109 lines
2.8 KiB
Markdown
109 lines
2.8 KiB
Markdown
# Phase 1 Node Placement Runbook
|
|
|
|
This runbook matches the manifest changes in this repository.
|
|
|
|
## Goal
|
|
|
|
Separate Kubernetes workloads into two planes:
|
|
|
|
- app plane for public-facing services
|
|
- worker plane for async NATS consumers
|
|
|
|
## Required node labels
|
|
|
|
Apply these labels to your nodes.
|
|
|
|
### App nodes
|
|
|
|
```powershell
|
|
kubectl label node <app-node-1> node-role.workolik/app=true
|
|
kubectl label node <app-node-2> node-role.workolik/app=true
|
|
```
|
|
|
|
### Worker nodes
|
|
|
|
```powershell
|
|
kubectl label node <worker-node-1> node-role.workolik/worker=true
|
|
kubectl label node <worker-node-2> node-role.workolik/worker=true
|
|
```
|
|
|
|
## Recommended taints
|
|
|
|
These taints keep worker jobs away from app nodes and allow only matching workloads onto the correct plane.
|
|
|
|
### Worker nodes
|
|
|
|
```powershell
|
|
kubectl taint node <worker-node-1> dedicated=workers:NoSchedule
|
|
kubectl taint node <worker-node-2> dedicated=workers:NoSchedule
|
|
```
|
|
|
|
### App nodes
|
|
|
|
```powershell
|
|
kubectl taint node <app-node-1> dedicated=apps:NoSchedule
|
|
kubectl taint node <app-node-2> dedicated=apps:NoSchedule
|
|
```
|
|
|
|
## What the updated manifests now expect
|
|
|
|
### Worker plane
|
|
|
|
These workloads now require worker-node placement:
|
|
|
|
- [`manifests/core/workers.yaml`](E:/Birock/kubernetes/manifests/core/workers.yaml)
|
|
- [`manifests/core/worker-statefulset.yaml`](E:/Birock/kubernetes/manifests/core/worker-statefulset.yaml)
|
|
|
|
They now use:
|
|
|
|
- required node affinity for `node-role.workolik/worker=true`
|
|
- toleration for `dedicated=workers:NoSchedule`
|
|
- pod anti-affinity
|
|
- topology spread constraints
|
|
|
|
### App plane
|
|
|
|
These workloads now require app-node placement:
|
|
|
|
- [`manifests/alaska/alaska.yaml`](E:/Birock/kubernetes/manifests/alaska/alaska.yaml)
|
|
- [`manifests/nearle/nearle-ariane.yaml`](E:/Birock/kubernetes/manifests/nearle/nearle-ariane.yaml)
|
|
- [`manifests/nearle/nearle-atlantis.yaml`](E:/Birock/kubernetes/manifests/nearle/nearle-atlantis.yaml)
|
|
- [`manifests/nearle/nearle-fiesta.yaml`](E:/Birock/kubernetes/manifests/nearle/nearle-fiesta.yaml)
|
|
- [`manifests/nearle/nearle-jupiter.yaml`](E:/Birock/kubernetes/manifests/nearle/nearle-jupiter.yaml)
|
|
- [`manifests/nearle/nearle-titan.yaml`](E:/Birock/kubernetes/manifests/nearle/nearle-titan.yaml)
|
|
|
|
They now use:
|
|
|
|
- required node affinity for `node-role.workolik/app=true`
|
|
- toleration for `dedicated=apps:NoSchedule`
|
|
- pod anti-affinity
|
|
- topology spread constraints
|
|
|
|
## Safe rollout order
|
|
|
|
1. Label nodes.
|
|
2. Taint nodes.
|
|
3. Confirm labels and taints:
|
|
|
|
```powershell
|
|
kubectl get nodes --show-labels
|
|
kubectl describe node <worker-node-1>
|
|
kubectl describe node <app-node-1>
|
|
```
|
|
|
|
4. Apply manifests.
|
|
5. Watch rescheduling:
|
|
|
|
```powershell
|
|
kubectl get pods -A -o wide
|
|
```
|
|
|
|
## Important warning
|
|
|
|
Do not apply these manifests until your cluster has at least:
|
|
|
|
- one labeled app node
|
|
- one labeled worker node
|
|
|
|
If the labels do not exist yet, pods with required node affinity will stay Pending.
|