KubeVirt KubeVirt Summit, 24 Feb 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Introducing the new KubeVirt driver for Ansible Molecule

Description

Molecule is a well known test framework for Ansible. But when you run your Molecule test in Kubernetes, no real good solution exists. I'm working on creating new Molecule driver for KubeVirt to find a better approach and get a 100% pure Kubernetes solution.

In this session I will introduce quickly why it may be better than actual drivers, how it works, and make a demo.

Presenter: Joël Séguillon, Senior Devops Consultant in mission at www.ateme.com - https://github.com/jseguillon, https://www.linkedin.com/in/jo%C3%ABl-s%C3%A9guillon-91a55814/

A

So we're getting close to the hour, so let me already start introducing that the next session uh in the today's um second day of the cooper summit, um we have joelle seguillon, excuse me for your pronunciation and he will present us and a model. Sorry, um a new uh driver for ansible molecule for cubit, actually.

B

Yeah, that's right. Can you hear.

A

Me we can hear you very well and it's all yours.

B

Okay, so here we go so hello. Welcome to this session- I'm I did not know this community uh since uh six months ago discovered uh the cooperative products which are very, very cool and, as damian said in the very first presentation, some usage that were not uh planned to be done with uh molecule with kubert uh can sometimes uh surprise the team itself.

B

So this is what uh I would like to present to you. So this is a new driver for the unit test framework for ansible, so please be all comes or I enjoyed sigiu in french 42, so that means basically, this is the first device I used to uh do some programs, some code saving on audio tapes was incredible, so I've done many things into it. Bs this for 20 years. Most of them were related to programming or related to managing platforms. So this was a good way to be devops.

B

So now I act as a freelance developer and I devops and I work for atm, which is a french company that makes software and hardware for video broadcasting, so they use a lot of kubernetes and okay. So I love open source and simple kubernetes and also complex pipelines because, as a devops, I uh many times go to ci's to help people uh getting cis or cds, okay. So here's the background uh for the story. uh Okay item is a provider for uh hardware and software solution for video delivery, conversion, etc.

B

So this is a company that is shifting his business model from uh pre-configured hardware that you send by boat to customers uh to producing uh software's with the form of containers that need to be run onto some types of kubernetes clusters.

B

So the company wants to shift all its business to kubernetes and as a devops, we wanted uh to make the ci pipelines also in kubernetes. So we had a plan for this. uh We created some long-living bare metal cluster kubernetes cluster, because atom has got some great hardware.

B

uh We also worked on making some some tooling for the resource contract control, because we have many people that want to uh to launch ci and get a bunch of cpus memories, etc. So we had to just schedule a little bit uh the pipelines and when everything was okay, we had to explain the dev teams how they now should build the their containers and test them into kubernetes coasters.

B

So this was not the best part of the history because of course it's like a description for uh people who are uh used to launch, for example, gitlab runners with plain documents etc. But, okay, this works and uh there is still something to do. We have to migrate our own pipelines, meaning devops products and okay. For most of them, it's not a real problem, but we have one tool that is handled by the devops team and it's a supercharger of coupe spray.

B

So basically this deploys a kubernetes cluster, but with some customizations uh so some features that are not uh built in the the kubernetes. So, uh okay, that's not a problem. We want to test it uh and compile etc into a kubernetes pipeline. So for the compilation, that's not problem for the testing. We have to do two things.

B

We have to test the whole deployment of the kubernetes okay and we also have to unit test uh the group spray rolls and our own roles we had into the unseen product, so those roles are related to some time: synchronization data plane the systems etc, because we are in video in video, softwares.

A

B

Need some more than a default kubernetes? Well, okay, uh it does not seems to be difficult with the help of kubviet. So, okay, we brainstormed uh so many hours to find the solution for this. No, uh to tell the truth, we just went to the coupe for a github and noticed uh they were using kubert. So, okay, let's do exactly the same thing.

B

We create uh some vms uh inside our kubernetes cluster and then we can launch our own product cloud manager to deploy kubernetes in kubernetes. Once again, this use case was mentioned by damian at the very end of this submit.

B

But the bad thing is that we cannot do a unit test inside the kubernetes cluster. This is uh simply because the framework that is used for unit testing on zebra rules is named. Molecule and molecule does not have a driver for kubwed. So this was a deception for us, but we thought we may find uh some little workarounds.

B

So, let's check what does exist on the market, we have some other music musical drivers we could use. If we want to run into a kubernetes cluster, then we have to.

B

We could launch privileged containers but of course, launching privilege. Containers is not good in a long living bare metal, kubernetes cluster, because this would break our own security rules. We keep our time to tell a developer. They don't need. We don't want you to use privileged containers, so we did not want to use this.

B

Of course we could use some external tool. We could provision some test vms onto I, don't know any cloud solution or we could use some other tools like background. Also something like this, but of course this is not building into the kubernetes cluster and also this is one more tool we would have to administrate if we add one more tool. Okay, so basically we were on to something like this. We had the choice between uh creating security breach while introducing privileged containers or maybe install vagrant like uh yes, like I did already 10 years ago.

B

True story. Okay, so here is my proposal. It seems to make sense, it's a molecule driver for kubrick. So it's very, very simple: uh it just goes between the molecule framework and the cubiet to create an ssh key for molecule, the user. Maybe you remember uncivil is accessing the vms through ssh, so we have to create a key and create a user.

B

We have to provision a cloud init config to start the vm with the provided, ssh public key. We then have to create the vm, create a kubernetes service to give access to the ssh of the vlan okay test.

B

Ok, and if everything is okay, then the driver will just tell the molecule framework how it should connect onto the vms via the ssh okay, and when everything is uh done, when the tests are passed or not, uh then the molecule uh driver will be also responsible to destroy all the resources, so whether they are the cloud in its secret, the service or the vm. So making everything clean after the unit test is done.

B

I see the chat. Sorry, I will take a look after um okay, so let's get for a little demo, so I will just tell you that uh demo gods are against me uh today. I tried again three times a demo before starting this and got no luck. So I tried again launching it. I mean I don't know why, but this environment is very, very slow today. So this explains why I cannot go to the end of the test because, uh okay, basically it finished with a timeout.

B

So anyway, this was uh the demo that was intended. I created a little uh ripple for this, and in this ripple we can find a little readme. Okay, so during me is telling, uh for is sorry. I will just give a little context on this. What we are gonna do is uh to take a jeff, gellingey, gelling, sorry, a simple rule that is done by jeff, that is a real, well known, zebra, rule maker and we'll switch it to uh the kubria driver. So this is just applying this little batch, okay, okay!

B

So on this patch, what we will what we will do? Okay, first, we will change the uh driver.

A

B

uh Molecule and also we will change the default uh distribution which, in uh in the in the sorry in the original role, is a docker centos image, and here I point to my own uh homemade- corvette uh image. Okay, so changing the driver changing the default context and we also have to add the become yes here, and this is a good point, because uh when you unit test your roles with docker, you are not on a real system.

B

uh You cannot do sudo. You have some other problems with uh if you want to make some rules so that uh change the fs tabs or things like that. So with this uh we are really connecting onto a vm. So we need to be rude before this role is installing nginx and we will have to do some comments as root okay.

B

So if we apply this patch, then in the source code, we now point uh to molecule uh sorry to molecule covet. But of course launching a test in kubernetes is not so easy. We have uh more things to do so. We have here, for example, we have to make a service account to give the right for the pod. That will run sorry in kubernetes to reach the kubernetes api and also to root to reach the coverage api.

B

Okay, so I will not apply it again and okay. We will have also to launch a little pod if you want to do the test.

B

uh Okay, and for this launching the pod, we of course need a docker file, so this local file is very, very simple: it's uh okay! It's just here! I will just clean the screen. It'll be much more readable okay, so we start uh from a molecule uh job for molecule image. We installed the components and we installed um it's a something, a little tricky here for molecule, but we have to copy the word both because we have uh the context molecule and we also have the role in the same uh container.

B

So we have to compete as possible, no matter so if we construct a container with molecule with the source, with a service account and okay, we can run a little pop like this. Okay.

B

Just a little board telling we are gonna launch the molecule test against the image we previously built. So at this time everything is cool.

B

I already launched the demo before I started to speak because again my pc is very very slow today, and I really don't know why. But we can take a look uh okay, so here we can see that I launched the molecule test and okay, everything run. Okay till we get uh trying to access the vm.

B

The thing is that the vm is booting very, very, very slow. So sorry, yes, yeah, sorry, okay, so we have the vm that was started by the molecule test, but you can see it's really really slow, so it's currently injecting uh the ssh key. Maybe this will go a little bit further, but I don't think so and okay, it's no. We have no time to lose, so I will just show you what we should have seen uh if we had uh some enough luck.

B

Okay, I will just take a look here, so I just saved something that comes from my github repo, because I just built everything into my github repo, and this is okay. This is a good ansible trace that show that okay, if everything is right coming here, okay- so here is the instance that was created by uh the driver. Okay was tested, ssh everything, everything is okay and then here you can see the converge playbook is launched by molecule, and this converge playbook will indeed install uh the role nginx and okay we'll deal with.

B

uh I think hume here, because we are we sent to us restart everything and so on chat check all the unit tests of the role and okay. It will try again the role because inaudible we tried twice the test because we always ensure we can run twice the deployment in case of error. We have to run and run and run again, and this is uh usual and then at the very end of the test. Okay, everything will be cleaned uh by the driver.

B

Okay, so sorry again, for uh this not real demo, but okay, I really don't know what's happening on my uh on my dev uh laptop. I think this is related to uh the green screen. I have uh behind me. I just don't know uh it. It's uh working and it's uh doing what we wanted us to do.

B

It's running kubernetes, it's running three molecule tests in a full kubernetes solution; okay, so just some uh little uh words of what I would like to do with this uh first, I would like to allow the usage of containerize data importer, which is a well-known component from the cool view that helps you to import once an image for the vm and copy it over the kubernetes cluster with the help of the csi drivers.

B

um This might be uh some use case. That could be very cool. I think uh if the ssh service is exposed to the external network of the cluster, then I should be able. I should be able to run the test from my dev uh from my dev laptop and uh spun the vm onto a remote kubernetes cluster, and this would be so cool because you could launch one the test and spawn every os.

B

You want for testing your role, one at the time and get the result uh when uh your remote kubernetes did finish the uh the test. Okay, uh something that is not up today. uh I would like people to uh custom the cloud in its section but keep uh ssh credential, and I think I have a solution, because uh someone uh in a previous session uh showed me a way to uh inject the ssh credential without the cloud in it- and I don't remember who was presenting this, but it's an incredible feature from codviet.

B

I didn't know and of course there are some fixedness, including uh there is no sanity checks right now, so we don't. The plugin does not know. If you really have access to kubernetes is covered, the good version compatible with this plugin and so on. But of course this is homemade. I started this repo late of december, so this is very, very, very fresh, okay, some little drawbacks on using uh this uh new corvette driver.

B

So uh the first one is that I think it's no good if you have short living vms, unless you really need to unit test a role that need really to do sudo things or mounting uh some fs tabs- or I don't know everything you can do with the docker driver. Okay. But uh if you have.

A

B

Yes, david exactly, and uh if you uh okay, if you run this in github, for example, you have short living vm, so you must deploy your kubernetes cluster here, it's a kind and you then have to build your molecule a container push it to kind, then launch the test with kubweat under cpu. You may emulation, so this makes a very, very long pipeline and also uh very long for the time.

B

Okay, so probably overkill use it if you have a long living kubernetes cluster, but if you have shortly short living vms, I don't think uh it was the point to uh install of this and wait so many times before you get a result uh and yes also running the unit test in kubernetes is complex because you have to get mostly all of the logs of the kubernetes cluster.

B

If you have a problem, then it might be related to the scheduler, but it may be related to vlc to convert components or it might be related to your own, cloned init, etc. So you have to get almost all the pod logs get the events. If you want to get a readable output and probably also get the console of the vm, because sometimes your vm does not start and the only place you can find information about the fail uh is on the on the console.

B

Okay, so it can be quite complex, running kubernetes uh running the unit test in a kubernetes cluster.

B

Okay. So let's just take a look at the live demo. Is it now working hey mate?

B

Let's just take a look if the logs are better. Oh sorry,.

B

B

Thank you well, not so much because I already had this point and okay dvm was created, so this account ssh access is okay, everything is okay, but dvm will take too long uh to respond to the fact gathering, so the test will be killed in. I think some few minutes. ah Okay, just going back to the presentation.

B

Okay- and this is the end, so if you like what you heard so please go to github and you can give a star. This is a great motivation for me. uh If people like stuff I'm doing, then I will uh okay make progress on this.

B

You can, of course, vote for issues uh or submit issues same thing for a pierre pr, sorry, um and just to make things clear, of course, if this plugin is good enough, the goal is to give it back to the molecule community and make it maybe a standard molecule driver. As you may know, molecule community is not always up to date for the drivers.

B

Many people are complaining that there are too many solutions and drivers are not always uh keep up to date, and maybe this one could be the um the only one with docker, of course tokyo or opponent, but maybe we could get rid of proxmox levitt, vagrant, etc.

B

If we, if this uh driver, is good enough, so thanks again for listening, if you have any question, I just want to thank the organization of this meeting, because it's again a community I did not know, and when I just uh proposed my subject, I thought I had no chance, because so many people working from red hat and nvidia and etc.

B

So, thanks again for all the community you're awesome. If you have any question this is the time. Thank you.

B

Oh at least, I think people saying me on the slack that it's a good job. Thank you very much.

B

You know so monizo is talking french incredible. I saw some mates hi.

B

B

Oh french guy uh french guys are on the chat.

B

um Okay, so if you have no question, maybe it's a good time for.

A

Yes, so in any case, you can always continue uh the conversation about this session uh on high school utilization and slack. There is a threat already open with a ping for you joel.

A

Thank you very much for your presentation and we will have a short break now and in about five minutes we will be back with a discussion uh around the batch and a new api for match creation or batch handling or virtual machines. So see you all in a few minutes.