/blob/master/kata-deploy/k8s-1.18/kata-runtimeClasses.yaml

cert-manager + acme-dns auto renew codius host SSL certificate (including wildcard) but traefik ingress controller does not automatically reload the updated tls secret.
traefik/traefik#5495

One solution would be to have traefik (instead of cert manager) manage certificate renewal
https://docs.traefik.io/v1.7/configuration/acme/
afaict, we'd still need cert-manager for codius-operator's webhook certificates
codius/codius-operator#3

https://rancher.com/docs/k3s/latest/en/advanced/#experimental-selinux-support

k3s install currently fails with the following with selinux enabled

[ERROR]  Failed to apply container_runtime_exec_t to /usr/local/bin/k3s, please install:
    yum install -y container-selinux selinux-policy-base
    rpm -i https://rpm.rancher.io/k3s-selinux-0.1.1-rc1.el7.noarch.rpm

include them in /tmp/codius/config.env and optionally ask for them in the script