The Power Developer Exchange article dives into using the Red Hat Ansible Automation Platform and how to create PowerVS instances with Ansible. The collection is available at https://github.com/IBM-Cloud/ansible-collection-ibm
Per the blog, you learn to start a sample controller UI and running some sample program such as hello_world.yaml playbook to say hello to Ansible. With Ansible the options are infinite, and there is always something more to explore. We would like to know how you are using this solution, so drop us a comment.
The cluster wasn’t getting loaded, so I checked the following…. and it pointed to an issue of a call back to a cluster inside my firewall setup. The klusterlet shows that it’s an issue with a callback.
oc get pod -n open-cluster-management-agent
❯ oc get klusterlet klusterlet -oyaml Failed to create &SelfSubjectAccessReview{ObjectMeta:{ 0 0001-01-01 00:00:00 +0000 UTC map[] map[] [] [] []},Spec:SelfSubjectAccessReviewSpec{ResourceAttributes:&ResourceAttributes{Namespace:,Verb:create,Group:cluster.open-cluster-management.io,Version:,Resource:managedclusters,Subresource:,Name:,},NonResourceAttributes:nil,},Status:SubjectAccessReviewStatus{Allowed:false,Reason:,EvaluationError:,Denied:false,},} with bootstrap secret “open-cluster-management-agent” “bootstrap-hub-kubeconfig”: Post “https://api.<XYZ>.com:6443/apis/authorization.k8s.io/v1/selfsubjectaccessreviews”: dial tcp: lookup api.acmfunc.cp.fyre.ibm.com on 172.30.0.10:53: no such host
Install ibmcloud cli curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
Install the Power IAAS, Transit Gateway, Cloud Internet Services, and Infrastructure Service plugins ibmcloud plugin install power-iaas tg-cli vpc-infrastructure cis
Login to ibmcloud cli ibmcloud login --apikey API_KEY -r us-east
List the datacenters ibmcloud pi datacenters in our case we want wdc06
List the resource group id ❯ ibmcloud resource group dev-resource-group
❯ ibmcloud resource group dev-resource-group
Retrieving resource group dev-resource-group under account 555555555555555 as email@id.xyz...
OK
Name: dev-resource-group
Account ID: 555555555555555
ID: 44444444444444444
Default Resource Group: false
State: ACTIVE
Create a Workspace on a Power Edge Router enabled PowerVS zone. ibmcloud pi workspace-create rdr-mac-p2-wdc06 --datacenter wdc06 --group 44444444444444444 --plan public
❯ ibmcloud pi workspace-create rdr-mac-p2-wdc06 --datacenter wdc06 --group 44444444444444444 --plan public
Creating workspace rdr-mac-p2-wdc06...
Name rdr-mac-p2-wdc06
Plan ID f165dd34-3a40-423b-9d95-e90a23f724dd
❯ ibmcloud pi service-target crn:v1:bluemix:public:power-iaas:wdc06:a/555555555555555:7777777-6666-5555-44444-1111111::
Targeting service crn:v1:bluemix:public:power-iaas:wdc06:a/555555555555555:7777777-6666-5555-44444-1111111::...
Create a Power Network using the CRN so there is an IP Range for the Power workers.
❯ ibmcloud pi network-create-private ocp-net --dns-servers 9.9.9.9 --jumbo --cidr-block 192.168.200.0/24 --gateway 192.168.200.1 --ip-range 192.168.200.10-192.168.200.250
Creating network ocp-net under account Power Cloud - pcloudci as user email@id.xyz...
Network ocp-net created.
ID 3e1add7e-1a12-4a50-9325-87f957b0cd63
Name ocp-net
Type vlan
VLAN 797
CIDR Block 192.168.200.0/24
IP Range [192.168.200.10 192.168.200.250]
Gateway 192.168.200.1
DNS 9.9.9.9, 161.26.0.10, 161.26.0.11
Import the Centos8 stock image
❯ ibmcloud pi image-create CentOS-Stream-8
Creating new image from CentOS-Stream-8 under account Power Cloud - pcloudci as user email@id.xyz...
Image created from CentOS-Stream-8.
Image 4904b3db-1dde-4f3c-a696-92f068816f6f
Name CentOS-Stream-8
Arch ppc64
Container Format bare
Disk Format raw
Hypervisor phyp
Type stock
OS rhel
Size 120
Created 2024-01-24T21:00:29.000Z
Last Updated 2024-01-24T21:00:29.000Z
Description
Storage Type
Storage Pool
Find the closest location.
❯ ibmcloud tg locations
Listing Transit Service locations under account Power Cloud - pcloudci as user email@id.xyz...
OK
Location Location Type Billing Location
eu-es region eu
eu-de region eu
au-syd region ap
eu-gb region eu
br-sao region br
jp-osa region ap
jp-tok region ap
ca-tor region ca
us-south region us
us-east region us
❯ ibmcloud is vpc rdr-mac-p2-wdc06-vpc --output json | jq -r '.status'
available
Add a subnet
❯ ibmcloud is subnet-create sn01 rdr-mac-p2-wdc06-vpc \
--resource-group-id 44444444444444444 \
--ipv4-address-count 256 --zone us-east-1
Creating subnet sn01 in resource group 44444444444444444 under account Power Cloud - pcloudci as user email@id.xyz...
ID 0757-46e9ca2e-4c63-4bce-8793-f04251d9bdb3
Name sn01
CRN crn:v1:bluemix:public:is:us-east-1:a/555555555555555::subnet:0757-46e9ca2e-4c63-4bce-8793-f04251d9bdb3
Status pending
IPv4 CIDR 10.241.0.0/24
Address available 251
Address total 256
Zone us-east-1
Created 2024-01-24T16:18:10-05:00
ACL ID Name
r001-0a0afc6c-0943-4a0f-b998-e5e87ec93668 causation-browse-capture-behind
Routing table ID Name
r001-216fb1f5-da8f-447e-8515-649bc76b83aa retaining-acquaint-retiring-curry
Public Gateway -
VPC ID Name
r001-372372bb-5f18-4e36-8b39-4444444333 rdr-mac-p2-wdc06-vpc
Resource group ID Name
44444444444444444 dev-resource-group
❯ ibmcloud is subnet-update sn01 --vpc rdr-mac-p2-wdc06-vpc \
--pgw gw01
Updating subnet sn01 under account Power Cloud - pcloudci as user email@id.xyz...
ID 0757-46e9ca2e-4c63-4bce-8793-f04251d9bdb3
Name sn01
CRN crn:v1:bluemix:public:is:us-east-1:a/555555555555555::subnet:0757-46e9ca2e-4c63-4bce-8793-f04251d9bdb3
Status pending
IPv4 CIDR 10.241.0.0/24
Address available 251
Address total 256
Zone us-east-1
Created 2024-01-24T16:18:10-05:00
ACL ID Name
r001-0a0afc6c-0943-4a0f-b998-e5e87ec93668 causation-browse-capture-behind
Routing table ID Name
r001-216fb1f5-da8f-447e-8515-649bc76b83aa retaining-acquaint-retiring-curry
Public Gateway ID Name
r001-f5f27e42-aed6-4b1a-b121-f234e5149416 gw01
VPC ID Name
r001-372372bb-5f18-4e36-8b39-4444444333 rdr-mac-p2-wdc06-vpc
Resource group ID Name
44444444444444444 dev-resource-group
The OpenShift Container Platform Multi-Arch Compute feature supports the pair of processor (ISA) architectures – ppc64le and amd64 in a cluster. With these pairs, there are various permutations when scheduling Pods. Fortunately, the platform has controls on where the work is scheduled in the cluster. One of these controls is called the node selector. This article outlines how to go about using Node Selectors at different levels – Pod, Project/Namespace, Cluster.
Consider the Pod definition for test, the nodeSelector has x: y and is matched with a Node which is labeled with .metadata.labels
apiVersion: v1
kind: Pod
metadata:
name: test
spec:
containers:
- name: test
image: "ocp-power.xyz/test:v0.0.1"
nodeSelector:
x: y
You can use node selectors on pods and labels on nodes to control where the pod is scheduled. With node selectors, OpenShift Container Platform schedules the pods on nodes that contain matching labels. To direct a Pod to a Power node, you could use the kubernetes.io/arch: ppc64le label.
apiVersion: v1
kind: Pod
metadata:
name: test
spec:
containers:
- name: test
image: "ocp-power.xyz/test:v0.0.1"
nodeSelector:
kubernetes.io/arch: ppc64le
You can see where the Pod is scheduled using oc get pods -owide.
❯ oc get pods -owide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
test 1/1 Running 0 24d 10.130.2.9 mac-acca-worker-1 <none> <none>
You can confirm the architecture for each node oc get nodes mac-acca-worker-1 -owide. You’ll then see the uname is marked with ppc64le
❯ oc get nodes mac-acca-worker-1 -owide
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
mac-acca-worker-1 Ready worker 25d v1.28.3+20a5764 192.168.200.11 <none> Red Hat Enterprise Linux CoreOS 414.92..... 5.14.0-284.41.1.el9_2.ppc64le cri-o://1.28.2-2.rhaos4.14.gite7be4e1.el9
This approach applies to high-level Kubernetes abstractions such as ReplicaSets, Deployments or DaemonSets.
Project / Namespace Level
Per OpenShift 4.14: Creating project-wide node selectors, the control of Pod creation may not be available in the Project or Namespace. This behavior leaves the customer without control over Pod placement. Kubernetes and OpenShift provide control over Pod placement when the control over the Pod definition is not possible.
Kubernetes enables this feature through the Namespace annotation scheduler.alpha.kubernetes.io/node-selector. You can read more about internal-behavior.
You can annotate the namespace:
oc annotate ns example scheduler.alpha.kubernetes.io/node-selector=kubernetes.io/arch=ppc64le
OpenShift enables this feature through Namespace annotation.
oc annotate ns example openshift.io/node-selector=kubernetes.io/arch=ppc64le
These direct the Pod to the right node architecture.
Cluster Level
Per OpenShift 4.14: Creating default cluster-wide node selectors, the control of Pod creation may not be available or there is a need for a default. This customer controls Pod placement through a default setting of the cluster-wide default node selector.
To configure the cluster-wide default, patch the Scheduler Operator custom resource (CR).
To direct scheduling to the other pair of architectures, you MUST define a nodeSelector to override the behavior.
Summary
You have seen how to control the distribution of work and how to schedule work with multiple architectures.
In a future blog, I’ll cover Multiarch Manager Operatorsource which aims to aims to address problems and usability issues encountered when working with Openshift clusters with multi-architecture compute nodes.
Following the release of Red Hat OpenShift 4.14, clients can run x86 and IBM Power Worker Nodes in the same OpenShift Container Platform Cluster with Multi-Architecture Compute. A study compared the performance implications of deploying applications on a Multi Arch Compute OpenShift Container Platform (OCP) cluster with a cluster exclusively built on IBM Power architecture. Findings revealed that performance had no significant impact with or without Multi Arch Compute. Click here to learn more about the study and the results found.
Watch the OpenShift Multi-Arch Sock Shop Demonstration Video deploying the open-source Sock Shop e-commerce solution using a mix of x86 and Power Worker Nodes with Red Hat OpenShift Multi-Arch to further your understanding.
In the ever-evolving landscape of computing, the quest for optimal performance and adaptability remains constant. This study delves into the performance implications of deploying applications on a Multi Arch Compute OpenShift Container Platform (OCP) cluster, comparing it with a cluster exclusively built on IBM Power architecture. Our findings reveal that, with or without Multi Arch Compute, there is no significant impact on performance.
Thanks to @Mel from the IBM Power Systems Performance Team
A new PDEX blog is posted to help the technical experts configure their OpenShift Container Platform on Power and the necessary background to configure FIPS 140-2 compliance.
This article identifies using cluster operators and components with TLS Security profiles, covers the available security profiles, and how to configure each profile, and verify each profile is properly enabled.
This document outlines the concepts, how to setup an external tang cluster on IBM PowerVS, how to setup a cluster on IBM PowerVS and how to confirm the encrypted disk setup.
Multi-arch build pipelines for Power: Automating multi-arch image builds
Multi-arch build pipelines can greatly reduce the complexity of supporting multiple operating systems and architectures. Notably, images built on the Power architecture can seamlessly be supported by other architectures, and vice versa, amplifying the versatility and impact of your applications. Furthermore, automating the processes using various CI tools, not only accelerates the creation of multi-arch images but also ensures consistency, reliability, and ease of integration into diverse software environments.
Building on our exploration of multi-arch pipelines for IBM Power in the first blog, this blog delves into the next frontier: Automation. Automating multi-arch image builds using Continuous Integration (CI) tools has become essential in modern software development. This process allows developers to efficiently create and maintain container images that can run on various CPU architectures, such as IBM Power (ppc64le), x86 (amd64), or ARM ensuring compatibility across diverse hardware environments.
Part 1 https://community.ibm.com/community/user/powerdeveloper/blogs/prajyot-parab/2023/11/27/multi-arch-pipelines-for-ibm-power Part 2 https://community.ibm.com/community/user/powerdeveloper/blogs/prajyot-parab/2023/11/27/automating-multi-arch-image-builds-for-power
Thanks to the RH and Power Team and Yussuf in particular – IBM Power now has quay.io install-run support.
Red Hat Quay is a distributed, highly available, security-focused, and scalable private image registry platform that enables you to build, organize, distribute, and deploy containers for your enterprise. It provides a single and resilient content repository for delivering containerized software to development and production across Red Hat OpenShift and Kubernetes clusters.
Calling all IBM Power customers looking to impact Power modernization capabilities. The IBM Power Design Team is facilitating a study to understand customer sentiment toward Multi-Architecture Computing (MAC) and needs your help.
Posted to https://community.ibm.com/community/user/powerdeveloper/blogs/paul-bastide/2023/07/19/kubernetes-krew-plugin-support-for-power?CommunityKey=daf9dca2-95e4-4b2c-8722-03cd2275ab63
Hey everyone,
Krew, the kubectl plugin package manager, is now available on Power. The release v0.4.4 has a ppc64le download. You can download and start taking advantage of the krew plugin list. ppc64le download It also works with OpenShift.
The Krew website has a list of plugins](https://krew.sigs.k8s.io/plugins/). Not all of the plugins support ppc64le, however may are cross-arch scripts and are cross compiled such as view-utilization.
To take advantage of Krew with OpenShift, here are a few steps
Download the krew-linux plugin
# curl -L -O https://github.com/kubernetes-sigs/krew/releases/download/v0.4.4/krew-linux_ppc64le.tar.gz
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 3977k 100 3977k 0 0 6333k 0 --:--:-- --:--:-- --:--:-- 30.5M
Extract the krew plugin
tar xvf krew-linux_ppc64le.tar.gz
./LICENSE
./krew-linux_ppc64le
Move to the /usr/bin so it’s picked up by oc.
mv krew-linux_ppc64le /usr/bin/kubectl-krew
Update the krew plugin
# kubectl krew update
WARNING: To be able to run kubectl plugins, you need to add
the following to your ~/.bash_profile or ~/.bashrc:
export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
and restart your shell.
Adding "default" plugin index from https://github.com/kubernetes-sigs/krew-index.git.
Updated the local copy of plugin index.
Restart your session (exit and come back to the shell so the variables are loaded)
Try oc krew list
# oc krew list
PLUGIN VERSION
List all the plugins that support ppc64le.
# oc krew search | grep -v 'unavailable on linux/ppc64le'
NAME DESCRIPTION INSTALLED
allctx Run commands on contexts in your kubeconfig no
assert Assert Kubernetes resources no
bulk-action Do bulk actions on Kubernetes resources. no
...
tmux-exec An exec multiplexer using Tmux no
view-utilization Shows cluster cpu and memory utilization no
Install a plugin
# oc krew install view-utilization
Updated the local copy of plugin index.
Installing plugin: view-utilization
Installed plugin: view-utilization
\
| Use this plugin:
| kubectl view-utilization
| Documentation:
| https://github.com/etopeter/kubectl-view-utilization
| Caveats:
| \
| | This plugin needs the following programs:
| | * bash
| | * awk (gawk,mawk,awk)
| /
/
WARNING: You installed plugin "view-utilization" from the krew-index plugin repository.
These plugins are not audited for security by the Krew maintainers.
Run them at your own risk.
