LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

30
LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Transcript of LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 1: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 2: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Third Edition (August 2020)

© Copyright Lenovo 2019, 2020.

LIMITED AND RESTRICTED RIGHTS NOTICE: If data or software is delivered pursuant to a General Services Administration (GSA) contract, use, reproduction, or disclosure is subject to restrictions set forth in Contract No. GS-35F- 05925.

Page 3: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Reading instructions

• To ensure that you get correct command lines using the copy/paste function, open this Guide with Adobe Acrobat Reader, a free PDF viewer. You can download it from the official Web site https://get.adobe.com/ reader/.

• Replace values in angle brackets with the actual values. For example, when you see <*_USERNAME> and <*_PASSWORD>, enter your actual username and password.

• Between the command lines and in the configuration files, ignore all annotations starting with #.

© Copyright Lenovo 2019, 2020 ii

Page 4: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

iii LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 5: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Contents

Reading instructions. . . . . . . . . . . ii

Chapter 1. Overview. . . . . . . . . . . 1Introduction . . . . . . . . . . . . . . . . . 1Typical cluster deployment . . . . . . . . . . . 1Operating environment . . . . . . . . . . . . . 1Prerequisites . . . . . . . . . . . . . . . . . 2

Chapter 2. Deploy the cluster environment . . . . . . . . . . . . . . . 3Configure environment variables . . . . . . . . . 3Create a local repository . . . . . . . . . . . . 4

Chapter 3. Install LiCO dependencies . . . . . . . . . . . . . . 5Configure LiCO dependencies repository . . . . . . 5Configure the local repository for LiCO . . . . . . . 5List of LiCO dependencies to be installed. . . . . . 5Install RabbitMQ . . . . . . . . . . . . . . . 5Install MariaDB . . . . . . . . . . . . . . . . 6Install InfluxDB . . . . . . . . . . . . . . . . 6Configure user authentication . . . . . . . . . . 7

Install OpenLDAP-server . . . . . . . . . . 7Install libuser . . . . . . . . . . . . . . . 8Configure OpenLDAP-client . . . . . . . . . 8Install nss-pam-ldapd . . . . . . . . . . . 8

Chapter 4. Install LiCO . . . . . . . . 11

List of LiCO components to be installed . . . . . 11Install LiCO Component . . . . . . . . . . . 11

Chapter 5. Configure LiCO . . . . . . 13Configure the database account . . . . . . . . 13Configure LiCO components. . . . . . . . . . 13

lico-portal . . . . . . . . . . . . . . . 13Initialize the system . . . . . . . . . . . . . 13Initialize users . . . . . . . . . . . . . . . 14

Chapter 6. Configure Kubernetes . . . 15Configure Kubernetes servers . . . . . . . . . 15Kubernetes information . . . . . . . . . . . . 15

Chapter 7. Start and log in to LiCO . . 17Start LiCO . . . . . . . . . . . . . . . . . 17Log in to LiCO . . . . . . . . . . . . . . . 17Configure LiCO services . . . . . . . . . . . 17

Chapter 8. Create and import system images . . . . . . . . . . . . . . . . . 19

Chapter 9. Appendix: Important information . . . . . . . . . . . . . . . 21Firewall settings. . . . . . . . . . . . . . . 21Example of LiCO Kubernetes deployment . . . . 21Troubleshooting creating image issues. . . . . . 23Notices and trademarks . . . . . . . . . . . 23

© Copyright Lenovo 2019, 2020 i

Page 6: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

ii LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 7: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 1. Overview

IntroductionKubernetes is a portable, extensible, open-source platform for managing heavy workload and services, which facilitates declarative configuration and automation.

Lenovo Intelligent Computing Orchestration (LiCO) is a platform for AI model training. It provides AI job management and file management based on Kubernetes.

This guide provides the instructions on installing LiCO for Kubernetes.

Typical cluster deployment

Figure 1. Typical cluster deployment

Elements in typical deployment are described in the table below. For the example of deployment, refer to “Example of LiCO Kubernetes deployment” on page 21.

Table 1. Description of elements in the typical deployment

Element Description

LiCO node The node deploying LiCO, which can be a physical machine or a virtual machine.

Kubernetes clusterLiCO schedules AI jobs to Kubernetes cluster. The Kubernetes versions supported by LiCO are V1.8–V1.17. Kubernetes cluster setup is beyond the scope of LiCO. For more information about setting up a Kubernetes cluster, refer to https://kubernetes.io/docs/home/.

Parallel file systemParallel file system provides shared storage for Kubernetes. The pods in Kubernetes can use the shared storage through PV and PVC. Parallel file system setup is beyond the scope of LiCO.

Operating environmentOperating system for LiCO node:

SUSE Linux Enterprise server (SLES) 15 SP1

© Copyright Lenovo 2019, 2020 1

Page 8: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Client requirements:

• Hardware: CPU of 2.0 GHz or above, memory of 8 GB or above

• Browser: Chrome (V 62.0 or higher) or Firefox (V 56.0 or higher) is recommended

• Display resolution: 1280 x 800 or above

Prerequisites• Unless otherwise stated in this guide, all commands should be executed on the LiCO node.

• If the NTP service is installed in the Kubernetes cluster, set the NTP client in LiCO node.

• LiCO uses Kubernetes stream to execute command and collect output of command, so the configuration item of kubelet streaming-connection-idle-timeout should be set to “no time-out”. If Kubernetes APIServer is deployed with the load balancer, the time-out between the load balancer and APIServer should be set to large number.

• To avoid security vulnerabilities, it is recommended to regularly patch and update components and OS.

2 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 9: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 2. Deploy the cluster environment

Configure environment variablesStep 1. Log in to the LiCO node.

Step 2. Run the following commands to configure environment variables for the entire installation process:

su root

cd /root

vi lico_env.local

Step 3. Run the following commands to edit the lico_env.local file:

# LiCO node hostname

sms_name="localhost"

# Set the domain name

domain_name="lico.com"

# Set OpenLDAP domain name

lico_ldap_domain_name="dc=lico,dc=com"

# set OpenLDAP domain component

lico_ldap_domain_component="lico"

# OS mirror pathway for OS

iso_path="/isos"

# Local repository directory for OS

installer_repo_dir="/install/custom/installer"

packages_repo_dir="/install/custom/packages"

# link name of repository directory for LiCO

link_lico_repo_dir="/install/custom/lico"

# link name of repository directory for LiCO-dep

link_lico_dep_repo_dir="/install/custom/lico-dep"

# The repository directory for LiCO.

lico_repo_dir="/install/custom/lico-6.0.0"

# The repository directory for LiCO-dep.

lico_dep_repo_dir="/install/custom/lico-dep-6.0.0"

Step 4. Save the changes to lico_env.local, and run the following commands to make the configurations file take effect:

chmod 600 lico_env.local

source lico_env.local

© Copyright Lenovo 2019, 2020 3

Page 10: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

After the environment is set up, configure the IP address of the public network on the node. In this way, you can log in to LiCO Web portal from external network.

Create a local repositoryStep 1. Run the following command to create a directory for ISO storage:

mkdir -p ${iso_path}

Step 2. Download SLE-15-SP1-Installer-DVD-x86_64-GM-DVD1.iso and SLE-15-SP1-Packages-x86_64-GM- DVD1.iso from the official Web site. Record MD5SUM result from your download Web site.

Step 3. Copy the file to ${iso_path}.

Step 4. Run the following commands to compare md5sum result with original to check if ISO file is valid:

cd ${iso_path}

md5sum SLE-15-SP1-Installer-DVD-x86_64-GM-DVD1.iso

md5sum SLE-15-SP1-Packages-x86_64-GM-DVD1.iso

cd ~

Step 5. Run the following commands to mount image:

mkdir -p ${installer_repo_dir}

mkdir -p ${packages_repo_dir}

mount -o loop ${iso_path}/SLE-15-SP1-Installer-DVD-x86_64-GM-DVD1.iso ${installer_repo_dir}

mount -o loop ${iso_path}/SLE-15-SP1-Packages-x86_64-GM-DVD1.iso ${packages_repo_dir}

Step 6. Run the following commands to configure local repository:

cat << eof > ${iso_path}/SLES15-SP1-15.1.repo

[SLES15-SP1-15.1-INSTALLER]

name=sle15-installer

enabled=1

autorefresh=0

gpgcheck=0

baseurl=file://${installer_repo_dir}

[SLES15-SP1-15.1-PACKAGES]

name=sle15-packages

enabled=1

autorefresh=0

gpgcheck=0

baseurl=file://${packages_repo_dir}

eof

cp ${iso_path}/SLES15-SP1-15.1.repo /etc/zypp/repos.d

4 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 11: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 3. Install LiCO dependencies

Configure LiCO dependencies repositoryStep 1. Download the package from https://hpc.lenovo.com/lico/downloads/6.0/lico-dep-6.0.0.sle15.x86_

64.tgz.

Step 2. Upload the package to the /root directory.

Step 3. Run the following commands to configure the yum repository:

mkdir -p $lico_dep_repo_dir

cd /root

tar -xvf lico-dep-6.0.0.sle15.x86_64.tgz -C $lico_dep_repo_dir

rm -rf $link_lico_dep_repo_dir

ln -s $lico_dep_repo_dir $link_lico_dep_repo_dir

$link_lico_dep_repo_dir/mklocalrepo.sh

rpm --import $link_lico_dep_repo_dir/RPM-GPG-KEY-LICO-DEP-SLE15

Configure the local repository for LiCOStep 1. Get LiCO software package lico-release-kube-6.0.0.suse15.tar.gz and license file.

Step 2. Upload the release package to the /root directory.

Step 3. Run the following commands to configure the local repository:

mkdir -p $lico_repo_dir

tar zxvf lico-release-kube-6.0.0.suse15.tar.gz -C $lico_repo_dir --strip-components 1

rm -rf $link_lico_repo_dir

ln -s $lico_repo_dir $link_lico_repo_dir

$link_lico_repo_dir/mklocalrepo.sh

List of LiCO dependencies to be installedTable 2. LiCO dependencies to be installed

Software Component Version Service

Rabbitmq rabbitmq-server 3.7.14 rabbitmq-server

mariadb mariadb 10.2.22 mariadb

Influxdb influxdb 1.8.0 influxdb

Install RabbitMQLiCO uses RabbitMQ as a message broker. Do the following to install RabbitMQ:

Step 1. Run the following command to install RabbitMQ:

© Copyright Lenovo 2019, 2020 5

Page 12: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

zypper install rabbitmq-server

Step 2. Run the following commands to start RabbitMQ service:

systemctl enable rabbitmq-server --now

Install MariaDBLiCO uses MariaDB as an object-related database for data storage.

Step 1. Run the following command to install MariaDB:

zypper install -y mariadb

Step 2. Run the following commands to start MariaDB:

systemctl enable mariadb --now

Step 3. Run the following commands to configure MariaDB for LiCO:

Note: The username and password are used for installing lico-passwd-tool. Therefore, keep a record of them when installing MariaDB.

mysql

create database lico character set utf8 collate utf8_bin;

create user '<DB_USERNAME>'@'localhost' identified by '<DB_PASSWORD>';

grant ALL on lico.* to '<DB_USERNAME>'@'localhost';

exit

Step 4. Run the following commands to configure MariaDB limits:

sed -i "/\[mysqld\]/a\max-connections=1024" /etc/my.cnf.d/mariadb-server.cnf

mkdir /usr/lib/systemd/system/mariadb.service.d

cat << eof > /usr/lib/systemd/system/mariadb.service.d/limits.conf

[Service]

LimitNOFILE=10000

eof

systemctl daemon-reload

systemctl restart mariadb

Install InfluxDBLiCO uses InfluxDB as a time series database for monitoring data storage.

Step 1. Run the following commands to install InfluxDB:

# Install InfluxDB

zypper install influxdb

# Start InfluxDB

systemctl enable influxdb --now

Step 2. Run the following commands to create InfluxDB users:

6 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 13: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

# Enter the InfluxDB shell

influx

# create database

create database lico

# use database

use lico

# To create an administrator user, please note that the password must be a string.

create user <INFLUX_USERNAME> with password '<INFLUX_PASSWORD>' with all privileges

# exit the influxDB shell

exit

# configuration

sed -i '/# auth-enabled = false/a\ auth-enabled = true' /etc/influxdb/config.toml

# restart InfluxDB

systemctl restart influxdb

Configure user authentication

Install OpenLDAP-serverOpenLDAP is the open-source version of the lightweight directory access protocol. It is recommended to use OpenLDAP to manage users. However, LiCO also supports other authentication services that compatible with Linux-PAM.

Step 1. Run the following command to install OpenLDAP:

zypper install --force-resolution slapd-ssl-config

Step 2. Run the following commands to modify the configuration file:

sed -i "s/dc=hpc,dc=com/${lico_ldap_domain_name}/" /usr/share/openldap-servers/lico.ldif

sed -i "/dc:/s/hpc/${lico_ldap_domain_component}/" /usr/share/openldap-servers/lico.ldif

install -g ldap -o ldap /etc/openldap/slapd.conf.lico /etc/openldap/slapd.conf

sed -i "s/dc=hpc,dc=com/${lico_ldap_domain_name}/" /etc/openldap/slapd.conf

slapadd -v -l /usr/share/openldap-servers/lico.ldif -f /etc/openldap/slapd.conf -b \

${lico_ldap_domain_name}

Step 3. Run the following command to get the key.

slappasswd

Step 4. Edit the /etc/openldap/slapd.conf file to cover the contents of the rootpw with the key obtained.

rootpw <ENCRYPT_LDAP_PASSWORD>

Step 5. Run the following command to change the role for configuration file:

chown -R ldap:ldap /var/lib/ldap

Chapter 3. Install LiCO dependencies 7

Page 14: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Step 6. Edit configuration files /etc/sysconfig/openldap, and ensure that the following commands are uncommented.

OPENLDAP_START_LDAPS="yes"

OPENLDAP_CONFIG_BACKEND="files"

Step 7. Run the following commands to start OpenLDAP service:

systemctl enable slapd --now

Step 8. Run the following command to check service:

systemctl status slapd

Install libuserThe libuser module is a recommended toolkit for OpenLDAP.

Step 1. Run the following command to install libuser:

zypper install libuser python3-libuser

Step 2. Download libuser.conf from https://hpc.lenovo.com/lico/downloads/6.0/examples/conf/ to /etc on the LiCO node, and modify this file referring to the instructions in the file.

Configure OpenLDAP-clientRun the following command to configure OpenLDAP-client:

echo "TLS_REQCERT never" >> /etc/openldap/ldap.conf

Install nss-pam-ldapdnss-pam-ldapd is a name management tool containing Name Service Switch(NSS) module and Pluggable Authentication Module(PAM). LiCO uses this tool for user authentication.

Step 1. Run the following command to install YaST extension on LiCO node:

zypper install yast2-auth-client

Step 2. Change the IP address for the LiCO node.

a. Run the following command to enter YaST2:

yast

b. Select Network Services ➙ LDAP and Kerberos Client on the LiCO node. The LDAP and Kerberos page is displayed.

c. Highlight the Computer Name row, and click Change Settings on the bottom right of the page. A new page is displayed.

d. Change the IP address for the LiCO node, click TTeesstt CCoonnnneeccttiioonn and ensure the IP address passes the test, and click OOKK.

8 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 15: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Step 3. Run the following command to install nss-pam-ldapd on LiCO node:

zypper install --force-resolution nss-pam-ldapd

Step 4. Run the following commands to edit the /etc/nslcd.conf configuration file:

Note: Modify <LDAP_ADDRESS> to the actual LiCO node IP address, and ensure that <DOMAIN> should be the same as ${lico_ldap_domain_name} defined in lico_env.local.

uri ldap://<LDAP_ADDRESS>

...

base <DOMAIN>

rootpwmoddn uid=admin,<DOMAIN>

Step 5. Run the following command to edit the /etc/pam.d/common-session-pc configuration file:

sed -i 's/pam_mkhomedir.so/pam_mkhomedir.so umask=0077/g' /etc/pam.d/common-session-pc

Step 6. Run the following commands to start service:

systemctl enable nslcd --now

Chapter 3. Install LiCO dependencies 9

Page 16: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

10 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 17: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 4. Install LiCO

List of LiCO components to be installedTable 3. List of LiCO components to be installed

Software Component Version Service

lico-core lico-core 6.0.0 lico

lico-portal lico-portal 6.0.0 \

lico-notice lico-mail-agent 1.3.5 lico-mail-agent

lico-mond lico-kube-mond 1.0.0 lico-kube-mond

Install LiCO ComponentRun the following command to install the LiCO:

zypper install --force-resolution lico-core lico-portal lico-mail-agent lico-kube-mond

© Copyright Lenovo 2019, 2020 11

Page 18: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

12 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 19: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 5. Configure LiCO

Configure the database accountNote: The username and password of MariaDB and InfluxDB are configured in this guide.

Step 1. Run the following command and follow the prompt to enter the username and password for MariaDB:

lico-password-tool --mariadb

Step 2. Run the following command and follow the prompt to enter the username and password for InfluxDB:

lico-password-tool --influxdb

Configure LiCO components

lico-portalTo prevent conflictions, you may need to modify some pathway files for nodes installed with the lico-portal module, which provides external Web services with different ports.

/etc/nginx/nginx.conf

To hide the server version information, add “server_tokens off” in /etc/nginx/nginx.conf.

http{

......

sendfile on;

server_tokens off;

……

}

/etc/nginx/conf.d/https.conf

In /etc/nginx/conf.d/https.conf, change the https default port 443 to other ports:

listen <port> ssl http2;

Note: Ensure that the port is not used by other applications and is not blocked by the firewall.

/etc/lico/portal.conf

In /etc/lico/portal.conf, input the custom shortcut links. For the configuration format, refer to /etc/lico/ portal.conf.example.

Initialize the systemRun the following command to initialize LiCO:

lico init

© Copyright Lenovo 2019, 2020 13

Page 20: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Initialize usersStep 1. Run the following command to set the LDAP administrator password:

# Use the LDAP_PASSWORD you configured in “Install OpenLDAP-server”.

lico-password-tool --ldap

Step 2. Run the following commands to add user with username and password:

# Use the LDAP_PASSWORD you configured in “Install OpenLDAP-server”.

luseradd <ADMIN_USERNAME> -P <ADMIN_PASSWORD>

Step 3. Run the following command to import the user to LiCO:

lico import_user -u <ADMIN_USERNAME> -r admin

14 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 21: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 6. Configure Kubernetes

Configure Kubernetes serversStep 1. Change Kubernetes configuration. Refer to https://hpc.lenovo.com/lico/downloads/6.0/examples/

k8s/Configure-K8S-for-LiCO.html.

Step 2. Run the following command to edit the Kubernetes information file:

cp /etc/lico/kube_server.csv.example /etc/lico/kube_server.csv

vi /etc/lico/kube_server.csv

Kubernetes informationAttention: If the configuration is changed, run the following command to make the configuration take effect:

lico sync_kube_server

Below is an example of the Kubernetes information table:

Table 4. Example of Kubernetes information table

na-me

display_ name

kube_cluster_ addr

ingress_ctrl_ addr

gpu_resource_ name

prometheus_ server

metrics_ server

my-ku-be

My K8s https:// 10.240.212.14:6-443

http:// 10.240.212.14:4-1938

nvidia.com/gpu http:// 10.240.212.14:31-889

https:// 10.240.212.1-4:45639

The descriptions of each item are as follows:

• name: The name of a Kubernetes cluster. LiCO system identifies the cluster through its name.

• display_name: The name of a Kubernetes cluster displayed in the LiCO system. A meaningful display name is recommended.

• kube_cluster_addr: The API server address of the Kubernetes cluster.

• ingress_ctrl_addr: The ingress controller service address of the Kubernetes cluster.

• gpu_resource_name: The GPU resource name of the Kubernetes cluster. If this field is blank, nvidia.com/ gpu will be the default value.

• prometheus_server: The prometheus-server address in Kubernetes for monitoring GPU capacity consumed in each pod of Kuernetes.

• metrics_server: The metrics-server address in Kubernetes for monitoring CPU capacity consumed in each pod of Kuernetes.

© Copyright Lenovo 2019, 2020 15

Page 22: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

16 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 23: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 7. Start and log in to LiCO

Start LiCOStep 1. Run the following commands to start nginx:

systemctl enable nginx

systemctl start nginx

Step 2. Run the following commands to start LiCO-related service:

systemctl enable lico-mail-agent

systemctl start lico-mail-agent

systemctl enable lico-kube-mond

systemctl start lico-kube-mond

Step 3. Run the following commands to start LiCO:

systemctl enable lico

systemctl start lico

Log in to LiCOAfter the LiCO service is started, you can access LiCO by opening https://<ip of lico node>:<port>/ in the Web browser.

Configure LiCO servicesThe LiCO service configuration file is located in /etc/lico/lico.ini and /etc/lico/kube_server.csv. This configuration file controls the operating parameters for various LiCO background service components. You can modify this configuration file based on your needs.

If the configuration or the operating status of components mentioned in this document is changed when LiCO is running, run the following command to restart LiCO:

systemctl restart lico

Note: The configurations not mentioned in this section cannot be modified without consulting Lenovo service engineer. Modifications made without the service consultation may cause system failure.

© Copyright Lenovo 2019, 2020 17

Page 24: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

18 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 25: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 8. Create and import system images

Obtain image_bootstrap.zip from https://hpc.lenovo.com/lico/downloads/6.0/images/k8s/image_bootstrap.zip, and generate and upload LiCO specified images based on the instructions on https://hpc.lenovo.com/lico/ downloads/6.0/images/k8s/readme.html.

© Copyright Lenovo 2019, 2020 19

Page 26: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

20 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 27: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Chapter 9. Appendix: Important information

Firewall settingsNote: If you have installed LiCO following this document, you can set up your firewall. For more information, refer to: https://documentation.suse.com/sles/15-SP1/html/SLES-all/book-security.html.

Step 1. Run the following command to run YaST2:

yast

Step 2. Select Security and Users ➙ Firewall.

Step 3. Click Allowed Services, and then set Allowed Services for Selected Zone to External Zone.

Step 4. Click Advanced. A dialog is displayed.

Step 5. In the window, set TCP Ports to 50000:60000 443 22.

Notes:

• 443: Nginx service port, you can modify the value to the actual value.

• 22: SSH service port.

• 50000:60000: Ports managed by LiCO.

Step 6. Select Interfaces, and set eth0 and eth1 to use External Zone.

Note: eth0 and eth1 should be your internal and external network interface.

Step 7. Select Start-Up, set Service Start to Enable Firewall Automatic Starting, and click Save Settings and Restart Firewall Now.

Step 8. Exit YaST2.

Example of LiCO Kubernetes deploymentThe following architecture is an example of LiCO Kubernetes deployment, which may be different with the actual Kubernetes. LiCO will not automatically set up Kubernetes cluster. Therefore, ensure LiCO can access Kubernetes master and ingress controller.

LiCO uses Kubernetes stream to execute command and collect output of command, so the configuration item of kubelet streaming-connection-idle-timeout should be set to “no time-out”. If Kubernetes APIServer is deployed with the load balancer, the time-out between the load balancer and APIServer should be set to large number.

© Copyright Lenovo 2019, 2020 21

Page 28: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Figure 2. LiCO Kubernetes deployment

Following are the descriptions for each component of LiCO Kubernetes deployment:

Internal network: • All nodes in the Kubernetes cluster can be connected through internal network.• Kubernetes cluster is set up and configured in internal network.• Pods can read/write shared data in the storage node by using PV/PVC in internal network.• Pods in different nodes are interacted with each other through internal network.

External network: • All nodes in the Kubernetes cluster can be connected through external network.• LiCO accesses Kubernetes master and ingress controller through external network. The services

automatically deployed by LiCO are exposed through ingress.• The storage node can be exposed through external network. To upload the big-size file, user should

access the storage node directly.• The harbor is exposed through external network. User can push docker images to the harbor. Pods pull

docker images from the harbor.

Internet: • If external network is connected to Internet, pods can access Internet and pull docker images on Internet.

LiCO node:

22 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

Page 29: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

• LiCO is deployed on the LiCO node (physical machine or virtual machine), and connects to external network.

• LiCO provides Web portal. User can access LiCO through Web browser.

Troubleshooting creating image issuesIf the following error message is displayed when creating images, perform the following steps:

ImportError: libcuda.so.1: cannot open shared object file: No such file or directory

Step 1. Edit or create the /etc/docker/daemon.json file with the following content:

{

"runtimes": {

"nvidia": {

"path": "nvidia-container-runtime",

"runtimeArgs": []

}

},

"default-runtime": "nvidia"

}

Step 2. Install the nvidia-container-runtime package.

Step 3. Restart Docker service.

Note: For more information, refer to https://github.com/NVIDIA/nvidia-docker/issues/595.

Notices and trademarks

Notices

Lenovo may not offer the products, services, or features discussed in this document in all countries. Consult your local Lenovo representative for information on the products and services currently available in your area. Any reference to a Lenovo product, program, or service is not intended to state or imply that only that Lenovo product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any Lenovo intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any other product, program, or service.

Lenovo may have patents or pending patent programs covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

Lenovo (United States), Inc. 8001 Development DriveMorrisville, NC 27560U.S.A.Attention: Lenovo Director of Licensing

LENOVO PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow

Chapter 9. Appendix: Important information 23

Page 30: LiCO 6.0.0 Kubernetes Installation Guide (for SLES)

disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

Changes are made periodically to the information herein; these changes will be incorporated in new editions of the publication. To provide better service, Lenovo reserves the right to improve and/or modify the products and software programs described in the manuals included with your computer, and the content of the manual, at any time without additional notice.

The software interface and function and hardware configuration described in the manuals included with your computer might not match exactly the actual configuration of the computer that you purchase. For the configuration of the product, refer to the related contract (if any) or product packing list, or consult the distributor for the product sales. Lenovo may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

The products described in this document are not intended for use in implantation or other life support applications where malfunction may result in injury or death to persons. The information contained in this document does not affect or change Lenovo product specifications or warranties. Nothing in this document shall operate as an express or implied license or indemnity under the intellectual property rights of Lenovo or third parties. All information contained in this document was obtained in specific environments and is presented as an illustration. The result obtained in other operating environments may vary.

Lenovo may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Any references in this publication to non-Lenovo Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this Lenovo product, and use of those Web sites is at your own risk.

Any performance data contained herein was determined in a controlled environment. Therefore, the result obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

This document is copyrighted by Lenovo and is not covered by any open source license, including any Linux agreement(s) which may accompany software included with this product. Lenovo may update this document at any time without notice.

For the latest information or any questions or comments, contact or visit the Lenovo Web site:

https://support.lenovo.com

Trademarks

LENOVO, LENOVO logo, THINKPAD, THINKPAD logo, TRACKPOINT, ULTRACONNECT, and Yoga are trademarks of Lenovo. Microsoft, Windows, Direct3D, BitLocker, and Cortana are trademarks of the Microsoft group of companies. Ubuntu is a registered trademark of Canonical Ltd. The terms HDMI and HDMI High-Definition Multimedia Interface are trademarks or registered trademarks of HDMI Licensing LLC in the United States and other countries. Wi-Fi, Wi-Fi Alliance, and Miracast are registered trademarks of Wi- Fi Alliance. USB-C is a trademark of USB Implementers Forum. All other trademarks are the property of their respective owners. © 2020 Lenovo.

24 LiCO 6.0.0 Kubernetes Installation Guide (for SLES)