Install PureLB
PureLB can be installed from:
- Manifest
- Helm Chart (coming soon)
- Source repository
Installation from Manifest
A Manifest is simply a concatenated set of yaml files that install all of the components of PureLB. The key installed components are:
- PureLB Namespace. A namespace is created and annotated for all of the Purelb components
- Custom Resource Definition. PureLB uses two CRD’s for configuration
- Sample/Default configuration. The default Purelb configuration and one sample Service Group configuration are added
- Allocator deployment. A deployment with a single instance of the allocator is installed on the cluster
- lbnodeagent daemonset. By default lbnodeagent is installed on all nodes.
Preparing the Cluster
Preparing the cluster Prior to the installation of PureLB, the k8s cluster should be installed with an operating Container Network Interface.
Firewall Rules
Purelb uses a library called Memberlist to provide local network address failover faster than standard k8s timeouts would require. If you plan to use local network address and have applied firewalls to your nodes, it is necessary to add a rule to allow the memberlist election to occur. The port used by Memberlist in PureLB is Port 7934 UDP/TCP, memberlist uses both TCP and UDP, open both.
If UDP/TCP 7934 is not open and a local network address is allocated, Purelb will exhibit “split brain” behavior. Each node will attempt to allocate the address where the local network addresses match and update v1/service. This will cause the v1/service to continously update, the lbnodeagent logs show repeated attempts to register addresses and it it will appear that Purelb is unstable.
ARP Behavior
It is recommended that the ARP behavior changed from the Linux kernel default. This is necessary if your using kubeproxy in IPVS model and is also good security practice. By default Linux will answer ARP requests for addresses on any interface irrespective of the source, we recommend changing this setting so Linux only answers ARP requests for addresses on the interface it receives the request. Linux sets this default to increase the the chance of successful communication. This change is made in sysconfig.
cat <<EOF | sudo tee /etc/sysctl.d/k8s_arp.conf
net.ipv4.conf.all.arp_filter=1
EOF
sudo sysctl --system
PureLB will operate without making this change, however kubeproxy is set to IPVS mode and arp_filter is set to 0, all nodes will respond to locally allocated addresses as kubeproxy adds these addresses to kube-ipvs0
Installing PureLB
# kubectl apply -f https://gitlab.com/purelb/purelb/-/raw/main/deployments/purelb-complete.yaml
Verify Installation
PureLB should install a single instance of the allocator and an instance of lbnodeagent on each untainted node.
$ kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
allocator-5cb95b946-5wmsz 1/1 Running 1 5h28m 10.129.3.152 purelb2-4 <none> <none>
lbnodeagent-5689z 1/1 Running 2 5h28m 172.30.250.101 purelb2-3 <none> <none>
lbnodeagent-86nlz 1/1 Running 3 5h27m 172.30.250.104 purelb2-1 <none> <none>
lbnodeagent-f2cmb 1/1 Running 2 5h27m 172.30.250.103 purelb2-2 <none> <none>
lbnodeagent-msrgs 1/1 Running 1 5h28m 172.30.250.105 purelb2-5 <none> <none>
lbnodeagent-wrvrs 1/1 Running 1 5h27m 172.30.250.102 purelb2-4 <none> <none>