Shows a Microservices Application running on Red Hat OpenShift Control Plane on IBM Power Systems with an Intel Worke
Author: Paul
-
Updates for End of March 2024
Here are some great updates for the first half of April 2024.
Sizing and configuring an LPAR for AI workloads
Sebastian Lehrig has a great introduction into CPU/AI/NUMA on Power10.
https://community.ibm.com/community/user/powerdeveloper/blogs/sebastian-lehrig/2024/03/26/sizing-for-aiFYI: a new article is published – Improving the User Experience for Multi-Architecture Compute on IBM Power
More and more IBM® Power® clients are modernizing securely with lower risk and faster time to value with cloud-native microservices on Red Hat® OpenShift® running alongside their existing banking and industry applications on AIX, IBM i, and Linux. With the availability of Red Hat OpenShift 4.15 on March 19th, Red Hat and IBM introduced a long-awaited innovation called Multi-Architecture Compute that enables clients to mix Power and x86 worker nodes in a single Red Hat OpenShift cluster. With the release of Red Hat OpenShift 4.15, clients can now run the control plane for a Multi-Architecture Compute cluster natively on Power.
Some tips for setting up a Multi-Arch Compute Cluster
Setting up a multi-arch compute cluster manually, not using automation, you’ll want to follow this process:
- Setup the Initial Cluster with the multi payload on Intel or Power for the Control Plane.
- Open the network ports between the two environments
ICMP/TCP/UDP flowing in both directions
- Configure the Cluster
a. Change any MTU between the networks
oc patch Network.operator.openshift.io cluster --type=merge --patch \ '{"spec": { "migration": { "mtu": { "network": { "from": 1400, "to": 1350 } , "machine": { "to" : 9100} } } } }'
b. Limit CSI drivers to a single Arch
oc annotate --kubeconfig /root/.kube/config ns openshift-cluster-csi-drivers \ scheduler.alpha.kubernetes.io/node-selector=kubernetes.io/arch=amd64
c. Disable offloading (I do this in the ignition)
d. Move the imagepruner jobs to the architecture that makes the most sense
oc patch imagepruner/cluster -p '{ "spec" : {"nodeSelector": {"kubernetes.io/arch" : "amd64"}}}' --type merge
e. Move the ingress operator pods to the arch that makes the most sense. If you want the ingress pods to be on Intel then patch the clsuter.
oc edit IngressController default -n openshift-ingress-operator
Change
ingresscontroller.spec.nodePlacement.nodeSelector
to use thekubernetes.io/arch: amd64
to move the workfload to Intel only.f. use routing via host
oc patch network.operator/cluster --type merge -p \ '{"spec":{"defaultNetwork":{"ovnKubernetesConfig":{"gatewayConfig":{"routingViaHost":true}}}}}'
Wait until the MCP is finished updating and has the latest MTU
g. Download the igntion file and host on the local network via http.
- Create a new VSI worker and point to the ignition in userdata
{ "ignition": { "version": "3.4.0", "config": { "merge": [ { "source": "http://${ignition_ip}:8080/ignition/worker.ign" } ] } }, "storage": { "files": [ { "group": {}, "path": "/etc/hostname", "user": {}, "contents": { "source": "data:text/plain;base64,${name}", "verification": {} }, "mode": 420 }, { "group": {}, "path": "/etc/NetworkManager/dispatcher.d/20-ethtool", "user": {}, "contents": { "source": "data:text/plain;base64,aWYgWyAiJDEiID0gImVudjIiIF0gJiYgWyAiJDIiID0gInVwIiBdCnRoZW4KICBlY2hvICJUdXJuaW5nIG9mZiB0eC1jaGVja3N1bW1pbmciCiAgL3NiaW4vZXRodG9vbCAtLW9mZmxvYWQgZW52MiB0eC1jaGVja3N1bW1pbmcgb2ZmCmVsc2UgCiAgZWNobyAibm90IHJ1bm5pbmcgdHgtY2hlY2tzdW1taW5nIG9mZiIKZmkKaWYgc3lzdGVtY3RsIGlzLWZhaWxlZCBOZXR3b3JrTWFuYWdlci13YWl0LW9ubGluZQp0aGVuCnN5c3RlbWN0bCByZXN0YXJ0IE5ldHdvcmtNYW5hZ2VyLXdhaXQtb25saW5lCmZpCg==", "verification": {} }, "mode": 420 } ] } }
${name}
is base64 encoded.- Post configuration tasks
a. Configure shared storage using the nfs provisioner and limit to running from the architecture that is hosting the NFS shared volumes.
b. Approve the CSRs for the workers. Do this carefully as it’s possible to lose the count as it may include Machine updates/csrs.
- Check the cluster operators and nodes it should be up and working.
-
Bringing OpenShift Container Platform Multiple-Architecture Compute to IBM Power with sme.up
The IBM team Bringing OpenShift Container Platform Multiple-Architecture Compute to IBM Power with sme.up posted an update on one of our OpenShift on Power customers who used Multi-Architecture Compute.
-
Multi-Architecture Compute: Managing User Provisioned Infrastructure Load Balancers with Post-Installation workers
From https://community.ibm.com/community/user/powerdeveloper/blogs/paul-bastide/2024/03/21/multi-architecture-compute-managing-user-provision?CommunityKey=daf9dca2-95e4-4b2c-8722-03cd2275ab63
Multi-Arch Compute for Red Hat OpenShift Container Platform on IBM Power systems lets one use a pair of compute architectures, such as, ppc64le and amd64, within a single cluster. This feature opens new possibilities for versatility and optimization for composite solutions that span multiple architectures. The cluster owner is able to add an additional worker post installation.
With User Provisioned Infrastructure (UPI), the cluster owner may have used automation or manual setup of front-end load balancers. The IBM team provides PowerVS ocp4-upi-powervs, PowerVM ocp4-upi-powervm and HMC ocp4-upi-powervm-hmc automation.
When installing a cluster, the cluster is setup with ab external load balancer, such as haproxy. The external load balancer routes traffic to pools the Ingress Pods, API Server and MachineConfig server. The haproxy configuration is stored at
/etc/haproxy/haproxy.cfg
.For instance, the configuration for ingress-https load balancer would look like the following:
frontend ingress-https bind *:443 default_backend ingress-https mode tcp option tcplog backend ingress-https balance source mode tcp server master0 10.17.15.11:443 check server master1 10.17.19.70:443 check server master2 10.17.22.204:443 check server worker0 10.17.26.89:443 check server worker1 10.17.30.71:443 check server worker2 10.17.30.225:443 check
When adding a post-installation worker to a UPI cluster, one must update the
ingress-http
andingress-https
. Y- Get the IP and hostname
# oc get nodes -lkubernetes.io/arch=amd64 --no-headers=true -ojson | jq -c '.items[].status.addresses' [{"address":"10.17.15.11","type":"InternalIP"},{"address":"worker-amd64-0","type":"Hostname"}] [{"address":"10.17.19.70","type":"InternalIP"},{"address":"worker-amd64-1","type":"Hostname"}]
- Edit the
/etc/haproxy/haproxy.cfg
a. Find
backend ingress-http
then before the firstserver
entry add the worker hostnames and ips.server worker-amd64-0 10.17.15.11:80 check server worker-amd64-1 10.17.19.70:80 check
b. Find
backend ingress-https
then before the firstserver
entry add the worker hostnames and ips.server worker-amd64-0 10.17.15.11:443 check server worker-amd64-1 10.17.19.70:443 check
c. Save the config file.
- Restart the haproxy
# systemctl restart haproxy
You now have the additional workers incorporated into the haproxy, and as the ingress pods are moved from Power to Intel and back. You have a fully functional environment.
Best wishes.
Paul
P.S. You can learn more about scalling up the ingress controller at
Scaling an Ingress Controller
$ oc patch -n openshift-ingress-operator ingresscontroller/default --patch '{"spec":{"replicas": 3}}' --type=merge
P.P.S If you are running very advanced scenarios, you can change the ingresscontroller
spec.nodePlacement.nodeSelector
to put the workload on specific architectures. see Configuring an Ingress ControllernodePlacement: nodeSelector: matchLabels: kubernetes.io/arch: ppc64le
-
OpenShift 4.15
IBM announced the availability of Red Hat OpenShift 4.15 available on IBM Power. Read more about it in
https://community.ibm.com/community/user/powerdeveloper/blogs/brandon-pederson1/2024/03/15/red-hat-openshift-415-now-available-on-ibm-powerI worked on the following:
Red Hat OpenShift 4.14, Multi-Architecture Compute was introduced for the IBM Power and IBM Z platforms, enabling a single heterogeneous cluster across different compute architectures. With the release of Red Hat OpenShift 4.15, clients can now add x86 compute nodes to a multi-architecture enabled cluster running on Power. This simplifies deployment across different environments even further and provides a more consistent management experience. Clients are accelerating their modernization journeys with multi-architecture compute and Red Hat OpenShift by exploiting the best-fit architecture for different solutions and reducing cost and complexity of workloads that require multiple compute architectures.
-
March 2024 – Let the coolness begin
Here are some incredible updates/links I ran across.
How to Setup a Rust Project to Leverage MMA Optimizations on IBM Power10 Systems
https://community.ibm.com/community/user/powerdeveloper/blogs/daniel-schenker/2024/03/07/how-to-setup-a-rust-project-to-leverage-mma-optimiocp4-upi-powervs is updated to v6.1.0. It adds:
- Replace the local registry image with the official multi-arch registry image by @Sachin-Itagi in #518
- Update for RHCOS image file names by @github-actions in #522
- Allow overriding bastion storage pool by @yussufsh in #521
Please be sure to update.
OpenShift: Add Intel Worker to Power Control Plane
I produced a small video showing how to add an Intel worker to a Power Control Plane.
Red Hat Products – February 2024 releases
In the month of February, there is a handy list of Red Hat products released on Power. Navigate to the URL to learn more
https://community.ibm.com/community/user/powerdeveloper/blogs/ashwini-sule/2024/03/08/red-hat-products-feb-2024 -
A couple IBM Power related updates
A couple quick updates…
opentofus – a terraform Compatible Build for ppc64le
The Oregon State University Open Source Lab (OSU OSL) provides Power servers to develop and test open source projects on the Power Architecture platform. OSU OSL provides ppc64le VMs and bare metal machines as well as CI. Read more about their Power services here.
You can download the latest version of OpenTofu for ppc64le here. A pull request for a documentation update has now merged. View the official OpenTofu documentation here.
https://community.ibm.com/community/user/powerdeveloper/blogs/mick-tarsel/2024/03/04/opentofu-openshift-ppc64leCost Management for OpenShift is a SaaS offering that provides users cost visibility across their hybrid cloud environments. The Cost Management Operator obtains OpenShift usage data by querying Prometheus every hour to create usage reports which is then uploaded to Cost Management at console.redhat.com to be processed and viewed.
Red Hat Cost Management is now available on IBM Power with the latest release version 3.2
https://community.ibm.com/community/user/powerdeveloper/blogs/jason-cho2/2024/03/04/red-hat-cost-management-on-ibm-power?CommunityKey=daf9dca2-95e4-4b2c-8722-03cd2275ab63FYI: Chandan posted
Multi-Architecture Compute: Supporting Architecture Specific Operating System and Kernel Parameters
https://community.ibm.com/community/user/powerdeveloper/blogs/chandan-abhyankar/2024/03/06/multi-architecture-compute-supporting-architecture -
Getting started with Multi-Arch Compute workloads with your Red Hat OpenShift cluster
FYI: Webinar: Getting started with Multi-Arch Compute workloads with your Red Hat OpenShift cluster
Summary
The Red Hat OpenShift Container Platform runs on IBM Power systems, offering a secure and reliable foundation for modernizing applications and running containerized workloads. Multi-Arch Compute for OpenShift Container Platform lets you use a pair of compute architectures such as, ppc64le and amd64, within a single cluster. This exciting feature opens new possibilities for versatility and optimization for composite solutions that span multiple architectures. Join Paul Bastide, IBM Senior Software Engineer, as he introduces the background behind Multi-Arch Compute and then gets you started setting up, configuring, and scheduling workloads. After, Paul will take you through a brief demonstration showing common problems and solutions for running multiple architectures in the same cluster. This presentation sets the background and gets you started so you can set up, configure, and scheduling workloads. There will be a brief demonstration showing common problems and solutions for running multiple architectures in the same cluster.
Please join me on 11 April 2024, 9:00 AM ET. Please share any questions by clicking on the Reply button. If you have not done so already, register here and download it to your calendar.
-
February 2024 Updates
Here are some updates for February 2024
Open Source Container images for Power now available in IBM Container Registry
The Power team has added a new image:
https://community.ibm.com/community/user/powerdeveloper/blogs/priya-seth/2023/04/05/open-source-containers-for-power-in-icrenvoy 1.29.0 podman pull icr.io/ppc64le-oss/envoy-ppc64le:1.29.0 Feb 7, 2024 Kube-burner is a Kubernetes performance and scale test orchestration toolset. It provides multi-faceted functionality, the most important of which are summarized below. A new version v1.9.2 is released.
https://github.com/kube-burner/kube-burner/tree/v1.9.2Looking to learn more about Multi-Arch Compute on IBM Power? The following blog details how to set up an IBM PowerVS Workspace to a IBM Cloud Virtual Private Cloud: https://community.ibm.com/community/user/powerdeveloper/blogs/paul-bastide/2024/01/26/setting-up-an-ibm-powervs-workspace-to-a-ibm-cloud
#IBM #IBMPower #Power10 #PowerVS # #MultiArchCompute #PDeX
Cert-manager is a cluster-wide service that provides application certificate lifecycle management. Learn how to use the cert-manager with your OpenShift cluster on IBM Power: https://community.ibm.com/community/user/powerdeveloper/blogs/paul-bastide/2024/01/18/cert-manager-operator-for-red-hat-openshift-v113
#IBM #Power10 #IBMPower #RedHat #OpenShift #clusters #clustermanagement #PDeX
FYI: How to visualize your OpenSCAP compliance reports Discover SCAPinoculars, a tool that helps you to visualize OpenSCAP reports, and the advantages it brings when used with the OpenShift Compliance Operator.
https://developers.redhat.com/articles/2024/02/08/how-visualize-your-openscap-compliance-reportsMy colleague Yussuf cut a new release v6.0.0 of
ocp4-upi-powervs
Please be sure topull
the latest code and use it when appropriate.FYI: My colleague @Punith Kenchappa posted an article on configuring your Multi-Arch Compute Pods with NodeAffinity see Controlling Pod placement based on weighted node-affininty with your Multi-Arch Compute cluster. It’s super helpful for scheduling workloads across architecture types.
-
kube ns delete stuck in terminating
Per https://www.ibm.com/docs/en/cloud-private/3.2.0?topic=console-namespace-is-stuck-in-terminating-state, you can delete the Namespace stuck in the Terminating Phase.
Recipe
1. Grab the namespace json
oc get namespace ma-operator -o json > tmp.json
2. Edit tmp.json to remove the finalizer
3. Start the proxy
oc proxy &
4. Delete the namespace
curl -k -H "Content-Type: application/json" -X PUT --data-binary @tmp.json http://127.0.0.1:8001/api/v1/namespaces/ma-operator/finalize